zenstack 1.0.16 → 1.1.0

package/plugins/access-policy/policy-guard-generator.js

@@ -13,64 +13,66 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const ast_1 = require("@zenstackhq/language/ast");
+const runtime_1 = require("@zenstackhq/runtime");
 const sdk_1 = require("@zenstackhq/sdk");
-const change_case_1 = require("change-case");
 const langium_1 = require("langium");
+const lower_case_first_1 = require("lower-case-first");
 const path_1 = __importDefault(require("path"));
 const ts_morph_1 = require("ts-morph");
 const _1 = require(".");
-const utils_1 = require("../../language-server/utils");
 const ast_utils_1 = require("../../utils/ast-utils");
+const typescript_expression_transformer_1 = require("../../utils/typescript-expression-transformer");
 const plugin_utils_1 = require("../plugin-utils");
 const expression_writer_1 = require("./expression-writer");
-const utils_2 = require("./utils");
-const zod_schema_generator_1 = require("./zod-schema-generator");
 /**
  * Generates source file that contains Prisma query guard objects used for injecting database queries
  */
 class PolicyGenerator {
-    generate(model, options) {
+    generate(model, options, globalOptions) {
         return __awaiter(this, void 0, void 0, function* () {
-            const output = options.output ? options.output : (0, plugin_utils_1.getDefaultOutputFolder)();
+            let output = options.output ? options.output : (0, plugin_utils_1.getDefaultOutputFolder)(globalOptions);
             if (!output) {
-                console.error(`Unable to determine output path, not running plugin ${_1.name}`);
-                return;
+                throw new sdk_1.PluginError(options.name, `Unable to determine output path, not running plugin`);
             }
-            const project = new ts_morph_1.Project();
+            output = (0, sdk_1.resolvePath)(output, options);
+            const project = (0, sdk_1.createProject)();
             const sf = project.createSourceFile(path_1.default.join(output, 'policy.ts'), undefined, { overwrite: true });
+            sf.addStatements('/* eslint-disable */');
             sf.addImportDeclaration({
-                namedImports: [{ name: 'QueryContext' }],
-                moduleSpecifier: `${plugin_utils_1.RUNTIME_PACKAGE}`,
-                isTypeOnly: true,
-            });
-            sf.addImportDeclaration({
-                namedImports: [{ name: 'z' }],
-                moduleSpecifier: 'zod',
+                namedImports: [
+                    { name: 'type QueryContext' },
+                    { name: 'type DbOperations' },
+                    { name: 'hasAllFields' },
+                    { name: 'allFieldsEqual' },
+                    { name: 'type PolicyDef' },
+                ],
+                moduleSpecifier: `${sdk_1.RUNTIME_PACKAGE}`,
             });
             // import enums
-            for (const e of model.declarations.filter((d) => (0, ast_1.isEnum)(d))) {
+            const prismaImport = (0, sdk_1.getPrismaClientImportSpec)(model, output);
+            for (const e of model.declarations.filter((d) => (0, ast_1.isEnum)(d) && this.isEnumReferenced(model, d))) {
                 sf.addImportDeclaration({
                     namedImports: [{ name: e.name }],
-                    moduleSpecifier: '@prisma/client',
+                    moduleSpecifier: prismaImport,
                 });
             }
-            const models = model.declarations.filter((d) => (0, ast_1.isDataModel)(d));
+            const models = (0, sdk_1.getDataModels)(model);
             const policyMap = {};
             for (const model of models) {
                 policyMap[model.name] = yield this.generateQueryGuardForModel(model, sf);
             }
-            const zodGenerator = new zod_schema_generator_1.ZodSchemaGenerator();
             sf.addVariableStatement({
                 declarationKind: ts_morph_1.VariableDeclarationKind.Const,
                 declarations: [
                     {
                         name: 'policy',
+                        type: 'PolicyDef',
                         initializer: (writer) => {
                             writer.block(() => {
                                 writer.write('guard:');
                                 writer.inlineBlock(() => {
                                     for (const [model, map] of Object.entries(policyMap)) {
-                                        writer.write(`${(0, change_case_1.camelCase)(model)}:`);
+                                        writer.write(`${(0, lower_case_first_1.lowerCaseFirst)(model)}:`);
                                         writer.inlineBlock(() => {
                                             for (const [op, func] of Object.entries(map)) {
                                                 if (typeof func === 'object') {
@@ -85,21 +87,57 @@ class PolicyGenerator {
                                     }
                                 });
                                 writer.writeLine(',');
-                                writer.write('schema:');
-                                zodGenerator.generate(writer, models);
+                                writer.write('validation:');
+                                writer.inlineBlock(() => {
+                                    for (const model of models) {
+                                        writer.write(`${(0, lower_case_first_1.lowerCaseFirst)(model.name)}:`);
+                                        writer.inlineBlock(() => {
+                                            writer.write(`hasValidation: ${(0, sdk_1.hasValidationAttributes)(model)}`);
+                                        });
+                                        writer.writeLine(',');
+                                    }
+                                });
                             });
                         },
                     },
                 ],
             });
             sf.addStatements('export default policy');
-            sf.formatText();
-            yield project.save();
-            yield project.emit();
+            let shouldCompile = true;
+            if (typeof options.compile === 'boolean') {
+                // explicit override
+                shouldCompile = options.compile;
+            }
+            else if (globalOptions) {
+                shouldCompile = globalOptions.compile;
+            }
+            if (!shouldCompile || options.preserveTsFiles === true) {
+                // save ts files
+                yield (0, sdk_1.saveProject)(project);
+            }
+            if (shouldCompile) {
+                yield (0, sdk_1.emitProject)(project);
+            }
+        });
+    }
+    isEnumReferenced(model, decl) {
+        return (0, langium_1.streamAllContents)(model).some((node) => {
+            var _a, _b;
+            if ((0, ast_1.isDataModelField)(node) && ((_a = node.type.reference) === null || _a === void 0 ? void 0 : _a.ref) === decl) {
+                // referenced as field type
+                return true;
+            }
+            if ((0, sdk_1.isEnumFieldReference)(node) && ((_b = node.target.ref) === null || _b === void 0 ? void 0 : _b.$container) === decl) {
+                // enum field is referenced
+                return true;
+            }
+            return false;
         });
     }
-    getPolicyExpressions(model, kind, operation) {
-        const attrs = model.attributes.filter((attr) => { var _a; return ((_a = attr.decl.ref) === null || _a === void 0 ? void 0 : _a.name) === `@@${kind}`; });
+    getPolicyExpressions(target, kind, operation) {
+        const attributes = target.attributes;
+        const attrName = (0, ast_1.isDataModel)(target) ? `@@${kind}` : `@${kind}`;
+        const attrs = attributes.filter((attr) => { var _a; return ((_a = attr.decl.ref) === null || _a === void 0 ? void 0 : _a.name) === attrName; });
         const checkOperation = operation === 'postUpdate' ? 'update' : operation;
         let result = attrs
             .filter((attr) => {
@@ -150,8 +188,8 @@ class PolicyGenerator {
     }
     hasFutureReference(expr) {
         var _a;
-        for (const node of (0, langium_1.streamAllContents)(expr)) {
-            if ((0, ast_1.isInvocationExpr)(node) && ((_a = node.function.ref) === null || _a === void 0 ? void 0 : _a.name) === 'future' && (0, utils_1.isFromStdlib)(node.function.ref)) {
+        for (const node of (0, langium_1.streamAst)(expr)) {
+            if ((0, ast_1.isInvocationExpr)(node) && ((_a = node.function.ref) === null || _a === void 0 ? void 0 : _a.name) === 'future' && (0, sdk_1.isFromStdlib)(node.function.ref)) {
                 return true;
             }
         }
@@ -161,10 +199,13 @@ class PolicyGenerator {
         return __awaiter(this, void 0, void 0, function* () {
             const result = {};
             // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            const policies = (0, ast_utils_1.analyzePolicies)(model);
+            const policies = (0, sdk_1.analyzePolicies)(model);
             for (const kind of plugin_utils_1.ALL_OPERATION_KINDS) {
                 if (policies[kind] === true || policies[kind] === false) {
                     result[kind] = policies[kind];
+                    if (kind === 'create') {
+                        result[kind + '_input'] = policies[kind];
+                    }
                     continue;
                 }
                 const denies = this.getPolicyExpressions(model, 'deny', kind);
@@ -186,23 +227,156 @@ class PolicyGenerator {
                     result[kind] = true;
                     continue;
                 }
-                const func = this.generateQueryGuardFunction(sourceFile, model, kind, allows, denies);
+                const guardFunc = this.generateQueryGuardFunction(sourceFile, model, kind, allows, denies);
                 // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-                result[kind] = func.getName();
+                result[kind] = guardFunc.getName();
                 if (kind === 'postUpdate') {
-                    const preValueSelect = this.generatePreValueSelect(model, allows, denies);
+                    const preValueSelect = this.generateSelectForRules(allows, denies);
                     if (preValueSelect) {
-                        result['preValueSelect'] = preValueSelect;
+                        result[runtime_1.PRE_UPDATE_VALUE_SELECTOR] = preValueSelect;
                     }
                 }
+                if (kind === 'create' && this.canCheckCreateBasedOnInput(model, allows, denies)) {
+                    const inputCheckFunc = this.generateInputCheckFunction(sourceFile, model, kind, allows, denies);
+                    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+                    result[kind + '_input'] = inputCheckFunc.getName();
+                }
             }
+            // generate field read checkers
+            this.generateReadFieldsGuards(model, sourceFile, result);
+            // generate field update guards
+            this.generateUpdateFieldsGuards(model, sourceFile, result);
             return result;
         });
     }
-    // generates an object that can be used as the 'select' argument when fetching pre-update
-    // entity value
-    generatePreValueSelect(model, allows, denies) {
-        var _a;
+    generateReadFieldsGuards(model, sourceFile, result) {
+        const allFieldsAllows = [];
+        const allFieldsDenies = [];
+        for (const field of model.fields) {
+            const allows = this.getPolicyExpressions(field, 'allow', 'read');
+            const denies = this.getPolicyExpressions(field, 'deny', 'read');
+            if (denies.length === 0 && allows.length === 0) {
+                continue;
+            }
+            allFieldsAllows.push(...allows);
+            allFieldsDenies.push(...denies);
+            const guardFunc = this.generateReadFieldGuardFunction(sourceFile, field, allows, denies);
+            // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+            result[`${runtime_1.FIELD_LEVEL_READ_CHECKER_PREFIX}${field.name}`] = guardFunc.getName();
+        }
+        if (allFieldsAllows.length > 0 || allFieldsDenies.length > 0) {
+            result[runtime_1.HAS_FIELD_LEVEL_POLICY_FLAG] = true;
+            const readFieldCheckSelect = this.generateSelectForRules(allFieldsAllows, allFieldsDenies);
+            if (readFieldCheckSelect) {
+                result[runtime_1.FIELD_LEVEL_READ_CHECKER_SELECTOR] = readFieldCheckSelect;
+            }
+        }
+    }
+    generateReadFieldGuardFunction(sourceFile, field, allows, denies) {
+        const statements = [];
+        this.generateNormalizedAuthRef(field.$container, allows, denies, statements);
+        // compile rules down to typescript expressions
+        statements.push((writer) => {
+            const transformer = new typescript_expression_transformer_1.TypeScriptExpressionTransformer({
+                context: sdk_1.ExpressionContext.AccessPolicy,
+                fieldReferenceContext: 'input',
+            });
+            const denyStmt = denies.length > 0
+                ? '!(' +
+                    denies
+                        .map((deny) => {
+                        return transformer.transform(deny);
+                    })
+                        .join(' || ') +
+                    ')'
+                : undefined;
+            const allowStmt = allows.length > 0
+                ? '(' +
+                    allows
+                        .map((allow) => {
+                        return transformer.transform(allow);
+                    })
+                        .join(' || ') +
+                    ')'
+                : undefined;
+            let expr;
+            if (denyStmt && allowStmt) {
+                expr = `${denyStmt} && ${allowStmt}`;
+            }
+            else if (denyStmt) {
+                expr = denyStmt;
+            }
+            else if (allowStmt) {
+                expr = allowStmt;
+            }
+            else {
+                throw new Error('should not happen');
+            }
+            writer.write('return ' + expr);
+        });
+        const func = sourceFile.addFunction({
+            name: `${field.$container.name}$${field.name}_read`,
+            returnType: 'boolean',
+            parameters: [
+                {
+                    name: 'input',
+                    type: 'any',
+                },
+                {
+                    name: 'context',
+                    type: 'QueryContext',
+                },
+            ],
+            statements,
+        });
+        return func;
+    }
+    generateUpdateFieldsGuards(model, sourceFile, result) {
+        for (const field of model.fields) {
+            const allows = this.getPolicyExpressions(field, 'allow', 'update');
+            const denies = this.getPolicyExpressions(field, 'deny', 'update');
+            if (denies.length === 0 && allows.length === 0) {
+                continue;
+            }
+            const guardFunc = this.generateQueryGuardFunction(sourceFile, model, 'update', allows, denies, field);
+            // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+            result[`${runtime_1.FIELD_LEVEL_UPDATE_GUARD_PREFIX}${field.name}`] = guardFunc.getName();
+        }
+    }
+    canCheckCreateBasedOnInput(model, allows, denies) {
+        return [...allows, ...denies].every((rule) => {
+            return (0, langium_1.streamAst)(rule).every((expr) => {
+                var _a;
+                if ((0, ast_1.isThisExpr)(expr)) {
+                    return false;
+                }
+                if ((0, ast_1.isReferenceExpr)(expr)) {
+                    if ((0, ast_1.isDataModel)((_a = expr.$resolvedType) === null || _a === void 0 ? void 0 : _a.decl)) {
+                        // if policy rules uses relation fields,
+                        // we can't check based on create input
+                        return false;
+                    }
+                    if ((0, ast_1.isDataModelField)(expr.target.ref) &&
+                        expr.target.ref.$container === model &&
+                        (0, sdk_1.hasAttribute)(expr.target.ref, '@default')) {
+                        // reference to field of current model
+                        // if it has default value, we can't check
+                        // based on create input
+                        return false;
+                    }
+                    if ((0, ast_1.isDataModelField)(expr.target.ref) && (0, sdk_1.isForeignKeyField)(expr.target.ref)) {
+                        // reference to foreign key field
+                        // we can't check based on create input
+                        return false;
+                    }
+                }
+                return true;
+            });
+        });
+    }
+    // generates a "select" object that contains (recursively) fields referenced by the
+    // given policy rules
+    generateSelectForRules(allows, denies) {
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
         const result = {};
         const addPath = (path) => {
@@ -219,6 +393,8 @@ class PolicyGenerator {
                 }
             });
         };
+        // visit a reference or member access expression to build a
+        // selection path
         const visit = (node) => {
             if ((0, ast_1.isReferenceExpr)(node)) {
                 const target = (0, sdk_1.resolved)(node.target);
@@ -228,7 +404,7 @@ class PolicyGenerator {
                 }
             }
             else if ((0, ast_1.isMemberAccessExpr)(node)) {
-                if ((0, utils_2.isFutureExpr)(node.operand)) {
+                if ((0, sdk_1.isFutureExpr)(node.operand)) {
                     // future().field is not subject to pre-update select
                     return undefined;
                 }
@@ -240,109 +416,218 @@ class PolicyGenerator {
             }
             return undefined;
         };
-        for (const rule of [...allows, ...denies]) {
-            for (const expr of (0, langium_1.streamAllContents)(rule).filter((node) => (0, ast_1.isExpression)(node))) {
-                // only care about member access and reference expressions
-                if (!(0, ast_1.isMemberAccessExpr)(expr) && !(0, ast_1.isReferenceExpr)(expr)) {
-                    continue;
-                }
-                if (expr.$container.$type === ast_1.MemberAccessExpr) {
-                    // only visit top-level member access
-                    continue;
-                }
+        // collect selection paths from the given expression
+        const collectReferencePaths = (expr) => {
+            var _a, _b, _c;
+            if ((0, ast_1.isThisExpr)(expr) && !(0, ast_1.isMemberAccessExpr)(expr.$container)) {
+                // a standalone `this` expression, include all id fields
+                const model = (_a = expr.$resolvedType) === null || _a === void 0 ? void 0 : _a.decl;
+                const idFields = (0, ast_utils_1.getIdFields)(model);
+                return idFields.map((field) => [field.name]);
+            }
+            if ((0, ast_1.isMemberAccessExpr)(expr) || (0, ast_1.isReferenceExpr)(expr)) {
                 const path = visit(expr);
                 if (path) {
-                    if ((0, ast_1.isDataModel)((_a = expr.$resolvedType) === null || _a === void 0 ? void 0 : _a.decl)) {
-                        // member selection ended at a data model field, include its 'id'
-                        path.push('id');
+                    if ((0, ast_1.isDataModel)((_b = expr.$resolvedType) === null || _b === void 0 ? void 0 : _b.decl)) {
+                        // member selection ended at a data model field, include its id fields
+                        const idFields = (0, ast_utils_1.getIdFields)((_c = expr.$resolvedType) === null || _c === void 0 ? void 0 : _c.decl);
+                        return idFields.map((field) => [...path, field.name]);
+                    }
+                    else {
+                        return [path];
                     }
-                    addPath(path);
                 }
+                else {
+                    return [];
+                }
+            }
+            else if ((0, ast_utils_1.isCollectionPredicate)(expr)) {
+                const path = visit(expr.left);
+                if (path) {
+                    // recurse into RHS
+                    const rhs = collectReferencePaths(expr.right);
+                    // combine path of LHS and RHS
+                    return rhs.map((r) => [...path, ...r]);
+                }
+                else {
+                    return [];
+                }
+            }
+            else {
+                // recurse
+                const children = (0, langium_1.streamContents)(expr)
+                    .filter((child) => (0, ast_1.isExpression)(child))
+                    .toArray();
+                return children.flatMap((child) => collectReferencePaths(child));
             }
+        };
+        for (const rule of [...allows, ...denies]) {
+            const paths = collectReferencePaths(rule);
+            paths.forEach((p) => addPath(p));
         }
-        return Object.keys(result).length === 0 ? null : result;
+        return Object.keys(result).length === 0 ? undefined : result;
     }
-    generateQueryGuardFunction(sourceFile, model, kind, allows, denies) {
-        const func = sourceFile
-            .addFunction({
-            name: model.name + '_' + kind,
+    generateQueryGuardFunction(sourceFile, model, kind, allows, denies, forField) {
+        const statements = [];
+        this.generateNormalizedAuthRef(model, allows, denies, statements);
+        const hasFieldAccess = [...denies, ...allows].some((rule) => (0, langium_1.streamAst)(rule).some((child) => 
+        // this.???
+        (0, ast_1.isThisExpr)(child) ||
+            // future().???
+            (0, sdk_1.isFutureExpr)(child) ||
+            // field reference
+            ((0, ast_1.isReferenceExpr)(child) && (0, ast_1.isDataModelField)(child.target.ref))));
+        if (!hasFieldAccess) {
+            // none of the rules reference model fields, we can compile down to a plain boolean
+            // function in this case (so we can skip doing SQL queries when validating)
+            statements.push((writer) => {
+                const transformer = new typescript_expression_transformer_1.TypeScriptExpressionTransformer({
+                    context: sdk_1.ExpressionContext.AccessPolicy,
+                    isPostGuard: kind === 'postUpdate',
+                });
+                try {
+                    denies.forEach((rule) => {
+                        writer.write(`if (${transformer.transform(rule, false)}) { return ${expression_writer_1.FALSE}; }`);
+                    });
+                    allows.forEach((rule) => {
+                        writer.write(`if (${transformer.transform(rule, false)}) { return ${expression_writer_1.TRUE}; }`);
+                    });
+                }
+                catch (err) {
+                    if (err instanceof typescript_expression_transformer_1.TypeScriptExpressionTransformerError) {
+                        throw new sdk_1.PluginError(_1.name, err.message);
+                    }
+                    else {
+                        throw err;
+                    }
+                }
+                writer.write(`return ${expression_writer_1.FALSE};`);
+            });
+        }
+        else {
+            statements.push((writer) => {
+                writer.write('return ');
+                const exprWriter = new expression_writer_1.ExpressionWriter(writer, kind === 'postUpdate');
+                const writeDenies = () => {
+                    writer.conditionalWrite(denies.length > 1, '{ AND: [');
+                    denies.forEach((expr, i) => {
+                        writer.inlineBlock(() => {
+                            writer.write('NOT: ');
+                            exprWriter.write(expr);
+                        });
+                        writer.conditionalWrite(i !== denies.length - 1, ',');
+                    });
+                    writer.conditionalWrite(denies.length > 1, ']}');
+                };
+                const writeAllows = () => {
+                    writer.conditionalWrite(allows.length > 1, '{ OR: [');
+                    allows.forEach((expr, i) => {
+                        exprWriter.write(expr);
+                        writer.conditionalWrite(i !== allows.length - 1, ',');
+                    });
+                    writer.conditionalWrite(allows.length > 1, ']}');
+                };
+                if (allows.length > 0 && denies.length > 0) {
+                    writer.write('{ AND: [');
+                    writeDenies();
+                    writer.write(',');
+                    writeAllows();
+                    writer.write(']}');
+                }
+                else if (denies.length > 0) {
+                    writeDenies();
+                }
+                else if (allows.length > 0) {
+                    writeAllows();
+                }
+                else {
+                    // disallow any operation
+                    writer.write(`{ OR: [] }`);
+                }
+                writer.write(';');
+            });
+        }
+        const func = sourceFile.addFunction({
+            name: `${model.name}${forField ? '$' + forField.name : ''}_${kind}`,
             returnType: 'any',
             parameters: [
                 {
                     name: 'context',
                     type: 'QueryContext',
                 },
+                {
+                    // for generating field references used by field comparison in the same model
+                    name: 'db',
+                    type: 'Record<string, DbOperations>',
+                },
             ],
-        })
-            .addBody();
-        // check if any allow or deny rule contains 'auth()' invocation
-        let hasAuthRef = false;
-        for (const node of [...denies, ...allows]) {
-            for (const child of (0, langium_1.streamAllContents)(node)) {
-                if ((0, ast_1.isInvocationExpr)(child) && (0, sdk_1.resolved)(child.function).name === 'auth') {
-                    hasAuthRef = true;
-                    break;
-                }
-            }
-            if (hasAuthRef) {
-                break;
+            statements,
+        });
+        return func;
+    }
+    generateInputCheckFunction(sourceFile, model, kind, allows, denies) {
+        const statements = [];
+        this.generateNormalizedAuthRef(model, allows, denies, statements);
+        statements.push((writer) => {
+            if (allows.length === 0) {
+                writer.write('return false;');
+                return;
             }
-        }
+            const transformer = new typescript_expression_transformer_1.TypeScriptExpressionTransformer({
+                context: sdk_1.ExpressionContext.AccessPolicy,
+                fieldReferenceContext: 'input',
+            });
+            let expr = denies.length > 0
+                ? '!(' +
+                    denies
+                        .map((deny) => {
+                        return transformer.transform(deny);
+                    })
+                        .join(' || ') +
+                    ')'
+                : undefined;
+            const allowStmt = allows
+                .map((allow) => {
+                return transformer.transform(allow);
+            })
+                .join(' || ');
+            expr = expr ? `${expr} && (${allowStmt})` : allowStmt;
+            writer.write('return ' + expr);
+        });
+        const func = sourceFile.addFunction({
+            name: model.name + '_' + kind + '_input',
+            returnType: 'boolean',
+            parameters: [
+                {
+                    name: 'input',
+                    type: 'any',
+                },
+                {
+                    name: 'context',
+                    type: 'QueryContext',
+                },
+            ],
+            statements,
+        });
+        return func;
+    }
+    generateNormalizedAuthRef(model, allows, denies, statements) {
+        // check if any allow or deny rule contains 'auth()' invocation
+        const hasAuthRef = [...allows, ...denies].some((rule) => (0, langium_1.streamAst)(rule).some((child) => (0, ast_utils_1.isAuthInvocation)(child)));
         if (hasAuthRef) {
             const userModel = model.$container.declarations.find((decl) => (0, ast_1.isDataModel)(decl) && decl.name === 'User');
             if (!userModel) {
-                throw new sdk_1.PluginError('User model not found');
+                throw new sdk_1.PluginError(_1.name, 'User model not found');
             }
-            const userIdField = (0, ast_utils_1.getIdField)(userModel);
-            if (!userIdField) {
-                throw new sdk_1.PluginError('User model does not have an id field');
+            const userIdFields = (0, ast_utils_1.getIdFields)(userModel);
+            if (!userIdFields || userIdFields.length === 0) {
+                throw new sdk_1.PluginError(_1.name, 'User model does not have an id field');
             }
             // normalize user to null to avoid accidentally use undefined in filter
-            func.addStatements(`const user = context.user ?? null;`);
+            statements.push(`const user = hasAllFields(context.user, [${userIdFields
+                .map((f) => "'" + f.name + "'")
+                .join(', ')}]) ? context.user as any : null;`);
         }
-        // r = <guard object>;
-        func.addStatements((writer) => {
-            writer.write('return ');
-            const exprWriter = new expression_writer_1.ExpressionWriter(writer, kind === 'postUpdate');
-            const writeDenies = () => {
-                writer.conditionalWrite(denies.length > 1, '{ AND: [');
-                denies.forEach((expr, i) => {
-                    writer.inlineBlock(() => {
-                        writer.write('NOT: ');
-                        exprWriter.write(expr);
-                    });
-                    writer.conditionalWrite(i !== denies.length - 1, ',');
-                });
-                writer.conditionalWrite(denies.length > 1, ']}');
-            };
-            const writeAllows = () => {
-                writer.conditionalWrite(allows.length > 1, '{ OR: [');
-                allows.forEach((expr, i) => {
-                    exprWriter.write(expr);
-                    writer.conditionalWrite(i !== allows.length - 1, ',');
-                });
-                writer.conditionalWrite(allows.length > 1, ']}');
-            };
-            if (allows.length > 0 && denies.length > 0) {
-                writer.write('{ AND: [');
-                writeDenies();
-                writer.write(',');
-                writeAllows();
-                writer.write(']}');
-            }
-            else if (denies.length > 0) {
-                writeDenies();
-            }
-            else if (allows.length > 0) {
-                writeAllows();
-            }
-            else {
-                // disallow any operation
-                writer.write(`{ ${sdk_1.GUARD_FIELD_NAME}: false }`);
-            }
-            writer.write(';');
-        });
-        return func;
     }
 }
 exports.default = PolicyGenerator;