@zenstackhq/runtime 1.8.2 → 2.0.0-alpha.1

package/enhancements/policy/handler.js

@@ -31,26 +31,24 @@ const upper_case_first_1 = require("upper-case-first");
 const zod_validation_error_1 = require("zod-validation-error");
 const constants_1 = require("../../constants");
 const cross_1 = require("../../cross");
+const logger_1 = require("../logger");
+const query_utils_1 = require("../query-utils");
 const utils_1 = require("../utils");
-const logger_1 = require("./logger");
 const policy_utils_1 = require("./policy-utils");
 const promise_1 = require("./promise");
 /**
  * Prisma proxy handler for injecting access policy check.
  */
 class PolicyProxyHandler {
-    constructor(prisma, policy, modelMeta, zodSchemas, model, user, options) {
+    constructor(prisma, model, options, context) {
         this.prisma = prisma;
-        this.policy = policy;
-        this.modelMeta = modelMeta;
-        this.zodSchemas = zodSchemas;
-        this.user = user;
         this.options = options;
-        this.DEFAULT_TX_MAXWAIT = 100000;
-        this.DEFAULT_TX_TIMEOUT = 100000;
+        this.context = context;
         this.logger = new logger_1.Logger(prisma);
-        this.utils = new policy_utils_1.PolicyUtil(this.prisma, this.modelMeta, this.policy, this.zodSchemas, this.user, this.shouldLogQuery);
         this.model = (0, lower_case_first_1.lowerCaseFirst)(model);
+        ({ modelMeta: this.modelMeta, prismaModule: this.prismaModule } = options);
+        this.policyUtils = new policy_utils_1.PolicyUtil(prisma, options, context, this.shouldLogQuery);
+        this.queryUtils = new query_utils_1.QueryUtils(prisma, options);
     }
     get modelClient() {
         return this.prisma[this.model];
@@ -59,22 +57,22 @@ class PolicyProxyHandler {
     // find operations behaves as if the entities that don't match access policies don't exist
     findUnique(args) {
         if (!args) {
-            throw (0, utils_1.prismaClientValidationError)(this.prisma, 'query argument is required');
+            throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'query argument is required');
         }
         if (!args.where) {
-            throw (0, utils_1.prismaClientValidationError)(this.prisma, 'where field is required in query argument');
+            throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'where field is required in query argument');
         }
         return this.findWithFluentCallStubs(args, 'findUnique', false, () => null);
     }
     findUniqueOrThrow(args) {
         if (!args) {
-            throw (0, utils_1.prismaClientValidationError)(this.prisma, 'query argument is required');
+            throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'query argument is required');
         }
         if (!args.where) {
-            throw (0, utils_1.prismaClientValidationError)(this.prisma, 'where field is required in query argument');
+            throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'where field is required in query argument');
         }
         return this.findWithFluentCallStubs(args, 'findUniqueOrThrow', true, () => {
-            throw this.utils.notFound(this.model);
+            throw this.policyUtils.notFound(this.model);
         });
     }
     findFirst(args) {
@@ -82,7 +80,7 @@ class PolicyProxyHandler {
     }
     findFirstOrThrow(args) {
         return this.findWithFluentCallStubs(args, 'findFirstOrThrow', true, () => {
-            throw this.utils.notFound(this.model);
+            throw this.policyUtils.notFound(this.model);
         });
     }
     findMany(args) {
@@ -97,17 +95,20 @@ class PolicyProxyHandler {
     }
     doFind(args, actionName, handleRejection) {
         const origArgs = args;
-        const _args = this.utils.clone(args);
-        if (!this.utils.injectForRead(this.prisma, this.model, _args)) {
+        const _args = this.policyUtils.clone(args);
+        if (!this.policyUtils.injectForRead(this.prisma, this.model, _args)) {
+            if (this.shouldLogQuery) {
+                this.logger.info(`[policy] \`${actionName}\` ${this.model}: unconditionally denied`);
+            }
             return handleRejection();
         }
-        this.utils.injectReadCheckSelect(this.model, _args);
+        this.policyUtils.injectReadCheckSelect(this.model, _args);
         if (this.shouldLogQuery) {
             this.logger.info(`[policy] \`${actionName}\` ${this.model}:\n${(0, utils_1.formatObject)(_args)}`);
         }
         return new Promise((resolve, reject) => {
             this.modelClient[actionName](_args).then((value) => {
-                this.utils.postProcessForRead(value, this.model, origArgs);
+                this.policyUtils.postProcessForRead(value, this.model, origArgs);
                 resolve(value);
             }, (err) => reject(err));
         });
@@ -115,13 +116,13 @@ class PolicyProxyHandler {
     // returns a fluent API call function
     fluentCall(filter, fieldInfo, rootPromise) {
         return (args) => {
-            args = this.utils.clone(args);
+            args = this.policyUtils.clone(args);
             // combine the parent filter with the current one
             const backLinkField = this.requireBackLink(fieldInfo);
             const condition = backLinkField.isArray
                 ? { [backLinkField.name]: { some: filter } }
                 : { [backLinkField.name]: { is: filter } };
-            args.where = this.utils.and(args.where, condition);
+            args.where = this.policyUtils.and(args.where, condition);
             const promise = (0, promise_1.createDeferredPromise)(() => {
                 // Promise for fetching
                 const fetchFluent = (resolve, reject) => {
@@ -155,7 +156,7 @@ class PolicyProxyHandler {
     }
     // add fluent API functions to the given promise
     addFluentFunctions(promise, model, filter, rootPromise) {
-        const fields = this.utils.getModelFields(model);
+        const fields = this.policyUtils.getModelFields(model);
         if (fields) {
             for (const [field, fieldInfo] of Object.entries(fields)) {
                 if (fieldInfo.isDataModel) {
@@ -169,21 +170,21 @@ class PolicyProxyHandler {
     create(args) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!args) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'query argument is required');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'query argument is required');
             }
             if (!args.data) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'data field is required in query argument');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'data field is required in query argument');
             }
-            this.utils.tryReject(this.prisma, this.model, 'create');
+            this.policyUtils.tryReject(this.prisma, this.model, 'create');
             const origArgs = args;
-            args = this.utils.clone(args);
+            args = this.policyUtils.clone(args);
             // static input policy check for top-level create data
-            const inputCheck = this.utils.checkInputGuard(this.model, args.data, 'create');
+            const inputCheck = this.policyUtils.checkInputGuard(this.model, args.data, 'create');
             if (inputCheck === false) {
-                throw this.utils.deniedByPolicy(this.model, 'create', undefined, constants_1.CrudFailureReason.ACCESS_POLICY_VIOLATION);
+                throw this.policyUtils.deniedByPolicy(this.model, 'create', undefined, constants_1.CrudFailureReason.ACCESS_POLICY_VIOLATION);
             }
             const hasNestedCreateOrConnect = yield this.hasNestedCreateOrConnect(args);
-            const { result, error } = yield this.transaction((tx) => __awaiter(this, void 0, void 0, function* () {
+            const { result, error } = yield this.queryUtils.transaction(this.prisma, (tx) => __awaiter(this, void 0, void 0, function* () {
                 if (
                 // MUST check true here since inputCheck can be undefined (meaning static input check not possible)
                 inputCheck === true &&
@@ -191,15 +192,15 @@ class PolicyProxyHandler {
                     !hasNestedCreateOrConnect) {
                     // there's no nested write and we've passed input check, proceed with the create directly
                     // validate zod schema if any
-                    this.validateCreateInputSchema(this.model, args.data);
+                    args.data = this.validateCreateInputSchema(this.model, args.data);
                     // make a create args only containing data and ID selection
-                    const createArgs = { data: args.data, select: this.utils.makeIdSelection(this.model) };
+                    const createArgs = { data: args.data, select: this.policyUtils.makeIdSelection(this.model) };
                     if (this.shouldLogQuery) {
                         this.logger.info(`[policy] \`create\` ${this.model}: ${(0, utils_1.formatObject)(createArgs)}`);
                     }
                     const result = yield tx[this.model].create(createArgs);
                     // filter the read-back data
-                    return this.utils.readBack(tx, this.model, 'create', args, result);
+                    return this.policyUtils.readBack(tx, this.model, 'create', args, result);
                 }
                 else {
                     // proceed with a complex create and collect post-write checks
@@ -207,7 +208,7 @@ class PolicyProxyHandler {
                     // execute post-write checks
                     yield this.runPostWriteChecks(postWriteChecks, tx);
                     // filter the read-back data
-                    return this.utils.readBack(tx, this.model, 'create', origArgs, result);
+                    return this.policyUtils.readBack(tx, this.model, 'create', origArgs, result);
                 }
             }));
             if (error) {
@@ -240,20 +241,30 @@ class PolicyProxyHandler {
             // visit the create payload
             const visitor = new cross_1.NestedWriteVisitor(this.modelMeta, {
                 create: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                    this.validateCreateInputSchema(model, args);
+                    const validateResult = this.validateCreateInputSchema(model, args);
+                    if (validateResult !== args) {
+                        this.policyUtils.replace(args, validateResult);
+                    }
                     pushIdFields(model, context);
                 }),
                 createMany: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                    (0, cross_1.enumerate)(args.data).forEach((item) => this.validateCreateInputSchema(model, item));
+                    (0, cross_1.enumerate)(args.data).forEach((item) => {
+                        const r = this.validateCreateInputSchema(model, item);
+                        if (r !== item) {
+                            this.policyUtils.replace(item, r);
+                        }
+                    });
                     pushIdFields(model, context);
                 }),
                 connectOrCreate: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
                     var _a;
                     if (!args.where) {
-                        throw this.utils.validationError(`'where' field is required for connectOrCreate`);
+                        throw this.policyUtils.validationError(`'where' field is required for connectOrCreate`);
+                    }
+                    if (args.create) {
+                        args.create = this.validateCreateInputSchema(model, args.create);
                     }
-                    this.validateCreateInputSchema(model, args.create);
-                    const existing = yield this.utils.checkExistence(db, model, args.where);
+                    const existing = yield this.policyUtils.checkExistence(db, model, args.where);
                     if (existing) {
                         // connect case
                         if ((_a = context.field) === null || _a === void 0 ? void 0 : _a.backLink) {
@@ -261,7 +272,7 @@ class PolicyProxyHandler {
                             if (backLinkField === null || backLinkField === void 0 ? void 0 : backLinkField.isRelationOwner) {
                                 // the target side of relation owns the relation,
                                 // check if it's updatable
-                                yield this.utils.checkPolicyForUnique(model, args.where, 'update', db, args);
+                                yield this.policyUtils.checkPolicyForUnique(model, args.where, 'update', db, args);
                             }
                         }
                         if (context.parent.connect) {
@@ -294,16 +305,16 @@ class PolicyProxyHandler {
                 connect: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
                     var _b;
                     if (!args || typeof args !== 'object' || Object.keys(args).length === 0) {
-                        throw this.utils.validationError(`'connect' field must be an non-empty object`);
+                        throw this.policyUtils.validationError(`'connect' field must be an non-empty object`);
                     }
                     if ((_b = context.field) === null || _b === void 0 ? void 0 : _b.backLink) {
                         const backLinkField = (0, cross_1.resolveField)(this.modelMeta, model, context.field.backLink);
                         if (backLinkField === null || backLinkField === void 0 ? void 0 : backLinkField.isRelationOwner) {
                             // check existence
-                            yield this.utils.checkExistence(db, model, args, true);
+                            yield this.policyUtils.checkExistence(db, model, args, true);
                             // the target side of relation owns the relation,
                             // check if it's updatable
-                            yield this.utils.checkPolicyForUnique(model, args, 'update', db, args);
+                            yield this.policyUtils.checkPolicyForUnique(model, args, 'update', db, args);
                         }
                     }
                 }),
@@ -342,7 +353,7 @@ class PolicyProxyHandler {
                 }
             });
             // return only the ids of the top-level entity
-            const ids = this.utils.getEntityIds(this.model, result);
+            const ids = this.policyUtils.getEntityIds(this.model, result);
             return { result: ids, postWriteChecks: [...postCreateChecks.values()] };
         });
     }
@@ -387,33 +398,40 @@ class PolicyProxyHandler {
     }
     // Validates the given create payload against Zod schema if any
     validateCreateInputSchema(model, data) {
-        const schema = this.utils.getZodSchema(model, 'create');
+        const schema = this.policyUtils.getZodSchema(model, 'create');
         if (schema) {
             const parseResult = schema.safeParse(data);
             if (!parseResult.success) {
-                throw this.utils.deniedByPolicy(model, 'create', `input failed validation: ${(0, zod_validation_error_1.fromZodError)(parseResult.error)}`, constants_1.CrudFailureReason.DATA_VALIDATION_VIOLATION, parseResult.error);
+                throw this.policyUtils.deniedByPolicy(model, 'create', `input failed validation: ${(0, zod_validation_error_1.fromZodError)(parseResult.error)}`, constants_1.CrudFailureReason.DATA_VALIDATION_VIOLATION, parseResult.error);
             }
+            return parseResult.data;
+        }
+        else {
+            return data;
         }
     }
     createMany(args) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!args) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'query argument is required');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'query argument is required');
             }
             if (!args.data) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'data field is required in query argument');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'data field is required in query argument');
             }
-            this.utils.tryReject(this.prisma, this.model, 'create');
-            args = this.utils.clone(args);
+            this.policyUtils.tryReject(this.prisma, this.model, 'create');
+            args = this.policyUtils.clone(args);
             // do static input validation and check if post-create checks are needed
             let needPostCreateCheck = false;
             for (const item of (0, cross_1.enumerate)(args.data)) {
-                const inputCheck = this.utils.checkInputGuard(this.model, item, 'create');
+                const inputCheck = this.policyUtils.checkInputGuard(this.model, item, 'create');
                 if (inputCheck === false) {
-                    throw this.utils.deniedByPolicy(this.model, 'create', undefined, constants_1.CrudFailureReason.ACCESS_POLICY_VIOLATION);
+                    throw this.policyUtils.deniedByPolicy(this.model, 'create', undefined, constants_1.CrudFailureReason.ACCESS_POLICY_VIOLATION);
                 }
                 else if (inputCheck === true) {
-                    this.validateCreateInputSchema(this.model, item);
+                    const r = this.validateCreateInputSchema(this.model, item);
+                    if (r !== item) {
+                        this.policyUtils.replace(item, r);
+                    }
                 }
                 else if (inputCheck === undefined) {
                     // static policy check is not possible, need to do post-create check
@@ -426,7 +444,7 @@ class PolicyProxyHandler {
             }
             else {
                 // create entities in a transaction with post-create checks
-                return this.transaction((tx) => __awaiter(this, void 0, void 0, function* () {
+                return this.queryUtils.transaction(this.prisma, (tx) => __awaiter(this, void 0, void 0, function* () {
                     const { result, postWriteChecks } = yield this.doCreateMany(this.model, args, tx);
                     // post-create check
                     yield this.runPostWriteChecks(postWriteChecks, tx);
@@ -451,7 +469,7 @@ class PolicyProxyHandler {
                 if (this.shouldLogQuery) {
                     this.logger.info(`[policy] \`create\` for \`createMany\` ${model}: ${(0, utils_1.formatObject)(item)}`);
                 }
-                return yield db[model].create({ select: this.utils.makeIdSelection(model), data: item });
+                return yield db[model].create({ select: this.policyUtils.makeIdSelection(model), data: item });
             })));
             // filter undefined values due to skipDuplicates
             createResult = createResult.filter((p) => !!p);
@@ -472,11 +490,11 @@ class PolicyProxyHandler {
             // TODO: for simple cases we should be able to translate it to an `upsert` with empty `update` payload
             // for each unique constraint, check if the input item has all fields set, and if so, check if
             // an entity already exists, and ignore accordingly
-            const uniqueConstraints = this.utils.getUniqueConstraints(model);
+            const uniqueConstraints = this.policyUtils.getUniqueConstraints(model);
             for (const constraint of Object.values(uniqueConstraints)) {
                 if (constraint.fields.every((f) => createData[f] !== undefined)) {
                     const uniqueFilter = constraint.fields.reduce((acc, f) => (Object.assign(Object.assign({}, acc), { [f]: createData[f] })), {});
-                    const existing = yield this.utils.checkExistence(db, model, uniqueFilter);
+                    const existing = yield this.policyUtils.checkExistence(db, model, uniqueFilter);
                     if (existing) {
                         return true;
                     }
@@ -495,22 +513,22 @@ class PolicyProxyHandler {
     update(args) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!args) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'query argument is required');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'query argument is required');
             }
             if (!args.where) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'where field is required in query argument');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'where field is required in query argument');
             }
             if (!args.data) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'data field is required in query argument');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'data field is required in query argument');
             }
-            args = this.utils.clone(args);
-            const { result, error } = yield this.transaction((tx) => __awaiter(this, void 0, void 0, function* () {
+            args = this.policyUtils.clone(args);
+            const { result, error } = yield this.queryUtils.transaction(this.prisma, (tx) => __awaiter(this, void 0, void 0, function* () {
                 // proceed with nested writes and collect post-write checks
                 const { result, postWriteChecks } = yield this.doUpdate(args, tx);
                 // post-write check
                 yield this.runPostWriteChecks(postWriteChecks, tx);
                 // filter the read-back data
-                return this.utils.readBack(tx, this.model, 'update', args, result);
+                return this.policyUtils.readBack(tx, this.model, 'update', args, result);
             }));
             if (error) {
                 throw error;
@@ -527,10 +545,10 @@ class PolicyProxyHandler {
             // registers a post-update check task
             const _registerPostUpdateCheck = (model, uniqueFilter) => __awaiter(this, void 0, void 0, function* () {
                 // both "post-update" rules and Zod schemas require a post-update check
-                if (this.utils.hasAuthGuard(model, 'postUpdate') || this.utils.getZodSchema(model)) {
+                if (this.policyUtils.hasAuthGuard(model, 'postUpdate') || this.policyUtils.getZodSchema(model)) {
                     // select pre-update field values
                     let preValue;
-                    const preValueSelect = this.utils.getPreValueSelect(model);
+                    const preValueSelect = this.policyUtils.getPreValueSelect(model);
                     if (preValueSelect && Object.keys(preValueSelect).length > 0) {
                         preValue = yield db[model].findFirst({ where: uniqueFilter, select: preValueSelect });
                     }
@@ -555,7 +573,7 @@ class PolicyProxyHandler {
                     //     - unsafe: { data: { userId: 1 } }
                     const unsafe = this.isUnsafeMutate(model, args);
                     // handles the connection to upstream entity
-                    const reversedQuery = this.utils.buildReversedQuery(context, true, unsafe);
+                    const reversedQuery = this.policyUtils.buildReversedQuery(context, true, unsafe);
                     if ((!unsafe || context.field.isRelationOwner) && reversedQuery[context.field.backLink]) {
                         // if mutation is safe, or current field owns the relation (so the other side has no fk),
                         // and the reverse query contains the back link, then we can build a "connect" with it
@@ -583,7 +601,7 @@ class PolicyProxyHandler {
                             // for example when it's nested inside a one-to-one update
                             const upstreamQuery = {
                                 where: reversedQuery[backLinkField.name],
-                                select: this.utils.makeIdSelection(backLinkField.type),
+                                select: this.policyUtils.makeIdSelection(backLinkField.type),
                             };
                             // fetch the upstream entity
                             if (this.logger.enabled('info')) {
@@ -620,8 +638,8 @@ class PolicyProxyHandler {
             const _connectDisconnect = (model, args, context) => __awaiter(this, void 0, void 0, function* () {
                 var _b;
                 if ((_b = context.field) === null || _b === void 0 ? void 0 : _b.backLink) {
-                    const backLinkField = this.utils.getModelField(model, context.field.backLink);
-                    if (backLinkField.isRelationOwner) {
+                    const backLinkField = this.policyUtils.getModelField(model, context.field.backLink);
+                    if (backLinkField === null || backLinkField === void 0 ? void 0 : backLinkField.isRelationOwner) {
                         // update happens on the related model, require updatable,
                         // translate args to foreign keys so field-level policies can be checked
                         const checkArgs = {};
@@ -633,7 +651,7 @@ class PolicyProxyHandler {
                                 }
                             }
                         }
-                        yield this.utils.checkPolicyForUnique(model, args, 'update', db, checkArgs);
+                        yield this.policyUtils.checkPolicyForUnique(model, args, 'update', db, checkArgs);
                         // register post-update check
                         yield _registerPostUpdateCheck(model, args);
                     }
@@ -644,9 +662,9 @@ class PolicyProxyHandler {
                 update: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
                     var _c;
                     // build a unique query including upstream conditions
-                    const uniqueFilter = this.utils.buildReversedQuery(context);
+                    const uniqueFilter = this.policyUtils.buildReversedQuery(context);
                     // handle not-found
-                    const existing = yield this.utils.checkExistence(db, model, uniqueFilter, true);
+                    const existing = yield this.policyUtils.checkExistence(db, model, uniqueFilter, true);
                     // check if the update actually writes to this model
                     let thisModelUpdate = false;
                     const updatePayload = (_c = args.data) !== null && _c !== void 0 ? _c : args;
@@ -668,11 +686,11 @@ class PolicyProxyHandler {
                         }
                     }
                     if (thisModelUpdate) {
-                        this.utils.tryReject(db, this.model, 'update');
+                        this.policyUtils.tryReject(db, this.model, 'update');
                         // check pre-update guard
-                        yield this.utils.checkPolicyForUnique(model, uniqueFilter, 'update', db, args);
+                        yield this.policyUtils.checkPolicyForUnique(model, uniqueFilter, 'update', db, args);
                         // handles the case where id fields are updated
-                        const ids = this.utils.clone(existing);
+                        const ids = this.policyUtils.clone(existing);
                         for (const key of Object.keys(existing)) {
                             const updateValue = args.data ? args.data[key] : args[key];
                             if (typeof updateValue === 'string' ||
@@ -687,15 +705,15 @@ class PolicyProxyHandler {
                 }),
                 updateMany: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
                     // prepare for post-update check
-                    if (this.utils.hasAuthGuard(model, 'postUpdate') || this.utils.getZodSchema(model)) {
-                        let select = this.utils.makeIdSelection(model);
-                        const preValueSelect = this.utils.getPreValueSelect(model);
+                    if (this.policyUtils.hasAuthGuard(model, 'postUpdate') || this.policyUtils.getZodSchema(model)) {
+                        let select = this.policyUtils.makeIdSelection(model);
+                        const preValueSelect = this.policyUtils.getPreValueSelect(model);
                         if (preValueSelect) {
                             select = Object.assign(Object.assign({}, select), preValueSelect);
                         }
-                        const reversedQuery = this.utils.buildReversedQuery(context);
+                        const reversedQuery = this.policyUtils.buildReversedQuery(context);
                         const currentSetQuery = { select, where: reversedQuery };
-                        this.utils.injectAuthGuardAsWhere(db, currentSetQuery, model, 'read');
+                        this.policyUtils.injectAuthGuardAsWhere(db, currentSetQuery, model, 'read');
                         if (this.shouldLogQuery) {
                             this.logger.info(`[policy] \`findMany\` for post update check ${model}:\n${(0, utils_1.formatObject)(currentSetQuery)}`);
                         }
@@ -707,16 +725,16 @@ class PolicyProxyHandler {
                             preValue: preValueSelect ? preValue : undefined,
                         })));
                     }
-                    const updateGuard = this.utils.getAuthGuard(db, model, 'update');
-                    if (this.utils.isTrue(updateGuard) || this.utils.isFalse(updateGuard)) {
+                    const updateGuard = this.policyUtils.getAuthGuard(db, model, 'update');
+                    if (this.policyUtils.isTrue(updateGuard) || this.policyUtils.isFalse(updateGuard)) {
                         // injects simple auth guard into where clause
-                        this.utils.injectAuthGuardAsWhere(db, args, model, 'update');
+                        this.policyUtils.injectAuthGuardAsWhere(db, args, model, 'update');
                     }
                     else {
                         // we have to process `updateMany` separately because the guard may contain
                         // filters using relation fields which are not allowed in nested `updateMany`
-                        const reversedQuery = this.utils.buildReversedQuery(context);
-                        const updateWhere = this.utils.and(reversedQuery, updateGuard);
+                        const reversedQuery = this.policyUtils.buildReversedQuery(context);
+                        const updateWhere = this.policyUtils.and(reversedQuery, updateGuard);
                         if (this.shouldLogQuery) {
                             this.logger.info(`[policy] \`updateMany\` ${model}:\n${(0, utils_1.formatObject)({
                                 where: updateWhere,
@@ -745,13 +763,13 @@ class PolicyProxyHandler {
                 }),
                 upsert: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
                     // build a unique query including upstream conditions
-                    const uniqueFilter = this.utils.buildReversedQuery(context);
+                    const uniqueFilter = this.policyUtils.buildReversedQuery(context);
                     // branch based on if the update target exists
-                    const existing = yield this.utils.checkExistence(db, model, uniqueFilter);
+                    const existing = yield this.policyUtils.checkExistence(db, model, uniqueFilter);
                     if (existing) {
                         // update case
                         // check pre-update guard
-                        yield this.utils.checkPolicyForUnique(model, uniqueFilter, 'update', db, args);
+                        yield this.policyUtils.checkPolicyForUnique(model, uniqueFilter, 'update', db, args);
                         // register post-update check
                         yield _registerPostUpdateCheck(model, uniqueFilter);
                         // convert upsert to update
@@ -773,7 +791,7 @@ class PolicyProxyHandler {
                 connect: (model, args, context) => __awaiter(this, void 0, void 0, function* () { return _connectDisconnect(model, args, context); }),
                 connectOrCreate: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
                     // the where condition is already unique, so we can use it to check if the target exists
-                    const existing = yield this.utils.checkExistence(db, model, args.where);
+                    const existing = yield this.policyUtils.checkExistence(db, model, args.where);
                     if (existing) {
                         // connect
                         yield _connectDisconnect(model, args.where, context);
@@ -786,9 +804,9 @@ class PolicyProxyHandler {
                 disconnect: (model, args, context) => __awaiter(this, void 0, void 0, function* () { return _connectDisconnect(model, args, context); }),
                 set: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
                     // find the set of items to be replaced
-                    const reversedQuery = this.utils.buildReversedQuery(context);
+                    const reversedQuery = this.policyUtils.buildReversedQuery(context);
                     const findCurrSetArgs = {
-                        select: this.utils.makeIdSelection(model),
+                        select: this.policyUtils.makeIdSelection(model),
                         where: reversedQuery,
                     };
                     if (this.shouldLogQuery) {
@@ -802,23 +820,23 @@ class PolicyProxyHandler {
                 }),
                 delete: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
                     // build a unique query including upstream conditions
-                    const uniqueFilter = this.utils.buildReversedQuery(context);
+                    const uniqueFilter = this.policyUtils.buildReversedQuery(context);
                     // handle not-found
-                    yield this.utils.checkExistence(db, model, uniqueFilter, true);
+                    yield this.policyUtils.checkExistence(db, model, uniqueFilter, true);
                     // check delete guard
-                    yield this.utils.checkPolicyForUnique(model, uniqueFilter, 'delete', db, args);
+                    yield this.policyUtils.checkPolicyForUnique(model, uniqueFilter, 'delete', db, args);
                 }),
                 deleteMany: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                    const guard = yield this.utils.getAuthGuard(db, model, 'delete');
-                    if (this.utils.isTrue(guard) || this.utils.isFalse(guard)) {
+                    const guard = yield this.policyUtils.getAuthGuard(db, model, 'delete');
+                    if (this.policyUtils.isTrue(guard) || this.policyUtils.isFalse(guard)) {
                         // inject simple auth guard
-                        context.parent.deleteMany = this.utils.and(args, guard);
+                        context.parent.deleteMany = this.policyUtils.and(args, guard);
                     }
                     else {
                         // we have to process `deleteMany` separately because the guard may contain
                         // filters using relation fields which are not allowed in nested `deleteMany`
-                        const reversedQuery = this.utils.buildReversedQuery(context);
-                        const deleteWhere = this.utils.and(reversedQuery, guard);
+                        const reversedQuery = this.policyUtils.buildReversedQuery(context);
+                        const deleteWhere = this.policyUtils.and(reversedQuery, guard);
                         if (this.shouldLogQuery) {
                             this.logger.info(`[policy] \`deleteMany\` ${model}:\n${(0, utils_1.formatObject)({ where: deleteWhere })}`);
                         }
@@ -835,7 +853,7 @@ class PolicyProxyHandler {
             const result = yield db[this.model].update({
                 where: args.where,
                 data: args.data,
-                select: this.utils.makeIdSelection(this.model),
+                select: this.policyUtils.makeIdSelection(this.model),
             });
             return { result, postWriteChecks };
         });
@@ -846,7 +864,7 @@ class PolicyProxyHandler {
         }
         for (const k of Object.keys(args)) {
             const field = (0, cross_1.resolveField)(this.modelMeta, model, k);
-            if (this.isAutoIncrementIdField(field) || (field === null || field === void 0 ? void 0 : field.isForeignKey)) {
+            if (field && (this.isAutoIncrementIdField(field) || field.isForeignKey)) {
                 return true;
             }
         }
@@ -858,26 +876,26 @@ class PolicyProxyHandler {
     updateMany(args) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!args) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'query argument is required');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'query argument is required');
             }
             if (!args.data) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'data field is required in query argument');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'data field is required in query argument');
             }
-            this.utils.tryReject(this.prisma, this.model, 'update');
-            args = this.utils.clone(args);
-            this.utils.injectAuthGuardAsWhere(this.prisma, args, this.model, 'update');
-            if (this.utils.hasAuthGuard(this.model, 'postUpdate') || this.utils.getZodSchema(this.model)) {
+            this.policyUtils.tryReject(this.prisma, this.model, 'update');
+            args = this.policyUtils.clone(args);
+            this.policyUtils.injectAuthGuardAsWhere(this.prisma, args, this.model, 'update');
+            if (this.policyUtils.hasAuthGuard(this.model, 'postUpdate') || this.policyUtils.getZodSchema(this.model)) {
                 // use a transaction to do post-update checks
                 const postWriteChecks = [];
-                return this.transaction((tx) => __awaiter(this, void 0, void 0, function* () {
+                return this.queryUtils.transaction(this.prisma, (tx) => __awaiter(this, void 0, void 0, function* () {
                     // collect pre-update values
-                    let select = this.utils.makeIdSelection(this.model);
-                    const preValueSelect = this.utils.getPreValueSelect(this.model);
+                    let select = this.policyUtils.makeIdSelection(this.model);
+                    const preValueSelect = this.policyUtils.getPreValueSelect(this.model);
                     if (preValueSelect) {
                         select = Object.assign(Object.assign({}, select), preValueSelect);
                     }
                     const currentSetQuery = { select, where: args.where };
-                    this.utils.injectAuthGuardAsWhere(tx, currentSetQuery, this.model, 'read');
+                    this.policyUtils.injectAuthGuardAsWhere(tx, currentSetQuery, this.model, 'read');
                     if (this.shouldLogQuery) {
                         this.logger.info(`[policy] \`findMany\` ${this.model}: ${(0, utils_1.formatObject)(currentSetQuery)}`);
                     }
@@ -885,7 +903,7 @@ class PolicyProxyHandler {
                     postWriteChecks.push(...currentSet.map((preValue) => ({
                         model: this.model,
                         operation: 'postUpdate',
-                        uniqueFilter: this.utils.getEntityIds(this.model, preValue),
+                        uniqueFilter: this.policyUtils.getEntityIds(this.model, preValue),
                         preValue: preValueSelect ? preValue : undefined,
                     })));
                     // proceed with the update
@@ -907,36 +925,36 @@ class PolicyProxyHandler {
     upsert(args) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!args) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'query argument is required');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'query argument is required');
             }
             if (!args.where) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'where field is required in query argument');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'where field is required in query argument');
             }
             if (!args.create) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'create field is required in query argument');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'create field is required in query argument');
             }
             if (!args.update) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'update field is required in query argument');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'update field is required in query argument');
             }
-            this.utils.tryReject(this.prisma, this.model, 'create');
-            this.utils.tryReject(this.prisma, this.model, 'update');
-            args = this.utils.clone(args);
+            this.policyUtils.tryReject(this.prisma, this.model, 'create');
+            this.policyUtils.tryReject(this.prisma, this.model, 'update');
+            args = this.policyUtils.clone(args);
             // We can call the native "upsert" because we can't tell if an entity was created or updated
             // for doing post-write check accordingly. Instead, decompose it into create or update.
-            const { result, error } = yield this.transaction((tx) => __awaiter(this, void 0, void 0, function* () {
+            const { result, error } = yield this.queryUtils.transaction(this.prisma, (tx) => __awaiter(this, void 0, void 0, function* () {
                 const { where, create, update } = args, rest = __rest(args, ["where", "create", "update"]);
-                const existing = yield this.utils.checkExistence(tx, this.model, args.where);
+                const existing = yield this.policyUtils.checkExistence(tx, this.model, args.where);
                 if (existing) {
                     // update case
                     const { result, postWriteChecks } = yield this.doUpdate(Object.assign({ where, data: update }, rest), tx);
                     yield this.runPostWriteChecks(postWriteChecks, tx);
-                    return this.utils.readBack(tx, this.model, 'update', args, result);
+                    return this.policyUtils.readBack(tx, this.model, 'update', args, result);
                 }
                 else {
                     // create case
                     const { result, postWriteChecks } = yield this.doCreate(this.model, Object.assign({ data: create }, rest), tx);
                     yield this.runPostWriteChecks(postWriteChecks, tx);
-                    return this.utils.readBack(tx, this.model, 'create', args, result);
+                    return this.policyUtils.readBack(tx, this.model, 'create', args, result);
                 }
             }));
             if (error) {
@@ -954,21 +972,21 @@ class PolicyProxyHandler {
     delete(args) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!args) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'query argument is required');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'query argument is required');
             }
             if (!args.where) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'where field is required in query argument');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'where field is required in query argument');
             }
-            this.utils.tryReject(this.prisma, this.model, 'delete');
-            const { result, error } = yield this.transaction((tx) => __awaiter(this, void 0, void 0, function* () {
+            this.policyUtils.tryReject(this.prisma, this.model, 'delete');
+            const { result, error } = yield this.queryUtils.transaction(this.prisma, (tx) => __awaiter(this, void 0, void 0, function* () {
                 // do a read-back before delete
-                const r = yield this.utils.readBack(tx, this.model, 'delete', args, args.where);
+                const r = yield this.policyUtils.readBack(tx, this.model, 'delete', args, args.where);
                 const error = r.error;
                 const read = r.result;
                 // check existence
-                yield this.utils.checkExistence(tx, this.model, args.where, true);
+                yield this.policyUtils.checkExistence(tx, this.model, args.where, true);
                 // inject delete guard
-                yield this.utils.checkPolicyForUnique(this.model, args.where, 'delete', tx, args);
+                yield this.policyUtils.checkPolicyForUnique(this.model, args.where, 'delete', tx, args);
                 // proceed with the deletion
                 if (this.shouldLogQuery) {
                     this.logger.info(`[policy] \`delete\` ${this.model}:\n${(0, utils_1.formatObject)(args)}`);
@@ -986,10 +1004,10 @@ class PolicyProxyHandler {
     }
     deleteMany(args) {
         return __awaiter(this, void 0, void 0, function* () {
-            this.utils.tryReject(this.prisma, this.model, 'delete');
+            this.policyUtils.tryReject(this.prisma, this.model, 'delete');
             // inject policy conditions
             args = args !== null && args !== void 0 ? args : {};
-            this.utils.injectAuthGuardAsWhere(this.prisma, args, this.model, 'delete');
+            this.policyUtils.injectAuthGuardAsWhere(this.prisma, args, this.model, 'delete');
             // conduct the deletion
             if (this.shouldLogQuery) {
                 this.logger.info(`[policy] \`deleteMany\` ${this.model}:\n${(0, utils_1.formatObject)(args)}`);
@@ -1002,11 +1020,11 @@ class PolicyProxyHandler {
     aggregate(args) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!args) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'query argument is required');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'query argument is required');
             }
-            args = this.utils.clone(args);
+            args = this.policyUtils.clone(args);
             // inject policy conditions
-            this.utils.injectAuthGuardAsWhere(this.prisma, args, this.model, 'read');
+            this.policyUtils.injectAuthGuardAsWhere(this.prisma, args, this.model, 'read');
             if (this.shouldLogQuery) {
                 this.logger.info(`[policy] \`aggregate\` ${this.model}:\n${(0, utils_1.formatObject)(args)}`);
             }
@@ -1016,11 +1034,11 @@ class PolicyProxyHandler {
     groupBy(args) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!args) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'query argument is required');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'query argument is required');
             }
-            args = this.utils.clone(args);
+            args = this.policyUtils.clone(args);
             // inject policy conditions
-            this.utils.injectAuthGuardAsWhere(this.prisma, args, this.model, 'read');
+            this.policyUtils.injectAuthGuardAsWhere(this.prisma, args, this.model, 'read');
             if (this.shouldLogQuery) {
                 this.logger.info(`[policy] \`groupBy\` ${this.model}:\n${(0, utils_1.formatObject)(args)}`);
             }
@@ -1030,8 +1048,8 @@ class PolicyProxyHandler {
     count(args) {
         return __awaiter(this, void 0, void 0, function* () {
             // inject policy conditions
-            args = args ? this.utils.clone(args) : {};
-            this.utils.injectAuthGuardAsWhere(this.prisma, args, this.model, 'read');
+            args = args ? this.policyUtils.clone(args) : {};
+            this.policyUtils.injectAuthGuardAsWhere(this.prisma, args, this.model, 'read');
             if (this.shouldLogQuery) {
                 this.logger.info(`[policy] \`count\` ${this.model}:\n${(0, utils_1.formatObject)(args)}`);
             }
@@ -1042,8 +1060,8 @@ class PolicyProxyHandler {
     //#region Subscribe (Prisma Pulse)
     subscribe(args) {
         return __awaiter(this, void 0, void 0, function* () {
-            const readGuard = this.utils.getAuthGuard(this.prisma, this.model, 'read');
-            if (this.utils.isTrue(readGuard)) {
+            const readGuard = this.policyUtils.getAuthGuard(this.prisma, this.model, 'read');
+            if (this.policyUtils.isTrue(readGuard)) {
                 // no need to inject
                 if (this.shouldLogQuery) {
                     this.logger.info(`[policy] \`subscribe\` ${this.model}:\n${(0, utils_1.formatObject)(args)}`);
@@ -1056,25 +1074,25 @@ class PolicyProxyHandler {
             }
             else {
                 if (typeof args !== 'object') {
-                    throw (0, utils_1.prismaClientValidationError)(this.prisma, 'argument must be an object');
+                    throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'argument must be an object');
                 }
                 if (Object.keys(args).length === 0) {
                     // include all
                     args = { create: {}, update: {}, delete: {} };
                 }
                 else {
-                    args = this.utils.clone(args);
+                    args = this.policyUtils.clone(args);
                 }
             }
             // inject into subscribe conditions
             if (args.create) {
-                args.create.after = this.utils.and(args.create.after, readGuard);
+                args.create.after = this.policyUtils.and(args.create.after, readGuard);
             }
             if (args.update) {
-                args.update.after = this.utils.and(args.update.after, readGuard);
+                args.update.after = this.policyUtils.and(args.update.after, readGuard);
             }
             if (args.delete) {
-                args.delete.before = this.utils.and(args.delete.before, readGuard);
+                args.delete.before = this.policyUtils.and(args.delete.before, readGuard);
             }
             if (this.shouldLogQuery) {
                 this.logger.info(`[policy] \`subscribe\` ${this.model}:\n${(0, utils_1.formatObject)(args)}`);
@@ -1088,33 +1106,13 @@ class PolicyProxyHandler {
         var _a;
         return !!((_a = this.options) === null || _a === void 0 ? void 0 : _a.logPrismaQuery) && this.logger.enabled('info');
     }
-    transaction(action) {
-        var _a, _b, _c;
-        if (this.prisma['$transaction']) {
-            const txOptions = { maxWait: this.DEFAULT_TX_MAXWAIT, timeout: this.DEFAULT_TX_TIMEOUT };
-            if (((_a = this.options) === null || _a === void 0 ? void 0 : _a.transactionMaxWait) !== undefined) {
-                txOptions.maxWait = this.options.transactionMaxWait;
-            }
-            if (((_b = this.options) === null || _b === void 0 ? void 0 : _b.transactionTimeout) !== undefined) {
-                txOptions.timeout = this.options.transactionTimeout;
-            }
-            if (((_c = this.options) === null || _c === void 0 ? void 0 : _c.transactionIsolationLevel) !== undefined) {
-                txOptions.isolationLevel = this.options.transactionIsolationLevel;
-            }
-            return this.prisma.$transaction((tx) => action(tx), txOptions);
-        }
-        else {
-            // already in transaction, don't nest
-            return action(this.prisma);
-        }
-    }
     runPostWriteChecks(postWriteChecks, db) {
         return __awaiter(this, void 0, void 0, function* () {
-            yield Promise.all(postWriteChecks.map(({ model, operation, uniqueFilter, preValue }) => __awaiter(this, void 0, void 0, function* () { return this.utils.checkPolicyForUnique(model, uniqueFilter, operation, db, undefined, preValue); })));
+            yield Promise.all(postWriteChecks.map(({ model, operation, uniqueFilter, preValue }) => __awaiter(this, void 0, void 0, function* () { return this.policyUtils.checkPolicyForUnique(model, uniqueFilter, operation, db, undefined, preValue); })));
         });
     }
     makeHandler(model) {
-        return new PolicyProxyHandler(this.prisma, this.policy, this.modelMeta, this.zodSchemas, model, this.user, this.options);
+        return new PolicyProxyHandler(this.prisma, model, this.options, this.context);
     }
     requireBackLink(fieldInfo) {
         (0, tiny_invariant_1.default)(fieldInfo.backLink, `back link not found for field ${fieldInfo.name}`);