@zenstackhq/runtime 2.1.2 → 2.2.0

package/enhancements/policy/policy-utils.js

@@ -15,6 +15,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PolicyUtil = void 0;
 const deepcopy_1 = __importDefault(require("deepcopy"));
+const deepmerge_1 = __importDefault(require("deepmerge"));
 const lower_case_first_1 = require("lower-case-first");
 const upper_case_first_1 = require("upper-case-first");
 const zod_validation_error_1 = require("zod-validation-error");
@@ -34,14 +35,14 @@ class PolicyUtil extends query_utils_1.QueryUtils {
         this.shouldLogQuery = shouldLogQuery;
         //#endregion
         //#region Auth guard
-        this.FULLY_OPEN_AUTH_GUARD = {
-            create: true,
-            read: true,
-            update: true,
-            delete: true,
-            postUpdate: true,
-            create_input: true,
-            update_input: true,
+        this.FULL_OPEN_MODEL_POLICY = {
+            modelLevel: {
+                read: { guard: true },
+                create: { guard: true, inputChecker: true },
+                update: { guard: true },
+                delete: { guard: true },
+                postUpdate: { guard: true },
+            },
         };
         this.logger = new logger_1.Logger(db);
         this.user = context === null || context === void 0 ? void 0 : context.user;
@@ -215,14 +216,21 @@ class PolicyUtil extends query_utils_1.QueryUtils {
         }
         return result;
     }
-    getModelAuthGuard(model) {
+    getModelPolicyDef(model) {
         if (this.options.kinds && !this.options.kinds.includes('policy')) {
             // policy enhancement not enabled, return an fully open guard
-            return this.FULLY_OPEN_AUTH_GUARD;
+            return this.FULL_OPEN_MODEL_POLICY;
         }
-        else {
-            return this.policy.guard[(0, lower_case_first_1.lowerCaseFirst)(model)];
+        const def = this.policy.policy[(0, lower_case_first_1.lowerCaseFirst)(model)];
+        if (!def) {
+            throw this.unknownError(`unable to load policy guard for ${model}`);
         }
+        return def;
+    }
+    getModelGuardForOperation(model, operation) {
+        var _a;
+        const def = this.getModelPolicyDef(model);
+        return (_a = def.modelLevel[operation].guard) !== null && _a !== void 0 ? _a : true;
     }
     /**
      * Gets pregenerated authorization guard object for a given model and operation.
@@ -231,91 +239,104 @@ class PolicyUtil extends query_utils_1.QueryUtils {
      * otherwise returns a guard object
      */
     getAuthGuard(db, model, operation, preValue) {
-        const guard = this.getModelAuthGuard(model);
-        if (!guard) {
-            throw this.unknownError(`unable to load policy guard for ${model}`);
+        const guard = this.getModelGuardForOperation(model, operation);
+        // constant guard
+        if (typeof guard === 'boolean') {
+            return this.reduce(guard);
         }
-        const provider = guard[operation];
-        if (typeof provider === 'boolean') {
-            return this.reduce(provider);
+        // invoke guard function
+        const r = guard({ user: this.user, preValue }, db);
+        return this.reduce(r);
+    }
+    /**
+     * Get field-level read auth guard
+     */
+    getFieldReadAuthGuard(db, model, field) {
+        var _a, _b, _c;
+        const def = this.getModelPolicyDef(model);
+        const guard = (_c = (_b = (_a = def.fieldLevel) === null || _a === void 0 ? void 0 : _a.read) === null || _b === void 0 ? void 0 : _b[field]) === null || _c === void 0 ? void 0 : _c.guard;
+        if (guard === undefined) {
+            // field access is allowed by default
+            return this.makeTrue();
         }
-        if (!provider) {
-            throw this.unknownError(`unable to load authorization guard for ${model}`);
+        if (typeof guard === 'boolean') {
+            return this.reduce(guard);
         }
-        const r = provider({ user: this.user, preValue }, db);
+        const r = guard({ user: this.user }, db);
         return this.reduce(r);
     }
     /**
      * Get field-level read auth guard that overrides the model-level
      */
     getFieldOverrideReadAuthGuard(db, model, field) {
-        const guard = this.requireGuard(model);
-        const provider = guard[`${constants_1.FIELD_LEVEL_OVERRIDE_READ_GUARD_PREFIX}${field}`];
-        if (provider === undefined) {
+        var _a, _b, _c;
+        const def = this.getModelPolicyDef(model);
+        const guard = (_c = (_b = (_a = def.fieldLevel) === null || _a === void 0 ? void 0 : _a.read) === null || _b === void 0 ? void 0 : _b[field]) === null || _c === void 0 ? void 0 : _c.overrideGuard;
+        if (guard === undefined) {
             // field access is denied by default in override mode
             return this.makeFalse();
         }
-        if (typeof provider === 'boolean') {
-            return this.reduce(provider);
+        if (typeof guard === 'boolean') {
+            return this.reduce(guard);
         }
-        const r = provider({ user: this.user }, db);
+        const r = guard({ user: this.user }, db);
         return this.reduce(r);
     }
     /**
      * Get field-level update auth guard
      */
     getFieldUpdateAuthGuard(db, model, field) {
-        const guard = this.requireGuard(model);
-        const provider = guard[`${constants_1.FIELD_LEVEL_UPDATE_GUARD_PREFIX}${field}`];
-        if (provider === undefined) {
+        var _a, _b, _c;
+        const def = this.getModelPolicyDef(model);
+        const guard = (_c = (_b = (_a = def.fieldLevel) === null || _a === void 0 ? void 0 : _a.update) === null || _b === void 0 ? void 0 : _b[field]) === null || _c === void 0 ? void 0 : _c.guard;
+        if (guard === undefined) {
             // field access is allowed by default
             return this.makeTrue();
         }
-        if (typeof provider === 'boolean') {
-            return this.reduce(provider);
+        if (typeof guard === 'boolean') {
+            return this.reduce(guard);
         }
-        const r = provider({ user: this.user }, db);
+        const r = guard({ user: this.user }, db);
         return this.reduce(r);
     }
     /**
      * Get field-level update auth guard that overrides the model-level
      */
     getFieldOverrideUpdateAuthGuard(db, model, field) {
-        const guard = this.requireGuard(model);
-        const provider = guard[`${constants_1.FIELD_LEVEL_OVERRIDE_UPDATE_GUARD_PREFIX}${field}`];
-        if (provider === undefined) {
+        var _a, _b, _c;
+        const def = this.getModelPolicyDef(model);
+        const guard = (_c = (_b = (_a = def.fieldLevel) === null || _a === void 0 ? void 0 : _a.update) === null || _b === void 0 ? void 0 : _b[field]) === null || _c === void 0 ? void 0 : _c.overrideGuard;
+        if (guard === undefined) {
             // field access is denied by default in override mode
             return this.makeFalse();
         }
-        if (typeof provider === 'boolean') {
-            return this.reduce(provider);
+        if (typeof guard === 'boolean') {
+            return this.reduce(guard);
         }
-        const r = provider({ user: this.user }, db);
+        const r = guard({ user: this.user }, db);
         return this.reduce(r);
     }
     /**
      * Checks if the given model has a policy guard for the given operation.
      */
     hasAuthGuard(model, operation) {
-        const guard = this.getModelAuthGuard(model);
-        if (!guard) {
-            return false;
-        }
-        const provider = guard[operation];
-        return typeof provider !== 'boolean' || provider !== true;
+        const guard = this.getModelGuardForOperation(model, operation);
+        return typeof guard !== 'boolean' || guard !== true;
     }
     /**
      * Checks if the given model has any field-level override policy guard for the given operation.
      */
     hasOverrideAuthGuard(model, operation) {
-        const guard = this.requireGuard(model);
-        switch (operation) {
-            case 'read':
-                return Object.keys(guard).some((k) => k.startsWith(constants_1.FIELD_LEVEL_OVERRIDE_READ_GUARD_PREFIX));
-            case 'update':
-                return Object.keys(guard).some((k) => k.startsWith(constants_1.FIELD_LEVEL_OVERRIDE_UPDATE_GUARD_PREFIX));
-            default:
-                return false;
+        var _a;
+        if (operation !== 'read' && operation !== 'update') {
+            return false;
+        }
+        const def = this.getModelPolicyDef(model);
+        if ((_a = def.fieldLevel) === null || _a === void 0 ? void 0 : _a[operation]) {
+            return Object.values(def.fieldLevel[operation]).some((f) => f.overrideGuard !== undefined || f.overrideEntityChecker !== undefined);
+        }
+        else {
+            return false;
         }
     }
     /**
@@ -324,18 +345,15 @@ class PolicyUtil extends query_utils_1.QueryUtils {
      * @returns boolean if static analysis is enough to determine the result, undefined if not
      */
     checkInputGuard(model, args, operation) {
-        const guard = this.getModelAuthGuard(model);
-        if (!guard) {
+        const def = this.getModelPolicyDef(model);
+        const guard = def.modelLevel[operation].inputChecker;
+        if (guard === undefined) {
             return undefined;
         }
-        const provider = guard[`${operation}_input`];
-        if (typeof provider === 'boolean') {
-            return provider;
+        if (typeof guard === 'boolean') {
+            return guard;
         }
-        if (!provider) {
-            return undefined;
-        }
-        return provider(args, { user: this.user });
+        return guard(args, { user: this.user });
     }
     /**
      * Injects model auth guard as where clause.
@@ -372,74 +390,93 @@ class PolicyUtil extends query_utils_1.QueryUtils {
             args.where = this.makeFalse();
             return false;
         }
+        let mergedGuard = guard;
         if (args.where) {
             // inject into relation fields:
             //   to-many: some/none/every
             //   to-one: direct-conditions/is/isNot
-            this.injectGuardForRelationFields(db, model, args.where, operation);
+            mergedGuard = this.injectReadGuardForRelationFields(db, model, args.where, guard);
         }
-        args.where = this.and(args.where, guard);
+        args.where = this.and(args.where, mergedGuard);
         return true;
     }
-    injectGuardForRelationFields(db, model, payload, operation) {
+    // Injects guard for relation fields nested in `payload`. The `modelGuard` parameter represents the model-level guard for `model`.
+    // The function returns a modified copy of `modelGuard` with field-level policies combined.
+    injectReadGuardForRelationFields(db, model, payload, modelGuard) {
+        if (!payload || typeof payload !== 'object' || Object.keys(payload).length === 0) {
+            return modelGuard;
+        }
+        const allFieldGuards = [];
+        const allFieldOverrideGuards = [];
         for (const [field, subPayload] of Object.entries(payload)) {
             if (!subPayload) {
                 continue;
             }
+            allFieldGuards.push(this.getFieldReadAuthGuard(db, model, field));
+            allFieldOverrideGuards.push(this.getFieldOverrideReadAuthGuard(db, model, field));
             const fieldInfo = (0, cross_1.resolveField)(this.modelMeta, model, field);
-            if (!fieldInfo || !fieldInfo.isDataModel) {
-                continue;
-            }
-            if (fieldInfo.isArray) {
-                this.injectGuardForToManyField(db, fieldInfo, subPayload, operation);
-            }
-            else {
-                this.injectGuardForToOneField(db, fieldInfo, subPayload, operation);
+            if (fieldInfo === null || fieldInfo === void 0 ? void 0 : fieldInfo.isDataModel) {
+                if (fieldInfo.isArray) {
+                    this.injectReadGuardForToManyField(db, fieldInfo, subPayload);
+                }
+                else {
+                    this.injectReadGuardForToOneField(db, fieldInfo, subPayload);
+                }
             }
         }
+        // all existing field-level guards must be true
+        const mergedGuard = this.and(...allFieldGuards);
+        // all existing field-level override guards must be true for override to take effect; override is disabled by default
+        const mergedOverrideGuard = allFieldOverrideGuards.length === 0 ? this.makeFalse() : this.and(...allFieldOverrideGuards);
+        // (original-guard && field-level-guard) || field-level-override-guard
+        const updatedGuard = this.or(this.and(modelGuard, mergedGuard), mergedOverrideGuard);
+        return updatedGuard;
     }
-    injectGuardForToManyField(db, fieldInfo, payload, operation) {
-        const guard = this.getAuthGuard(db, fieldInfo.type, operation);
+    injectReadGuardForToManyField(db, fieldInfo, payload) {
+        const guard = this.getAuthGuard(db, fieldInfo.type, 'read');
         if (payload.some) {
-            this.injectGuardForRelationFields(db, fieldInfo.type, payload.some, operation);
+            const mergedGuard = this.injectReadGuardForRelationFields(db, fieldInfo.type, payload.some, guard);
             // turn "some" into: { some: { AND: [guard, payload.some] } }
-            payload.some = this.and(payload.some, guard);
+            payload.some = this.and(payload.some, mergedGuard);
         }
         if (payload.none) {
-            this.injectGuardForRelationFields(db, fieldInfo.type, payload.none, operation);
+            const mergedGuard = this.injectReadGuardForRelationFields(db, fieldInfo.type, payload.none, guard);
             // turn none into: { none: { AND: [guard, payload.none] } }
-            payload.none = this.and(payload.none, guard);
+            payload.none = this.and(payload.none, mergedGuard);
         }
         if (payload.every &&
             typeof payload.every === 'object' &&
             // ignore empty every clause
             Object.keys(payload.every).length > 0) {
-            this.injectGuardForRelationFields(db, fieldInfo.type, payload.every, operation);
+            const mergedGuard = this.injectReadGuardForRelationFields(db, fieldInfo.type, payload.every, guard);
             // turn "every" into: { none: { AND: [guard, { NOT: payload.every }] } }
             if (!payload.none) {
                 payload.none = {};
             }
-            payload.none = this.and(payload.none, guard, this.not(payload.every));
+            payload.none = this.and(payload.none, mergedGuard, this.not(payload.every));
             delete payload.every;
         }
     }
-    injectGuardForToOneField(db, fieldInfo, payload, operation) {
-        const guard = this.getAuthGuard(db, fieldInfo.type, operation);
+    injectReadGuardForToOneField(db, fieldInfo, payload) {
+        const guard = this.getAuthGuard(db, fieldInfo.type, 'read');
         // is|isNot and flat fields conditions are mutually exclusive
-        if (payload.is || payload.isNot) {
+        // is and isNot can be null value
+        if (payload.is !== undefined || payload.isNot !== undefined) {
             if (payload.is) {
-                this.injectGuardForRelationFields(db, fieldInfo.type, payload.is, operation);
+                const mergedGuard = this.injectReadGuardForRelationFields(db, fieldInfo.type, payload.is, guard);
+                // merge guard with existing "is": { is: { AND: [originalIs, guard] } }
+                payload.is = this.and(payload.is, mergedGuard);
             }
             if (payload.isNot) {
-                this.injectGuardForRelationFields(db, fieldInfo.type, payload.isNot, operation);
+                const mergedGuard = this.injectReadGuardForRelationFields(db, fieldInfo.type, payload.isNot, guard);
+                // merge guard with existing "isNot":  { isNot: { AND: [originalIsNot, guard] } }
+                payload.isNot = this.and(payload.isNot, mergedGuard);
             }
-            // merge guard with existing "is": { is: [originalIs, guard] }
-            payload.is = this.and(payload.is, guard);
         }
         else {
-            this.injectGuardForRelationFields(db, fieldInfo.type, payload, operation);
+            const mergedGuard = this.injectReadGuardForRelationFields(db, fieldInfo.type, payload, guard);
             // turn direct conditions into: { is: { AND: [ originalConditions, guard ] } }
-            const combined = this.and((0, deepcopy_1.default)(payload), guard);
+            const combined = this.and((0, deepcopy_1.default)(payload), mergedGuard);
             Object.keys(payload).forEach((key) => delete payload[key]);
             payload.is = combined;
         }
@@ -457,7 +494,7 @@ class PolicyUtil extends query_utils_1.QueryUtils {
             // inject into relation fields:
             //   to-many: some/none/every
             //   to-one: direct-conditions/is/isNot
-            this.injectGuardForRelationFields(db, model, args.where, 'read');
+            this.injectReadGuardForRelationFields(db, model, args.where, {});
         }
         if (injected.where && Object.keys(injected.where).length > 0 && !this.isTrue(injected.where)) {
             if (!args.where) {
@@ -487,31 +524,23 @@ class PolicyUtil extends query_utils_1.QueryUtils {
      * Gets checker constraints for the given model and operation.
      */
     getCheckerConstraint(model, operation) {
-        const checker = this.getModelChecker(model);
-        const provider = checker[operation];
-        if (typeof provider === 'boolean') {
-            return provider;
+        if (this.options.kinds && !this.options.kinds.includes('policy')) {
+            // policy enhancement not enabled, return a constant true checker result
+            return true;
         }
-        if (typeof provider !== 'function') {
-            throw this.unknownError(`invalid ${operation} checker function for ${model}`);
+        const def = this.getModelPolicyDef(model);
+        const checker = def.modelLevel[operation].permissionChecker;
+        if (checker === undefined) {
+            throw new Error(`Generated permission checkers not found. Please make sure the "generatePermissionChecker" option is set to true in the "@core/enhancer" plugin.`);
         }
-        // call checker function
-        return provider({ user: this.user });
-    }
-    getModelChecker(model) {
-        var _a;
-        if (this.options.kinds && !this.options.kinds.includes('policy')) {
-            // policy enhancement not enabled, return a constant true checker
-            return { create: true, read: true, update: true, delete: true };
+        if (typeof checker === 'boolean') {
+            return checker;
         }
-        else {
-            const result = (_a = this.options.policy.checker) === null || _a === void 0 ? void 0 : _a[(0, lower_case_first_1.lowerCaseFirst)(model)];
-            if (!result) {
-                // checker generation not enabled, return constant false checker
-                throw new Error(`Generated permission checkers not found. Please make sure the "generatePermissionChecker" option is set to true in the "@core/enhancer" plugin.`);
-            }
-            return result;
+        if (typeof checker !== 'function') {
+            throw this.unknownError(`invalid ${operation} checker function for ${model}`);
         }
+        // call checker function
+        return checker({ user: this.user });
     }
     //#endregion
     /**
@@ -609,6 +638,7 @@ class PolicyUtil extends query_utils_1.QueryUtils {
             if (this.isFalse(guard) && !this.hasOverrideAuthGuard(model, operation)) {
                 throw this.deniedByPolicy(model, operation, `entity ${(0, utils_1.formatObject)(uniqueFilter, false)} failed policy check`, constants_1.CrudFailureReason.ACCESS_POLICY_VIOLATION);
             }
+            let entityChecker;
             if (operation === 'update' && args) {
                 // merge field-level policy guards
                 const fieldUpdateGuard = this.getFieldUpdateGuards(db, model, args);
@@ -616,28 +646,37 @@ class PolicyUtil extends query_utils_1.QueryUtils {
                     // rejected
                     throw this.deniedByPolicy(model, 'update', `entity ${(0, utils_1.formatObject)(uniqueFilter, false)} failed update policy check for field "${fieldUpdateGuard.rejectedByField}"`, constants_1.CrudFailureReason.ACCESS_POLICY_VIOLATION);
                 }
-                else {
-                    if (fieldUpdateGuard.guard) {
-                        // merge field-level guard
-                        guard = this.and(guard, fieldUpdateGuard.guard);
-                    }
-                    if (fieldUpdateGuard.overrideGuard) {
-                        // merge field-level override guard
-                        guard = this.or(guard, fieldUpdateGuard.overrideGuard);
-                    }
+                if (fieldUpdateGuard.guard) {
+                    // merge field-level guard with AND
+                    guard = this.and(guard, fieldUpdateGuard.guard);
                 }
+                if (fieldUpdateGuard.overrideGuard) {
+                    // merge field-level override guard with OR
+                    guard = this.or(guard, fieldUpdateGuard.overrideGuard);
+                }
+                // field-level entity checker
+                entityChecker = fieldUpdateGuard.entityChecker;
             }
             // Zod schema is to be checked for "create" and "postUpdate"
             const schema = ['create', 'postUpdate'].includes(operation) ? this.getZodSchema(model) : undefined;
-            if (this.isTrue(guard) && !schema) {
+            // combine field-level entity checker with model-level
+            const modelEntityChecker = this.getEntityChecker(model, operation);
+            entityChecker = this.combineEntityChecker(entityChecker, modelEntityChecker, 'and');
+            if (this.isTrue(guard) && !schema && !entityChecker) {
                 // unconditionally allowed
                 return;
             }
-            const select = schema
+            let select = schema
                 ? // need to validate against schema, need to fetch all fields
                     undefined
                 : // only fetch id fields
                     this.makeIdSelection(model);
+            if (entityChecker === null || entityChecker === void 0 ? void 0 : entityChecker.selector) {
+                if (!select) {
+                    select = this.makeAllScalarFieldSelect(model);
+                }
+                select = Object.assign(Object.assign({}, select), entityChecker.selector);
+            }
             let where = this.clone(uniqueFilter);
             // query args may have be of combined-id form, need to flatten it to call findFirst
             this.flattenGeneratedUniqueField(model, where);
@@ -651,6 +690,14 @@ class PolicyUtil extends query_utils_1.QueryUtils {
             if (!result) {
                 throw this.deniedByPolicy(model, operation, `entity ${(0, utils_1.formatObject)(uniqueFilter, false)} failed policy check`, constants_1.CrudFailureReason.ACCESS_POLICY_VIOLATION);
             }
+            if (entityChecker) {
+                if (this.logger.enabled('info')) {
+                    this.logger.info(`[policy] running entity checker on ${model} for ${operation}`);
+                }
+                if (!entityChecker.func(result, { user: this.user, preValue })) {
+                    throw this.deniedByPolicy(model, operation, `entity ${(0, utils_1.formatObject)(uniqueFilter, false)} failed policy check`, constants_1.CrudFailureReason.ACCESS_POLICY_VIOLATION);
+                }
+            }
             if (schema) {
                 // TODO: push down schema check to the database
                 const parseResult = schema.safeParse(result);
@@ -664,6 +711,21 @@ class PolicyUtil extends query_utils_1.QueryUtils {
             }
         });
     }
+    getEntityChecker(model, operation, field) {
+        var _a, _b, _c;
+        const def = this.getModelPolicyDef(model);
+        if (field) {
+            return (_c = (_b = (_a = def.fieldLevel) === null || _a === void 0 ? void 0 : _a[operation]) === null || _b === void 0 ? void 0 : _b[field]) === null || _c === void 0 ? void 0 : _c.entityChecker;
+        }
+        else {
+            return def.modelLevel[operation].entityChecker;
+        }
+    }
+    getUpdateOverrideEntityCheckerForField(model, field) {
+        var _a, _b, _c;
+        const def = this.getModelPolicyDef(model);
+        return (_c = (_b = (_a = def.fieldLevel) === null || _a === void 0 ? void 0 : _a.update) === null || _b === void 0 ? void 0 : _b[field]) === null || _c === void 0 ? void 0 : _c.overrideEntityChecker;
+    }
     getFieldReadGuards(db, model, args) {
         const allFields = Object.values((0, cross_1.getFields)(this.modelMeta, model));
         // all scalar fields by default
@@ -687,16 +749,17 @@ class PolicyUtil extends query_utils_1.QueryUtils {
         var _a;
         const allFieldGuards = [];
         const allOverrideFieldGuards = [];
-        for (const [k, v] of Object.entries((_a = args.data) !== null && _a !== void 0 ? _a : args)) {
-            if (typeof v === 'undefined') {
+        let entityChecker;
+        for (const [field, value] of Object.entries((_a = args.data) !== null && _a !== void 0 ? _a : args)) {
+            if (typeof value === 'undefined') {
                 continue;
             }
-            const field = (0, cross_1.resolveField)(this.modelMeta, model, k);
-            if (field === null || field === void 0 ? void 0 : field.isDataModel) {
+            const fieldInfo = (0, cross_1.resolveField)(this.modelMeta, model, field);
+            if (fieldInfo === null || fieldInfo === void 0 ? void 0 : fieldInfo.isDataModel) {
                 // relation field update should be treated as foreign key update,
                 // fetch and merge all foreign key guards
-                if (field.isRelationOwner && field.foreignKeyMapping) {
-                    const foreignKeys = Object.values(field.foreignKeyMapping);
+                if (fieldInfo.isRelationOwner && fieldInfo.foreignKeyMapping) {
+                    const foreignKeys = Object.values(fieldInfo.foreignKeyMapping);
                     for (const fk of foreignKeys) {
                         const fieldGuard = this.getFieldUpdateAuthGuard(db, model, fk);
                         if (this.isFalse(fieldGuard)) {
@@ -711,16 +774,22 @@ class PolicyUtil extends query_utils_1.QueryUtils {
                 }
             }
             else {
-                const fieldGuard = this.getFieldUpdateAuthGuard(db, model, k);
+                const fieldGuard = this.getFieldUpdateAuthGuard(db, model, field);
                 if (this.isFalse(fieldGuard)) {
-                    return { guard: fieldGuard, rejectedByField: k };
+                    return { guard: fieldGuard, rejectedByField: field };
                 }
                 // add field guard
                 allFieldGuards.push(fieldGuard);
                 // add field override guard
-                const overrideFieldGuard = this.getFieldOverrideUpdateAuthGuard(db, model, k);
+                const overrideFieldGuard = this.getFieldOverrideUpdateAuthGuard(db, model, field);
                 allOverrideFieldGuards.push(overrideFieldGuard);
             }
+            // merge regular and override entity checkers with OR
+            let checker = this.getEntityChecker(model, 'update', field);
+            const overrideChecker = this.getUpdateOverrideEntityCheckerForField(model, field);
+            checker = this.combineEntityChecker(checker, overrideChecker, 'or');
+            // accumulate entity checker across fields
+            entityChecker = this.combineEntityChecker(entityChecker, checker, 'and');
         }
         const allFieldsCombined = this.and(...allFieldGuards);
         const allOverrideFieldsCombined = allOverrideFieldGuards.length !== 0 ? this.and(...allOverrideFieldGuards) : undefined;
@@ -728,6 +797,23 @@ class PolicyUtil extends query_utils_1.QueryUtils {
             guard: allFieldsCombined,
             overrideGuard: allOverrideFieldsCombined,
             rejectedByField: undefined,
+            entityChecker,
+        };
+    }
+    combineEntityChecker(left, right, combiner) {
+        var _a, _b;
+        if (!left) {
+            return right;
+        }
+        if (!right) {
+            return left;
+        }
+        const func = combiner === 'and'
+            ? (entity, context) => left.func(entity, context) && right.func(entity, context)
+            : (entity, context) => left.func(entity, context) || right.func(entity, context);
+        return {
+            func,
+            selector: (0, deepmerge_1.default)((_a = left.selector) !== null && _a !== void 0 ? _a : {}, (_b = right.selector) !== null && _b !== void 0 ? _b : {}),
         };
     }
     /**
@@ -788,8 +874,8 @@ class PolicyUtil extends query_utils_1.QueryUtils {
         });
     }
     /**
-     * Injects field selection needed for checking field-level read policy into query args.
-     * @returns
+     * Injects field selection needed for checking field-level read policy check and evaluating
+     * entity checker into query args.
      */
     injectReadCheckSelect(model, args) {
         // we need to recurse into relation fields before injecting the current level, because
@@ -805,11 +891,15 @@ class PolicyUtil extends query_utils_1.QueryUtils {
         }
         if (this.hasFieldLevelPolicy(model)) {
             // recursively inject selection for fields needed for field-level read checks
-            const readFieldSelect = this.getReadFieldSelect(model);
+            const readFieldSelect = this.getFieldReadCheckSelector(model);
             if (readFieldSelect) {
                 this.doInjectReadCheckSelect(model, args, { select: readFieldSelect });
             }
         }
+        const entityChecker = this.getEntityChecker(model, 'read');
+        if (entityChecker === null || entityChecker === void 0 ? void 0 : entityChecker.selector) {
+            this.doInjectReadCheckSelect(model, args, { select: entityChecker.selector });
+        }
     }
     doInjectReadCheckSelect(model, args, input) {
         // omit should be ignored to avoid interfering with field selection
@@ -899,30 +989,39 @@ class PolicyUtil extends query_utils_1.QueryUtils {
      * Gets field selection for fetching pre-update entity values for the given model.
      */
     getPreValueSelect(model) {
-        const guard = this.getModelAuthGuard(model);
-        if (!guard) {
-            throw this.unknownError(`unable to load policy guard for ${model}`);
-        }
-        return guard[constants_1.PRE_UPDATE_VALUE_SELECTOR];
+        const def = this.getModelPolicyDef(model);
+        return def.modelLevel.postUpdate.preUpdateSelector;
     }
-    getReadFieldSelect(model) {
-        const guard = this.getModelAuthGuard(model);
-        if (!guard) {
-            throw this.unknownError(`unable to load policy guard for ${model}`);
+    // get a merged selector object for all field-level read policies
+    getFieldReadCheckSelector(model) {
+        var _a, _b, _c;
+        const def = this.getModelPolicyDef(model);
+        let result = {};
+        const fieldLevel = (_a = def.fieldLevel) === null || _a === void 0 ? void 0 : _a.read;
+        if (fieldLevel) {
+            for (const def of Object.values(fieldLevel)) {
+                if ((_b = def.entityChecker) === null || _b === void 0 ? void 0 : _b.selector) {
+                    result = (0, deepmerge_1.default)(result, def.entityChecker.selector);
+                }
+                if ((_c = def.overrideEntityChecker) === null || _c === void 0 ? void 0 : _c.selector) {
+                    result = (0, deepmerge_1.default)(result, def.overrideEntityChecker.selector);
+                }
+            }
         }
-        return guard[constants_1.FIELD_LEVEL_READ_CHECKER_SELECTOR];
+        return Object.keys(result).length > 0 ? result : undefined;
     }
     checkReadField(model, field, entity) {
-        const guard = this.getModelAuthGuard(model);
-        if (!guard) {
-            throw this.unknownError(`unable to load policy guard for ${model}`);
-        }
-        const func = guard[`${constants_1.FIELD_LEVEL_READ_CHECKER_PREFIX}${field}`];
-        if (!func) {
+        var _a, _b, _c, _d, _e, _f;
+        const def = this.getModelPolicyDef(model);
+        // combine regular and override field-level entity checkers with OR
+        const checker = (_c = (_b = (_a = def.fieldLevel) === null || _a === void 0 ? void 0 : _a.read) === null || _b === void 0 ? void 0 : _b[field]) === null || _c === void 0 ? void 0 : _c.entityChecker;
+        const overrideChecker = (_f = (_e = (_d = def.fieldLevel) === null || _d === void 0 ? void 0 : _d.read) === null || _e === void 0 ? void 0 : _e[field]) === null || _f === void 0 ? void 0 : _f.overrideEntityChecker;
+        const combinedChecker = this.combineEntityChecker(checker, overrideChecker, 'or');
+        if (combinedChecker === undefined) {
             return true;
         }
         else {
-            return func(entity, { user: this.user });
+            return combinedChecker.func(entity, { user: this.user });
         }
     }
     hasFieldValidation(model) {
@@ -930,11 +1029,9 @@ class PolicyUtil extends query_utils_1.QueryUtils {
         return ((_b = (_a = this.policy.validation) === null || _a === void 0 ? void 0 : _a[(0, lower_case_first_1.lowerCaseFirst)(model)]) === null || _b === void 0 ? void 0 : _b.hasValidation) === true;
     }
     hasFieldLevelPolicy(model) {
-        const guard = this.getModelAuthGuard(model);
-        if (!guard) {
-            throw this.unknownError(`unable to load policy guard for ${model}`);
-        }
-        return !!guard[constants_1.HAS_FIELD_LEVEL_POLICY_FLAG];
+        var _a, _b;
+        const def = this.getModelPolicyDef(model);
+        return Object.keys((_b = (_a = def.fieldLevel) === null || _a === void 0 ? void 0 : _a.read) !== null && _b !== void 0 ? _b : {}).length > 0;
     }
     /**
      * Gets Zod schema for the given model and access kind.
@@ -956,16 +1053,44 @@ class PolicyUtil extends query_utils_1.QueryUtils {
         // preserve the original data as it may be needed for checking field-level readability,
         // while the "data" will be manipulated during traversal (deleting unreadable fields)
         const origData = this.clone(data);
-        this.doPostProcessForRead(data, model, origData, queryArgs, this.hasFieldLevelPolicy(model));
+        return this.doPostProcessForRead(data, model, origData, queryArgs, this.hasFieldLevelPolicy(model));
     }
     doPostProcessForRead(data, model, fullData, queryArgs, hasFieldLevelPolicy, path = '') {
         var _a, _b, _c;
         if (data === null || data === undefined) {
-            return;
+            return data;
+        }
+        let filteredData = data;
+        let filteredFullData = fullData;
+        const entityChecker = this.getEntityChecker(model, 'read');
+        if (entityChecker) {
+            if (Array.isArray(data)) {
+                filteredData = [];
+                filteredFullData = [];
+                for (const [entityData, entityFullData] of (0, cross_1.zip)(data, fullData)) {
+                    if (!entityChecker.func(entityData, { user: this.user })) {
+                        if (this.shouldLogQuery) {
+                            this.logger.info(`[policy] dropping ${model} entity${path ? ' at ' + path : ''} due to entity checker`);
+                        }
+                    }
+                    else {
+                        filteredData.push(entityData);
+                        filteredFullData.push(entityFullData);
+                    }
+                }
+            }
+            else {
+                if (!entityChecker.func(data, { user: this.user })) {
+                    if (this.shouldLogQuery) {
+                        this.logger.info(`[policy] dropping ${model} entity${path ? ' at ' + path : ''} due to entity checker`);
+                    }
+                    return null;
+                }
+            }
         }
-        for (const [entityData, entityFullData] of (0, cross_1.zip)(data, fullData)) {
+        for (const [entityData, entityFullData] of (0, cross_1.zip)(filteredData, filteredFullData)) {
             if (typeof entityData !== 'object' || !entityData) {
-                return;
+                continue;
             }
             for (const [field, fieldData] of Object.entries(entityData)) {
                 if (fieldData === undefined) {
@@ -1015,10 +1140,17 @@ class PolicyUtil extends query_utils_1.QueryUtils {
                 if (fieldInfo.isDataModel) {
                     // recurse into nested fields
                     const nextArgs = (_c = ((_b = queryArgs === null || queryArgs === void 0 ? void 0 : queryArgs.select) !== null && _b !== void 0 ? _b : queryArgs === null || queryArgs === void 0 ? void 0 : queryArgs.include)) === null || _c === void 0 ? void 0 : _c[field];
-                    this.doPostProcessForRead(fieldData, fieldInfo.type, entityFullData[field], nextArgs, this.hasFieldLevelPolicy(fieldInfo.type), path ? path + '.' + field : field);
+                    const nestedResult = this.doPostProcessForRead(fieldData, fieldInfo.type, entityFullData[field], nextArgs, this.hasFieldLevelPolicy(fieldInfo.type), path ? path + '.' + field : field);
+                    if (nestedResult === undefined) {
+                        delete entityData[field];
+                    }
+                    else {
+                        entityData[field] = nestedResult;
+                    }
                 }
             }
         }
+        return filteredData;
     }
     /**
      * Clones an object and makes sure it's not empty.
@@ -1080,13 +1212,6 @@ class PolicyUtil extends query_utils_1.QueryUtils {
             where.AND = [extra];
         }
     }
-    requireGuard(model) {
-        const guard = this.getModelAuthGuard(model);
-        if (!guard) {
-            throw this.unknownError(`unable to load policy guard for ${model}`);
-        }
-        return guard;
-    }
     /**
      * Given an entity data, returns an object only containing id fields.
      */