zenstack 1.0.0-alpha.23 → 1.0.0-alpha.25

package/plugins/access-policy/policy-guard-generator.js

@@ -1,345 +1,351 @@
 "use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.default = void 0;
-var _ast = require("@zenstackhq/language/ast");
-var _sdk = require("@zenstackhq/sdk");
-var _changeCase = require("change-case");
-var _langium = require("langium");
-var _path = _interopRequireDefault(require("path"));
-var _tsMorph = require("ts-morph");
-var _ = require(".");
-var _utils = require("../../language-server/utils");
-var _astUtils = require("../../utils/ast-utils");
-var _pluginUtils = require("../plugin-utils");
-var _expressionWriter = require("./expression-writer");
-var _utils2 = require("./utils");
-var _zodSchemaGenerator = require("./zod-schema-generator");
-function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const ast_1 = require("@zenstackhq/language/ast");
+const sdk_1 = require("@zenstackhq/sdk");
+const change_case_1 = require("change-case");
+const langium_1 = require("langium");
+const path_1 = __importDefault(require("path"));
+const ts_morph_1 = require("ts-morph");
+const _1 = require(".");
+const utils_1 = require("../../language-server/utils");
+const ast_utils_1 = require("../../utils/ast-utils");
+const plugin_utils_1 = require("../plugin-utils");
+const expression_writer_1 = require("./expression-writer");
+const utils_2 = require("./utils");
+const zod_schema_generator_1 = require("./zod-schema-generator");
 const UNKNOWN_USER_ID = 'zenstack_unknown_user';
-
 /**
  * Generates source file that contains Prisma query guard objects used for injecting database queries
  */
 class PolicyGenerator {
-  async generate(model, options) {
-    const output = options.output ? options.output : (0, _pluginUtils.getDefaultOutputFolder)();
-    if (!output) {
-      console.error(`Unable to determine output path, not running plugin ${_.name}`);
-      return;
-    }
-    const project = new _tsMorph.Project();
-    const sf = project.createSourceFile(_path.default.join(output, 'policy.ts'), undefined, {
-      overwrite: true
-    });
-    sf.addImportDeclaration({
-      namedImports: [{
-        name: 'QueryContext'
-      }],
-      moduleSpecifier: `${_pluginUtils.RUNTIME_PACKAGE}`,
-      isTypeOnly: true
-    });
-    sf.addImportDeclaration({
-      namedImports: [{
-        name: 'z'
-      }],
-      moduleSpecifier: 'zod'
-    });
-
-    // import enums
-    for (const e of model.declarations.filter(d => (0, _ast.isEnum)(d))) {
-      sf.addImportDeclaration({
-        namedImports: [{
-          name: e.name
-        }],
-        moduleSpecifier: '@prisma/client'
-      });
-    }
-    const models = model.declarations.filter(d => (0, _ast.isDataModel)(d));
-    const policyMap = {};
-    for (const model of models) {
-      policyMap[model.name] = await this.generateQueryGuardForModel(model, sf);
-    }
-    const zodGenerator = new _zodSchemaGenerator.ZodSchemaGenerator();
-    sf.addVariableStatement({
-      declarationKind: _tsMorph.VariableDeclarationKind.Const,
-      declarations: [{
-        name: 'policy',
-        initializer: writer => {
-          writer.block(() => {
-            writer.write('guard:');
-            writer.inlineBlock(() => {
-              for (const [model, map] of Object.entries(policyMap)) {
-                writer.write(`${(0, _changeCase.camelCase)(model)}:`);
-                writer.inlineBlock(() => {
-                  for (const [op, func] of Object.entries(map)) {
-                    if (typeof func === 'object') {
-                      writer.write(`${op}: ${JSON.stringify(func)},`);
-                    } else {
-                      writer.write(`${op}: ${func},`);
-                    }
-                  }
+    generate(model, options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const output = options.output ? options.output : (0, plugin_utils_1.getDefaultOutputFolder)();
+            if (!output) {
+                console.error(`Unable to determine output path, not running plugin ${_1.name}`);
+                return;
+            }
+            const project = new ts_morph_1.Project();
+            const sf = project.createSourceFile(path_1.default.join(output, 'policy.ts'), undefined, { overwrite: true });
+            sf.addImportDeclaration({
+                namedImports: [{ name: 'QueryContext' }],
+                moduleSpecifier: `${plugin_utils_1.RUNTIME_PACKAGE}`,
+                isTypeOnly: true,
+            });
+            sf.addImportDeclaration({
+                namedImports: [{ name: 'z' }],
+                moduleSpecifier: 'zod',
+            });
+            // import enums
+            for (const e of model.declarations.filter((d) => (0, ast_1.isEnum)(d))) {
+                sf.addImportDeclaration({
+                    namedImports: [{ name: e.name }],
+                    moduleSpecifier: '@prisma/client',
                 });
-                writer.write(',');
-              }
+            }
+            const models = model.declarations.filter((d) => (0, ast_1.isDataModel)(d));
+            const policyMap = {};
+            for (const model of models) {
+                policyMap[model.name] = yield this.generateQueryGuardForModel(model, sf);
+            }
+            const zodGenerator = new zod_schema_generator_1.ZodSchemaGenerator();
+            sf.addVariableStatement({
+                declarationKind: ts_morph_1.VariableDeclarationKind.Const,
+                declarations: [
+                    {
+                        name: 'policy',
+                        initializer: (writer) => {
+                            writer.block(() => {
+                                writer.write('guard:');
+                                writer.inlineBlock(() => {
+                                    for (const [model, map] of Object.entries(policyMap)) {
+                                        writer.write(`${(0, change_case_1.camelCase)(model)}:`);
+                                        writer.inlineBlock(() => {
+                                            for (const [op, func] of Object.entries(map)) {
+                                                if (typeof func === 'object') {
+                                                    writer.write(`${op}: ${JSON.stringify(func)},`);
+                                                }
+                                                else {
+                                                    writer.write(`${op}: ${func},`);
+                                                }
+                                            }
+                                        });
+                                        writer.write(',');
+                                    }
+                                });
+                                writer.writeLine(',');
+                                writer.write('schema:');
+                                zodGenerator.generate(writer, models);
+                            });
+                        },
+                    },
+                ],
             });
-            writer.writeLine(',');
-            writer.write('schema:');
-            zodGenerator.generate(writer, models);
-          });
-        }
-      }]
-    });
-    sf.addStatements('export default policy');
-    sf.formatText();
-    await project.save();
-    await project.emit();
-  }
-  getPolicyExpressions(model, kind, operation) {
-    const attrs = model.attributes.filter(attr => {
-      var _attr$decl$ref;
-      return ((_attr$decl$ref = attr.decl.ref) === null || _attr$decl$ref === void 0 ? void 0 : _attr$decl$ref.name) === `@@${kind}`;
-    });
-    const checkOperation = operation === 'postUpdate' ? 'update' : operation;
-    let result = attrs.filter(attr => {
-      const opsValue = (0, _sdk.getLiteral)(attr.args[0].value);
-      if (!opsValue) {
-        return false;
-      }
-      const ops = opsValue.split(',').map(s => s.trim());
-      return ops.includes(checkOperation) || ops.includes('all');
-    }).map(attr => attr.args[1].value);
-    if (operation === 'update') {
-      result = this.processUpdatePolicies(result, false);
-    } else if (operation === 'postUpdate') {
-      result = this.processUpdatePolicies(result, true);
-    }
-    return result;
-  }
-  processUpdatePolicies(expressions, postUpdate) {
-    return expressions.map(expr => this.visitPolicyExpression(expr, postUpdate)).filter(e => !!e);
-  }
-  visitPolicyExpression(expr, postUpdate) {
-    if ((0, _ast.isBinaryExpr)(expr) && (expr.operator === '&&' || expr.operator === '||')) {
-      const left = this.visitPolicyExpression(expr.left, postUpdate);
-      const right = this.visitPolicyExpression(expr.right, postUpdate);
-      if (!left) return right;
-      if (!right) return left;
-      return {
-        ...expr,
-        left,
-        right
-      };
-    }
-    if ((0, _ast.isUnaryExpr)(expr) && expr.operator === '!') {
-      const operand = this.visitPolicyExpression(expr.operand, postUpdate);
-      if (!operand) return undefined;
-      return {
-        ...expr,
-        operand
-      };
-    }
-    if (postUpdate && !this.hasFutureReference(expr)) {
-      return undefined;
-    } else if (!postUpdate && this.hasFutureReference(expr)) {
-      return undefined;
-    }
-    return expr;
-  }
-  hasFutureReference(expr) {
-    for (const node of (0, _langium.streamAllContents)(expr)) {
-      var _node$function$ref;
-      if ((0, _ast.isInvocationExpr)(node) && ((_node$function$ref = node.function.ref) === null || _node$function$ref === void 0 ? void 0 : _node$function$ref.name) === 'future' && (0, _utils.isFromStdlib)(node.function.ref)) {
-        return true;
-      }
+            sf.addStatements('export default policy');
+            sf.formatText();
+            yield project.save();
+            yield project.emit();
+        });
     }
-    return false;
-  }
-  async generateQueryGuardForModel(model, sourceFile) {
-    const result = {};
-
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    const policies = (0, _astUtils.analyzePolicies)(model);
-    for (const kind of _pluginUtils.ALL_OPERATION_KINDS) {
-      if (policies[kind] === true || policies[kind] === false) {
-        result[kind] = policies[kind];
-        continue;
-      }
-      const denies = this.getPolicyExpressions(model, 'deny', kind);
-      const allows = this.getPolicyExpressions(model, 'allow', kind);
-      if (kind === 'update' && allows.length === 0) {
-        // no allow rule for 'update', policy is constant based on if there's
-        // post-update counterpart
-        if (this.getPolicyExpressions(model, 'allow', 'postUpdate').length === 0) {
-          result[kind] = false;
-          continue;
-        } else {
-          result[kind] = true;
-          continue;
+    getPolicyExpressions(model, kind, operation) {
+        const attrs = model.attributes.filter((attr) => { var _a; return ((_a = attr.decl.ref) === null || _a === void 0 ? void 0 : _a.name) === `@@${kind}`; });
+        const checkOperation = operation === 'postUpdate' ? 'update' : operation;
+        let result = attrs
+            .filter((attr) => {
+            const opsValue = (0, sdk_1.getLiteral)(attr.args[0].value);
+            if (!opsValue) {
+                return false;
+            }
+            const ops = opsValue.split(',').map((s) => s.trim());
+            return ops.includes(checkOperation) || ops.includes('all');
+        })
+            .map((attr) => attr.args[1].value);
+        if (operation === 'update') {
+            result = this.processUpdatePolicies(result, false);
         }
-      }
-      if (kind === 'postUpdate' && allows.length === 0 && denies.length === 0) {
-        // no rule 'postUpdate', always allow
-        result[kind] = true;
-        continue;
-      }
-      const func = this.generateQueryGuardFunction(sourceFile, model, kind, allows, denies);
-      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-      result[kind] = func.getName();
-      if (kind === 'postUpdate') {
-        const preValueSelect = this.generatePreValueSelect(model, allows, denies);
-        if (preValueSelect) {
-          result['preValueSelect'] = preValueSelect;
+        else if (operation === 'postUpdate') {
+            result = this.processUpdatePolicies(result, true);
         }
-      }
+        return result;
     }
-    return result;
-  }
-
-  // generates an object that can be used as the 'select' argument when fetching pre-update
-  // entity value
-  generatePreValueSelect(model, allows, denies) {
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    const result = {};
-    const addPath = path => {
-      let curr = result;
-      path.forEach((seg, i) => {
-        if (i === path.length - 1) {
-          curr[seg] = true;
-        } else {
-          if (!curr[seg]) {
-            curr[seg] = {
-              select: {}
-            };
-          }
-          curr = curr[seg].select;
-        }
-      });
-    };
-    const visit = node => {
-      if ((0, _ast.isReferenceExpr)(node)) {
-        const target = (0, _sdk.resolved)(node.target);
-        if ((0, _ast.isDataModelField)(target)) {
-          // a field selection, it's a terminal
-          return [target.name];
-        }
-      } else if ((0, _ast.isMemberAccessExpr)(node)) {
-        if ((0, _utils2.isFutureExpr)(node.operand)) {
-          // future().field is not subject to pre-update select
-          return undefined;
-        }
-
-        // build a selection path inside-out for chained member access
-        const inner = visit(node.operand);
-        if (inner) {
-          return [...inner, node.member.$refText];
+    processUpdatePolicies(expressions, postUpdate) {
+        return expressions
+            .map((expr) => this.visitPolicyExpression(expr, postUpdate))
+            .filter((e) => !!e);
+    }
+    visitPolicyExpression(expr, postUpdate) {
+        if ((0, ast_1.isBinaryExpr)(expr) && (expr.operator === '&&' || expr.operator === '||')) {
+            const left = this.visitPolicyExpression(expr.left, postUpdate);
+            const right = this.visitPolicyExpression(expr.right, postUpdate);
+            if (!left)
+                return right;
+            if (!right)
+                return left;
+            return Object.assign(Object.assign({}, expr), { left, right });
         }
-      }
-      return undefined;
-    };
-    for (const rule of [...allows, ...denies]) {
-      for (const expr of (0, _langium.streamAllContents)(rule).filter(node => (0, _ast.isExpression)(node))) {
-        // only care about member access and reference expressions
-        if (!(0, _ast.isMemberAccessExpr)(expr) && !(0, _ast.isReferenceExpr)(expr)) {
-          continue;
+        if ((0, ast_1.isUnaryExpr)(expr) && expr.operator === '!') {
+            const operand = this.visitPolicyExpression(expr.operand, postUpdate);
+            if (!operand)
+                return undefined;
+            return Object.assign(Object.assign({}, expr), { operand });
         }
-        if (expr.$container.$type === _ast.MemberAccessExpr) {
-          // only visit top-level member access
-          continue;
+        if (postUpdate && !this.hasFutureReference(expr)) {
+            return undefined;
         }
-        const path = visit(expr);
-        if (path) {
-          var _expr$$resolvedType;
-          if ((0, _ast.isDataModel)((_expr$$resolvedType = expr.$resolvedType) === null || _expr$$resolvedType === void 0 ? void 0 : _expr$$resolvedType.decl)) {
-            // member selection ended at a data model field, include its 'id'
-            path.push('id');
-          }
-          addPath(path);
+        else if (!postUpdate && this.hasFutureReference(expr)) {
+            return undefined;
         }
-      }
+        return expr;
     }
-    return Object.keys(result).length === 0 ? null : result;
-  }
-  generateQueryGuardFunction(sourceFile, model, kind, allows, denies) {
-    const func = sourceFile.addFunction({
-      name: model.name + '_' + kind,
-      returnType: 'any',
-      parameters: [{
-        name: 'context',
-        type: 'QueryContext'
-      }]
-    }).addBody();
-
-    // check if any allow or deny rule contains 'auth()' invocation
-    let hasAuthRef = false;
-    for (const node of [...denies, ...allows]) {
-      for (const child of (0, _langium.streamAllContents)(node)) {
-        if ((0, _ast.isInvocationExpr)(child) && (0, _sdk.resolved)(child.function).name === 'auth') {
-          hasAuthRef = true;
-          break;
+    hasFutureReference(expr) {
+        var _a;
+        for (const node of (0, langium_1.streamAllContents)(expr)) {
+            if ((0, ast_1.isInvocationExpr)(node) && ((_a = node.function.ref) === null || _a === void 0 ? void 0 : _a.name) === 'future' && (0, utils_1.isFromStdlib)(node.function.ref)) {
+                return true;
+            }
         }
-      }
-      if (hasAuthRef) {
-        break;
-      }
-    }
-    if (hasAuthRef) {
-      const userModel = model.$container.declarations.find(decl => (0, _ast.isDataModel)(decl) && decl.name === 'User');
-      if (!userModel) {
-        throw new _sdk.PluginError('User model not found');
-      }
-      const userIdField = (0, _astUtils.getIdField)(userModel);
-      if (!userIdField) {
-        throw new _sdk.PluginError('User model does not have an id field');
-      }
-      func.addStatements(
-      // make sure user id is always available
-      `const user = context.user?.${userIdField.name} ? context.user : { ...context.user, ${userIdField.name}: '${UNKNOWN_USER_ID}' };`);
+        return false;
     }
-
-    // r = <guard object>;
-    func.addStatements(writer => {
-      writer.write('return ');
-      const exprWriter = new _expressionWriter.ExpressionWriter(writer, kind === 'postUpdate');
-      const writeDenies = () => {
-        writer.conditionalWrite(denies.length > 1, '{ AND: [');
-        denies.forEach((expr, i) => {
-          writer.inlineBlock(() => {
-            writer.write('NOT: ');
-            exprWriter.write(expr);
-          });
-          writer.conditionalWrite(i !== denies.length - 1, ',');
+    generateQueryGuardForModel(model, sourceFile) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const result = {};
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            const policies = (0, ast_utils_1.analyzePolicies)(model);
+            for (const kind of plugin_utils_1.ALL_OPERATION_KINDS) {
+                if (policies[kind] === true || policies[kind] === false) {
+                    result[kind] = policies[kind];
+                    continue;
+                }
+                const denies = this.getPolicyExpressions(model, 'deny', kind);
+                const allows = this.getPolicyExpressions(model, 'allow', kind);
+                if (kind === 'update' && allows.length === 0) {
+                    // no allow rule for 'update', policy is constant based on if there's
+                    // post-update counterpart
+                    if (this.getPolicyExpressions(model, 'allow', 'postUpdate').length === 0) {
+                        result[kind] = false;
+                        continue;
+                    }
+                    else {
+                        result[kind] = true;
+                        continue;
+                    }
+                }
+                if (kind === 'postUpdate' && allows.length === 0 && denies.length === 0) {
+                    // no rule 'postUpdate', always allow
+                    result[kind] = true;
+                    continue;
+                }
+                const func = this.generateQueryGuardFunction(sourceFile, model, kind, allows, denies);
+                // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+                result[kind] = func.getName();
+                if (kind === 'postUpdate') {
+                    const preValueSelect = this.generatePreValueSelect(model, allows, denies);
+                    if (preValueSelect) {
+                        result['preValueSelect'] = preValueSelect;
+                    }
+                }
+            }
+            return result;
         });
-        writer.conditionalWrite(denies.length > 1, ']}');
-      };
-      const writeAllows = () => {
-        writer.conditionalWrite(allows.length > 1, '{ OR: [');
-        allows.forEach((expr, i) => {
-          exprWriter.write(expr);
-          writer.conditionalWrite(i !== allows.length - 1, ',');
+    }
+    // generates an object that can be used as the 'select' argument when fetching pre-update
+    // entity value
+    generatePreValueSelect(model, allows, denies) {
+        var _a;
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const result = {};
+        const addPath = (path) => {
+            let curr = result;
+            path.forEach((seg, i) => {
+                if (i === path.length - 1) {
+                    curr[seg] = true;
+                }
+                else {
+                    if (!curr[seg]) {
+                        curr[seg] = { select: {} };
+                    }
+                    curr = curr[seg].select;
+                }
+            });
+        };
+        const visit = (node) => {
+            if ((0, ast_1.isReferenceExpr)(node)) {
+                const target = (0, sdk_1.resolved)(node.target);
+                if ((0, ast_1.isDataModelField)(target)) {
+                    // a field selection, it's a terminal
+                    return [target.name];
+                }
+            }
+            else if ((0, ast_1.isMemberAccessExpr)(node)) {
+                if ((0, utils_2.isFutureExpr)(node.operand)) {
+                    // future().field is not subject to pre-update select
+                    return undefined;
+                }
+                // build a selection path inside-out for chained member access
+                const inner = visit(node.operand);
+                if (inner) {
+                    return [...inner, node.member.$refText];
+                }
+            }
+            return undefined;
+        };
+        for (const rule of [...allows, ...denies]) {
+            for (const expr of (0, langium_1.streamAllContents)(rule).filter((node) => (0, ast_1.isExpression)(node))) {
+                // only care about member access and reference expressions
+                if (!(0, ast_1.isMemberAccessExpr)(expr) && !(0, ast_1.isReferenceExpr)(expr)) {
+                    continue;
+                }
+                if (expr.$container.$type === ast_1.MemberAccessExpr) {
+                    // only visit top-level member access
+                    continue;
+                }
+                const path = visit(expr);
+                if (path) {
+                    if ((0, ast_1.isDataModel)((_a = expr.$resolvedType) === null || _a === void 0 ? void 0 : _a.decl)) {
+                        // member selection ended at a data model field, include its 'id'
+                        path.push('id');
+                    }
+                    addPath(path);
+                }
+            }
+        }
+        return Object.keys(result).length === 0 ? null : result;
+    }
+    generateQueryGuardFunction(sourceFile, model, kind, allows, denies) {
+        const func = sourceFile
+            .addFunction({
+            name: model.name + '_' + kind,
+            returnType: 'any',
+            parameters: [
+                {
+                    name: 'context',
+                    type: 'QueryContext',
+                },
+            ],
+        })
+            .addBody();
+        // check if any allow or deny rule contains 'auth()' invocation
+        let hasAuthRef = false;
+        for (const node of [...denies, ...allows]) {
+            for (const child of (0, langium_1.streamAllContents)(node)) {
+                if ((0, ast_1.isInvocationExpr)(child) && (0, sdk_1.resolved)(child.function).name === 'auth') {
+                    hasAuthRef = true;
+                    break;
+                }
+            }
+            if (hasAuthRef) {
+                break;
+            }
+        }
+        if (hasAuthRef) {
+            const userModel = model.$container.declarations.find((decl) => (0, ast_1.isDataModel)(decl) && decl.name === 'User');
+            if (!userModel) {
+                throw new sdk_1.PluginError('User model not found');
+            }
+            const userIdField = (0, ast_utils_1.getIdField)(userModel);
+            if (!userIdField) {
+                throw new sdk_1.PluginError('User model does not have an id field');
+            }
+            func.addStatements(
+            // make sure user id is always available
+            `const user = context.user?.${userIdField.name} ? context.user : { ...context.user, ${userIdField.name}: '${UNKNOWN_USER_ID}' };`);
+        }
+        // r = <guard object>;
+        func.addStatements((writer) => {
+            writer.write('return ');
+            const exprWriter = new expression_writer_1.ExpressionWriter(writer, kind === 'postUpdate');
+            const writeDenies = () => {
+                writer.conditionalWrite(denies.length > 1, '{ AND: [');
+                denies.forEach((expr, i) => {
+                    writer.inlineBlock(() => {
+                        writer.write('NOT: ');
+                        exprWriter.write(expr);
+                    });
+                    writer.conditionalWrite(i !== denies.length - 1, ',');
+                });
+                writer.conditionalWrite(denies.length > 1, ']}');
+            };
+            const writeAllows = () => {
+                writer.conditionalWrite(allows.length > 1, '{ OR: [');
+                allows.forEach((expr, i) => {
+                    exprWriter.write(expr);
+                    writer.conditionalWrite(i !== allows.length - 1, ',');
+                });
+                writer.conditionalWrite(allows.length > 1, ']}');
+            };
+            if (allows.length > 0 && denies.length > 0) {
+                writer.write('{ AND: [');
+                writeDenies();
+                writer.write(',');
+                writeAllows();
+                writer.write(']}');
+            }
+            else if (denies.length > 0) {
+                writeDenies();
+            }
+            else if (allows.length > 0) {
+                writeAllows();
+            }
+            else {
+                // disallow any operation
+                writer.write(`{ ${sdk_1.GUARD_FIELD_NAME}: false }`);
+            }
+            writer.write(';');
         });
-        writer.conditionalWrite(allows.length > 1, ']}');
-      };
-      if (allows.length > 0 && denies.length > 0) {
-        writer.write('{ AND: [');
-        writeDenies();
-        writer.write(',');
-        writeAllows();
-        writer.write(']}');
-      } else if (denies.length > 0) {
-        writeDenies();
-      } else if (allows.length > 0) {
-        writeAllows();
-      } else {
-        // disallow any operation
-        writer.write(`{ ${_sdk.GUARD_FIELD_NAME}: false }`);
-      }
-      writer.write(';');
-    });
-    return func;
-  }
+        return func;
+    }
 }
 exports.default = PolicyGenerator;
 //# sourceMappingURL=policy-guard-generator.js.map