@zenstackhq/runtime 3.0.0-beta.2 → 3.0.0-beta.4

package/dist/plugins/policy/index.d.cts

@@ -1,5 +1,5 @@
 import * as kysely from 'kysely';
-import { R as RuntimePlugin, V as OnKyselyQueryArgs } from '../../contract-CusA0mQO.cjs';
+import { R as RuntimePlugin, V as OnKyselyQueryArgs } from '../../contract-hoS-Sd87.cjs';
 import { SchemaDef } from '@zenstackhq/sdk/schema';
 import 'decimal.js';
 

package/dist/plugins/policy/index.d.ts

@@ -1,5 +1,5 @@
 import * as kysely from 'kysely';
-import { R as RuntimePlugin, V as OnKyselyQueryArgs } from '../../contract-CusA0mQO.js';
+import { R as RuntimePlugin, V as OnKyselyQueryArgs } from '../../contract-hoS-Sd87.js';
 import { SchemaDef } from '@zenstackhq/sdk/schema';
 import 'decimal.js';
 

package/dist/plugins/policy/index.js

@@ -15,7 +15,7 @@ var RejectedByPolicyError = class extends Error {
 
 // src/plugins/policy/policy-handler.ts
 import { invariant as invariant6 } from "@zenstackhq/common-helpers";
-import { AliasNode as AliasNode3, BinaryOperationNode as BinaryOperationNode3, ColumnNode as ColumnNode2, DeleteQueryNode, FromNode as FromNode2, IdentifierNode as IdentifierNode2, InsertQueryNode, OperationNodeTransformer, OperatorNode as OperatorNode3, PrimitiveValueListNode, RawNode, ReturningNode, SelectionNode as SelectionNode2, SelectQueryNode as SelectQueryNode2, TableNode as TableNode3, UpdateQueryNode, ValueNode as ValueNode3, ValuesNode, WhereNode as WhereNode2 } from "kysely";
+import { AliasNode as AliasNode3, BinaryOperationNode as BinaryOperationNode3, ColumnNode as ColumnNode2, DeleteQueryNode, FromNode as FromNode2, FunctionNode as FunctionNode3, IdentifierNode as IdentifierNode2, InsertQueryNode, OperationNodeTransformer, OperatorNode as OperatorNode3, ParensNode as ParensNode2, PrimitiveValueListNode, RawNode, ReturningNode, SelectionNode as SelectionNode2, SelectQueryNode as SelectQueryNode2, TableNode as TableNode3, UpdateQueryNode, ValueListNode as ValueListNode2, ValueNode as ValueNode3, ValuesNode, WhereNode as WhereNode2 } from "kysely";
 import { match as match8 } from "ts-pattern";
 
 // src/client/crud/dialects/index.ts
@@ -109,6 +109,9 @@ var ExpressionUtils = {
   or: /* @__PURE__ */ __name((expr2, ...expressions) => {
     return expressions.reduce((acc, exp) => ExpressionUtils.binary(acc, "||", exp), expr2);
   }, "or"),
+  not: /* @__PURE__ */ __name((expr2) => {
+    return ExpressionUtils.unary("!", expr2);
+  }, "not"),
   is: /* @__PURE__ */ __name((value, kind) => {
     return !!value && typeof value === "object" && "kind" in value && value.kind === kind;
   }, "is"),
@@ -145,15 +148,19 @@ var InternalError = class extends Error {
 
 // src/client/query-utils.ts
 function getModel(schema, model) {
-  return schema.models[model];
+  return Object.values(schema.models).find((m) => m.name.toLowerCase() === model.toLowerCase());
 }
 __name(getModel, "getModel");
+function getTypeDef(schema, type) {
+  return schema.typeDefs?.[type];
+}
+__name(getTypeDef, "getTypeDef");
 function requireModel(schema, model) {
-  const matchedName = Object.keys(schema.models).find((k) => k.toLowerCase() === model.toLowerCase());
-  if (!matchedName) {
+  const modelDef = getModel(schema, model);
+  if (!modelDef) {
     throw new QueryError(`Model "${model}" not found in schema`);
   }
-  return schema.models[matchedName];
+  return modelDef;
 }
 __name(requireModel, "requireModel");
 function getField(schema, model, field) {
@@ -161,12 +168,24 @@ function getField(schema, model, field) {
   return modelDef?.fields[field];
 }
 __name(getField, "getField");
-function requireField(schema, model, field) {
-  const modelDef = requireModel(schema, model);
-  if (!modelDef.fields[field]) {
-    throw new QueryError(`Field "${field}" not found in model "${model}"`);
+function requireField(schema, modelOrType, field) {
+  const modelDef = getModel(schema, modelOrType);
+  if (modelDef) {
+    if (!modelDef.fields[field]) {
+      throw new QueryError(`Field "${field}" not found in model "${modelOrType}"`);
+    } else {
+      return modelDef.fields[field];
+    }
+  }
+  const typeDef = getTypeDef(schema, modelOrType);
+  if (typeDef) {
+    if (!typeDef.fields[field]) {
+      throw new QueryError(`Field "${field}" not found in type "${modelOrType}"`);
+    } else {
+      return typeDef.fields[field];
+    }
   }
-  return modelDef.fields[field];
+  throw new QueryError(`Model or type "${modelOrType}" not found in schema`);
 }
 __name(requireField, "requireField");
 function getIdFields(schema, model) {
@@ -392,7 +411,7 @@ function aggregate(eb, expr2, op) {
 }
 __name(aggregate, "aggregate");
 
-// src/client/crud/dialects/base.ts
+// src/client/crud/dialects/base-dialect.ts
 import { invariant, isPlainObject } from "@zenstackhq/common-helpers";
 import { expressionBuilder, sql } from "kysely";
 import { match as match2, P } from "ts-pattern";
@@ -411,7 +430,7 @@ function enumerate(x) {
 }
 __name(enumerate, "enumerate");
 
-// src/client/crud/dialects/base.ts
+// src/client/crud/dialects/base-dialect.ts
 var BaseCrudDialect = class {
   static {
     __name(this, "BaseCrudDialect");
@@ -1785,6 +1804,12 @@ function isFalseNode(node) {
 }
 __name(isFalseNode, "isFalseNode");
 function conjunction(dialect, nodes) {
+  if (nodes.length === 0) {
+    return trueNode(dialect);
+  }
+  if (nodes.length === 1) {
+    return nodes[0];
+  }
   if (nodes.some(isFalseNode)) {
     return falseNode(dialect);
   }
@@ -1792,10 +1817,16 @@ function conjunction(dialect, nodes) {
   if (items.length === 0) {
     return trueNode(dialect);
   }
-  return items.reduce((acc, node) => OrNode.is(node) ? AndNode.create(acc, ParensNode.create(node)) : AndNode.create(acc, node));
+  return items.reduce((acc, node) => AndNode.create(wrapParensIf(acc, OrNode.is), wrapParensIf(node, OrNode.is)));
 }
 __name(conjunction, "conjunction");
 function disjunction(dialect, nodes) {
+  if (nodes.length === 0) {
+    return falseNode(dialect);
+  }
+  if (nodes.length === 1) {
+    return nodes[0];
+  }
   if (nodes.some(isTrueNode)) {
     return trueNode(dialect);
   }
@@ -1803,13 +1834,23 @@ function disjunction(dialect, nodes) {
   if (items.length === 0) {
     return falseNode(dialect);
   }
-  return items.reduce((acc, node) => AndNode.is(node) ? OrNode.create(acc, ParensNode.create(node)) : OrNode.create(acc, node));
+  return items.reduce((acc, node) => OrNode.create(wrapParensIf(acc, AndNode.is), wrapParensIf(node, AndNode.is)));
 }
 __name(disjunction, "disjunction");
-function logicalNot(node) {
-  return UnaryOperationNode.create(OperatorNode.create("not"), AndNode.is(node) || OrNode.is(node) ? ParensNode.create(node) : node);
+function logicalNot(dialect, node) {
+  if (isTrueNode(node)) {
+    return falseNode(dialect);
+  }
+  if (isFalseNode(node)) {
+    return trueNode(dialect);
+  }
+  return UnaryOperationNode.create(OperatorNode.create("not"), wrapParensIf(node, (n) => AndNode.is(n) || OrNode.is(n)));
 }
 __name(logicalNot, "logicalNot");
+function wrapParensIf(node, predicate) {
+  return predicate(node) ? ParensNode.create(node) : node;
+}
+__name(wrapParensIf, "wrapParensIf");
 function buildIsFalse(node, dialect) {
   if (isFalseNode(node)) {
     return trueNode(dialect);
@@ -1900,11 +1941,7 @@ var ExpressionTransformer = class {
   _field(expr2, context) {
     const fieldDef = requireField(this.schema, context.model, expr2.field);
     if (!fieldDef.relation) {
-      if (context.thisEntity) {
-        return context.thisEntity[expr2.field];
-      } else {
-        return this.createColumnRef(expr2.field, context);
-      }
+      return this.createColumnRef(expr2.field, context);
     } else {
       const { memberFilter, memberSelect, ...restContext } = context;
       const relation = this.transformRelationAccess(expr2.field, fieldDef.type, restContext);
@@ -1945,7 +1982,7 @@ var ExpressionTransformer = class {
       ]);
     }
     if (this.isAuthCall(expr2.left) || this.isAuthCall(expr2.right)) {
-      return this.transformAuthBinary(expr2);
+      return this.transformAuthBinary(expr2, context);
     }
     const op = expr2.op;
     if (op === "?" || op === "!" || op === "^") {
@@ -1998,11 +2035,10 @@ var ExpressionTransformer = class {
     let predicateFilter = this.transform(expr2.right, {
       ...context,
       model: newContextModel,
-      alias: void 0,
-      thisEntity: void 0
+      alias: void 0
     });
     if (expr2.op === "!") {
-      predicateFilter = logicalNot(predicateFilter);
+      predicateFilter = logicalNot(this.dialect, predicateFilter);
     }
     const count = FunctionNode2.create("count", [
       ValueNode2.createImmediate(1)
@@ -2014,20 +2050,38 @@ var ExpressionTransformer = class {
       memberFilter: predicateFilter
     });
   }
-  transformAuthBinary(expr2) {
+  transformAuthBinary(expr2, context) {
     if (expr2.op !== "==" && expr2.op !== "!=") {
-      throw new Error(`Unsupported operator for auth call: ${expr2.op}`);
+      throw new QueryError(`Unsupported operator for \`auth()\` in policy of model "${context.model}": ${expr2.op}`);
     }
+    let authExpr;
     let other;
     if (this.isAuthCall(expr2.left)) {
+      authExpr = expr2.left;
       other = expr2.right;
     } else {
+      authExpr = expr2.right;
       other = expr2.left;
     }
     if (ExpressionUtils.isNull(other)) {
       return this.transformValue(expr2.op === "==" ? !this.auth : !!this.auth, "Boolean");
     } else {
-      throw new Error("Unsupported binary expression with `auth()`");
+      const authModel = getModel(this.schema, this.authType);
+      if (!authModel) {
+        throw new QueryError(`Unsupported use of \`auth()\` in policy of model "${context.model}", comparing with \`auth()\` is only possible when auth type is a model`);
+      }
+      const idFields = Object.values(authModel.fields).filter((f) => f.id).map((f) => f.name);
+      invariant5(idFields.length > 0, "auth type model must have at least one id field");
+      const conditions = idFields.map((fieldName) => ExpressionUtils.binary(ExpressionUtils.member(authExpr, [
+        fieldName
+      ]), "==", ExpressionUtils.member(other, [
+        fieldName
+      ])));
+      let result = this.buildAnd(conditions);
+      if (expr2.op === "!=") {
+        result = this.buildLogicalNot(result);
+      }
+      return this.transform(result, context);
     }
   }
   transformValue(value, type) {
@@ -2035,7 +2089,7 @@ var ExpressionTransformer = class {
   }
   _unary(expr2, context) {
     invariant5(expr2.op === "!", 'only "!" operator is supported');
-    return BinaryOperationNode2.create(this.transform(expr2.operand, context), this.transformOperator("!="), trueNode(this.dialect));
+    return logicalNot(this.dialect, this.transform(expr2.operand, context));
   }
   transformOperator(op) {
     const mappedOp = match7(op).with("==", () => "=").otherwise(() => op);
@@ -2062,7 +2116,7 @@ var ExpressionTransformer = class {
       return eb.val(arg.value);
     }
     if (ExpressionUtils.isField(arg)) {
-      return context.thisEntityRaw ? eb.val(context.thisEntityRaw[arg.field]) : eb.ref(arg.field);
+      return eb.ref(arg.field);
     }
     if (ExpressionUtils.isCall(arg)) {
       return this.transformCall(arg, context);
@@ -2077,14 +2131,33 @@ var ExpressionTransformer = class {
     if (this.isAuthCall(expr2.receiver)) {
       return this.valueMemberAccess(this.auth, expr2, this.authType);
     }
-    invariant5(ExpressionUtils.isField(expr2.receiver), "expect receiver to be field expression");
+    invariant5(ExpressionUtils.isField(expr2.receiver) || ExpressionUtils.isThis(expr2.receiver), 'expect receiver to be field expression or "this"');
+    let members = expr2.members;
+    let receiver;
     const { memberFilter, memberSelect, ...restContext } = context;
-    const receiver = this.transform(expr2.receiver, restContext);
+    if (ExpressionUtils.isThis(expr2.receiver)) {
+      if (expr2.members.length === 1) {
+        const fieldDef = requireField(this.schema, context.model, expr2.members[0]);
+        invariant5(!fieldDef.relation, "this.relation access should have been transformed into relation access");
+        return this.createColumnRef(expr2.members[0], restContext);
+      }
+      const firstMemberFieldDef = requireField(this.schema, context.model, expr2.members[0]);
+      receiver = this.transformRelationAccess(expr2.members[0], firstMemberFieldDef.type, restContext);
+      members = expr2.members.slice(1);
+    } else {
+      receiver = this.transform(expr2.receiver, restContext);
+    }
     invariant5(SelectQueryNode.is(receiver), "expected receiver to be select query");
-    const receiverField = requireField(this.schema, context.model, expr2.receiver.field);
+    let startType;
+    if (ExpressionUtils.isField(expr2.receiver)) {
+      const receiverField = requireField(this.schema, context.model, expr2.receiver.field);
+      startType = receiverField.type;
+    } else {
+      startType = context.model;
+    }
     const memberFields = [];
-    let currType = receiverField.type;
-    for (const member of expr2.members) {
+    let currType = startType;
+    for (const member of members) {
       const fieldDef = requireField(this.schema, currType, member);
       memberFields.push({
         fieldDef,
@@ -2093,22 +2166,21 @@ var ExpressionTransformer = class {
       currType = fieldDef.type;
     }
     let currNode = void 0;
-    for (let i = expr2.members.length - 1; i >= 0; i--) {
-      const member = expr2.members[i];
+    for (let i = members.length - 1; i >= 0; i--) {
+      const member = members[i];
       const { fieldDef, fromModel } = memberFields[i];
       if (fieldDef.relation) {
         const relation = this.transformRelationAccess(member, fieldDef.type, {
           ...restContext,
           model: fromModel,
-          alias: void 0,
-          thisEntity: void 0
+          alias: void 0
         });
         if (currNode) {
           invariant5(SelectQueryNode.is(currNode), "expected select query node");
           currNode = {
             ...relation,
             selections: [
-              SelectionNode.create(AliasNode2.create(currNode, IdentifierNode.create(expr2.members[i + 1])))
+              SelectionNode.create(AliasNode2.create(currNode, IdentifierNode.create(members[i + 1])))
             ]
           };
         } else {
@@ -2121,7 +2193,7 @@ var ExpressionTransformer = class {
           };
         }
       } else {
-        invariant5(i === expr2.members.length - 1, "plain field access must be the last segment");
+        invariant5(i === members.length - 1, "plain field access must be the last segment");
         invariant5(!currNode, "plain field access must be the last segment");
         currNode = ColumnNode.create(member);
       }
@@ -2148,35 +2220,19 @@ var ExpressionTransformer = class {
   transformRelationAccess(field, relationModel, context) {
     const fromModel = context.model;
     const { keyPairs, ownedByModel } = getRelationForeignKeyFieldPairs(this.schema, fromModel, field);
-    if (context.thisEntity) {
-      let condition;
-      if (ownedByModel) {
-        condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => BinaryOperationNode2.create(ReferenceNode2.create(ColumnNode.create(pk), TableNode2.create(relationModel)), OperatorNode2.create("="), context.thisEntity[fk])));
-      } else {
-        condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => BinaryOperationNode2.create(ReferenceNode2.create(ColumnNode.create(fk), TableNode2.create(relationModel)), OperatorNode2.create("="), context.thisEntity[pk])));
-      }
-      return {
-        kind: "SelectQueryNode",
-        from: FromNode.create([
-          TableNode2.create(relationModel)
-        ]),
-        where: WhereNode.create(condition)
-      };
+    let condition;
+    if (ownedByModel) {
+      condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => BinaryOperationNode2.create(ReferenceNode2.create(ColumnNode.create(fk), TableNode2.create(context.alias ?? fromModel)), OperatorNode2.create("="), ReferenceNode2.create(ColumnNode.create(pk), TableNode2.create(relationModel)))));
     } else {
-      let condition;
-      if (ownedByModel) {
-        condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => BinaryOperationNode2.create(ReferenceNode2.create(ColumnNode.create(fk), TableNode2.create(context.alias ?? fromModel)), OperatorNode2.create("="), ReferenceNode2.create(ColumnNode.create(pk), TableNode2.create(relationModel)))));
-      } else {
-        condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => BinaryOperationNode2.create(ReferenceNode2.create(ColumnNode.create(pk), TableNode2.create(context.alias ?? fromModel)), OperatorNode2.create("="), ReferenceNode2.create(ColumnNode.create(fk), TableNode2.create(relationModel)))));
-      }
-      return {
-        kind: "SelectQueryNode",
-        from: FromNode.create([
-          TableNode2.create(relationModel)
-        ]),
-        where: WhereNode.create(condition)
-      };
+      condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => BinaryOperationNode2.create(ReferenceNode2.create(ColumnNode.create(pk), TableNode2.create(context.alias ?? fromModel)), OperatorNode2.create("="), ReferenceNode2.create(ColumnNode.create(fk), TableNode2.create(relationModel)))));
     }
+    return {
+      kind: "SelectQueryNode",
+      from: FromNode.create([
+        TableNode2.create(relationModel)
+      ]),
+      where: WhereNode.create(condition)
+    };
   }
   createColumnRef(column, context) {
     return ReferenceNode2.create(ColumnNode.create(column), TableNode2.create(context.alias ?? context.model));
@@ -2190,6 +2246,18 @@ var ExpressionTransformer = class {
   isNullNode(node) {
     return ValueNode2.is(node) && node.value === null;
   }
+  buildLogicalNot(result) {
+    return ExpressionUtils.unary("!", result);
+  }
+  buildAnd(conditions) {
+    if (conditions.length === 0) {
+      return ExpressionUtils.literal(true);
+    } else if (conditions.length === 1) {
+      return conditions[0];
+    } else {
+      return conditions.reduce((acc, condition) => ExpressionUtils.binary(acc, "&&", condition));
+    }
+  }
 };
 _ts_decorate([
   expr("literal"),
@@ -2319,29 +2387,47 @@ var PolicyHandler = class extends OperationNodeTransformer {
     return selectedColumns.every((c) => idFields.includes(c));
   }
   async enforcePreCreatePolicy(node, proceed) {
-    if (!node.columns || !node.values) {
-      return;
-    }
     const model = this.getMutationModel(node);
-    const fields = node.columns.map((c) => c.column.name);
-    const valueRows = this.unwrapCreateValueRows(node.values, model, fields);
+    const fields = node.columns?.map((c) => c.column.name) ?? [];
+    const valueRows = node.values ? this.unwrapCreateValueRows(node.values, model, fields) : [
+      []
+    ];
     for (const values of valueRows) {
-      await this.enforcePreCreatePolicyForOne(model, fields, values.map((v) => v.node), values.map((v) => v.raw), proceed);
+      await this.enforcePreCreatePolicyForOne(model, fields, values.map((v) => v.node), proceed);
     }
   }
-  async enforcePreCreatePolicyForOne(model, fields, values, valuesRaw, proceed) {
-    const thisEntity = {};
-    const thisEntityRaw = {};
-    for (let i = 0; i < fields.length; i++) {
-      thisEntity[fields[i]] = values[i];
-      thisEntityRaw[fields[i]] = valuesRaw[i];
+  async enforcePreCreatePolicyForOne(model, fields, values, proceed) {
+    const allFields = Object.keys(requireModel(this.client.$schema, model).fields);
+    const allValues = [];
+    for (const fieldName of allFields) {
+      const index = fields.indexOf(fieldName);
+      if (index >= 0) {
+        allValues.push(values[index]);
+      } else {
+        allValues.push(ValueNode3.createImmediate(null));
+      }
     }
-    const filter = this.buildPolicyFilter(model, void 0, "create", thisEntity, thisEntityRaw);
+    const constTable = {
+      kind: "SelectQueryNode",
+      from: FromNode2.create([
+        AliasNode3.create(ParensNode2.create(ValuesNode.create([
+          ValueListNode2.create(allValues)
+        ])), IdentifierNode2.create("$t"))
+      ]),
+      selections: allFields.map((field, index) => SelectionNode2.create(AliasNode3.create(ColumnNode2.create(`column${index + 1}`), IdentifierNode2.create(field))))
+    };
+    const filter = this.buildPolicyFilter(model, void 0, "create");
     const preCreateCheck = {
       kind: "SelectQueryNode",
+      from: FromNode2.create([
+        AliasNode3.create(constTable, IdentifierNode2.create(model))
+      ]),
       selections: [
-        SelectionNode2.create(AliasNode3.create(filter, IdentifierNode2.create("$condition")))
-      ]
+        SelectionNode2.create(AliasNode3.create(BinaryOperationNode3.create(FunctionNode3.create("COUNT", [
+          ValueNode3.createImmediate(1)
+        ]), OperatorNode3.create(">"), ValueNode3.createImmediate(0)), IdentifierNode2.create("$condition")))
+      ],
+      where: WhereNode2.create(filter)
     };
     const result = await proceed(preCreateCheck);
     if (!result.rows[0]?.$condition) {
@@ -2458,13 +2544,13 @@ var PolicyHandler = class extends OperationNodeTransformer {
   isMutationQueryNode(node) {
     return InsertQueryNode.is(node) || UpdateQueryNode.is(node) || DeleteQueryNode.is(node);
   }
-  buildPolicyFilter(model, alias, operation, thisEntity, thisEntityRaw) {
+  buildPolicyFilter(model, alias, operation) {
     const policies = this.getModelPolicies(model, operation);
     if (policies.length === 0) {
       return falseNode(this.dialect);
     }
-    const allows = policies.filter((policy) => policy.kind === "allow").map((policy) => this.transformPolicyCondition(model, alias, operation, policy, thisEntity, thisEntityRaw));
-    const denies = policies.filter((policy) => policy.kind === "deny").map((policy) => this.transformPolicyCondition(model, alias, operation, policy, thisEntity, thisEntityRaw));
+    const allows = policies.filter((policy) => policy.kind === "allow").map((policy) => this.transformPolicyCondition(model, alias, operation, policy));
+    const denies = policies.filter((policy) => policy.kind === "deny").map((policy) => this.transformPolicyCondition(model, alias, operation, policy));
     let combinedPolicy;
     if (allows.length === 0) {
       combinedPolicy = falseNode(this.dialect);
@@ -2560,13 +2646,11 @@ var PolicyHandler = class extends OperationNodeTransformer {
       return void 0;
     }
   }
-  transformPolicyCondition(model, alias, operation, policy, thisEntity, thisEntityRaw) {
+  transformPolicyCondition(model, alias, operation, policy) {
     return new ExpressionTransformer(this.client.$schema, this.client.$options, this.client.$auth).transform(policy.condition, {
       model,
       alias,
       operation,
-      thisEntity,
-      thisEntityRaw,
       auth: this.client.$auth
     });
   }