@zenstackhq/runtime 3.0.0-beta.2 → 3.0.0-beta.4

package/dist/plugins/policy/index.cjs

@@ -134,6 +134,9 @@ var ExpressionUtils = {
   or: /* @__PURE__ */ __name((expr2, ...expressions) => {
     return expressions.reduce((acc, exp) => ExpressionUtils.binary(acc, "||", exp), expr2);
   }, "or"),
+  not: /* @__PURE__ */ __name((expr2) => {
+    return ExpressionUtils.unary("!", expr2);
+  }, "not"),
   is: /* @__PURE__ */ __name((value, kind) => {
     return !!value && typeof value === "object" && "kind" in value && value.kind === kind;
   }, "is"),
@@ -170,15 +173,19 @@ var InternalError = class extends Error {
 
 // src/client/query-utils.ts
 function getModel(schema, model) {
-  return schema.models[model];
+  return Object.values(schema.models).find((m) => m.name.toLowerCase() === model.toLowerCase());
 }
 __name(getModel, "getModel");
+function getTypeDef(schema, type) {
+  return schema.typeDefs?.[type];
+}
+__name(getTypeDef, "getTypeDef");
 function requireModel(schema, model) {
-  const matchedName = Object.keys(schema.models).find((k) => k.toLowerCase() === model.toLowerCase());
-  if (!matchedName) {
+  const modelDef = getModel(schema, model);
+  if (!modelDef) {
     throw new QueryError(`Model "${model}" not found in schema`);
   }
-  return schema.models[matchedName];
+  return modelDef;
 }
 __name(requireModel, "requireModel");
 function getField(schema, model, field) {
@@ -186,12 +193,24 @@ function getField(schema, model, field) {
   return modelDef?.fields[field];
 }
 __name(getField, "getField");
-function requireField(schema, model, field) {
-  const modelDef = requireModel(schema, model);
-  if (!modelDef.fields[field]) {
-    throw new QueryError(`Field "${field}" not found in model "${model}"`);
+function requireField(schema, modelOrType, field) {
+  const modelDef = getModel(schema, modelOrType);
+  if (modelDef) {
+    if (!modelDef.fields[field]) {
+      throw new QueryError(`Field "${field}" not found in model "${modelOrType}"`);
+    } else {
+      return modelDef.fields[field];
+    }
+  }
+  const typeDef = getTypeDef(schema, modelOrType);
+  if (typeDef) {
+    if (!typeDef.fields[field]) {
+      throw new QueryError(`Field "${field}" not found in type "${modelOrType}"`);
+    } else {
+      return typeDef.fields[field];
+    }
   }
-  return modelDef.fields[field];
+  throw new QueryError(`Model or type "${modelOrType}" not found in schema`);
 }
 __name(requireField, "requireField");
 function getIdFields(schema, model) {
@@ -417,7 +436,7 @@ function aggregate(eb, expr2, op) {
 }
 __name(aggregate, "aggregate");
 
-// src/client/crud/dialects/base.ts
+// src/client/crud/dialects/base-dialect.ts
 var import_common_helpers = require("@zenstackhq/common-helpers");
 var import_kysely = require("kysely");
 var import_ts_pattern2 = require("ts-pattern");
@@ -436,7 +455,7 @@ function enumerate(x) {
 }
 __name(enumerate, "enumerate");
 
-// src/client/crud/dialects/base.ts
+// src/client/crud/dialects/base-dialect.ts
 var BaseCrudDialect = class {
   static {
     __name(this, "BaseCrudDialect");
@@ -1810,6 +1829,12 @@ function isFalseNode(node) {
 }
 __name(isFalseNode, "isFalseNode");
 function conjunction(dialect, nodes) {
+  if (nodes.length === 0) {
+    return trueNode(dialect);
+  }
+  if (nodes.length === 1) {
+    return nodes[0];
+  }
   if (nodes.some(isFalseNode)) {
     return falseNode(dialect);
   }
@@ -1817,10 +1842,16 @@ function conjunction(dialect, nodes) {
   if (items.length === 0) {
     return trueNode(dialect);
   }
-  return items.reduce((acc, node) => import_kysely5.OrNode.is(node) ? import_kysely5.AndNode.create(acc, import_kysely5.ParensNode.create(node)) : import_kysely5.AndNode.create(acc, node));
+  return items.reduce((acc, node) => import_kysely5.AndNode.create(wrapParensIf(acc, import_kysely5.OrNode.is), wrapParensIf(node, import_kysely5.OrNode.is)));
 }
 __name(conjunction, "conjunction");
 function disjunction(dialect, nodes) {
+  if (nodes.length === 0) {
+    return falseNode(dialect);
+  }
+  if (nodes.length === 1) {
+    return nodes[0];
+  }
   if (nodes.some(isTrueNode)) {
     return trueNode(dialect);
   }
@@ -1828,13 +1859,23 @@ function disjunction(dialect, nodes) {
   if (items.length === 0) {
     return falseNode(dialect);
   }
-  return items.reduce((acc, node) => import_kysely5.AndNode.is(node) ? import_kysely5.OrNode.create(acc, import_kysely5.ParensNode.create(node)) : import_kysely5.OrNode.create(acc, node));
+  return items.reduce((acc, node) => import_kysely5.OrNode.create(wrapParensIf(acc, import_kysely5.AndNode.is), wrapParensIf(node, import_kysely5.AndNode.is)));
 }
 __name(disjunction, "disjunction");
-function logicalNot(node) {
-  return import_kysely5.UnaryOperationNode.create(import_kysely5.OperatorNode.create("not"), import_kysely5.AndNode.is(node) || import_kysely5.OrNode.is(node) ? import_kysely5.ParensNode.create(node) : node);
+function logicalNot(dialect, node) {
+  if (isTrueNode(node)) {
+    return falseNode(dialect);
+  }
+  if (isFalseNode(node)) {
+    return trueNode(dialect);
+  }
+  return import_kysely5.UnaryOperationNode.create(import_kysely5.OperatorNode.create("not"), wrapParensIf(node, (n) => import_kysely5.AndNode.is(n) || import_kysely5.OrNode.is(n)));
 }
 __name(logicalNot, "logicalNot");
+function wrapParensIf(node, predicate) {
+  return predicate(node) ? import_kysely5.ParensNode.create(node) : node;
+}
+__name(wrapParensIf, "wrapParensIf");
 function buildIsFalse(node, dialect) {
   if (isFalseNode(node)) {
     return trueNode(dialect);
@@ -1925,11 +1966,7 @@ var ExpressionTransformer = class {
   _field(expr2, context) {
     const fieldDef = requireField(this.schema, context.model, expr2.field);
     if (!fieldDef.relation) {
-      if (context.thisEntity) {
-        return context.thisEntity[expr2.field];
-      } else {
-        return this.createColumnRef(expr2.field, context);
-      }
+      return this.createColumnRef(expr2.field, context);
     } else {
       const { memberFilter, memberSelect, ...restContext } = context;
       const relation = this.transformRelationAccess(expr2.field, fieldDef.type, restContext);
@@ -1970,7 +2007,7 @@ var ExpressionTransformer = class {
       ]);
     }
     if (this.isAuthCall(expr2.left) || this.isAuthCall(expr2.right)) {
-      return this.transformAuthBinary(expr2);
+      return this.transformAuthBinary(expr2, context);
     }
     const op = expr2.op;
     if (op === "?" || op === "!" || op === "^") {
@@ -2023,11 +2060,10 @@ var ExpressionTransformer = class {
     let predicateFilter = this.transform(expr2.right, {
       ...context,
       model: newContextModel,
-      alias: void 0,
-      thisEntity: void 0
+      alias: void 0
     });
     if (expr2.op === "!") {
-      predicateFilter = logicalNot(predicateFilter);
+      predicateFilter = logicalNot(this.dialect, predicateFilter);
     }
     const count = import_kysely6.FunctionNode.create("count", [
       import_kysely6.ValueNode.createImmediate(1)
@@ -2039,20 +2075,38 @@ var ExpressionTransformer = class {
       memberFilter: predicateFilter
     });
   }
-  transformAuthBinary(expr2) {
+  transformAuthBinary(expr2, context) {
     if (expr2.op !== "==" && expr2.op !== "!=") {
-      throw new Error(`Unsupported operator for auth call: ${expr2.op}`);
+      throw new QueryError(`Unsupported operator for \`auth()\` in policy of model "${context.model}": ${expr2.op}`);
     }
+    let authExpr;
     let other;
     if (this.isAuthCall(expr2.left)) {
+      authExpr = expr2.left;
       other = expr2.right;
     } else {
+      authExpr = expr2.right;
       other = expr2.left;
     }
     if (ExpressionUtils.isNull(other)) {
       return this.transformValue(expr2.op === "==" ? !this.auth : !!this.auth, "Boolean");
     } else {
-      throw new Error("Unsupported binary expression with `auth()`");
+      const authModel = getModel(this.schema, this.authType);
+      if (!authModel) {
+        throw new QueryError(`Unsupported use of \`auth()\` in policy of model "${context.model}", comparing with \`auth()\` is only possible when auth type is a model`);
+      }
+      const idFields = Object.values(authModel.fields).filter((f) => f.id).map((f) => f.name);
+      (0, import_common_helpers5.invariant)(idFields.length > 0, "auth type model must have at least one id field");
+      const conditions = idFields.map((fieldName) => ExpressionUtils.binary(ExpressionUtils.member(authExpr, [
+        fieldName
+      ]), "==", ExpressionUtils.member(other, [
+        fieldName
+      ])));
+      let result = this.buildAnd(conditions);
+      if (expr2.op === "!=") {
+        result = this.buildLogicalNot(result);
+      }
+      return this.transform(result, context);
     }
   }
   transformValue(value, type) {
@@ -2060,7 +2114,7 @@ var ExpressionTransformer = class {
   }
   _unary(expr2, context) {
     (0, import_common_helpers5.invariant)(expr2.op === "!", 'only "!" operator is supported');
-    return import_kysely6.BinaryOperationNode.create(this.transform(expr2.operand, context), this.transformOperator("!="), trueNode(this.dialect));
+    return logicalNot(this.dialect, this.transform(expr2.operand, context));
   }
   transformOperator(op) {
     const mappedOp = (0, import_ts_pattern7.match)(op).with("==", () => "=").otherwise(() => op);
@@ -2087,7 +2141,7 @@ var ExpressionTransformer = class {
       return eb.val(arg.value);
     }
     if (ExpressionUtils.isField(arg)) {
-      return context.thisEntityRaw ? eb.val(context.thisEntityRaw[arg.field]) : eb.ref(arg.field);
+      return eb.ref(arg.field);
     }
     if (ExpressionUtils.isCall(arg)) {
       return this.transformCall(arg, context);
@@ -2102,14 +2156,33 @@ var ExpressionTransformer = class {
     if (this.isAuthCall(expr2.receiver)) {
       return this.valueMemberAccess(this.auth, expr2, this.authType);
     }
-    (0, import_common_helpers5.invariant)(ExpressionUtils.isField(expr2.receiver), "expect receiver to be field expression");
+    (0, import_common_helpers5.invariant)(ExpressionUtils.isField(expr2.receiver) || ExpressionUtils.isThis(expr2.receiver), 'expect receiver to be field expression or "this"');
+    let members = expr2.members;
+    let receiver;
     const { memberFilter, memberSelect, ...restContext } = context;
-    const receiver = this.transform(expr2.receiver, restContext);
+    if (ExpressionUtils.isThis(expr2.receiver)) {
+      if (expr2.members.length === 1) {
+        const fieldDef = requireField(this.schema, context.model, expr2.members[0]);
+        (0, import_common_helpers5.invariant)(!fieldDef.relation, "this.relation access should have been transformed into relation access");
+        return this.createColumnRef(expr2.members[0], restContext);
+      }
+      const firstMemberFieldDef = requireField(this.schema, context.model, expr2.members[0]);
+      receiver = this.transformRelationAccess(expr2.members[0], firstMemberFieldDef.type, restContext);
+      members = expr2.members.slice(1);
+    } else {
+      receiver = this.transform(expr2.receiver, restContext);
+    }
     (0, import_common_helpers5.invariant)(import_kysely6.SelectQueryNode.is(receiver), "expected receiver to be select query");
-    const receiverField = requireField(this.schema, context.model, expr2.receiver.field);
+    let startType;
+    if (ExpressionUtils.isField(expr2.receiver)) {
+      const receiverField = requireField(this.schema, context.model, expr2.receiver.field);
+      startType = receiverField.type;
+    } else {
+      startType = context.model;
+    }
     const memberFields = [];
-    let currType = receiverField.type;
-    for (const member of expr2.members) {
+    let currType = startType;
+    for (const member of members) {
       const fieldDef = requireField(this.schema, currType, member);
       memberFields.push({
         fieldDef,
@@ -2118,22 +2191,21 @@ var ExpressionTransformer = class {
       currType = fieldDef.type;
     }
     let currNode = void 0;
-    for (let i = expr2.members.length - 1; i >= 0; i--) {
-      const member = expr2.members[i];
+    for (let i = members.length - 1; i >= 0; i--) {
+      const member = members[i];
       const { fieldDef, fromModel } = memberFields[i];
       if (fieldDef.relation) {
         const relation = this.transformRelationAccess(member, fieldDef.type, {
           ...restContext,
           model: fromModel,
-          alias: void 0,
-          thisEntity: void 0
+          alias: void 0
         });
         if (currNode) {
           (0, import_common_helpers5.invariant)(import_kysely6.SelectQueryNode.is(currNode), "expected select query node");
           currNode = {
             ...relation,
             selections: [
-              import_kysely6.SelectionNode.create(import_kysely6.AliasNode.create(currNode, import_kysely6.IdentifierNode.create(expr2.members[i + 1])))
+              import_kysely6.SelectionNode.create(import_kysely6.AliasNode.create(currNode, import_kysely6.IdentifierNode.create(members[i + 1])))
             ]
           };
         } else {
@@ -2146,7 +2218,7 @@ var ExpressionTransformer = class {
           };
         }
       } else {
-        (0, import_common_helpers5.invariant)(i === expr2.members.length - 1, "plain field access must be the last segment");
+        (0, import_common_helpers5.invariant)(i === members.length - 1, "plain field access must be the last segment");
         (0, import_common_helpers5.invariant)(!currNode, "plain field access must be the last segment");
         currNode = import_kysely6.ColumnNode.create(member);
       }
@@ -2173,35 +2245,19 @@ var ExpressionTransformer = class {
   transformRelationAccess(field, relationModel, context) {
     const fromModel = context.model;
     const { keyPairs, ownedByModel } = getRelationForeignKeyFieldPairs(this.schema, fromModel, field);
-    if (context.thisEntity) {
-      let condition;
-      if (ownedByModel) {
-        condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => import_kysely6.BinaryOperationNode.create(import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(pk), import_kysely6.TableNode.create(relationModel)), import_kysely6.OperatorNode.create("="), context.thisEntity[fk])));
-      } else {
-        condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => import_kysely6.BinaryOperationNode.create(import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(fk), import_kysely6.TableNode.create(relationModel)), import_kysely6.OperatorNode.create("="), context.thisEntity[pk])));
-      }
-      return {
-        kind: "SelectQueryNode",
-        from: import_kysely6.FromNode.create([
-          import_kysely6.TableNode.create(relationModel)
-        ]),
-        where: import_kysely6.WhereNode.create(condition)
-      };
+    let condition;
+    if (ownedByModel) {
+      condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => import_kysely6.BinaryOperationNode.create(import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(fk), import_kysely6.TableNode.create(context.alias ?? fromModel)), import_kysely6.OperatorNode.create("="), import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(pk), import_kysely6.TableNode.create(relationModel)))));
     } else {
-      let condition;
-      if (ownedByModel) {
-        condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => import_kysely6.BinaryOperationNode.create(import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(fk), import_kysely6.TableNode.create(context.alias ?? fromModel)), import_kysely6.OperatorNode.create("="), import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(pk), import_kysely6.TableNode.create(relationModel)))));
-      } else {
-        condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => import_kysely6.BinaryOperationNode.create(import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(pk), import_kysely6.TableNode.create(context.alias ?? fromModel)), import_kysely6.OperatorNode.create("="), import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(fk), import_kysely6.TableNode.create(relationModel)))));
-      }
-      return {
-        kind: "SelectQueryNode",
-        from: import_kysely6.FromNode.create([
-          import_kysely6.TableNode.create(relationModel)
-        ]),
-        where: import_kysely6.WhereNode.create(condition)
-      };
+      condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => import_kysely6.BinaryOperationNode.create(import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(pk), import_kysely6.TableNode.create(context.alias ?? fromModel)), import_kysely6.OperatorNode.create("="), import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(fk), import_kysely6.TableNode.create(relationModel)))));
     }
+    return {
+      kind: "SelectQueryNode",
+      from: import_kysely6.FromNode.create([
+        import_kysely6.TableNode.create(relationModel)
+      ]),
+      where: import_kysely6.WhereNode.create(condition)
+    };
   }
   createColumnRef(column, context) {
     return import_kysely6.ReferenceNode.create(import_kysely6.ColumnNode.create(column), import_kysely6.TableNode.create(context.alias ?? context.model));
@@ -2215,6 +2271,18 @@ var ExpressionTransformer = class {
   isNullNode(node) {
     return import_kysely6.ValueNode.is(node) && node.value === null;
   }
+  buildLogicalNot(result) {
+    return ExpressionUtils.unary("!", result);
+  }
+  buildAnd(conditions) {
+    if (conditions.length === 0) {
+      return ExpressionUtils.literal(true);
+    } else if (conditions.length === 1) {
+      return conditions[0];
+    } else {
+      return conditions.reduce((acc, condition) => ExpressionUtils.binary(acc, "&&", condition));
+    }
+  }
 };
 _ts_decorate([
   expr("literal"),
@@ -2344,29 +2412,47 @@ var PolicyHandler = class extends import_kysely7.OperationNodeTransformer {
     return selectedColumns.every((c) => idFields.includes(c));
   }
   async enforcePreCreatePolicy(node, proceed) {
-    if (!node.columns || !node.values) {
-      return;
-    }
     const model = this.getMutationModel(node);
-    const fields = node.columns.map((c) => c.column.name);
-    const valueRows = this.unwrapCreateValueRows(node.values, model, fields);
+    const fields = node.columns?.map((c) => c.column.name) ?? [];
+    const valueRows = node.values ? this.unwrapCreateValueRows(node.values, model, fields) : [
+      []
+    ];
     for (const values of valueRows) {
-      await this.enforcePreCreatePolicyForOne(model, fields, values.map((v) => v.node), values.map((v) => v.raw), proceed);
+      await this.enforcePreCreatePolicyForOne(model, fields, values.map((v) => v.node), proceed);
     }
   }
-  async enforcePreCreatePolicyForOne(model, fields, values, valuesRaw, proceed) {
-    const thisEntity = {};
-    const thisEntityRaw = {};
-    for (let i = 0; i < fields.length; i++) {
-      thisEntity[fields[i]] = values[i];
-      thisEntityRaw[fields[i]] = valuesRaw[i];
+  async enforcePreCreatePolicyForOne(model, fields, values, proceed) {
+    const allFields = Object.keys(requireModel(this.client.$schema, model).fields);
+    const allValues = [];
+    for (const fieldName of allFields) {
+      const index = fields.indexOf(fieldName);
+      if (index >= 0) {
+        allValues.push(values[index]);
+      } else {
+        allValues.push(import_kysely7.ValueNode.createImmediate(null));
+      }
     }
-    const filter = this.buildPolicyFilter(model, void 0, "create", thisEntity, thisEntityRaw);
+    const constTable = {
+      kind: "SelectQueryNode",
+      from: import_kysely7.FromNode.create([
+        import_kysely7.AliasNode.create(import_kysely7.ParensNode.create(import_kysely7.ValuesNode.create([
+          import_kysely7.ValueListNode.create(allValues)
+        ])), import_kysely7.IdentifierNode.create("$t"))
+      ]),
+      selections: allFields.map((field, index) => import_kysely7.SelectionNode.create(import_kysely7.AliasNode.create(import_kysely7.ColumnNode.create(`column${index + 1}`), import_kysely7.IdentifierNode.create(field))))
+    };
+    const filter = this.buildPolicyFilter(model, void 0, "create");
     const preCreateCheck = {
       kind: "SelectQueryNode",
+      from: import_kysely7.FromNode.create([
+        import_kysely7.AliasNode.create(constTable, import_kysely7.IdentifierNode.create(model))
+      ]),
       selections: [
-        import_kysely7.SelectionNode.create(import_kysely7.AliasNode.create(filter, import_kysely7.IdentifierNode.create("$condition")))
-      ]
+        import_kysely7.SelectionNode.create(import_kysely7.AliasNode.create(import_kysely7.BinaryOperationNode.create(import_kysely7.FunctionNode.create("COUNT", [
+          import_kysely7.ValueNode.createImmediate(1)
+        ]), import_kysely7.OperatorNode.create(">"), import_kysely7.ValueNode.createImmediate(0)), import_kysely7.IdentifierNode.create("$condition")))
+      ],
+      where: import_kysely7.WhereNode.create(filter)
     };
     const result = await proceed(preCreateCheck);
     if (!result.rows[0]?.$condition) {
@@ -2483,13 +2569,13 @@ var PolicyHandler = class extends import_kysely7.OperationNodeTransformer {
   isMutationQueryNode(node) {
     return import_kysely7.InsertQueryNode.is(node) || import_kysely7.UpdateQueryNode.is(node) || import_kysely7.DeleteQueryNode.is(node);
   }
-  buildPolicyFilter(model, alias, operation, thisEntity, thisEntityRaw) {
+  buildPolicyFilter(model, alias, operation) {
     const policies = this.getModelPolicies(model, operation);
     if (policies.length === 0) {
       return falseNode(this.dialect);
     }
-    const allows = policies.filter((policy) => policy.kind === "allow").map((policy) => this.transformPolicyCondition(model, alias, operation, policy, thisEntity, thisEntityRaw));
-    const denies = policies.filter((policy) => policy.kind === "deny").map((policy) => this.transformPolicyCondition(model, alias, operation, policy, thisEntity, thisEntityRaw));
+    const allows = policies.filter((policy) => policy.kind === "allow").map((policy) => this.transformPolicyCondition(model, alias, operation, policy));
+    const denies = policies.filter((policy) => policy.kind === "deny").map((policy) => this.transformPolicyCondition(model, alias, operation, policy));
     let combinedPolicy;
     if (allows.length === 0) {
       combinedPolicy = falseNode(this.dialect);
@@ -2585,13 +2671,11 @@ var PolicyHandler = class extends import_kysely7.OperationNodeTransformer {
       return void 0;
     }
   }
-  transformPolicyCondition(model, alias, operation, policy, thisEntity, thisEntityRaw) {
+  transformPolicyCondition(model, alias, operation, policy) {
     return new ExpressionTransformer(this.client.$schema, this.client.$options, this.client.$auth).transform(policy.condition, {
       model,
       alias,
       operation,
-      thisEntity,
-      thisEntityRaw,
       auth: this.client.$auth
     });
   }