@zenstackhq/runtime 2.10.2 → 2.11.0

package/enhancements/node/encryption.js

@@ -0,0 +1,150 @@
+"use strict";
+/* eslint-disable @typescript-eslint/no-explicit-any */
+/* eslint-disable @typescript-eslint/no-unused-vars */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withEncrypted = withEncrypted;
+const constants_1 = require("../../constants");
+const cross_1 = require("../../cross");
+const encryption_1 = require("../../encryption");
+const logger_1 = require("./logger");
+const proxy_1 = require("./proxy");
+const query_utils_1 = require("./query-utils");
+/**
+ * Gets an enhanced Prisma client that supports `@encrypted` attribute.
+ *
+ * @private
+ */
+function withEncrypted(prisma, options) {
+    return (0, proxy_1.makeProxy)(prisma, options.modelMeta, (_prisma, model) => new EncryptedHandler(_prisma, model, options), 'encryption');
+}
+class EncryptedHandler extends proxy_1.DefaultPrismaProxyHandler {
+    constructor(prisma, model, options) {
+        super(prisma, model, options);
+        this.decryptionKeys = [];
+        this.queryUtils = new query_utils_1.QueryUtils(prisma, options);
+        this.logger = new logger_1.Logger(prisma);
+        if (!options.encryption) {
+            throw this.queryUtils.unknownError('Encryption options must be provided');
+        }
+        if (this.isCustomEncryption(options.encryption)) {
+            if (!options.encryption.encrypt || !options.encryption.decrypt) {
+                throw this.queryUtils.unknownError('Custom encryption must provide encrypt and decrypt functions');
+            }
+        }
+        else {
+            if (!options.encryption.encryptionKey) {
+                throw this.queryUtils.unknownError('Encryption key must be provided');
+            }
+            this.encrypter = new encryption_1.Encrypter(options.encryption.encryptionKey);
+            this.decrypter = new encryption_1.Decrypter([
+                options.encryption.encryptionKey,
+                ...(options.encryption.decryptionKeys || []),
+            ]);
+        }
+    }
+    isCustomEncryption(encryption) {
+        return 'encrypt' in encryption && 'decrypt' in encryption;
+    }
+    encrypt(field, data) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (this.isCustomEncryption(this.options.encryption)) {
+                return this.options.encryption.encrypt(this.model, field, data);
+            }
+            return this.encrypter.encrypt(data);
+        });
+    }
+    decrypt(field, data) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (this.isCustomEncryption(this.options.encryption)) {
+                return this.options.encryption.decrypt(this.model, field, data);
+            }
+            return this.decrypter.decrypt(data);
+        });
+    }
+    // base override
+    preprocessArgs(action, args) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (args && constants_1.ACTIONS_WITH_WRITE_PAYLOAD.includes(action)) {
+                yield this.preprocessWritePayload(this.model, action, args);
+            }
+            return args;
+        });
+    }
+    // base override
+    processResultEntity(method, data) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!data || typeof data !== 'object') {
+                return data;
+            }
+            for (const value of (0, cross_1.enumerate)(data)) {
+                yield this.doPostProcess(value, this.model);
+            }
+            return data;
+        });
+    }
+    doPostProcess(entityData, model) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const realModel = this.queryUtils.getDelegateConcreteModel(model, entityData);
+            for (const field of (0, cross_1.getModelFields)(entityData)) {
+                // don't decrypt null, undefined or empty string values
+                if (!entityData[field])
+                    continue;
+                const fieldInfo = yield (0, cross_1.resolveField)(this.options.modelMeta, realModel, field);
+                if (!fieldInfo) {
+                    continue;
+                }
+                if (fieldInfo.isDataModel) {
+                    const items = fieldInfo.isArray && Array.isArray(entityData[field]) ? entityData[field] : [entityData[field]];
+                    for (const item of items) {
+                        // recurse
+                        yield this.doPostProcess(item, fieldInfo.type);
+                    }
+                }
+                else {
+                    const shouldDecrypt = (_a = fieldInfo.attributes) === null || _a === void 0 ? void 0 : _a.find((attr) => attr.name === '@encrypted');
+                    if (shouldDecrypt) {
+                        try {
+                            entityData[field] = yield this.decrypt(fieldInfo, entityData[field]);
+                        }
+                        catch (error) {
+                            this.logger.warn(`Decryption failed, keeping original value: ${error}`);
+                        }
+                    }
+                }
+            }
+        });
+    }
+    preprocessWritePayload(model, action, args) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const visitor = new cross_1.NestedWriteVisitor(this.options.modelMeta, {
+                field: (field, _action, data, context) => __awaiter(this, void 0, void 0, function* () {
+                    var _a;
+                    // don't encrypt null, undefined or empty string values
+                    if (!data)
+                        return;
+                    const encAttr = (_a = field.attributes) === null || _a === void 0 ? void 0 : _a.find((attr) => attr.name === '@encrypted');
+                    if (encAttr && field.type === 'String') {
+                        try {
+                            context.parent[field.name] = yield this.encrypt(field, data);
+                        }
+                        catch (error) {
+                            this.queryUtils.unknownError(`Encryption failed for field ${field.name}: ${error}`);
+                        }
+                    }
+                }),
+            });
+            yield visitor.visit(model, action, args);
+        });
+    }
+}
+//# sourceMappingURL=encryption.js.map

package/enhancements/node/encryption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.js","sourceRoot":"","sources":["../../../src/enhancements/node/encryption.ts"],"names":[],"mappings":";AAAA,uDAAuD;AACvD,sDAAsD;;;;;;;;;;;AAuBtD,sCAUC;AA/BD,+CAA6D;AAC7D,uCAOqB;AACrB,iDAAwD;AAGxD,qCAAkC;AAClC,mCAAmF;AACnF,+CAA2C;AAE3C;;;;GAIG;AACH,SAAgB,aAAa,CACzB,MAAgB,EAChB,OAAmC;IAEnC,OAAO,IAAA,iBAAS,EACZ,MAAM,EACN,OAAO,CAAC,SAAS,EACjB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,gBAAgB,CAAC,OAA2B,EAAE,KAAK,EAAE,OAAO,CAAC,EACrF,YAAY,CACf,CAAC;AACN,CAAC;AAED,MAAM,gBAAiB,SAAQ,iCAAyB;IASpD,YAAY,MAAwB,EAAE,KAAa,EAAE,OAAmC;QACpF,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAL1B,mBAAc,GAA8C,EAAE,CAAC;QAOnE,IAAI,CAAC,UAAU,GAAG,IAAI,wBAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,GAAG,IAAI,eAAM,CAAC,MAAM,CAAC,CAAC;QAEjC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACtB,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,qCAAqC,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,UAAW,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBAC7D,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,8DAA8D,CAAC,CAAC;YACvG,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;gBACpC,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,iCAAiC,CAAC,CAAC;YAC1E,CAAC;YAED,IAAI,CAAC,SAAS,GAAG,IAAI,sBAAS,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YACjE,IAAI,CAAC,SAAS,GAAG,IAAI,sBAAS,CAAC;gBAC3B,OAAO,CAAC,UAAU,CAAC,aAAa;gBAChC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,IAAI,EAAE,CAAC;aAC/C,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAEO,kBAAkB,CAAC,UAA+C;QACtE,OAAO,SAAS,IAAI,UAAU,IAAI,SAAS,IAAI,UAAU,CAAC;IAC9D,CAAC;IAEa,OAAO,CAAC,KAAgB,EAAE,IAAY;;YAChD,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,UAAW,CAAC,EAAE,CAAC;gBACpD,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACpE,CAAC;YAED,OAAO,IAAI,CAAC,SAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzC,CAAC;KAAA;IAEa,OAAO,CAAC,KAAgB,EAAE,IAAY;;YAChD,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,UAAW,CAAC,EAAE,CAAC;gBACpD,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACpE,CAAC;YAED,OAAO,IAAI,CAAC,SAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzC,CAAC;KAAA;IAED,gBAAgB;IACA,cAAc,CAAC,MAA0B,EAAE,IAAS;;YAChE,IAAI,IAAI,IAAI,sCAA0B,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtD,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,EAAE,MAA+B,EAAE,IAAI,CAAC,CAAC;YACzF,CAAC;YACD,OAAO,IAAI,CAAC;QAChB,CAAC;KAAA;IAED,gBAAgB;IACA,mBAAmB,CAAI,MAA0B,EAAE,IAAO;;YACtE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACpC,OAAO,IAAI,CAAC;YAChB,CAAC;YAED,KAAK,MAAM,KAAK,IAAI,IAAA,iBAAS,EAAC,IAAI,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YAChD,CAAC;YAED,OAAO,IAAI,CAAC;QAChB,CAAC;KAAA;IAEa,aAAa,CAAC,UAAe,EAAE,KAAa;;;YACtD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;YAE9E,KAAK,MAAM,KAAK,IAAI,IAAA,sBAAc,EAAC,UAAU,CAAC,EAAE,CAAC;gBAC7C,uDAAuD;gBACvD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;oBAAE,SAAS;gBAEjC,MAAM,SAAS,GAAG,MAAM,IAAA,oBAAY,EAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;gBAC/E,IAAI,CAAC,SAAS,EAAE,CAAC;oBACb,SAAS;gBACb,CAAC;gBAED,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;oBACxB,MAAM,KAAK,GACP,SAAS,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;oBACpG,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;wBACvB,UAAU;wBACV,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;oBACnD,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACJ,MAAM,aAAa,GAAG,MAAA,SAAS,CAAC,UAAU,0CAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;oBACvF,IAAI,aAAa,EAAE,CAAC;wBAChB,IAAI,CAAC;4BACD,UAAU,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;wBACzE,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8CAA8C,KAAK,EAAE,CAAC,CAAC;wBAC5E,CAAC;oBACL,CAAC;gBACL,CAAC;YACL,CAAC;QACL,CAAC;KAAA;IAEa,sBAAsB,CAAC,KAAa,EAAE,MAA6B,EAAE,IAAS;;YACxF,MAAM,OAAO,GAAG,IAAI,0BAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE;gBAC3D,KAAK,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;;oBAC3C,uDAAuD;oBACvD,IAAI,CAAC,IAAI;wBAAE,OAAO;oBAElB,MAAM,OAAO,GAAG,MAAA,KAAK,CAAC,UAAU,0CAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;oBAC7E,IAAI,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;wBACrC,IAAI,CAAC;4BACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;wBACjE,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BACb,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,+BAA+B,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC;wBACxF,CAAC;oBACL,CAAC;gBACL,CAAC,CAAA;aACJ,CAAC,CAAC;YAEH,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7C,CAAC;KAAA;CACJ"}

package/enhancements/node/password.js

@@ -32,8 +32,7 @@ class PasswordHandler extends proxy_1.DefaultPrismaProxyHandler {
     // base override
     preprocessArgs(action, args) {
         return __awaiter(this, void 0, void 0, function* () {
-            const actionsOfInterest = ['create', 'createMany', 'update', 'updateMany', 'upsert'];
-            if (args && args.data && actionsOfInterest.includes(action)) {
+            if (args && constants_1.ACTIONS_WITH_WRITE_PAYLOAD.includes(action)) {
                 yield this.preprocessWritePayload(this.model, action, args);
             }
             return args;

package/enhancements/node/password.js.map

@@ -1 +1 @@
-{"version":3,"file":"password.js","sourceRoot":"","sources":["../../../src/enhancements/node/password.ts"],"names":[],"mappings":";AAAA,uDAAuD;AACvD,sDAAsD;;;;;;;;;;;AAatD,oCAUC;AArBD,+CAA+D;AAC/D,uCAA6E;AAG7E,mCAAmF;AAEnF;;;;GAIG;AACH,SAAgB,YAAY,CACxB,MAAgB,EAChB,OAAmC;IAEnC,OAAO,IAAA,iBAAS,EACZ,MAAM,EACN,OAAO,CAAC,SAAS,EACjB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,eAAe,CAAC,OAA2B,EAAE,KAAK,EAAE,OAAO,CAAC,EACpF,UAAU,CACb,CAAC;AACN,CAAC;AAOD,8DAA8D;AAC9D,MAAM,QAAQ,GAAG,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;AAE3G,MAAM,eAAgB,SAAQ,iCAAyB;IACnD,YAAY,MAAwB,EAAE,KAAa,EAAE,OAAmC;QACpF,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,gBAAgB;IACA,cAAc,CAAC,MAA0B,EAAE,IAAS;;YAChE,MAAM,iBAAiB,GAAyB,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;YAC3G,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1D,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,EAAE,MAA+B,EAAE,IAAI,CAAC,CAAC;YACzF,CAAC;YACD,OAAO,IAAI,CAAC;QAChB,CAAC;KAAA;IAEa,sBAAsB,CAAC,KAAa,EAAE,MAA6B,EAAE,IAAS;;YACxF,MAAM,OAAO,GAAG,IAAI,0BAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE;gBAC3D,KAAK,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;;oBAC3C,MAAM,OAAO,GAAG,MAAA,KAAK,CAAC,UAAU,0CAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;oBAC5E,IAAI,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;wBACrC,sBAAsB;wBACtB,IAAI,IAAI,GAAgC,MAAA,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,0CACjF,KAAe,CAAC;wBACtB,IAAI,CAAC,IAAI,EAAE,CAAC;4BACR,IAAI,GAAG,MAAA,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC,0CAAE,KAAe,CAAC;wBAClF,CAAC;wBACD,IAAI,CAAC,IAAI,EAAE,CAAC;4BACR,IAAI,GAAG,wCAA4B,CAAC;wBACxC,CAAC;wBACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;oBAC5D,CAAC;gBACL,CAAC,CAAA;aACJ,CAAC,CAAC;YAEH,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7C,CAAC;KAAA;CACJ"}
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../../../src/enhancements/node/password.ts"],"names":[],"mappings":";AAAA,uDAAuD;AACvD,sDAAsD;;;;;;;;;;;AAatD,oCAUC;AArBD,+CAA2F;AAC3F,uCAA6E;AAG7E,mCAAmF;AAEnF;;;;GAIG;AACH,SAAgB,YAAY,CACxB,MAAgB,EAChB,OAAmC;IAEnC,OAAO,IAAA,iBAAS,EACZ,MAAM,EACN,OAAO,CAAC,SAAS,EACjB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,eAAe,CAAC,OAA2B,EAAE,KAAK,EAAE,OAAO,CAAC,EACpF,UAAU,CACb,CAAC;AACN,CAAC;AAOD,8DAA8D;AAC9D,MAAM,QAAQ,GAAG,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;AAE3G,MAAM,eAAgB,SAAQ,iCAAyB;IACnD,YAAY,MAAwB,EAAE,KAAa,EAAE,OAAmC;QACpF,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,gBAAgB;IACA,cAAc,CAAC,MAA0B,EAAE,IAAS;;YAChE,IAAI,IAAI,IAAI,sCAA0B,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtD,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,EAAE,MAA+B,EAAE,IAAI,CAAC,CAAC;YACzF,CAAC;YACD,OAAO,IAAI,CAAC;QAChB,CAAC;KAAA;IAEa,sBAAsB,CAAC,KAAa,EAAE,MAA6B,EAAE,IAAS;;YACxF,MAAM,OAAO,GAAG,IAAI,0BAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE;gBAC3D,KAAK,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;;oBAC3C,MAAM,OAAO,GAAG,MAAA,KAAK,CAAC,UAAU,0CAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;oBAC5E,IAAI,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;wBACrC,sBAAsB;wBACtB,IAAI,IAAI,GAAgC,MAAA,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,0CACjF,KAAe,CAAC;wBACtB,IAAI,CAAC,IAAI,EAAE,CAAC;4BACR,IAAI,GAAG,MAAA,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC,0CAAE,KAAe,CAAC;wBAClF,CAAC;wBACD,IAAI,CAAC,IAAI,EAAE,CAAC;4BACR,IAAI,GAAG,wCAA4B,CAAC;wBACxC,CAAC;wBACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;oBAC5D,CAAC;gBACL,CAAC,CAAA;aACJ,CAAC,CAAC;YAEH,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7C,CAAC;KAAA;CACJ"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zenstackhq/runtime",
   "displayName": "ZenStack Runtime Library",
-  "version": "2.10.2",
+  "version": "2.11.0",
   "description": "Runtime of ZenStack for both client-side and server-side environments.",
   "repository": {
     "type": "git",
@@ -73,6 +73,10 @@
       "types": "./zod-utils.d.ts",
       "default": "./zod-utils.js"
     },
+    "./encryption": {
+      "types": "./encryption/index.d.ts",
+      "default": "./encryption/index.js"
+    },
     "./package.json": {
       "default": "./package.json"
     }

package/types.d.ts

@@ -1,4 +1,5 @@
 import type { z } from 'zod';
+import { FieldInfo } from './cross';
 export type PrismaPromise<T> = Promise<T> & Record<string, (args?: any) => PrismaPromise<any>>;
 /**
  * Weakly-typed database access methods
@@ -112,6 +113,10 @@ export type EnhancementOptions = {
      * The `isolationLevel` option passed to `prisma.$transaction()` call for transactions initiated by ZenStack.
      */
     transactionIsolationLevel?: TransactionIsolationLevel;
+    /**
+     * The encryption options for using the `encrypted` enhancement.
+     */
+    encryption?: SimpleEncryption | CustomEncryption;
 };
 /**
  * Context for creating enhanced `PrismaClient`
@@ -122,7 +127,7 @@ export type EnhancementContext<User extends AuthUser = AuthUser> = {
 /**
  * Kinds of enhancements to `PrismaClient`
  */
-export type EnhancementKind = 'password' | 'omit' | 'policy' | 'validation' | 'delegate';
+export type EnhancementKind = 'password' | 'omit' | 'policy' | 'validation' | 'delegate' | 'encryption';
 /**
  * Function for transforming errors.
  */
@@ -140,3 +145,35 @@ export type ZodSchemas = {
      */
     input?: Record<string, Record<string, z.ZodSchema>>;
 };
+/**
+ * Simple encryption settings for processing fields marked with `@encrypted`.
+ */
+export type SimpleEncryption = {
+    /**
+     * The encryption key.
+     */
+    encryptionKey: Uint8Array;
+    /**
+     * Optional list of all decryption keys that were previously used to encrypt the data
+     * , for supporting key rotation. The `encryptionKey` field value is automatically
+     * included for decryption.
+     *
+     * When the encrypted data is persisted, a metadata object containing the digest of the
+     * encryption key is stored alongside the data. This digest is used to quickly determine
+     * the correct decryption key to use when reading the data.
+     */
+    decryptionKeys?: Uint8Array[];
+};
+/**
+ * Custom encryption settings for processing fields marked with `@encrypted`.
+ */
+export type CustomEncryption = {
+    /**
+     * Encryption function.
+     */
+    encrypt: (model: string, field: FieldInfo, plain: string) => Promise<string>;
+    /**
+     * Decryption function
+     */
+    decrypt: (model: string, field: FieldInfo, cipher: string) => Promise<string>;
+};