zenstack 0.6.0-pre.8 → 1.0.0-alpha.100

package/plugins/access-policy/expression-writer.js

@@ -0,0 +1,475 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExpressionWriter = void 0;
+const ast_1 = require("@zenstackhq/language/ast");
+const sdk_1 = require("@zenstackhq/sdk");
+const constants_1 = require("../../language-server/constants");
+const ast_utils_1 = require("../../utils/ast-utils");
+const typescript_expression_transformer_1 = __importDefault(require("./typescript-expression-transformer"));
+const utils_1 = require("./utils");
+/**
+ * Utility for writing ZModel expression as Prisma query argument objects into a ts-morph writer
+ */
+class ExpressionWriter {
+    /**
+     * Constructs a new ExpressionWriter
+     *
+     * @param isPostGuard indicates if we're writing for post-update conditions
+     */
+    constructor(writer, isPostGuard = false) {
+        this.writer = writer;
+        this.isPostGuard = isPostGuard;
+        this.plainExprBuilder = new typescript_expression_transformer_1.default(this.isPostGuard);
+    }
+    /**
+     * Writes the given ZModel expression.
+     */
+    write(expr) {
+        switch (expr.$type) {
+            case ast_1.LiteralExpr:
+                this.writeLiteral(expr);
+                break;
+            case ast_1.UnaryExpr:
+                this.writeUnary(expr);
+                break;
+            case ast_1.BinaryExpr:
+                this.writeBinary(expr);
+                break;
+            case ast_1.ReferenceExpr:
+                this.writeReference(expr);
+                break;
+            case ast_1.MemberAccessExpr:
+                this.writeMemberAccess(expr);
+                break;
+            case ast_1.InvocationExpr:
+                this.writeInvocation(expr);
+                break;
+            default:
+                throw new Error(`Not implemented: ${expr.$type}`);
+        }
+    }
+    writeReference(expr) {
+        if ((0, ast_1.isEnumField)(expr.target.ref)) {
+            throw new Error('We should never get here');
+        }
+        else {
+            this.block(() => {
+                var _a;
+                this.writer.write(`${(_a = expr.target.ref) === null || _a === void 0 ? void 0 : _a.name}: true`);
+            });
+        }
+    }
+    writeMemberAccess(expr) {
+        this.block(() => {
+            if (this.isAuthOrAuthMemberAccess(expr)) {
+                // member access of `auth()`, generate plain expression
+                this.guard(() => this.plain(expr), true);
+            }
+            else {
+                // must be a boolean member
+                this.writeFieldCondition(expr.operand, () => {
+                    this.block(() => {
+                        var _a;
+                        this.writer.write(`${(_a = expr.member.ref) === null || _a === void 0 ? void 0 : _a.name}: true`);
+                    });
+                });
+            }
+        });
+    }
+    writeExprList(exprs) {
+        this.writer.write('[');
+        for (let i = 0; i < exprs.length; i++) {
+            this.write(exprs[i]);
+            if (i !== exprs.length - 1) {
+                this.writer.write(',');
+            }
+        }
+        this.writer.write(']');
+    }
+    writeBinary(expr) {
+        switch (expr.operator) {
+            case '&&':
+            case '||':
+                this.writeLogical(expr, expr.operator);
+                break;
+            case '==':
+            case '!=':
+            case '>':
+            case '>=':
+            case '<':
+            case '<=':
+                this.writeComparison(expr, expr.operator);
+                break;
+            case 'in':
+                this.writeIn(expr);
+                break;
+            case '?':
+            case '!':
+            case '^':
+                this.writeCollectionPredicate(expr, expr.operator);
+                break;
+        }
+    }
+    writeIn(expr) {
+        this.block(() => {
+            this.writeFieldCondition(expr.left, () => {
+                this.plain(expr.right);
+            }, 'in');
+        });
+    }
+    writeCollectionPredicate(expr, operator) {
+        this.block(() => {
+            this.writeFieldCondition(expr.left, () => {
+                this.write(expr.right);
+            }, operator === '?' ? 'some' : operator === '!' ? 'every' : 'none');
+        });
+    }
+    isFieldAccess(expr) {
+        if ((0, ast_1.isThisExpr)(expr)) {
+            return true;
+        }
+        if ((0, ast_1.isMemberAccessExpr)(expr)) {
+            if ((0, utils_1.isFutureExpr)(expr.operand) && this.isPostGuard) {
+                // when writing for post-update, future().field.x is a field access
+                return true;
+            }
+            else {
+                return this.isFieldAccess(expr.operand);
+            }
+        }
+        if ((0, ast_1.isReferenceExpr)(expr) && (0, ast_1.isDataModelField)(expr.target.ref) && !this.isPostGuard) {
+            return true;
+        }
+        return false;
+    }
+    guard(write, cast = false) {
+        this.writer.write(`${sdk_1.GUARD_FIELD_NAME}: `);
+        if (cast) {
+            this.writer.write('!!');
+            write();
+        }
+        else {
+            write();
+        }
+    }
+    plain(expr) {
+        this.writer.write(this.plainExprBuilder.transform(expr));
+    }
+    writeComparison(expr, operator) {
+        var _a;
+        const leftIsFieldAccess = this.isFieldAccess(expr.left);
+        const rightIsFieldAccess = this.isFieldAccess(expr.right);
+        if (leftIsFieldAccess && rightIsFieldAccess) {
+            throw new sdk_1.PluginError(`Comparison between fields are not supported yet`);
+        }
+        if (!leftIsFieldAccess && !rightIsFieldAccess) {
+            // compile down to a plain expression
+            this.block(() => {
+                this.guard(() => {
+                    this.plain(expr);
+                });
+            });
+            return;
+        }
+        let fieldAccess;
+        let operand;
+        if (leftIsFieldAccess) {
+            fieldAccess = expr.left;
+            operand = expr.right;
+        }
+        else {
+            fieldAccess = expr.right;
+            operand = expr.left;
+            operator = this.negateOperator(operator);
+        }
+        if ((0, ast_1.isMemberAccessExpr)(fieldAccess) && (0, utils_1.isFutureExpr)(fieldAccess.operand)) {
+            // future().field should be treated as the "field" directly, so we
+            // strip 'future().' and synthesize a reference expr
+            fieldAccess = {
+                $type: ast_1.ReferenceExpr,
+                $container: fieldAccess.$container,
+                target: fieldAccess.member,
+                $resolvedType: fieldAccess.$resolvedType,
+            };
+        }
+        // guard member access of `auth()` with null check
+        if (this.isAuthOrAuthMemberAccess(operand) && !((_a = fieldAccess.$resolvedType) === null || _a === void 0 ? void 0 : _a.nullable)) {
+            this.writer.write(`(${this.plainExprBuilder.transform(operand)} == null) ? { ${sdk_1.GUARD_FIELD_NAME}: ${
+            // auth().x != user.x is true when auth().x is null and user is not nullable
+            // other expressions are evaluated to false when null is involved
+            operator === '!=' ? 'true' : 'false'} } : `);
+        }
+        this.block(() => {
+            this.writeFieldCondition(fieldAccess, () => {
+                this.block(() => {
+                    var _a;
+                    const dataModel = this.isModelTyped(fieldAccess);
+                    if (dataModel && (0, ast_utils_1.isAuthInvocation)(operand)) {
+                        // right now this branch only serves comparison with `auth`, like
+                        //     @@allow('all', owner == auth())
+                        const idFields = (0, ast_utils_1.getIdFields)(dataModel);
+                        if (!idFields || idFields.length === 0) {
+                            throw new sdk_1.PluginError(`Data model ${dataModel.name} does not have an id field`);
+                        }
+                        if (operator !== '==' && operator !== '!=') {
+                            throw new sdk_1.PluginError('Only == and != operators are allowed');
+                        }
+                        if (!(0, ast_1.isThisExpr)(fieldAccess)) {
+                            this.writer.writeLine(operator === '==' ? 'is:' : 'isNot:');
+                            const fieldIsNullable = !!((_a = fieldAccess.$resolvedType) === null || _a === void 0 ? void 0 : _a.nullable);
+                            if (fieldIsNullable) {
+                                // if field is nullable, we can generate "null" check condition
+                                this.writer.write(`(user == null) ? null : `);
+                            }
+                        }
+                        this.block(() => {
+                            idFields.forEach((idField, idx) => {
+                                const writeIdsCheck = () => {
+                                    // id: user.id
+                                    this.writer.write(`${idField.name}:`);
+                                    this.plain(operand);
+                                    this.writer.write(`.${idField.name}`);
+                                    if (idx !== idFields.length - 1) {
+                                        this.writer.write(',');
+                                    }
+                                };
+                                if ((0, ast_1.isThisExpr)(fieldAccess) && operator === '!=') {
+                                    // wrap a not
+                                    this.writer.writeLine('NOT:');
+                                    this.block(() => writeIdsCheck());
+                                }
+                                else {
+                                    writeIdsCheck();
+                                }
+                            });
+                        });
+                    }
+                    else {
+                        this.writeOperator(operator, fieldAccess, () => {
+                            this.plain(operand);
+                        });
+                    }
+                }, !(0, ast_1.isThisExpr)(fieldAccess));
+            });
+        }, 
+        // "this" expression is compiled away (to .id access), so we should
+        // avoid generating a new layer
+        !(0, ast_1.isThisExpr)(fieldAccess));
+    }
+    isAuthOrAuthMemberAccess(expr) {
+        return (0, ast_utils_1.isAuthInvocation)(expr) || ((0, ast_1.isMemberAccessExpr)(expr) && (0, ast_utils_1.isAuthInvocation)(expr.operand));
+    }
+    writeOperator(operator, fieldAccess, writeOperand) {
+        var _a;
+        if ((0, ast_1.isDataModel)((_a = fieldAccess.$resolvedType) === null || _a === void 0 ? void 0 : _a.decl)) {
+            if (operator === '==') {
+                this.writer.write('is: ');
+            }
+            else if (operator === '!=') {
+                this.writer.write('isNot: ');
+            }
+            else {
+                throw new sdk_1.PluginError('Only == and != operators are allowed for data model comparison');
+            }
+            writeOperand();
+        }
+        else {
+            if (operator === '!=') {
+                // wrap a 'not'
+                this.writer.write('not: ');
+                this.block(() => {
+                    this.writer.write(`${this.mapOperator('==')}: `);
+                    writeOperand();
+                });
+            }
+            else {
+                this.writer.write(`${this.mapOperator(operator)}: `);
+                writeOperand();
+            }
+        }
+    }
+    writeFieldCondition(fieldAccess, writeCondition, filterOp, extraArgs) {
+        var _a, _b, _c;
+        let selector;
+        let operand;
+        if ((0, ast_1.isThisExpr)(fieldAccess)) {
+            // pass on
+            writeCondition();
+            return;
+        }
+        else if ((0, ast_1.isReferenceExpr)(fieldAccess)) {
+            selector = (_a = fieldAccess.target.ref) === null || _a === void 0 ? void 0 : _a.name;
+        }
+        else if ((0, ast_1.isMemberAccessExpr)(fieldAccess)) {
+            if ((0, utils_1.isFutureExpr)(fieldAccess.operand)) {
+                // future().field should be treated as the "field"
+                selector = (_b = fieldAccess.member.ref) === null || _b === void 0 ? void 0 : _b.name;
+            }
+            else {
+                selector = (_c = fieldAccess.member.ref) === null || _c === void 0 ? void 0 : _c.name;
+                operand = fieldAccess.operand;
+            }
+        }
+        else {
+            throw new sdk_1.PluginError(`Unsupported expression type: ${fieldAccess.$type}`);
+        }
+        if (!selector) {
+            throw new sdk_1.PluginError(`Failed to write FieldAccess expression`);
+        }
+        const writerFilterOutput = () => {
+            this.writer.write(selector + ': ');
+            if (filterOp) {
+                this.block(() => {
+                    this.writer.write(`${filterOp}: `);
+                    writeCondition();
+                    if (extraArgs) {
+                        for (const [k, v] of Object.entries(extraArgs)) {
+                            this.writer.write(`,\n${k}: `);
+                            this.plain(v);
+                        }
+                    }
+                });
+            }
+            else {
+                writeCondition();
+            }
+        };
+        if (operand) {
+            // member access expression
+            this.writeFieldCondition(operand, () => {
+                this.block(writerFilterOutput, 
+                // if operand is "this", it doesn't really generate a new layer of query,
+                // so we should avoid generating a new block
+                !(0, ast_1.isThisExpr)(operand));
+            });
+        }
+        else {
+            writerFilterOutput();
+        }
+    }
+    block(write, condition = true) {
+        if (condition) {
+            this.writer.inlineBlock(write);
+        }
+        else {
+            write();
+        }
+    }
+    isModelTyped(expr) {
+        var _a, _b;
+        return (0, ast_1.isDataModel)((_a = expr.$resolvedType) === null || _a === void 0 ? void 0 : _a.decl) ? (_b = expr.$resolvedType) === null || _b === void 0 ? void 0 : _b.decl : undefined;
+    }
+    mapOperator(operator) {
+        switch (operator) {
+            case '==':
+                return 'equals';
+            case '!=':
+                throw new Error('Operation != should have been compiled away');
+            case '>':
+                return 'gt';
+            case '>=':
+                return 'gte';
+            case '<':
+                return 'lt';
+            case '<=':
+                return 'lte';
+        }
+    }
+    negateOperator(operator) {
+        switch (operator) {
+            case '>':
+                return '<=';
+            case '<':
+                return '>=';
+            case '>=':
+                return '<';
+            case '<=':
+                return '>';
+            default:
+                return operator;
+        }
+    }
+    writeLogical(expr, operator) {
+        // TODO: do we need short-circuit for logical operators?
+        if (operator === '&&') {
+            // // && short-circuit: left && right -> left ? right : { zenstack_guard: false }
+            // if (!this.hasFieldAccess(expr.left)) {
+            //     this.plain(expr.left);
+            //     this.writer.write(' ? ');
+            //     this.write(expr.right);
+            //     this.writer.write(' : ');
+            //     this.block(() => this.guard(() => this.writer.write('false')));
+            // } else {
+            this.block(() => {
+                this.writer.write('AND:');
+                this.writeExprList([expr.left, expr.right]);
+            });
+            // }
+        }
+        else {
+            // // || short-circuit: left || right -> left ? { zenstack_guard: true } : right
+            // if (!this.hasFieldAccess(expr.left)) {
+            //     this.plain(expr.left);
+            //     this.writer.write(' ? ');
+            //     this.block(() => this.guard(() => this.writer.write('true')));
+            //     this.writer.write(' : ');
+            //     this.write(expr.right);
+            // } else {
+            this.block(() => {
+                this.writer.write('OR:');
+                this.writeExprList([expr.left, expr.right]);
+            });
+            // }
+        }
+    }
+    writeUnary(expr) {
+        if (expr.operator !== '!') {
+            throw new sdk_1.PluginError(`Unary operator "${expr.operator}" is not supported`);
+        }
+        this.block(() => {
+            this.writer.write('NOT: ');
+            this.write(expr.operand);
+        });
+    }
+    writeLiteral(expr) {
+        this.block(() => {
+            this.guard(() => {
+                this.plain(expr);
+            });
+        });
+    }
+    writeInvocation(expr) {
+        var _a, _b;
+        const funcDecl = expr.function.ref;
+        if (!funcDecl) {
+            throw new sdk_1.PluginError(`Failed to resolve function declaration`);
+        }
+        if (constants_1.FILTER_OPERATOR_FUNCTIONS.includes(funcDecl.name)) {
+            let valueArg = (_a = expr.args[1]) === null || _a === void 0 ? void 0 : _a.value;
+            // isEmpty function is zero arity, it's mapped to a boolean literal
+            if (funcDecl.name === 'isEmpty') {
+                valueArg = { $type: ast_1.LiteralExpr, value: true };
+            }
+            // contains function has a 3rd argument that indicates whether the comparison should be case-insensitive
+            let extraArgs = undefined;
+            if (funcDecl.name === 'contains') {
+                if ((0, sdk_1.getLiteral)((_b = expr.args[2]) === null || _b === void 0 ? void 0 : _b.value) === true) {
+                    extraArgs = { mode: { $type: ast_1.LiteralExpr, value: 'insensitive' } };
+                }
+            }
+            this.block(() => {
+                this.writeFieldCondition(expr.args[0].value, () => {
+                    this.plain(valueArg);
+                }, funcDecl.name, extraArgs);
+            });
+        }
+        else {
+            throw new sdk_1.PluginError(`Unsupported function ${funcDecl.name}`);
+        }
+    }
+}
+exports.ExpressionWriter = ExpressionWriter;
+//# sourceMappingURL=expression-writer.js.map

package/plugins/access-policy/expression-writer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"expression-writer.js","sourceRoot":"","sources":["../../../src/plugins/access-policy/expression-writer.ts"],"names":[],"mappings":";;;;;;AAAA,kDAekC;AAClC,yCAA4E;AAE5E,+DAA4E;AAC5E,qDAAsE;AACtE,4GAAkF;AAClF,mCAAuC;AAmBvC;;GAEG;AACH,MAAa,gBAAgB;IAGzB;;;;OAIG;IACH,YAA6B,MAAuB,EAAmB,cAAc,KAAK;QAA7D,WAAM,GAAN,MAAM,CAAiB;QAAmB,gBAAW,GAAX,WAAW,CAAQ;QACtF,IAAI,CAAC,gBAAgB,GAAG,IAAI,2CAA+B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAClF,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAgB;QAClB,QAAQ,IAAI,CAAC,KAAK,EAAE;YAChB,KAAK,iBAAW;gBACZ,IAAI,CAAC,YAAY,CAAC,IAAmB,CAAC,CAAC;gBACvC,MAAM;YAEV,KAAK,eAAS;gBACV,IAAI,CAAC,UAAU,CAAC,IAAiB,CAAC,CAAC;gBACnC,MAAM;YAEV,KAAK,gBAAU;gBACX,IAAI,CAAC,WAAW,CAAC,IAAkB,CAAC,CAAC;gBACrC,MAAM;YAEV,KAAK,mBAAa;gBACd,IAAI,CAAC,cAAc,CAAC,IAAqB,CAAC,CAAC;gBAC3C,MAAM;YAEV,KAAK,sBAAgB;gBACjB,IAAI,CAAC,iBAAiB,CAAC,IAAwB,CAAC,CAAC;gBACjD,MAAM;YAEV,KAAK,oBAAc;gBACf,IAAI,CAAC,eAAe,CAAC,IAAsB,CAAC,CAAC;gBAC7C,MAAM;YAEV;gBACI,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;SACzD;IACL,CAAC;IAEO,cAAc,CAAC,IAAmB;QACtC,IAAI,IAAA,iBAAW,EAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YAC9B,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;SAC/C;aAAM;YACH,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;;gBACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAA,IAAI,CAAC,MAAM,CAAC,GAAG,0CAAE,IAAI,QAAQ,CAAC,CAAC;YACxD,CAAC,CAAC,CAAC;SACN;IACL,CAAC;IAEO,iBAAiB,CAAC,IAAsB;QAC5C,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YACZ,IAAI,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE;gBACrC,uDAAuD;gBACvD,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;aAC5C;iBAAM;gBACH,2BAA2B;gBAC3B,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;oBACxC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;;wBACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAA,IAAI,CAAC,MAAM,CAAC,GAAG,0CAAE,IAAI,QAAQ,CAAC,CAAC;oBACxD,CAAC,CAAC,CAAC;gBACP,CAAC,CAAC,CAAC;aACN;QACL,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,aAAa,CAAC,KAAmB;QACrC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;YACnC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;gBACxB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;aAC1B;SACJ;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAEO,WAAW,CAAC,IAAgB;QAChC,QAAQ,IAAI,CAAC,QAAQ,EAAE;YACnB,KAAK,IAAI,CAAC;YACV,KAAK,IAAI;gBACL,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACvC,MAAM;YAEV,KAAK,IAAI,CAAC;YACV,KAAK,IAAI,CAAC;YACV,KAAK,GAAG,CAAC;YACT,KAAK,IAAI,CAAC;YACV,KAAK,GAAG,CAAC;YACT,KAAK,IAAI;gBACL,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC1C,MAAM;YAEV,KAAK,IAAI;gBACL,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACnB,MAAM;YAEV,KAAK,GAAG,CAAC;YACT,KAAK,GAAG,CAAC;YACT,KAAK,GAAG;gBACJ,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACnD,MAAM;SACb;IACL,CAAC;IAEO,OAAO,CAAC,IAAgB;QAC5B,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,mBAAmB,CACpB,IAAI,CAAC,IAAI,EACT,GAAG,EAAE;gBACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC,EACD,IAAI,CACP,CAAC;QACN,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,wBAAwB,CAAC,IAAgB,EAAE,QAAgB;QAC/D,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,mBAAmB,CACpB,IAAI,CAAC,IAAI,EACT,GAAG,EAAE;gBACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC,EACD,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAClE,CAAC;QACN,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,aAAa,CAAC,IAAgB;QAClC,IAAI,IAAA,gBAAU,EAAC,IAAI,CAAC,EAAE;YAClB,OAAO,IAAI,CAAC;SACf;QAED,IAAI,IAAA,wBAAkB,EAAC,IAAI,CAAC,EAAE;YAC1B,IAAI,IAAA,oBAAY,EAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE;gBAChD,mEAAmE;gBACnE,OAAO,IAAI,CAAC;aACf;iBAAM;gBACH,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;aAC3C;SACJ;QACD,IAAI,IAAA,qBAAe,EAAC,IAAI,CAAC,IAAI,IAAA,sBAAgB,EAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YACjF,OAAO,IAAI,CAAC;SACf;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,KAAiB,EAAE,IAAI,GAAG,KAAK;QACzC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,sBAAgB,IAAI,CAAC,CAAC;QAC3C,IAAI,IAAI,EAAE;YACN,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACxB,KAAK,EAAE,CAAC;SACX;aAAM;YACH,KAAK,EAAE,CAAC;SACX;IACL,CAAC;IAEO,KAAK,CAAC,IAAgB;QAC1B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,CAAC;IAEO,eAAe,CAAC,IAAgB,EAAE,QAA4B;;QAClE,MAAM,iBAAiB,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,kBAAkB,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE1D,IAAI,iBAAiB,IAAI,kBAAkB,EAAE;YACzC,MAAM,IAAI,iBAAW,CAAC,iDAAiD,CAAC,CAAC;SAC5E;QAED,IAAI,CAAC,iBAAiB,IAAI,CAAC,kBAAkB,EAAE;YAC3C,qCAAqC;YACrC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;gBACZ,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;oBACZ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACrB,CAAC,CAAC,CAAC;YACP,CAAC,CAAC,CAAC;YACH,OAAO;SACV;QAED,IAAI,WAAuB,CAAC;QAC5B,IAAI,OAAmB,CAAC;QACxB,IAAI,iBAAiB,EAAE;YACnB,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC;YACxB,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;SACxB;aAAM;YACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC;YACzB,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC;YACpB,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;SAC5C;QAED,IAAI,IAAA,wBAAkB,EAAC,WAAW,CAAC,IAAI,IAAA,oBAAY,EAAC,WAAW,CAAC,OAAO,CAAC,EAAE;YACtE,kEAAkE;YAClE,oDAAoD;YACpD,WAAW,GAAG;gBACV,KAAK,EAAE,mBAAa;gBACpB,UAAU,EAAE,WAAW,CAAC,UAAU;gBAClC,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,aAAa,EAAE,WAAW,CAAC,aAAa;aAC1B,CAAC;SACtB;QAED,kDAAkD;QAClD,IAAI,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA,MAAA,WAAW,CAAC,aAAa,0CAAE,QAAQ,CAAA,EAAE;YAChF,IAAI,CAAC,MAAM,CAAC,KAAK,CACb,IAAI,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC,iBAAiB,sBAAgB,KAAK;YAC9E,4EAA4E;YAC5E,iEAAiE;YACjE,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OACjC,OAAO,CACV,CAAC;SACL;QAED,IAAI,CAAC,KAAK,CACN,GAAG,EAAE;YACD,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,GAAG,EAAE;gBACvC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;;oBACZ,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;oBACjD,IAAI,SAAS,IAAI,IAAA,4BAAgB,EAAC,OAAO,CAAC,EAAE;wBACxC,iEAAiE;wBACjE,sCAAsC;wBAEtC,MAAM,QAAQ,GAAG,IAAA,uBAAW,EAAC,SAAS,CAAC,CAAC;wBACxC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE;4BACpC,MAAM,IAAI,iBAAW,CAAC,cAAc,SAAS,CAAC,IAAI,4BAA4B,CAAC,CAAC;yBACnF;wBAED,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI,EAAE;4BACxC,MAAM,IAAI,iBAAW,CAAC,sCAAsC,CAAC,CAAC;yBACjE;wBAED,IAAI,CAAC,IAAA,gBAAU,EAAC,WAAW,CAAC,EAAE;4BAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;4BAC5D,MAAM,eAAe,GAAG,CAAC,CAAC,CAAA,MAAA,WAAW,CAAC,aAAa,0CAAE,QAAQ,CAAA,CAAC;4BAC9D,IAAI,eAAe,EAAE;gCACjB,+DAA+D;gCAC/D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;6BACjD;yBACJ;wBAED,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;4BACZ,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;gCAC9B,MAAM,aAAa,GAAG,GAAG,EAAE;oCACvB,cAAc;oCACd,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;oCACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oCACpB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;oCACtC,IAAI,GAAG,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;wCAC7B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;qCAC1B;gCACL,CAAC,CAAC;gCAEF,IAAI,IAAA,gBAAU,EAAC,WAAW,CAAC,IAAI,QAAQ,KAAK,IAAI,EAAE;oCAC9C,aAAa;oCACb,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;oCAC9B,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC;iCACrC;qCAAM;oCACH,aAAa,EAAE,CAAC;iCACnB;4BACL,CAAC,CAAC,CAAC;wBACP,CAAC,CAAC,CAAC;qBACN;yBAAM;wBACH,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE;4BAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;wBACxB,CAAC,CAAC,CAAC;qBACN;gBACL,CAAC,EAAE,CAAC,IAAA,gBAAU,EAAC,WAAW,CAAC,CAAC,CAAC;YACjC,CAAC,CAAC,CAAC;QACP,CAAC;QACD,mEAAmE;QACnE,+BAA+B;QAC/B,CAAC,IAAA,gBAAU,EAAC,WAAW,CAAC,CAC3B,CAAC;IACN,CAAC;IAEO,wBAAwB,CAAC,IAAgB;QAC7C,OAAO,IAAA,4BAAgB,EAAC,IAAI,CAAC,IAAI,CAAC,IAAA,wBAAkB,EAAC,IAAI,CAAC,IAAI,IAAA,4BAAgB,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAClG,CAAC;IAEO,aAAa,CAAC,QAA4B,EAAE,WAAuB,EAAE,YAAwB;;QACjG,IAAI,IAAA,iBAAW,EAAC,MAAA,WAAW,CAAC,aAAa,0CAAE,IAAI,CAAC,EAAE;YAC9C,IAAI,QAAQ,KAAK,IAAI,EAAE;gBACnB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;aAC7B;iBAAM,IAAI,QAAQ,KAAK,IAAI,EAAE;gBAC1B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;aAChC;iBAAM;gBACH,MAAM,IAAI,iBAAW,CAAC,gEAAgE,CAAC,CAAC;aAC3F;YACD,YAAY,EAAE,CAAC;SAClB;aAAM;YACH,IAAI,QAAQ,KAAK,IAAI,EAAE;gBACnB,eAAe;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC3B,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;oBACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACjD,YAAY,EAAE,CAAC;gBACnB,CAAC,CAAC,CAAC;aACN;iBAAM;gBACH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACrD,YAAY,EAAE,CAAC;aAClB;SACJ;IACL,CAAC;IAEO,mBAAmB,CACvB,WAAuB,EACvB,cAA0B,EAC1B,QAA0B,EAC1B,SAAsC;;QAEtC,IAAI,QAA4B,CAAC;QACjC,IAAI,OAA+B,CAAC;QAEpC,IAAI,IAAA,gBAAU,EAAC,WAAW,CAAC,EAAE;YACzB,UAAU;YACV,cAAc,EAAE,CAAC;YACjB,OAAO;SACV;aAAM,IAAI,IAAA,qBAAe,EAAC,WAAW,CAAC,EAAE;YACrC,QAAQ,GAAG,MAAA,WAAW,CAAC,MAAM,CAAC,GAAG,0CAAE,IAAI,CAAC;SAC3C;aAAM,IAAI,IAAA,wBAAkB,EAAC,WAAW,CAAC,EAAE;YACxC,IAAI,IAAA,oBAAY,EAAC,WAAW,CAAC,OAAO,CAAC,EAAE;gBACnC,kDAAkD;gBAClD,QAAQ,GAAG,MAAA,WAAW,CAAC,MAAM,CAAC,GAAG,0CAAE,IAAI,CAAC;aAC3C;iBAAM;gBACH,QAAQ,GAAG,MAAA,WAAW,CAAC,MAAM,CAAC,GAAG,0CAAE,IAAI,CAAC;gBACxC,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC;aACjC;SACJ;aAAM;YACH,MAAM,IAAI,iBAAW,CAAC,gCAAgC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;SAC9E;QAED,IAAI,CAAC,QAAQ,EAAE;YACX,MAAM,IAAI,iBAAW,CAAC,wCAAwC,CAAC,CAAC;SACnE;QAED,MAAM,kBAAkB,GAAG,GAAG,EAAE;YAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;YACnC,IAAI,QAAQ,EAAE;gBACV,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;oBACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,IAAI,CAAC,CAAC;oBACnC,cAAc,EAAE,CAAC;oBAEjB,IAAI,SAAS,EAAE;wBACX,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE;4BAC5C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;4BAC/B,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;yBACjB;qBACJ;gBACL,CAAC,CAAC,CAAC;aACN;iBAAM;gBACH,cAAc,EAAE,CAAC;aACpB;QACL,CAAC,CAAC;QAEF,IAAI,OAAO,EAAE;YACT,2BAA2B;YAC3B,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnC,IAAI,CAAC,KAAK,CACN,kBAAkB;gBAClB,yEAAyE;gBACzE,4CAA4C;gBAC5C,CAAC,IAAA,gBAAU,EAAC,OAAO,CAAC,CACvB,CAAC;YACN,CAAC,CAAC,CAAC;SACN;aAAM;YACH,kBAAkB,EAAE,CAAC;SACxB;IACL,CAAC;IAEO,KAAK,CAAC,KAAiB,EAAE,SAAS,GAAG,IAAI;QAC7C,IAAI,SAAS,EAAE;YACX,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;SAClC;aAAM;YACH,KAAK,EAAE,CAAC;SACX;IACL,CAAC;IAEO,YAAY,CAAC,IAAgB;;QACjC,OAAO,IAAA,iBAAW,EAAC,MAAA,IAAI,CAAC,aAAa,0CAAE,IAAI,CAAC,CAAC,CAAC,CAAE,MAAA,IAAI,CAAC,aAAa,0CAAE,IAAkB,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,CAAC;IAEO,WAAW,CAAC,QAA+C;QAC/D,QAAQ,QAAQ,EAAE;YACd,KAAK,IAAI;gBACL,OAAO,QAAQ,CAAC;YACpB,KAAK,IAAI;gBACL,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACnE,KAAK,GAAG;gBACJ,OAAO,IAAI,CAAC;YAChB,KAAK,IAAI;gBACL,OAAO,KAAK,CAAC;YACjB,KAAK,GAAG;gBACJ,OAAO,IAAI,CAAC;YAChB,KAAK,IAAI;gBACL,OAAO,KAAK,CAAC;SACpB;IACL,CAAC;IAEO,cAAc,CAAC,QAA+C;QAClE,QAAQ,QAAQ,EAAE;YACd,KAAK,GAAG;gBACJ,OAAO,IAAI,CAAC;YAChB,KAAK,GAAG;gBACJ,OAAO,IAAI,CAAC;YAChB,KAAK,IAAI;gBACL,OAAO,GAAG,CAAC;YACf,KAAK,IAAI;gBACL,OAAO,GAAG,CAAC;YACf;gBACI,OAAO,QAAQ,CAAC;SACvB;IACL,CAAC;IAEO,YAAY,CAAC,IAAgB,EAAE,QAAqB;QACxD,wDAAwD;QAExD,IAAI,QAAQ,KAAK,IAAI,EAAE;YACnB,iFAAiF;YACjF,yCAAyC;YACzC,6BAA6B;YAC7B,gCAAgC;YAChC,8BAA8B;YAC9B,gCAAgC;YAChC,sEAAsE;YACtE,WAAW;YACX,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;gBACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC1B,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAChD,CAAC,CAAC,CAAC;YACH,IAAI;SACP;aAAM;YACH,gFAAgF;YAChF,yCAAyC;YACzC,6BAA6B;YAC7B,gCAAgC;YAChC,qEAAqE;YACrE,gCAAgC;YAChC,8BAA8B;YAC9B,WAAW;YACX,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;gBACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACzB,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAChD,CAAC,CAAC,CAAC;YACH,IAAI;SACP;IACL,CAAC;IAEO,UAAU,CAAC,IAAe;QAC9B,IAAI,IAAI,CAAC,QAAQ,KAAK,GAAG,EAAE;YACvB,MAAM,IAAI,iBAAW,CAAC,mBAAmB,IAAI,CAAC,QAAQ,oBAAoB,CAAC,CAAC;SAC/E;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC3B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,YAAY,CAAC,IAAiB;QAClC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;gBACZ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,eAAe,CAAC,IAAoB;;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,QAAQ,EAAE;YACX,MAAM,IAAI,iBAAW,CAAC,wCAAwC,CAAC,CAAC;SACnE;QAED,IAAI,qCAAyB,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;YACnD,IAAI,QAAQ,GAAG,MAAA,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,0CAAE,KAAK,CAAC;YAEnC,mEAAmE;YACnE,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE;gBAC7B,QAAQ,GAAG,EAAE,KAAK,EAAE,iBAAW,EAAE,KAAK,EAAE,IAAI,EAAiB,CAAC;aACjE;YAED,wGAAwG;YACxG,IAAI,SAAS,GAA2C,SAAS,CAAC;YAClE,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE;gBAC9B,IAAI,IAAA,gBAAU,EAAU,MAAA,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,0CAAE,KAAK,CAAC,KAAK,IAAI,EAAE;oBACnD,SAAS,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,iBAAW,EAAE,KAAK,EAAE,aAAa,EAAiB,EAAE,CAAC;iBACrF;aACJ;YAED,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;gBACZ,IAAI,CAAC,mBAAmB,CACpB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAClB,GAAG,EAAE;oBACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACzB,CAAC,EACD,QAAQ,CAAC,IAAuB,EAChC,SAAS,CACZ,CAAC;YACN,CAAC,CAAC,CAAC;SACN;aAAM;YACH,MAAM,IAAI,iBAAW,CAAC,wBAAwB,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;SAClE;IACL,CAAC;CACJ;AA5fD,4CA4fC"}

package/plugins/access-policy/index.d.ts

@@ -0,0 +1,4 @@
+import { Model } from '@zenstackhq/language/ast';
+import { PluginOptions } from '@zenstackhq/sdk';
+export declare const name = "Access Policy";
+export default function run(model: Model, options: PluginOptions): Promise<void>;

package/plugins/access-policy/index.js

@@ -0,0 +1,24 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.name = void 0;
+const policy_guard_generator_1 = __importDefault(require("./policy-guard-generator"));
+exports.name = 'Access Policy';
+function run(model, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        return new policy_guard_generator_1.default().generate(model, options);
+    });
+}
+exports.default = run;
+//# sourceMappingURL=index.js.map

package/plugins/access-policy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/plugins/access-policy/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAEA,sFAAuD;AAE1C,QAAA,IAAI,GAAG,eAAe,CAAC;AAEpC,SAA8B,GAAG,CAAC,KAAY,EAAE,OAAsB;;QAClE,OAAO,IAAI,gCAAe,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;CAAA;AAFD,sBAEC"}

package/plugins/access-policy/policy-guard-generator.d.ts

@@ -0,0 +1,15 @@
+import { Model } from '@zenstackhq/language/ast';
+import { PluginOptions } from '@zenstackhq/sdk';
+/**
+ * Generates source file that contains Prisma query guard objects used for injecting database queries
+ */
+export default class PolicyGenerator {
+    generate(model: Model, options: PluginOptions): Promise<void>;
+    private getPolicyExpressions;
+    private processUpdatePolicies;
+    private visitPolicyExpression;
+    private hasFutureReference;
+    private generateQueryGuardForModel;
+    private generatePreValueSelect;
+    private generateQueryGuardFunction;
+}