zenstack 1.0.0 → 1.0.1

package/plugins/access-policy/policy-guard-generator.js

@@ -0,0 +1,634 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const ast_1 = require("@zenstackhq/language/ast");
+const runtime_1 = require("@zenstackhq/runtime");
+const sdk_1 = require("@zenstackhq/sdk");
+const langium_1 = require("langium");
+const lower_case_first_1 = require("lower-case-first");
+const path_1 = __importDefault(require("path"));
+const ts_morph_1 = require("ts-morph");
+const _1 = require(".");
+const ast_utils_1 = require("../../utils/ast-utils");
+const typescript_expression_transformer_1 = require("../../utils/typescript-expression-transformer");
+const plugin_utils_1 = require("../plugin-utils");
+const expression_writer_1 = require("./expression-writer");
+/**
+ * Generates source file that contains Prisma query guard objects used for injecting database queries
+ */
+class PolicyGenerator {
+    generate(model, options, globalOptions) {
+        return __awaiter(this, void 0, void 0, function* () {
+            let output = options.output ? options.output : (0, plugin_utils_1.getDefaultOutputFolder)(globalOptions);
+            if (!output) {
+                throw new sdk_1.PluginError(options.name, `Unable to determine output path, not running plugin`);
+            }
+            output = (0, sdk_1.resolvePath)(output, options);
+            const project = (0, sdk_1.createProject)();
+            const sf = project.createSourceFile(path_1.default.join(output, 'policy.ts'), undefined, { overwrite: true });
+            sf.addStatements('/* eslint-disable */');
+            sf.addImportDeclaration({
+                namedImports: [
+                    { name: 'type QueryContext' },
+                    { name: 'type DbOperations' },
+                    { name: 'hasAllFields' },
+                    { name: 'allFieldsEqual' },
+                    { name: 'type PolicyDef' },
+                ],
+                moduleSpecifier: `${sdk_1.RUNTIME_PACKAGE}`,
+            });
+            // import enums
+            const prismaImport = (0, sdk_1.getPrismaClientImportSpec)(model, output);
+            for (const e of model.declarations.filter((d) => (0, ast_1.isEnum)(d) && this.isEnumReferenced(model, d))) {
+                sf.addImportDeclaration({
+                    namedImports: [{ name: e.name }],
+                    moduleSpecifier: prismaImport,
+                });
+            }
+            const models = (0, sdk_1.getDataModels)(model);
+            const policyMap = {};
+            for (const model of models) {
+                policyMap[model.name] = yield this.generateQueryGuardForModel(model, sf);
+            }
+            sf.addVariableStatement({
+                declarationKind: ts_morph_1.VariableDeclarationKind.Const,
+                declarations: [
+                    {
+                        name: 'policy',
+                        type: 'PolicyDef',
+                        initializer: (writer) => {
+                            writer.block(() => {
+                                writer.write('guard:');
+                                writer.inlineBlock(() => {
+                                    for (const [model, map] of Object.entries(policyMap)) {
+                                        writer.write(`${(0, lower_case_first_1.lowerCaseFirst)(model)}:`);
+                                        writer.inlineBlock(() => {
+                                            for (const [op, func] of Object.entries(map)) {
+                                                if (typeof func === 'object') {
+                                                    writer.write(`${op}: ${JSON.stringify(func)},`);
+                                                }
+                                                else {
+                                                    writer.write(`${op}: ${func},`);
+                                                }
+                                            }
+                                        });
+                                        writer.write(',');
+                                    }
+                                });
+                                writer.writeLine(',');
+                                writer.write('validation:');
+                                writer.inlineBlock(() => {
+                                    for (const model of models) {
+                                        writer.write(`${(0, lower_case_first_1.lowerCaseFirst)(model.name)}:`);
+                                        writer.inlineBlock(() => {
+                                            writer.write(`hasValidation: ${(0, sdk_1.hasValidationAttributes)(model)}`);
+                                        });
+                                        writer.writeLine(',');
+                                    }
+                                });
+                            });
+                        },
+                    },
+                ],
+            });
+            sf.addStatements('export default policy');
+            let shouldCompile = true;
+            if (typeof options.compile === 'boolean') {
+                // explicit override
+                shouldCompile = options.compile;
+            }
+            else if (globalOptions) {
+                shouldCompile = globalOptions.compile;
+            }
+            if (!shouldCompile || options.preserveTsFiles === true) {
+                // save ts files
+                yield (0, sdk_1.saveProject)(project);
+            }
+            if (shouldCompile) {
+                yield (0, sdk_1.emitProject)(project);
+            }
+        });
+    }
+    isEnumReferenced(model, decl) {
+        return (0, langium_1.streamAllContents)(model).some((node) => {
+            var _a, _b;
+            if ((0, ast_1.isDataModelField)(node) && ((_a = node.type.reference) === null || _a === void 0 ? void 0 : _a.ref) === decl) {
+                // referenced as field type
+                return true;
+            }
+            if ((0, sdk_1.isEnumFieldReference)(node) && ((_b = node.target.ref) === null || _b === void 0 ? void 0 : _b.$container) === decl) {
+                // enum field is referenced
+                return true;
+            }
+            return false;
+        });
+    }
+    getPolicyExpressions(target, kind, operation) {
+        const attributes = target.attributes;
+        const attrName = (0, ast_1.isDataModel)(target) ? `@@${kind}` : `@${kind}`;
+        const attrs = attributes.filter((attr) => { var _a; return ((_a = attr.decl.ref) === null || _a === void 0 ? void 0 : _a.name) === attrName; });
+        const checkOperation = operation === 'postUpdate' ? 'update' : operation;
+        let result = attrs
+            .filter((attr) => {
+            const opsValue = (0, sdk_1.getLiteral)(attr.args[0].value);
+            if (!opsValue) {
+                return false;
+            }
+            const ops = opsValue.split(',').map((s) => s.trim());
+            return ops.includes(checkOperation) || ops.includes('all');
+        })
+            .map((attr) => attr.args[1].value);
+        if (operation === 'update') {
+            result = this.processUpdatePolicies(result, false);
+        }
+        else if (operation === 'postUpdate') {
+            result = this.processUpdatePolicies(result, true);
+        }
+        return result;
+    }
+    processUpdatePolicies(expressions, postUpdate) {
+        return expressions
+            .map((expr) => this.visitPolicyExpression(expr, postUpdate))
+            .filter((e) => !!e);
+    }
+    visitPolicyExpression(expr, postUpdate) {
+        if ((0, ast_1.isBinaryExpr)(expr) && (expr.operator === '&&' || expr.operator === '||')) {
+            const left = this.visitPolicyExpression(expr.left, postUpdate);
+            const right = this.visitPolicyExpression(expr.right, postUpdate);
+            if (!left)
+                return right;
+            if (!right)
+                return left;
+            return Object.assign(Object.assign({}, expr), { left, right });
+        }
+        if ((0, ast_1.isUnaryExpr)(expr) && expr.operator === '!') {
+            const operand = this.visitPolicyExpression(expr.operand, postUpdate);
+            if (!operand)
+                return undefined;
+            return Object.assign(Object.assign({}, expr), { operand });
+        }
+        if (postUpdate && !this.hasFutureReference(expr)) {
+            return undefined;
+        }
+        else if (!postUpdate && this.hasFutureReference(expr)) {
+            return undefined;
+        }
+        return expr;
+    }
+    hasFutureReference(expr) {
+        var _a;
+        for (const node of (0, langium_1.streamAst)(expr)) {
+            if ((0, ast_1.isInvocationExpr)(node) && ((_a = node.function.ref) === null || _a === void 0 ? void 0 : _a.name) === 'future' && (0, sdk_1.isFromStdlib)(node.function.ref)) {
+                return true;
+            }
+        }
+        return false;
+    }
+    generateQueryGuardForModel(model, sourceFile) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const result = {};
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            const policies = (0, sdk_1.analyzePolicies)(model);
+            for (const kind of plugin_utils_1.ALL_OPERATION_KINDS) {
+                if (policies[kind] === true || policies[kind] === false) {
+                    result[kind] = policies[kind];
+                    if (kind === 'create') {
+                        result[kind + '_input'] = policies[kind];
+                    }
+                    continue;
+                }
+                const denies = this.getPolicyExpressions(model, 'deny', kind);
+                const allows = this.getPolicyExpressions(model, 'allow', kind);
+                if (kind === 'update' && allows.length === 0) {
+                    // no allow rule for 'update', policy is constant based on if there's
+                    // post-update counterpart
+                    if (this.getPolicyExpressions(model, 'allow', 'postUpdate').length === 0) {
+                        result[kind] = false;
+                        continue;
+                    }
+                    else {
+                        result[kind] = true;
+                        continue;
+                    }
+                }
+                if (kind === 'postUpdate' && allows.length === 0 && denies.length === 0) {
+                    // no rule 'postUpdate', always allow
+                    result[kind] = true;
+                    continue;
+                }
+                const guardFunc = this.generateQueryGuardFunction(sourceFile, model, kind, allows, denies);
+                // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+                result[kind] = guardFunc.getName();
+                if (kind === 'postUpdate') {
+                    const preValueSelect = this.generateSelectForRules(allows, denies);
+                    if (preValueSelect) {
+                        result[runtime_1.PRE_UPDATE_VALUE_SELECTOR] = preValueSelect;
+                    }
+                }
+                if (kind === 'create' && this.canCheckCreateBasedOnInput(model, allows, denies)) {
+                    const inputCheckFunc = this.generateInputCheckFunction(sourceFile, model, kind, allows, denies);
+                    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+                    result[kind + '_input'] = inputCheckFunc.getName();
+                }
+            }
+            // generate field read checkers
+            this.generateReadFieldsGuards(model, sourceFile, result);
+            // generate field update guards
+            this.generateUpdateFieldsGuards(model, sourceFile, result);
+            return result;
+        });
+    }
+    generateReadFieldsGuards(model, sourceFile, result) {
+        const allFieldsAllows = [];
+        const allFieldsDenies = [];
+        for (const field of model.fields) {
+            const allows = this.getPolicyExpressions(field, 'allow', 'read');
+            const denies = this.getPolicyExpressions(field, 'deny', 'read');
+            if (denies.length === 0 && allows.length === 0) {
+                continue;
+            }
+            allFieldsAllows.push(...allows);
+            allFieldsDenies.push(...denies);
+            const guardFunc = this.generateReadFieldGuardFunction(sourceFile, field, allows, denies);
+            // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+            result[`${runtime_1.FIELD_LEVEL_READ_CHECKER_PREFIX}${field.name}`] = guardFunc.getName();
+        }
+        if (allFieldsAllows.length > 0 || allFieldsDenies.length > 0) {
+            result[runtime_1.HAS_FIELD_LEVEL_POLICY_FLAG] = true;
+            const readFieldCheckSelect = this.generateSelectForRules(allFieldsAllows, allFieldsDenies);
+            if (readFieldCheckSelect) {
+                result[runtime_1.FIELD_LEVEL_READ_CHECKER_SELECTOR] = readFieldCheckSelect;
+            }
+        }
+    }
+    generateReadFieldGuardFunction(sourceFile, field, allows, denies) {
+        const statements = [];
+        this.generateNormalizedAuthRef(field.$container, allows, denies, statements);
+        // compile rules down to typescript expressions
+        statements.push((writer) => {
+            const transformer = new typescript_expression_transformer_1.TypeScriptExpressionTransformer({
+                context: sdk_1.ExpressionContext.AccessPolicy,
+                fieldReferenceContext: 'input',
+            });
+            const denyStmt = denies.length > 0
+                ? '!(' +
+                    denies
+                        .map((deny) => {
+                        return transformer.transform(deny);
+                    })
+                        .join(' || ') +
+                    ')'
+                : undefined;
+            const allowStmt = allows.length > 0
+                ? '(' +
+                    allows
+                        .map((allow) => {
+                        return transformer.transform(allow);
+                    })
+                        .join(' || ') +
+                    ')'
+                : undefined;
+            let expr;
+            if (denyStmt && allowStmt) {
+                expr = `${denyStmt} && ${allowStmt}`;
+            }
+            else if (denyStmt) {
+                expr = denyStmt;
+            }
+            else if (allowStmt) {
+                expr = allowStmt;
+            }
+            else {
+                throw new Error('should not happen');
+            }
+            writer.write('return ' + expr);
+        });
+        const func = sourceFile.addFunction({
+            name: `${field.$container.name}$${field.name}_read`,
+            returnType: 'boolean',
+            parameters: [
+                {
+                    name: 'input',
+                    type: 'any',
+                },
+                {
+                    name: 'context',
+                    type: 'QueryContext',
+                },
+            ],
+            statements,
+        });
+        return func;
+    }
+    generateUpdateFieldsGuards(model, sourceFile, result) {
+        for (const field of model.fields) {
+            const allows = this.getPolicyExpressions(field, 'allow', 'update');
+            const denies = this.getPolicyExpressions(field, 'deny', 'update');
+            if (denies.length === 0 && allows.length === 0) {
+                continue;
+            }
+            const guardFunc = this.generateQueryGuardFunction(sourceFile, model, 'update', allows, denies, field);
+            // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+            result[`${runtime_1.FIELD_LEVEL_UPDATE_GUARD_PREFIX}${field.name}`] = guardFunc.getName();
+        }
+    }
+    canCheckCreateBasedOnInput(model, allows, denies) {
+        return [...allows, ...denies].every((rule) => {
+            return (0, langium_1.streamAst)(rule).every((expr) => {
+                var _a;
+                if ((0, ast_1.isThisExpr)(expr)) {
+                    return false;
+                }
+                if ((0, ast_1.isReferenceExpr)(expr)) {
+                    if ((0, ast_1.isDataModel)((_a = expr.$resolvedType) === null || _a === void 0 ? void 0 : _a.decl)) {
+                        // if policy rules uses relation fields,
+                        // we can't check based on create input
+                        return false;
+                    }
+                    if ((0, ast_1.isDataModelField)(expr.target.ref) &&
+                        expr.target.ref.$container === model &&
+                        (0, sdk_1.hasAttribute)(expr.target.ref, '@default')) {
+                        // reference to field of current model
+                        // if it has default value, we can't check
+                        // based on create input
+                        return false;
+                    }
+                    if ((0, ast_1.isDataModelField)(expr.target.ref) && (0, sdk_1.isForeignKeyField)(expr.target.ref)) {
+                        // reference to foreign key field
+                        // we can't check based on create input
+                        return false;
+                    }
+                }
+                return true;
+            });
+        });
+    }
+    // generates a "select" object that contains (recursively) fields referenced by the
+    // given policy rules
+    generateSelectForRules(allows, denies) {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const result = {};
+        const addPath = (path) => {
+            let curr = result;
+            path.forEach((seg, i) => {
+                if (i === path.length - 1) {
+                    curr[seg] = true;
+                }
+                else {
+                    if (!curr[seg]) {
+                        curr[seg] = { select: {} };
+                    }
+                    curr = curr[seg].select;
+                }
+            });
+        };
+        // visit a reference or member access expression to build a
+        // selection path
+        const visit = (node) => {
+            if ((0, ast_1.isReferenceExpr)(node)) {
+                const target = (0, sdk_1.resolved)(node.target);
+                if ((0, ast_1.isDataModelField)(target)) {
+                    // a field selection, it's a terminal
+                    return [target.name];
+                }
+            }
+            else if ((0, ast_1.isMemberAccessExpr)(node)) {
+                if ((0, sdk_1.isFutureExpr)(node.operand)) {
+                    // future().field is not subject to pre-update select
+                    return undefined;
+                }
+                // build a selection path inside-out for chained member access
+                const inner = visit(node.operand);
+                if (inner) {
+                    return [...inner, node.member.$refText];
+                }
+            }
+            return undefined;
+        };
+        // collect selection paths from the given expression
+        const collectReferencePaths = (expr) => {
+            var _a, _b, _c;
+            if ((0, ast_1.isThisExpr)(expr) && !(0, ast_1.isMemberAccessExpr)(expr.$container)) {
+                // a standalone `this` expression, include all id fields
+                const model = (_a = expr.$resolvedType) === null || _a === void 0 ? void 0 : _a.decl;
+                const idFields = (0, ast_utils_1.getIdFields)(model);
+                return idFields.map((field) => [field.name]);
+            }
+            if ((0, ast_1.isMemberAccessExpr)(expr) || (0, ast_1.isReferenceExpr)(expr)) {
+                const path = visit(expr);
+                if (path) {
+                    if ((0, ast_1.isDataModel)((_b = expr.$resolvedType) === null || _b === void 0 ? void 0 : _b.decl)) {
+                        // member selection ended at a data model field, include its id fields
+                        const idFields = (0, ast_utils_1.getIdFields)((_c = expr.$resolvedType) === null || _c === void 0 ? void 0 : _c.decl);
+                        return idFields.map((field) => [...path, field.name]);
+                    }
+                    else {
+                        return [path];
+                    }
+                }
+                else {
+                    return [];
+                }
+            }
+            else if ((0, ast_utils_1.isCollectionPredicate)(expr)) {
+                const path = visit(expr.left);
+                if (path) {
+                    // recurse into RHS
+                    const rhs = collectReferencePaths(expr.right);
+                    // combine path of LHS and RHS
+                    return rhs.map((r) => [...path, ...r]);
+                }
+                else {
+                    return [];
+                }
+            }
+            else {
+                // recurse
+                const children = (0, langium_1.streamContents)(expr)
+                    .filter((child) => (0, ast_1.isExpression)(child))
+                    .toArray();
+                return children.flatMap((child) => collectReferencePaths(child));
+            }
+        };
+        for (const rule of [...allows, ...denies]) {
+            const paths = collectReferencePaths(rule);
+            paths.forEach((p) => addPath(p));
+        }
+        return Object.keys(result).length === 0 ? undefined : result;
+    }
+    generateQueryGuardFunction(sourceFile, model, kind, allows, denies, forField) {
+        const statements = [];
+        this.generateNormalizedAuthRef(model, allows, denies, statements);
+        const hasFieldAccess = [...denies, ...allows].some((rule) => (0, langium_1.streamAst)(rule).some((child) => 
+        // this.???
+        (0, ast_1.isThisExpr)(child) ||
+            // future().???
+            (0, sdk_1.isFutureExpr)(child) ||
+            // field reference
+            ((0, ast_1.isReferenceExpr)(child) && (0, ast_1.isDataModelField)(child.target.ref))));
+        if (!hasFieldAccess) {
+            // none of the rules reference model fields, we can compile down to a plain boolean
+            // function in this case (so we can skip doing SQL queries when validating)
+            statements.push((writer) => {
+                const transformer = new typescript_expression_transformer_1.TypeScriptExpressionTransformer({
+                    context: sdk_1.ExpressionContext.AccessPolicy,
+                    isPostGuard: kind === 'postUpdate',
+                });
+                try {
+                    denies.forEach((rule) => {
+                        writer.write(`if (${transformer.transform(rule, false)}) { return ${expression_writer_1.FALSE}; }`);
+                    });
+                    allows.forEach((rule) => {
+                        writer.write(`if (${transformer.transform(rule, false)}) { return ${expression_writer_1.TRUE}; }`);
+                    });
+                }
+                catch (err) {
+                    if (err instanceof typescript_expression_transformer_1.TypeScriptExpressionTransformerError) {
+                        throw new sdk_1.PluginError(_1.name, err.message);
+                    }
+                    else {
+                        throw err;
+                    }
+                }
+                writer.write(`return ${expression_writer_1.FALSE};`);
+            });
+        }
+        else {
+            statements.push((writer) => {
+                writer.write('return ');
+                const exprWriter = new expression_writer_1.ExpressionWriter(writer, kind === 'postUpdate');
+                const writeDenies = () => {
+                    writer.conditionalWrite(denies.length > 1, '{ AND: [');
+                    denies.forEach((expr, i) => {
+                        writer.inlineBlock(() => {
+                            writer.write('NOT: ');
+                            exprWriter.write(expr);
+                        });
+                        writer.conditionalWrite(i !== denies.length - 1, ',');
+                    });
+                    writer.conditionalWrite(denies.length > 1, ']}');
+                };
+                const writeAllows = () => {
+                    writer.conditionalWrite(allows.length > 1, '{ OR: [');
+                    allows.forEach((expr, i) => {
+                        exprWriter.write(expr);
+                        writer.conditionalWrite(i !== allows.length - 1, ',');
+                    });
+                    writer.conditionalWrite(allows.length > 1, ']}');
+                };
+                if (allows.length > 0 && denies.length > 0) {
+                    writer.write('{ AND: [');
+                    writeDenies();
+                    writer.write(',');
+                    writeAllows();
+                    writer.write(']}');
+                }
+                else if (denies.length > 0) {
+                    writeDenies();
+                }
+                else if (allows.length > 0) {
+                    writeAllows();
+                }
+                else {
+                    // disallow any operation
+                    writer.write(`{ OR: [] }`);
+                }
+                writer.write(';');
+            });
+        }
+        const func = sourceFile.addFunction({
+            name: `${model.name}${forField ? '$' + forField.name : ''}_${kind}`,
+            returnType: 'any',
+            parameters: [
+                {
+                    name: 'context',
+                    type: 'QueryContext',
+                },
+                {
+                    // for generating field references used by field comparison in the same model
+                    name: 'db',
+                    type: 'Record<string, DbOperations>',
+                },
+            ],
+            statements,
+        });
+        return func;
+    }
+    generateInputCheckFunction(sourceFile, model, kind, allows, denies) {
+        const statements = [];
+        this.generateNormalizedAuthRef(model, allows, denies, statements);
+        statements.push((writer) => {
+            if (allows.length === 0) {
+                writer.write('return false;');
+                return;
+            }
+            const transformer = new typescript_expression_transformer_1.TypeScriptExpressionTransformer({
+                context: sdk_1.ExpressionContext.AccessPolicy,
+                fieldReferenceContext: 'input',
+            });
+            let expr = denies.length > 0
+                ? '!(' +
+                    denies
+                        .map((deny) => {
+                        return transformer.transform(deny);
+                    })
+                        .join(' || ') +
+                    ')'
+                : undefined;
+            const allowStmt = allows
+                .map((allow) => {
+                return transformer.transform(allow);
+            })
+                .join(' || ');
+            expr = expr ? `${expr} && (${allowStmt})` : allowStmt;
+            writer.write('return ' + expr);
+        });
+        const func = sourceFile.addFunction({
+            name: model.name + '_' + kind + '_input',
+            returnType: 'boolean',
+            parameters: [
+                {
+                    name: 'input',
+                    type: 'any',
+                },
+                {
+                    name: 'context',
+                    type: 'QueryContext',
+                },
+            ],
+            statements,
+        });
+        return func;
+    }
+    generateNormalizedAuthRef(model, allows, denies, statements) {
+        // check if any allow or deny rule contains 'auth()' invocation
+        const hasAuthRef = [...allows, ...denies].some((rule) => (0, langium_1.streamAst)(rule).some((child) => (0, ast_utils_1.isAuthInvocation)(child)));
+        if (hasAuthRef) {
+            const userModel = model.$container.declarations.find((decl) => (0, ast_1.isDataModel)(decl) && decl.name === 'User');
+            if (!userModel) {
+                throw new sdk_1.PluginError(_1.name, 'User model not found');
+            }
+            const userIdFields = (0, ast_utils_1.getIdFields)(userModel);
+            if (!userIdFields || userIdFields.length === 0) {
+                throw new sdk_1.PluginError(_1.name, 'User model does not have an id field');
+            }
+            // normalize user to null to avoid accidentally use undefined in filter
+            statements.push(`const user = hasAllFields(context.user, [${userIdFields
+                .map((f) => "'" + f.name + "'")
+                .join(', ')}]) ? context.user as any : null;`);
+        }
+    }
+}
+exports.default = PolicyGenerator;
+//# sourceMappingURL=policy-guard-generator.js.map