@zenstackhq/runtime 2.16.0 → 3.0.0-alpha.0

package/enhancements/node/policy/handler.js

@@ -1,1440 +0,0 @@
-"use strict";
-/* eslint-disable @typescript-eslint/no-explicit-any */
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-var __rest = (this && this.__rest) || function (s, e) {
-    var t = {};
-    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
-        t[p] = s[p];
-    if (s != null && typeof Object.getOwnPropertySymbols === "function")
-        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
-            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
-                t[p[i]] = s[p[i]];
-        }
-    return t;
-};
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.PolicyProxyHandler = void 0;
-const deepmerge_1 = __importDefault(require("deepmerge"));
-const zod_validation_error_1 = require("zod-validation-error");
-const constants_1 = require("../../../constants");
-const cross_1 = require("../../../cross");
-const local_helpers_1 = require("../../../local-helpers");
-const logger_1 = require("../logger");
-const promise_1 = require("../promise");
-const query_utils_1 = require("../query-utils");
-const utils_1 = require("../utils");
-const check_utils_1 = require("./check-utils");
-const policy_utils_1 = require("./policy-utils");
-/**
- * Prisma proxy handler for injecting access policy check.
- */
-class PolicyProxyHandler {
-    constructor(prisma, model, options, context) {
-        this.prisma = prisma;
-        this.options = options;
-        this.context = context;
-        this.logger = new logger_1.Logger(prisma);
-        this.model = (0, local_helpers_1.lowerCaseFirst)(model);
-        ({ modelMeta: this.modelMeta, prismaModule: this.prismaModule } = options);
-        this.policyUtils = new policy_utils_1.PolicyUtil(prisma, options, context, this.shouldLogQuery);
-        this.queryUtils = new query_utils_1.QueryUtils(prisma, options);
-    }
-    get modelClient() {
-        return this.prisma[this.model];
-    }
-    //#region Find
-    // find operations behaves as if the entities that don't match access policies don't exist
-    findUnique(args) {
-        if (!args) {
-            throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'query argument is required');
-        }
-        if (!args.where) {
-            throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'where field is required in query argument');
-        }
-        return this.findWithFluent('findUnique', args, () => null);
-    }
-    findUniqueOrThrow(args) {
-        if (!args) {
-            throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'query argument is required');
-        }
-        if (!args.where) {
-            throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'where field is required in query argument');
-        }
-        return this.findWithFluent('findUniqueOrThrow', args, () => {
-            throw this.policyUtils.notFound(this.model);
-        });
-    }
-    findFirst(args) {
-        return this.findWithFluent('findFirst', args, () => null);
-    }
-    findFirstOrThrow(args) {
-        return this.findWithFluent('findFirstOrThrow', args, () => {
-            throw this.policyUtils.notFound(this.model);
-        });
-    }
-    findMany(args) {
-        return (0, promise_1.createDeferredPromise)(() => this.doFind(args, 'findMany', () => []));
-    }
-    // make a find query promise with fluent API call stubs installed
-    findWithFluent(method, args, handleRejection) {
-        args = this.policyUtils.safeClone(args);
-        return (0, promise_1.createFluentPromise)(() => this.doFind(args, method, handleRejection), args, this.options.modelMeta, this.model);
-    }
-    doFind(args, actionName, handleRejection) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const origArgs = args;
-            const _args = this.policyUtils.safeClone(args);
-            if (!this.policyUtils.injectForRead(this.prisma, this.model, _args)) {
-                if (this.shouldLogQuery) {
-                    this.logger.info(`[policy] \`${actionName}\` ${this.model}: unconditionally denied`);
-                }
-                return handleRejection();
-            }
-            this.policyUtils.injectReadCheckSelect(this.model, _args);
-            if (this.shouldLogQuery) {
-                this.logger.info(`[policy] \`${actionName}\` ${this.model}:\n${(0, utils_1.formatObject)(_args)}`);
-            }
-            const result = yield this.modelClient[actionName](_args);
-            return this.policyUtils.postProcessForRead(result, this.model, origArgs);
-        });
-    }
-    //#endregion
-    //#region Create
-    create(args) {
-        if (!args) {
-            throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'query argument is required');
-        }
-        if (!args.data) {
-            throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'data field is required in query argument');
-        }
-        return (0, promise_1.createDeferredPromise)(() => __awaiter(this, void 0, void 0, function* () {
-            this.policyUtils.tryReject(this.prisma, this.model, 'create');
-            const origArgs = args;
-            args = this.policyUtils.safeClone(args);
-            // static input policy check for top-level create data
-            const inputCheck = this.policyUtils.checkInputGuard(this.model, args.data, 'create');
-            if (inputCheck === false) {
-                throw this.policyUtils.deniedByPolicy(this.model, 'create', undefined, constants_1.CrudFailureReason.ACCESS_POLICY_VIOLATION);
-            }
-            const hasNestedCreateOrConnect = yield this.hasNestedCreateOrConnect(args);
-            const { result, error } = yield this.queryUtils.transaction(this.prisma, (tx) => __awaiter(this, void 0, void 0, function* () {
-                if (
-                // MUST check true here since inputCheck can be undefined (meaning static input check not possible)
-                inputCheck === true &&
-                    // simple create: no nested create/connect
-                    !hasNestedCreateOrConnect) {
-                    // there's no nested write and we've passed input check, proceed with the create directly
-                    // validate zod schema if any
-                    args.data = this.validateCreateInputSchema(this.model, args.data);
-                    // make a create args only containing data and ID selection
-                    const createArgs = { data: args.data, select: this.policyUtils.makeIdSelection(this.model) };
-                    if (this.shouldLogQuery) {
-                        this.logger.info(`[policy] \`create\` ${this.model}: ${(0, utils_1.formatObject)(createArgs)}`);
-                    }
-                    const result = yield tx[this.model].create(createArgs);
-                    // filter the read-back data
-                    return this.policyUtils.readBack(tx, this.model, 'create', args, result);
-                }
-                else {
-                    // proceed with a complex create and collect post-write checks
-                    const { result, postWriteChecks } = yield this.doCreate(this.model, args, tx);
-                    // execute post-write checks
-                    yield this.runPostWriteChecks(postWriteChecks, tx);
-                    // filter the read-back data
-                    return this.policyUtils.readBack(tx, this.model, 'create', origArgs, result);
-                }
-            }));
-            if (error) {
-                throw error;
-            }
-            else {
-                return result;
-            }
-        }));
-    }
-    // create with nested write
-    doCreate(model, args, db) {
-        return __awaiter(this, void 0, void 0, function* () {
-            // record id fields involved in the nesting context
-            const idSelections = [];
-            const pushIdFields = (model, context) => {
-                const idFields = (0, cross_1.getIdFields)(this.modelMeta, model);
-                idSelections.push({
-                    path: context.nestingPath.map((p) => p.field).filter((f) => !!f),
-                    ids: idFields.map((f) => f.name),
-                });
-            };
-            // create a string key that uniquely identifies an entity
-            const getEntityKey = (model, ids) => `${(0, local_helpers_1.upperCaseFirst)(model)}#${Object.keys(ids)
-                .sort()
-                .map((f) => { var _a; return `${f}:${(_a = ids[f]) === null || _a === void 0 ? void 0 : _a.toString()}`; })
-                .join('_')}`;
-            // record keys of entities that are connected instead of created
-            const connectedEntities = new Set();
-            // visit the create payload
-            const visitor = new cross_1.NestedWriteVisitor(this.modelMeta, {
-                create: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                    const validateResult = this.validateCreateInputSchema(model, args);
-                    if (validateResult !== args) {
-                        this.policyUtils.replace(args, validateResult);
-                    }
-                    pushIdFields(model, context);
-                }),
-                createMany: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                    (0, cross_1.enumerate)(args.data).forEach((item) => {
-                        const r = this.validateCreateInputSchema(model, item);
-                        if (r !== item) {
-                            this.policyUtils.replace(item, r);
-                        }
-                    });
-                    pushIdFields(model, context);
-                }),
-                connectOrCreate: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                    var _a, _b;
-                    if (!args.where) {
-                        throw this.policyUtils.validationError(`'where' field is required for connectOrCreate`);
-                    }
-                    if (args.create) {
-                        args.create = this.validateCreateInputSchema(model, args.create);
-                    }
-                    const existing = yield this.policyUtils.checkExistence(db, model, args.where);
-                    if (existing) {
-                        // connect case
-                        if ((_a = context.field) === null || _a === void 0 ? void 0 : _a.backLink) {
-                            const backLinkField = (0, cross_1.resolveField)(this.modelMeta, model, context.field.backLink);
-                            if (backLinkField === null || backLinkField === void 0 ? void 0 : backLinkField.isRelationOwner) {
-                                // "connect" is actually "update" to foreign keys, so we need to map the "connect" payload
-                                // to "update" payload by translating pk to fks, and use that to check update policies
-                                const fieldsToUpdate = Object.values((_b = backLinkField.foreignKeyMapping) !== null && _b !== void 0 ? _b : {});
-                                yield this.policyUtils.checkPolicyForUnique(model, args.where, 'update', db, fieldsToUpdate);
-                            }
-                        }
-                        this.mergeToParent(context.parent, 'connect', args.where);
-                        // record the key of connected entities so we can avoid validating them later
-                        connectedEntities.add(getEntityKey(model, existing));
-                    }
-                    else {
-                        // create case
-                        pushIdFields(model, context);
-                        // create a new "create" clause at the parent level
-                        this.mergeToParent(context.parent, 'create', args.create);
-                    }
-                    // remove the connectOrCreate clause
-                    this.removeFromParent(context.parent, 'connectOrCreate', args);
-                    // return false to prevent visiting the nested payload
-                    return false;
-                }),
-                connect: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                    var _a, _b;
-                    if (!args || typeof args !== 'object' || Object.keys(args).length === 0) {
-                        throw this.policyUtils.validationError(`'connect' field must be an non-empty object`);
-                    }
-                    if ((_a = context.field) === null || _a === void 0 ? void 0 : _a.backLink) {
-                        const backLinkField = (0, cross_1.resolveField)(this.modelMeta, model, context.field.backLink);
-                        if (backLinkField === null || backLinkField === void 0 ? void 0 : backLinkField.isRelationOwner) {
-                            // check existence
-                            yield this.policyUtils.checkExistence(db, model, args, true);
-                            // the target side of relation owns the relation, check if it's updatable
-                            // "connect" is actually "update" to foreign keys, so we need to map the "connect" payload
-                            // to "update" payload by translating pk to fks, and use that to check update policies
-                            const fieldsToUpdate = Object.values((_b = backLinkField.foreignKeyMapping) !== null && _b !== void 0 ? _b : {});
-                            yield this.policyUtils.checkPolicyForUnique(model, args, 'update', db, fieldsToUpdate);
-                        }
-                    }
-                }),
-            });
-            yield visitor.visit(model, 'create', args);
-            // build the final "select" clause including all nested ID fields
-            let select = undefined;
-            if (idSelections.length > 0) {
-                select = {};
-                idSelections.forEach(({ path, ids }) => {
-                    let curr = select;
-                    for (const p of path) {
-                        if (!curr[p.name]) {
-                            curr[p.name] = { select: {} };
-                        }
-                        curr = curr[p.name].select;
-                    }
-                    Object.assign(curr, ...ids.map((f) => ({ [f]: true })));
-                });
-            }
-            // proceed with the create
-            const createArgs = { data: args.data, select };
-            if (this.shouldLogQuery) {
-                this.logger.info(`[policy] \`create\` ${model}: ${(0, utils_1.formatObject)(createArgs)}`);
-            }
-            const result = yield db[model].create(createArgs);
-            // post create policy check for the top-level and nested creates
-            const postCreateChecks = new Map();
-            // visit the create result and collect entities that need to be post-checked
-            const modelDataVisitor = new cross_1.ModelDataVisitor(this.modelMeta);
-            modelDataVisitor.visit(model, result, (model, _data, scalarData) => {
-                const key = getEntityKey(model, scalarData);
-                // only check if entity is created, not connected
-                if (!connectedEntities.has(key) && !postCreateChecks.has(key)) {
-                    const idFields = this.policyUtils.getIdFieldValues(model, scalarData);
-                    postCreateChecks.set(key, { model, operation: 'create', uniqueFilter: idFields });
-                }
-            });
-            // return only the ids of the top-level entity
-            const ids = this.policyUtils.getEntityIds(model, result);
-            return { result: ids, postWriteChecks: [...postCreateChecks.values()] };
-        });
-    }
-    // Checks if the given create payload has nested create or connect
-    hasNestedCreateOrConnect(args) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let hasNestedCreateOrConnect = false;
-            const visitor = new cross_1.NestedWriteVisitor(this.modelMeta, {
-                create(_model, _args, context) {
-                    return __awaiter(this, void 0, void 0, function* () {
-                        if (context.field) {
-                            hasNestedCreateOrConnect = true;
-                            return false;
-                        }
-                        else {
-                            return true;
-                        }
-                    });
-                },
-                connect() {
-                    return __awaiter(this, void 0, void 0, function* () {
-                        hasNestedCreateOrConnect = true;
-                        return false;
-                    });
-                },
-                connectOrCreate() {
-                    return __awaiter(this, void 0, void 0, function* () {
-                        hasNestedCreateOrConnect = true;
-                        return false;
-                    });
-                },
-                createMany() {
-                    return __awaiter(this, void 0, void 0, function* () {
-                        hasNestedCreateOrConnect = true;
-                        return false;
-                    });
-                },
-            });
-            yield visitor.visit(this.model, 'create', args);
-            return hasNestedCreateOrConnect;
-        });
-    }
-    // Validates the given create payload against Zod schema if any
-    validateCreateInputSchema(model, data) {
-        if (!data) {
-            return data;
-        }
-        return this.policyUtils.validateZodSchema(model, 'create', data, false, (err) => {
-            throw this.policyUtils.deniedByPolicy(model, 'create', `input failed validation: ${(0, zod_validation_error_1.fromZodError)(err)}`, constants_1.CrudFailureReason.DATA_VALIDATION_VIOLATION, err);
-        });
-    }
-    createMany(args) {
-        if (!args) {
-            throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'query argument is required');
-        }
-        if (!args.data) {
-            throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'data field is required in query argument');
-        }
-        return (0, promise_1.createDeferredPromise)(() => __awaiter(this, void 0, void 0, function* () {
-            this.policyUtils.tryReject(this.prisma, this.model, 'create');
-            args = this.policyUtils.safeClone(args);
-            // `createManyAndReturn` may need to be converted to regular `create`s
-            const shouldConvertToCreate = this.preprocessCreateManyPayload(args);
-            if (!shouldConvertToCreate) {
-                // direct `createMany`
-                return this.modelClient.createMany(args);
-            }
-            else {
-                // create entities in a transaction with post-create checks
-                return this.queryUtils.transaction(this.prisma, (tx) => __awaiter(this, void 0, void 0, function* () {
-                    const { result, postWriteChecks } = yield this.doCreateMany(this.model, args, tx, 'createMany');
-                    // post-create check
-                    yield this.runPostWriteChecks(postWriteChecks, tx);
-                    return { count: result.length };
-                }));
-            }
-        }));
-    }
-    createManyAndReturn(args) {
-        if (!args) {
-            throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'query argument is required');
-        }
-        if (!args.data) {
-            throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'data field is required in query argument');
-        }
-        return (0, promise_1.createDeferredPromise)(() => __awaiter(this, void 0, void 0, function* () {
-            var _a;
-            this.policyUtils.tryReject(this.prisma, this.model, 'create');
-            const origArgs = args;
-            args = this.policyUtils.safeClone(args);
-            // `createManyAndReturn` may need to be converted to regular `create`s
-            const shouldConvertToCreate = this.preprocessCreateManyPayload(args);
-            let result;
-            if (!shouldConvertToCreate) {
-                // direct `createManyAndReturn`, make sure we only select id fields for return
-                // so we can use the results directly for read-back check
-                const updatedArgs = Object.assign(Object.assign({}, args), { select: this.policyUtils.makeIdSelection(this.model), include: undefined });
-                const created = yield this.modelClient.createManyAndReturn(updatedArgs);
-                // process read-back
-                result = yield Promise.all(created.map((item) => this.policyUtils.readBack(this.prisma, this.model, 'create', origArgs, item)));
-            }
-            else {
-                // create entities in a transaction with post-create checks
-                result = yield this.queryUtils.transaction(this.prisma, (tx) => __awaiter(this, void 0, void 0, function* () {
-                    const { result: created, postWriteChecks } = yield this.doCreateMany(this.model, args, tx, 'createManyAndReturn');
-                    // post-create check
-                    yield this.runPostWriteChecks(postWriteChecks, tx);
-                    // process read-back
-                    return Promise.all(created.map((item) => this.policyUtils.readBack(tx, this.model, 'create', origArgs, item)));
-                }));
-            }
-            // throw read-back error if any of the create result read-back fails
-            const error = (_a = result.find((r) => !!r.error)) === null || _a === void 0 ? void 0 : _a.error;
-            if (error) {
-                throw error;
-            }
-            else {
-                return result.map((r) => r.result);
-            }
-        }));
-    }
-    /**
-     * Preprocess the payload of `createMany` and `createManyAndReturn` and update in place if needed.
-     * @returns `true` if the operation should be converted to regular `create`s; false otherwise.
-     */
-    preprocessCreateManyPayload(args) {
-        if (!args) {
-            return false;
-        }
-        // if post-create check is needed
-        const needPostCreateCheck = this.validateCreateInput(args);
-        // if the payload has any relation fields. Note that other enhancements (`withDefaultInAuth` for now)
-        // can introduce relation fields into the payload
-        let hasRelationFields = false;
-        if (args.data) {
-            hasRelationFields = this.hasRelationFieldsInPayload(this.model, args.data);
-        }
-        return needPostCreateCheck || hasRelationFields;
-    }
-    hasRelationFieldsInPayload(model, payload) {
-        const modelInfo = (0, cross_1.getModelInfo)(this.modelMeta, model);
-        if (!modelInfo) {
-            return false;
-        }
-        for (const item of (0, cross_1.enumerate)(payload)) {
-            for (const field of Object.keys(item)) {
-                const fieldInfo = (0, cross_1.resolveField)(this.modelMeta, model, field);
-                if (fieldInfo === null || fieldInfo === void 0 ? void 0 : fieldInfo.isDataModel) {
-                    return true;
-                }
-            }
-        }
-        return false;
-    }
-    validateCreateInput(args) {
-        let needPostCreateCheck = false;
-        for (const item of (0, cross_1.enumerate)(args.data)) {
-            const validationResult = this.validateCreateInputSchema(this.model, item);
-            if (validationResult !== item) {
-                this.policyUtils.replace(item, validationResult);
-            }
-            const inputCheck = this.policyUtils.checkInputGuard(this.model, item, 'create');
-            if (inputCheck === false) {
-                // unconditionally deny
-                throw this.policyUtils.deniedByPolicy(this.model, 'create', undefined, constants_1.CrudFailureReason.ACCESS_POLICY_VIOLATION);
-            }
-            else if (inputCheck === true) {
-                // unconditionally allow
-            }
-            else if (inputCheck === undefined) {
-                // static policy check is not possible, need to do post-create check
-                needPostCreateCheck = true;
-            }
-        }
-        return needPostCreateCheck;
-    }
-    doCreateMany(model, args, db, action) {
-        return __awaiter(this, void 0, void 0, function* () {
-            // We can't call the native "createMany" because we can't get back what was created
-            // for post-create checks. Instead, do a "create" for each item and collect the results.
-            let createResult = yield Promise.all((0, cross_1.enumerate)(args.data).map((item) => __awaiter(this, void 0, void 0, function* () {
-                if (args.skipDuplicates) {
-                    if (yield this.hasDuplicatedUniqueConstraint(model, item, undefined, db)) {
-                        if (this.shouldLogQuery) {
-                            this.logger.info(`[policy] \`createMany\` skipping duplicate ${(0, utils_1.formatObject)(item)}`);
-                        }
-                        return undefined;
-                    }
-                }
-                if (this.shouldLogQuery) {
-                    this.logger.info(`[policy] \`create\` for \`${action}\` ${model}: ${(0, utils_1.formatObject)(item)}`);
-                }
-                return yield db[model].create({ select: this.policyUtils.makeIdSelection(model), data: item });
-            })));
-            // filter undefined values due to skipDuplicates
-            createResult = createResult.filter((p) => !!p);
-            return {
-                result: createResult,
-                postWriteChecks: createResult.map((item) => ({
-                    model,
-                    operation: 'create',
-                    uniqueFilter: item,
-                })),
-            };
-        });
-    }
-    hasDuplicatedUniqueConstraint(model, createData, upstreamQuery, db) {
-        return __awaiter(this, void 0, void 0, function* () {
-            // check unique constraint conflicts
-            // we can't rely on try/catch/ignore constraint violation error: https://github.com/prisma/prisma/issues/20496
-            // TODO: for simple cases we should be able to translate it to an `upsert` with empty `update` payload
-            var _a;
-            // for each unique constraint, check if the input item has all fields set, and if so, check if
-            // an entity already exists, and ignore accordingly
-            const uniqueConstraints = this.policyUtils.getUniqueConstraints(model);
-            for (const constraint of Object.values(uniqueConstraints)) {
-                // the unique filter used to check existence
-                const uniqueFilter = {};
-                // unique constraint fields not covered yet
-                const remainingConstraintFields = new Set(constraint.fields);
-                // collect constraint fields from the create data
-                for (const [k, v] of Object.entries(createData)) {
-                    if (v === undefined) {
-                        continue;
-                    }
-                    if (remainingConstraintFields.has(k)) {
-                        uniqueFilter[k] = v;
-                        remainingConstraintFields.delete(k);
-                    }
-                }
-                // collect constraint fields from the upstream query
-                if (upstreamQuery) {
-                    for (const [k, v] of Object.entries(upstreamQuery)) {
-                        if (v === undefined) {
-                            continue;
-                        }
-                        if (remainingConstraintFields.has(k)) {
-                            uniqueFilter[k] = v;
-                            remainingConstraintFields.delete(k);
-                            continue;
-                        }
-                        // check if the upstream query contains a relation field which covers
-                        // a foreign key field constraint
-                        const fieldInfo = (0, cross_1.requireField)(this.modelMeta, model, k);
-                        if (!fieldInfo.isDataModel) {
-                            // only care about relation fields
-                            continue;
-                        }
-                        // merge the upstream query into the unique filter
-                        uniqueFilter[k] = v;
-                        // mark the corresponding foreign key fields as covered
-                        const fkMapping = (_a = fieldInfo.foreignKeyMapping) !== null && _a !== void 0 ? _a : {};
-                        for (const fk of Object.values(fkMapping)) {
-                            remainingConstraintFields.delete(fk);
-                        }
-                    }
-                }
-                if (remainingConstraintFields.size === 0) {
-                    // all constraint fields set, check existence
-                    const existing = yield this.policyUtils.checkExistence(db, model, uniqueFilter);
-                    if (existing) {
-                        return true;
-                    }
-                }
-            }
-            return false;
-        });
-    }
-    //#endregion
-    //#region Update & Upsert
-    // "update" and "upsert" work against unique entity, so we actively rejects the request if the
-    // entity fails policy check
-    //
-    // "updateMany" works against a set of entities, entities not passing policy check are silently
-    // ignored
-    update(args) {
-        if (!args) {
-            throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'query argument is required');
-        }
-        if (!args.where) {
-            throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'where field is required in query argument');
-        }
-        if (!args.data) {
-            throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'data field is required in query argument');
-        }
-        return (0, promise_1.createDeferredPromise)(() => __awaiter(this, void 0, void 0, function* () {
-            args = this.policyUtils.safeClone(args);
-            const { result, error } = yield this.queryUtils.transaction(this.prisma, (tx) => __awaiter(this, void 0, void 0, function* () {
-                // proceed with nested writes and collect post-write checks
-                const { result, postWriteChecks } = yield this.doUpdate(args, tx);
-                // post-write check
-                yield this.runPostWriteChecks(postWriteChecks, tx);
-                // filter the read-back data
-                return this.policyUtils.readBack(tx, this.model, 'update', args, result);
-            }));
-            if (error) {
-                throw error;
-            }
-            else {
-                return result;
-            }
-        }));
-    }
-    doUpdate(args, db) {
-        return __awaiter(this, void 0, void 0, function* () {
-            // collected post-update checks
-            const postWriteChecks = [];
-            // registers a post-update check task
-            const _registerPostUpdateCheck = (model, preUpdateLookupFilter, postUpdateLookupFilter) => __awaiter(this, void 0, void 0, function* () {
-                // both "post-update" rules and Zod schemas require a post-update check
-                if (this.policyUtils.hasAuthGuard(model, 'postUpdate') || this.policyUtils.getZodSchema(model)) {
-                    // select pre-update field values
-                    let preValue;
-                    const preValueSelect = this.policyUtils.getPreValueSelect(model);
-                    if (preValueSelect && Object.keys(preValueSelect).length > 0) {
-                        preValue = yield db[model].findFirst({ where: preUpdateLookupFilter, select: preValueSelect });
-                    }
-                    postWriteChecks.push({
-                        model,
-                        operation: 'postUpdate',
-                        uniqueFilter: postUpdateLookupFilter,
-                        preValue,
-                    });
-                }
-            });
-            // We can't let the native "update" to handle nested "create" because we can't get back what
-            // was created for doing post-update checks.
-            // Instead, handle nested create inside update as an atomic operation that creates an entire
-            // subtree (containing nested creates/connects)
-            const _create = (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                var _a;
-                let createData = args;
-                if ((_a = context.field) === null || _a === void 0 ? void 0 : _a.backLink) {
-                    // Check if the create payload contains any "unsafe" assignment:
-                    // assign id or foreign key fields.
-                    //
-                    // The reason why we need to do that is Prisma's mutations payload
-                    // structure has two mutually exclusive forms for safe and unsafe
-                    // operations. E.g.:
-                    //     - safe: { data: { user: { connect: { id: 1 }} } }
-                    //     - unsafe: { data: { userId: 1 } }
-                    const unsafe = (0, utils_1.isUnsafeMutate)(model, args, this.modelMeta);
-                    // handles the connection to upstream entity
-                    const reversedQuery = yield this.policyUtils.buildReversedQuery(db, context, true, unsafe);
-                    if ((!unsafe || context.field.isRelationOwner) && reversedQuery[context.field.backLink]) {
-                        // if mutation is safe, or current field owns the relation (so the other side has no fk),
-                        // and the reverse query contains the back link, then we can build a "connect" with it
-                        createData = Object.assign(Object.assign({}, createData), { [context.field.backLink]: {
-                                connect: reversedQuery[context.field.backLink],
-                            } });
-                    }
-                    else {
-                        // otherwise, the reverse query should be translated to foreign key setting
-                        // and merged to the create data
-                        const backLinkField = this.requireBackLink(context.field);
-                        (0, local_helpers_1.invariant)(backLinkField.foreignKeyMapping);
-                        // try to extract foreign key values from the reverse query
-                        let fkValues = Object.values(backLinkField.foreignKeyMapping).reduce((obj, fk) => {
-                            obj[fk] = reversedQuery[fk];
-                            return obj;
-                        }, {});
-                        if (Object.values(fkValues).every((v) => v !== undefined)) {
-                            // all foreign key values are available, merge them to the create data
-                            createData = Object.assign(Object.assign({}, createData), fkValues);
-                        }
-                        else {
-                            // some foreign key values are missing, need to look up the upstream entity,
-                            // this can happen when the upstream entity doesn't have a unique where clause,
-                            // for example when it's nested inside a one-to-one update
-                            const upstreamQuery = {
-                                where: reversedQuery[backLinkField.name],
-                                select: this.policyUtils.makeIdSelection(backLinkField.type),
-                            };
-                            // fetch the upstream entity
-                            if (this.shouldLogQuery) {
-                                this.logger.info(`[policy] \`findUniqueOrThrow\` ${model}: looking up upstream entity of ${backLinkField.type}, ${(0, utils_1.formatObject)(upstreamQuery)}`);
-                            }
-                            const upstreamEntity = yield this.prisma[backLinkField.type].findUniqueOrThrow(upstreamQuery);
-                            // map ids to foreign keys
-                            fkValues = Object.entries(backLinkField.foreignKeyMapping).reduce((obj, [id, fk]) => {
-                                obj[fk] = upstreamEntity[id];
-                                return obj;
-                            }, {});
-                            // merge them to the create data
-                            createData = Object.assign(Object.assign({}, createData), fkValues);
-                        }
-                    }
-                }
-                // proceed with the create and collect post-create checks
-                const { postWriteChecks: checks, result } = yield this.doCreate(model, { data: createData }, db);
-                postWriteChecks.push(...checks);
-                return result;
-            });
-            const _createMany = (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                for (const item of (0, cross_1.enumerate)(args.data)) {
-                    if (args.skipDuplicates) {
-                        // get a reversed query to include fields inherited from upstream mutation,
-                        // it'll be merged with the create payload for unique constraint checking
-                        const upstreamQuery = yield this.policyUtils.buildReversedQuery(db, context);
-                        if (yield this.hasDuplicatedUniqueConstraint(model, item, upstreamQuery, db)) {
-                            if (this.shouldLogQuery) {
-                                this.logger.info(`[policy] \`createMany\` skipping duplicate ${(0, utils_1.formatObject)(item)}`);
-                            }
-                            continue;
-                        }
-                    }
-                    yield _create(model, item, context);
-                }
-            });
-            const _connectDisconnect = (model, args, context, operation) => __awaiter(this, void 0, void 0, function* () {
-                var _a, _b;
-                if ((_a = context.field) === null || _a === void 0 ? void 0 : _a.backLink) {
-                    const backLinkField = this.policyUtils.getModelField(model, context.field.backLink);
-                    if (backLinkField === null || backLinkField === void 0 ? void 0 : backLinkField.isRelationOwner) {
-                        let uniqueFilter = args;
-                        if (operation === 'disconnect') {
-                            // disconnect filter is not unique, need to build a reversed query to
-                            // locate the entity and use its id fields as unique filter
-                            const reversedQuery = yield this.policyUtils.buildReversedQuery(db, context);
-                            const found = yield db[model].findUnique({
-                                where: reversedQuery,
-                                select: this.policyUtils.makeIdSelection(model),
-                            });
-                            uniqueFilter = found && this.policyUtils.getIdFieldValues(model, found);
-                        }
-                        // update happens on the related model, require updatable,
-                        // `uniqueFilter` can be undefined if the entity to be disconnected doesn't exist
-                        if (uniqueFilter) {
-                            // check for update, "connect" and "disconnect" are actually "update" to foreign keys
-                            const fieldsToUpdate = Object.values((_b = backLinkField.foreignKeyMapping) !== null && _b !== void 0 ? _b : {});
-                            yield this.policyUtils.checkPolicyForUnique(model, uniqueFilter, 'update', db, fieldsToUpdate);
-                            // register post-update check
-                            yield _registerPostUpdateCheck(model, uniqueFilter, uniqueFilter);
-                        }
-                    }
-                }
-            });
-            // visit nested writes
-            const visitor = new cross_1.NestedWriteVisitor(this.modelMeta, {
-                update: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                    var _a;
-                    // build a unique query including upstream conditions
-                    const uniqueFilter = yield this.policyUtils.buildReversedQuery(db, context);
-                    // handle not-found
-                    const existing = yield this.policyUtils.checkExistence(db, model, uniqueFilter, true);
-                    // check if the update actually writes to this model
-                    let thisModelUpdate = false;
-                    const updatePayload = (_a = args.data) !== null && _a !== void 0 ? _a : args;
-                    const validatedPayload = this.validateUpdateInputSchema(model, updatePayload);
-                    if (validatedPayload !== updatePayload) {
-                        this.policyUtils.replace(updatePayload, validatedPayload);
-                    }
-                    if (updatePayload) {
-                        for (const key of Object.keys(updatePayload)) {
-                            const field = (0, cross_1.resolveField)(this.modelMeta, model, key);
-                            if (field) {
-                                if (!field.isDataModel) {
-                                    // scalar field, require this model to be updatable
-                                    thisModelUpdate = true;
-                                    break;
-                                }
-                                else if (field.isRelationOwner) {
-                                    // relation is being updated and this model owns foreign key, require updatable
-                                    thisModelUpdate = true;
-                                    break;
-                                }
-                            }
-                        }
-                    }
-                    if (thisModelUpdate) {
-                        this.policyUtils.tryReject(db, this.model, 'update');
-                        // check pre-update guard
-                        yield this.policyUtils.checkPolicyForUnique(model, uniqueFilter, 'update', db, this.queryUtils.getFieldsWithDefinedValues(updatePayload));
-                        // handle the case where id fields are updated
-                        const _args = args;
-                        const checkPayload = _args.data && typeof _args.data === 'object' ? _args.data : _args;
-                        const postUpdateIds = this.calculatePostUpdateIds(model, existing, checkPayload);
-                        // register post-update check
-                        yield _registerPostUpdateCheck(model, existing, postUpdateIds);
-                    }
-                }),
-                updateMany: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                    // prepare for post-update check
-                    if (this.policyUtils.hasAuthGuard(model, 'postUpdate') || this.policyUtils.getZodSchema(model)) {
-                        let select = this.policyUtils.makeIdSelection(model);
-                        const preValueSelect = this.policyUtils.getPreValueSelect(model);
-                        if (preValueSelect) {
-                            select = Object.assign(Object.assign({}, select), preValueSelect);
-                        }
-                        const reversedQuery = yield this.policyUtils.buildReversedQuery(db, context);
-                        const currentSetQuery = { select, where: reversedQuery };
-                        this.policyUtils.injectAuthGuardAsWhere(db, currentSetQuery, model, 'read');
-                        if (this.shouldLogQuery) {
-                            this.logger.info(`[policy] \`findMany\` for post update check ${model}:\n${(0, utils_1.formatObject)(currentSetQuery)}`);
-                        }
-                        const currentSet = yield db[model].findMany(currentSetQuery);
-                        postWriteChecks.push(...currentSet.map((preValue) => ({
-                            model,
-                            operation: 'postUpdate',
-                            uniqueFilter: preValue,
-                            preValue: preValueSelect ? preValue : undefined,
-                        })));
-                    }
-                    args.data = this.validateUpdateInputSchema(model, args.data);
-                    const updateGuard = this.policyUtils.getAuthGuard(db, model, 'update');
-                    if (this.policyUtils.isTrue(updateGuard) || this.policyUtils.isFalse(updateGuard)) {
-                        // injects simple auth guard into where clause
-                        this.policyUtils.injectAuthGuardAsWhere(db, args, model, 'update');
-                    }
-                    else {
-                        // we have to process `updateMany` separately because the guard may contain
-                        // filters using relation fields which are not allowed in nested `updateMany`
-                        const reversedQuery = yield this.policyUtils.buildReversedQuery(db, context);
-                        const updateWhere = this.policyUtils.and(reversedQuery, updateGuard);
-                        if (this.shouldLogQuery) {
-                            this.logger.info(`[policy] \`updateMany\` ${model}:\n${(0, utils_1.formatObject)({
-                                where: updateWhere,
-                                data: args.data,
-                            })}`);
-                        }
-                        yield db[model].updateMany({ where: updateWhere, data: args.data });
-                        delete context.parent.updateMany;
-                    }
-                }),
-                create: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                    // process the entire create subtree separately
-                    yield _create(model, args, context);
-                    // remove it from the update payload
-                    this.removeFromParent(context.parent, 'create', args);
-                    // don't visit payload
-                    return false;
-                }),
-                createMany: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                    // process createMany separately
-                    yield _createMany(model, args, context);
-                    // remove it from the update payload
-                    delete context.parent.createMany;
-                    // don't visit payload
-                    return false;
-                }),
-                upsert: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                    var _a;
-                    // build a unique query including upstream conditions
-                    const uniqueFilter = yield this.policyUtils.buildReversedQuery(db, context);
-                    // branch based on if the update target exists
-                    const existing = yield this.policyUtils.checkExistence(db, model, uniqueFilter);
-                    if (existing) {
-                        // update case
-                        // check pre-update guard
-                        yield this.policyUtils.checkPolicyForUnique(model, existing, 'update', db, this.queryUtils.getFieldsWithDefinedValues(args.update));
-                        // handle the case where id fields are updated
-                        const postUpdateIds = this.calculatePostUpdateIds(model, existing, args.update);
-                        // register post-update check
-                        yield _registerPostUpdateCheck(model, existing, postUpdateIds);
-                        // convert upsert to update
-                        const convertedUpdate = {
-                            where: (_a = args.where) !== null && _a !== void 0 ? _a : {},
-                            data: this.validateUpdateInputSchema(model, args.update),
-                        };
-                        this.mergeToParent(context.parent, 'update', convertedUpdate);
-                        this.removeFromParent(context.parent, 'upsert', args);
-                        // continue visiting the new payload
-                        return convertedUpdate;
-                    }
-                    else {
-                        // create case
-                        // process the entire create subtree separately
-                        yield _create(model, args.create, context);
-                        // remove it from the update payload
-                        this.removeFromParent(context.parent, 'upsert', args);
-                        // don't visit payload
-                        return false;
-                    }
-                }),
-                connect: (model, args, context) => __awaiter(this, void 0, void 0, function* () { return _connectDisconnect(model, args, context, 'connect'); }),
-                connectOrCreate: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                    // the where condition is already unique, so we can use it to check if the target exists
-                    const existing = yield this.policyUtils.checkExistence(db, model, args.where);
-                    if (existing) {
-                        // connect
-                        yield _connectDisconnect(model, args.where, context, 'connect');
-                        return true;
-                    }
-                    else {
-                        // create
-                        const created = yield _create(model, args.create, context);
-                        const upperContext = context.nestingPath[context.nestingPath.length - 2];
-                        if ((upperContext === null || upperContext === void 0 ? void 0 : upperContext.where) && context.field) {
-                            // check if the where clause of the upper context references the id
-                            // of the connected entity, if so, we need to update it
-                            this.overrideForeignKeyFields(upperContext.model, upperContext.where, context.field, created);
-                        }
-                        // remove the payload from the parent
-                        this.removeFromParent(context.parent, 'connectOrCreate', args);
-                        return false;
-                    }
-                }),
-                disconnect: (model, args, context) => __awaiter(this, void 0, void 0, function* () { return _connectDisconnect(model, args, context, 'disconnect'); }),
-                set: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                    // find the set of items to be replaced
-                    const reversedQuery = yield this.policyUtils.buildReversedQuery(db, context);
-                    const findCurrSetArgs = {
-                        select: this.policyUtils.makeIdSelection(model),
-                        where: reversedQuery,
-                    };
-                    if (this.shouldLogQuery) {
-                        this.logger.info(`[policy] \`findMany\` ${model}:\n${(0, utils_1.formatObject)(findCurrSetArgs)}`);
-                    }
-                    const currentSet = yield db[model].findMany(findCurrSetArgs);
-                    // register current set for update (foreign key)
-                    yield Promise.all(currentSet.map((item) => _connectDisconnect(model, item, context, 'disconnect')));
-                    // proceed with connecting the new set
-                    yield Promise.all((0, cross_1.enumerate)(args).map((item) => _connectDisconnect(model, item, context, 'connect')));
-                }),
-                delete: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                    // build a unique query including upstream conditions
-                    const uniqueFilter = yield this.policyUtils.buildReversedQuery(db, context);
-                    // handle not-found
-                    yield this.policyUtils.checkExistence(db, model, uniqueFilter, true);
-                    // check delete guard
-                    yield this.policyUtils.checkPolicyForUnique(model, uniqueFilter, 'delete', db, []);
-                }),
-                deleteMany: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                    const guard = yield this.policyUtils.getAuthGuard(db, model, 'delete');
-                    if (this.policyUtils.isTrue(guard) || this.policyUtils.isFalse(guard)) {
-                        // inject simple auth guard
-                        context.parent.deleteMany = this.policyUtils.and(args, guard);
-                    }
-                    else {
-                        // we have to process `deleteMany` separately because the guard may contain
-                        // filters using relation fields which are not allowed in nested `deleteMany`
-                        const reversedQuery = yield this.policyUtils.buildReversedQuery(db, context);
-                        const deleteWhere = this.policyUtils.and(reversedQuery, guard);
-                        if (this.shouldLogQuery) {
-                            this.logger.info(`[policy] \`deleteMany\` ${model}:\n${(0, utils_1.formatObject)({ where: deleteWhere })}`);
-                        }
-                        yield db[model].deleteMany({ where: deleteWhere });
-                        delete context.parent.deleteMany;
-                    }
-                }),
-            });
-            yield visitor.visit(this.model, 'update', args);
-            // finally proceed with the update
-            if (this.shouldLogQuery) {
-                this.logger.info(`[policy] \`update\` ${this.model}: ${(0, utils_1.formatObject)(args)}`);
-            }
-            const result = yield db[this.model].update({
-                where: args.where,
-                data: args.data,
-                select: this.policyUtils.makeIdSelection(this.model),
-            });
-            return { result, postWriteChecks };
-        });
-    }
-    // calculate id fields used for post-update check given an update payload
-    calculatePostUpdateIds(_model, currentIds, updatePayload) {
-        const result = this.policyUtils.safeClone(currentIds);
-        for (const key of Object.keys(currentIds)) {
-            const updateValue = updatePayload[key];
-            if (typeof updateValue === 'string' || typeof updateValue === 'number' || typeof updateValue === 'bigint') {
-                result[key] = updateValue;
-            }
-        }
-        return result;
-    }
-    // updates foreign key fields inside `payload` based on relation id fields in `newIds`
-    overrideForeignKeyFields(model, payload, relation, newIds) {
-        if (!relation.foreignKeyMapping || Object.keys(relation.foreignKeyMapping).length === 0) {
-            return;
-        }
-        // override foreign key values
-        for (const [id, fk] of Object.entries(relation.foreignKeyMapping)) {
-            if (payload[fk] !== undefined && newIds[id] !== undefined) {
-                payload[fk] = newIds[id];
-            }
-        }
-        // deal with compound id fields
-        const uniqueConstraints = this.policyUtils.getUniqueConstraints(model);
-        for (const [name, constraint] of Object.entries(uniqueConstraints)) {
-            if (constraint.fields.length > 1) {
-                const target = payload[name];
-                if (target) {
-                    for (const [id, fk] of Object.entries(relation.foreignKeyMapping)) {
-                        if (target[fk] !== undefined && newIds[id] !== undefined) {
-                            target[fk] = newIds[id];
-                        }
-                    }
-                }
-            }
-        }
-    }
-    // Validates the given update payload against Zod schema if any
-    validateUpdateInputSchema(model, data) {
-        if (!data) {
-            return data;
-        }
-        // update payload can contain non-literal fields, like:
-        //   { x: { increment: 1 } }
-        // we should only validate literal fields
-        const literalData = Object.entries(data).reduce((acc, [k, v]) => (Object.assign(Object.assign({}, acc), (typeof v !== 'object' ? { [k]: v } : {}))), {});
-        const validatedData = this.policyUtils.validateZodSchema(model, 'update', literalData, false, (err) => {
-            throw this.policyUtils.deniedByPolicy(model, 'update', `input failed validation: ${(0, zod_validation_error_1.fromZodError)(err)}`, constants_1.CrudFailureReason.DATA_VALIDATION_VIOLATION, err);
-        });
-        // schema may have transformed field values, use it to overwrite the original data
-        return Object.assign(Object.assign({}, data), validatedData);
-    }
-    updateMany(args) {
-        return this.doUpdateMany(args, 'updateMany');
-    }
-    updateManyAndReturn(args) {
-        return this.doUpdateMany(args, 'updateManyAndReturn');
-    }
-    doUpdateMany(args, action) {
-        if (!args) {
-            throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'query argument is required');
-        }
-        if (!args.data) {
-            throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'data field is required in query argument');
-        }
-        return (0, promise_1.createDeferredPromise)(() => __awaiter(this, void 0, void 0, function* () {
-            var _a, _b;
-            this.policyUtils.tryReject(this.prisma, this.model, 'update');
-            const origArgs = args;
-            args = this.policyUtils.safeClone(args);
-            this.policyUtils.injectAuthGuardAsWhere(this.prisma, args, this.model, 'update');
-            args.data = this.validateUpdateInputSchema(this.model, args.data);
-            const entityChecker = this.policyUtils.getEntityChecker(this.model, 'update');
-            const canProceedWithoutTransaction = 
-            // no post-update rules
-            !this.policyUtils.hasAuthGuard(this.model, 'postUpdate') &&
-                // no Zod schema
-                !this.policyUtils.getZodSchema(this.model) &&
-                // no entity checker
-                !entityChecker;
-            if (canProceedWithoutTransaction) {
-                // proceed without a transaction
-                if (this.shouldLogQuery) {
-                    this.logger.info(`[policy] \`updateMany\` ${this.model}: ${(0, utils_1.formatObject)(args)}`);
-                }
-                if (action === 'updateMany') {
-                    return this.modelClient.updateMany(args);
-                }
-                else {
-                    // make sure only id fields are returned so we can directly use the result
-                    // for read-back check
-                    const updatedArg = Object.assign(Object.assign({}, args), { select: this.policyUtils.makeIdSelection(this.model), include: undefined });
-                    const updated = yield this.modelClient.updateManyAndReturn(updatedArg);
-                    // process read-back
-                    const result = yield Promise.all(updated.map((item) => this.policyUtils.readBack(this.prisma, this.model, 'update', origArgs, item)));
-                    // throw read-back error if any of create result read-back fails
-                    const error = (_a = result.find((r) => !!r.error)) === null || _a === void 0 ? void 0 : _a.error;
-                    if (error) {
-                        throw error;
-                    }
-                    else {
-                        return result.map((r) => r.result);
-                    }
-                }
-            }
-            // collect post-update checks
-            const postWriteChecks = [];
-            const result = yield this.queryUtils.transaction(this.prisma, (tx) => __awaiter(this, void 0, void 0, function* () {
-                // collect pre-update values
-                let select = this.policyUtils.makeIdSelection(this.model);
-                const preValueSelect = this.policyUtils.getPreValueSelect(this.model);
-                if (preValueSelect) {
-                    select = Object.assign(Object.assign({}, select), preValueSelect);
-                }
-                // merge selection required for running additional checker
-                const entityChecker = this.policyUtils.getEntityChecker(this.model, 'update');
-                if (entityChecker === null || entityChecker === void 0 ? void 0 : entityChecker.selector) {
-                    select = (0, deepmerge_1.default)(select, entityChecker.selector);
-                }
-                const currentSetQuery = { select, where: args.where };
-                this.policyUtils.injectAuthGuardAsWhere(tx, currentSetQuery, this.model, 'update');
-                if (this.shouldLogQuery) {
-                    this.logger.info(`[policy] \`findMany\` ${this.model}: ${(0, utils_1.formatObject)(currentSetQuery)}`);
-                }
-                let candidates = yield tx[this.model].findMany(currentSetQuery);
-                if (entityChecker) {
-                    // filter candidates with additional checker and build an id filter
-                    const r = this.buildIdFilterWithEntityChecker(candidates, entityChecker.func);
-                    candidates = r.filteredCandidates;
-                    // merge id filter into update's where clause
-                    args.where = args.where ? { AND: [args.where, r.idFilter] } : r.idFilter;
-                }
-                postWriteChecks.push(...candidates.map((preValue) => ({
-                    model: this.model,
-                    operation: 'postUpdate',
-                    uniqueFilter: this.policyUtils.getEntityIds(this.model, preValue),
-                    preValue: preValueSelect ? preValue : undefined,
-                })));
-                // proceed with the update
-                if (this.shouldLogQuery) {
-                    this.logger.info(`[policy] \`updateMany\` in tx for ${this.model}: ${(0, utils_1.formatObject)(args)}`);
-                }
-                if (action === 'updateMany') {
-                    const result = yield tx[this.model].updateMany(args);
-                    // run post-write checks
-                    yield this.runPostWriteChecks(postWriteChecks, tx);
-                    return result;
-                }
-                else {
-                    // make sure only id fields are returned so we can directly use the result
-                    // for read-back check
-                    const updatedArg = Object.assign(Object.assign({}, args), { select: this.policyUtils.makeIdSelection(this.model), include: undefined });
-                    const result = yield tx[this.model].updateManyAndReturn(updatedArg);
-                    // run post-write checks
-                    yield this.runPostWriteChecks(postWriteChecks, tx);
-                    return result;
-                }
-            }));
-            if (action === 'updateMany') {
-                // no further processing needed
-                return result;
-            }
-            else {
-                // process read-back
-                const readBackResult = yield Promise.all(result.map((item) => this.policyUtils.readBack(this.prisma, this.model, 'update', origArgs, item)));
-                // throw read-back error if any of the update result read-back fails
-                const error = (_b = readBackResult.find((r) => !!r.error)) === null || _b === void 0 ? void 0 : _b.error;
-                if (error) {
-                    throw error;
-                }
-                else {
-                    return readBackResult.map((r) => r.result);
-                }
-            }
-        }));
-    }
-    upsert(args) {
-        if (!args) {
-            throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'query argument is required');
-        }
-        if (!args.where) {
-            throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'where field is required in query argument');
-        }
-        if (!args.create) {
-            throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'create field is required in query argument');
-        }
-        if (!args.update) {
-            throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'update field is required in query argument');
-        }
-        return (0, promise_1.createDeferredPromise)(() => __awaiter(this, void 0, void 0, function* () {
-            this.policyUtils.tryReject(this.prisma, this.model, 'create');
-            this.policyUtils.tryReject(this.prisma, this.model, 'update');
-            args = this.policyUtils.safeClone(args);
-            // We can call the native "upsert" because we can't tell if an entity was created or updated
-            // for doing post-write check accordingly. Instead, decompose it into create or update.
-            const { result, error } = yield this.queryUtils.transaction(this.prisma, (tx) => __awaiter(this, void 0, void 0, function* () {
-                const { where, create, update } = args, rest = __rest(args, ["where", "create", "update"]);
-                const existing = yield this.policyUtils.checkExistence(tx, this.model, where);
-                if (existing) {
-                    // update case
-                    const { result, postWriteChecks } = yield this.doUpdate(Object.assign({ where: this.policyUtils.composeCompoundUniqueField(this.model, existing), data: update }, rest), tx);
-                    yield this.runPostWriteChecks(postWriteChecks, tx);
-                    return this.policyUtils.readBack(tx, this.model, 'update', args, result);
-                }
-                else {
-                    // create case
-                    const { result, postWriteChecks } = yield this.doCreate(this.model, Object.assign({ data: create }, rest), tx);
-                    yield this.runPostWriteChecks(postWriteChecks, tx);
-                    return this.policyUtils.readBack(tx, this.model, 'create', args, result);
-                }
-            }));
-            if (error) {
-                throw error;
-            }
-            else {
-                return result;
-            }
-        }));
-    }
-    //#endregion
-    //#region Delete
-    // "delete" works against a single entity, and is rejected if the entity fails policy check.
-    // "deleteMany" works against a set of entities, entities that fail policy check are filtered out.
-    delete(args) {
-        if (!args) {
-            throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'query argument is required');
-        }
-        if (!args.where) {
-            throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'where field is required in query argument');
-        }
-        return (0, promise_1.createDeferredPromise)(() => __awaiter(this, void 0, void 0, function* () {
-            this.policyUtils.tryReject(this.prisma, this.model, 'delete');
-            const { result, error } = yield this.queryUtils.transaction(this.prisma, (tx) => __awaiter(this, void 0, void 0, function* () {
-                // do a read-back before delete
-                const r = yield this.policyUtils.readBack(tx, this.model, 'delete', args, args.where);
-                const error = r.error;
-                const read = r.result;
-                // check existence
-                yield this.policyUtils.checkExistence(tx, this.model, args.where, true);
-                // inject delete guard
-                yield this.policyUtils.checkPolicyForUnique(this.model, args.where, 'delete', tx, []);
-                // proceed with the deletion
-                if (this.shouldLogQuery) {
-                    this.logger.info(`[policy] \`delete\` ${this.model}:\n${(0, utils_1.formatObject)(args)}`);
-                }
-                yield tx[this.model].delete(args);
-                return { result: read, error };
-            }));
-            if (error) {
-                throw error;
-            }
-            else {
-                return result;
-            }
-        }));
-    }
-    deleteMany(args) {
-        return (0, promise_1.createDeferredPromise)(() => {
-            this.policyUtils.tryReject(this.prisma, this.model, 'delete');
-            // inject policy conditions
-            args = this.policyUtils.safeClone(args);
-            this.policyUtils.injectAuthGuardAsWhere(this.prisma, args, this.model, 'delete');
-            const entityChecker = this.policyUtils.getEntityChecker(this.model, 'delete');
-            if (entityChecker) {
-                // additional checker exists, need to run deletion inside a transaction
-                return this.queryUtils.transaction(this.prisma, (tx) => __awaiter(this, void 0, void 0, function* () {
-                    var _a, _b;
-                    // find the delete candidates, selecting id fields and fields needed for
-                    // running the additional checker
-                    let candidateSelect = this.policyUtils.makeIdSelection(this.model);
-                    if (entityChecker.selector) {
-                        candidateSelect = (0, deepmerge_1.default)(candidateSelect, entityChecker.selector);
-                    }
-                    if (this.shouldLogQuery) {
-                        this.logger.info(`[policy] \`findMany\` ${this.model}: ${(0, utils_1.formatObject)({
-                            where: (_a = args.where) !== null && _a !== void 0 ? _a : {},
-                            select: candidateSelect,
-                        })}`);
-                    }
-                    const candidates = yield tx[this.model].findMany({
-                        where: (_b = args.where) !== null && _b !== void 0 ? _b : {},
-                        select: candidateSelect,
-                    });
-                    // build a ID filter based on id values filtered by the additional checker
-                    const { idFilter } = this.buildIdFilterWithEntityChecker(candidates, entityChecker.func);
-                    // merge the ID filter into the where clause
-                    args.where = args.where ? { AND: [args.where, idFilter] } : idFilter;
-                    // finally, conduct the deletion with the combined where clause
-                    if (this.shouldLogQuery) {
-                        this.logger.info(`[policy] \`deleteMany\` in tx for ${this.model}:\n${(0, utils_1.formatObject)(args)}`);
-                    }
-                    return tx[this.model].deleteMany(args);
-                }));
-            }
-            else {
-                // conduct the deletion directly
-                if (this.shouldLogQuery) {
-                    this.logger.info(`[policy] \`deleteMany\` ${this.model}:\n${(0, utils_1.formatObject)(args)}`);
-                }
-                return this.modelClient.deleteMany(args);
-            }
-        });
-    }
-    //#endregion
-    //#region Aggregation
-    aggregate(args) {
-        if (!args) {
-            throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'query argument is required');
-        }
-        return (0, promise_1.createDeferredPromise)(() => {
-            args = this.policyUtils.safeClone(args);
-            // inject policy conditions
-            this.policyUtils.injectAuthGuardAsWhere(this.prisma, args, this.model, 'read');
-            if (this.shouldLogQuery) {
-                this.logger.info(`[policy] \`aggregate\` ${this.model}:\n${(0, utils_1.formatObject)(args)}`);
-            }
-            return this.modelClient.aggregate(args);
-        });
-    }
-    groupBy(args) {
-        if (!args) {
-            throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'query argument is required');
-        }
-        return (0, promise_1.createDeferredPromise)(() => {
-            args = this.policyUtils.safeClone(args);
-            // inject policy conditions
-            this.policyUtils.injectAuthGuardAsWhere(this.prisma, args, this.model, 'read');
-            if (this.shouldLogQuery) {
-                this.logger.info(`[policy] \`groupBy\` ${this.model}:\n${(0, utils_1.formatObject)(args)}`);
-            }
-            return this.modelClient.groupBy(args);
-        });
-    }
-    count(args) {
-        return (0, promise_1.createDeferredPromise)(() => {
-            // inject policy conditions
-            args = args ? this.policyUtils.safeClone(args) : {};
-            this.policyUtils.injectAuthGuardAsWhere(this.prisma, args, this.model, 'read');
-            if (this.shouldLogQuery) {
-                this.logger.info(`[policy] \`count\` ${this.model}:\n${(0, utils_1.formatObject)(args)}`);
-            }
-            return this.modelClient.count(args);
-        });
-    }
-    //#endregion
-    //#region Prisma Pulse
-    subscribe(args) {
-        return this.handleSubscribeStream('subscribe', args);
-    }
-    stream(args) {
-        return this.handleSubscribeStream('stream', args);
-    }
-    handleSubscribeStream(action, args) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (!args) {
-                // include all
-                args = { create: {}, update: {}, delete: {} };
-            }
-            else {
-                if (typeof args !== 'object') {
-                    throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'argument must be an object');
-                }
-                args = this.policyUtils.safeClone(args);
-            }
-            // inject read guard as subscription filter
-            for (const key of ['create', 'update', 'delete']) {
-                if (args[key] === undefined) {
-                    continue;
-                }
-                // "update" has an extra layer of "after"
-                const payload = key === 'update' ? args[key].after : args[key];
-                const toInject = { where: payload };
-                this.policyUtils.injectForRead(this.prisma, this.model, toInject);
-                if (key === 'update') {
-                    // "update" has an extra layer of "after"
-                    args[key].after = toInject.where;
-                }
-                else {
-                    args[key] = toInject.where;
-                }
-            }
-            if (this.shouldLogQuery) {
-                this.logger.info(`[policy] \`${action}\` ${this.model}:\n${(0, utils_1.formatObject)(args)}`);
-            }
-            // Prisma Pulse returns an async iterable, which we need to wrap
-            // and post-process the iteration results
-            const iterable = yield this.modelClient[action](args);
-            return {
-                [Symbol.asyncIterator]: () => {
-                    const iter = iterable[Symbol.asyncIterator].bind(iterable)();
-                    return {
-                        next: () => __awaiter(this, void 0, void 0, function* () {
-                            const { done, value } = yield iter.next();
-                            let processedValue = value;
-                            if (value && 'action' in value) {
-                                switch (value.action) {
-                                    case 'create':
-                                        if ('created' in value) {
-                                            processedValue = Object.assign(Object.assign({}, value), { created: this.policyUtils.postProcessForRead(value.created, this.model, {}) });
-                                        }
-                                        break;
-                                    case 'update':
-                                        if ('before' in value) {
-                                            processedValue = Object.assign(Object.assign({}, value), { before: this.policyUtils.postProcessForRead(value.before, this.model, {}) });
-                                        }
-                                        if ('after' in value) {
-                                            processedValue = Object.assign(Object.assign({}, value), { after: this.policyUtils.postProcessForRead(value.after, this.model, {}) });
-                                        }
-                                        break;
-                                    case 'delete':
-                                        if ('deleted' in value) {
-                                            processedValue = Object.assign(Object.assign({}, value), { deleted: this.policyUtils.postProcessForRead(value.deleted, this.model, {}) });
-                                        }
-                                        break;
-                                }
-                            }
-                            return { done, value: processedValue };
-                        }),
-                        return: () => { var _a; return (_a = iter.return) === null || _a === void 0 ? void 0 : _a.call(iter); },
-                        throw: () => { var _a; return (_a = iter.throw) === null || _a === void 0 ? void 0 : _a.call(iter); },
-                    };
-                },
-            };
-        });
-    }
-    //#endregion
-    //#region Check
-    /**
-     * Checks if the given operation is possibly allowed by the policy, without querying the database.
-     * @param operation The CRUD operation.
-     * @param fieldValues Extra field value filters to be combined with the policy constraints.
-     */
-    check(args) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return (0, check_utils_1.checkPermission)(this.model, args, this.modelMeta, this.policyUtils, this.prisma, this.prismaModule);
-        });
-    }
-    //#endregion
-    //#region Utils
-    get shouldLogQuery() {
-        var _a;
-        return !!((_a = this.options) === null || _a === void 0 ? void 0 : _a.logPrismaQuery) && this.logger.enabled('info');
-    }
-    runPostWriteChecks(postWriteChecks, db) {
-        return __awaiter(this, void 0, void 0, function* () {
-            yield Promise.all(postWriteChecks.map((_a) => __awaiter(this, [_a], void 0, function* ({ model, operation, uniqueFilter, preValue }) { return this.policyUtils.checkPolicyForUnique(model, uniqueFilter, operation, db, [], preValue); })));
-        });
-    }
-    requireBackLink(fieldInfo) {
-        (0, local_helpers_1.invariant)(fieldInfo.backLink, `back link not found for field ${fieldInfo.name}`);
-        return (0, cross_1.requireField)(this.modelMeta, fieldInfo.type, fieldInfo.backLink);
-    }
-    mergeToParent(parent, key, value) {
-        if (parent[key]) {
-            if (Array.isArray(parent[key])) {
-                parent[key].push(value);
-            }
-            else {
-                parent[key] = [parent[key], value];
-            }
-        }
-        else {
-            parent[key] = value;
-        }
-    }
-    removeFromParent(parent, key, data) {
-        if (parent[key] === data) {
-            delete parent[key];
-        }
-        else if (Array.isArray(parent[key])) {
-            const idx = parent[key].indexOf(data);
-            if (idx >= 0) {
-                parent[key].splice(idx, 1);
-                if (parent[key].length === 0) {
-                    delete parent[key];
-                }
-            }
-        }
-    }
-    buildIdFilterWithEntityChecker(candidates, entityChecker) {
-        const filteredCandidates = candidates.filter((value) => { var _a; return entityChecker(value, { user: (_a = this.context) === null || _a === void 0 ? void 0 : _a.user }); });
-        const idFields = this.policyUtils.getIdFields(this.model);
-        let idFilter;
-        if (idFields.length === 1) {
-            idFilter = { [idFields[0].name]: { in: filteredCandidates.map((x) => x[idFields[0].name]) } };
-        }
-        else {
-            idFilter = { AND: filteredCandidates.map((x) => this.policyUtils.getIdFieldValues(this.model, x)) };
-        }
-        return { filteredCandidates, idFilter };
-    }
-}
-exports.PolicyProxyHandler = PolicyProxyHandler;
-//# sourceMappingURL=handler.js.map