zenstack 2.1.2 → 2.2.0

package/plugins/enhancer/policy/policy-guard-generator.js

@@ -14,60 +14,27 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PolicyGenerator = void 0;
 const ast_1 = require("@zenstackhq/language/ast");
-const runtime_1 = require("@zenstackhq/runtime");
 const sdk_1 = require("@zenstackhq/sdk");
 const prisma_1 = require("@zenstackhq/sdk/prisma");
 const langium_1 = require("langium");
 const lower_case_first_1 = require("lower-case-first");
 const path_1 = __importDefault(require("path"));
 const ts_morph_1 = require("ts-morph");
-const __1 = require("..");
-const ast_utils_1 = require("../../../utils/ast-utils");
-const plugin_utils_1 = require("../../plugin-utils");
 const constraint_transformer_1 = require("./constraint-transformer");
-const expression_writer_1 = require("./expression-writer");
+const utils_1 = require("./utils");
 /**
  * Generates source file that contains Prisma query guard objects used for injecting database queries
  */
 class PolicyGenerator {
-    generate(project, model, options, output) {
+    constructor(options) {
+        this.options = options;
+    }
+    generate(project, model, output) {
         return __awaiter(this, void 0, void 0, function* () {
             const sf = project.createSourceFile(path_1.default.join(output, 'policy.ts'), undefined, { overwrite: true });
             sf.addStatements('/* eslint-disable */');
-            sf.addImportDeclaration({
-                namedImports: [
-                    { name: 'type QueryContext' },
-                    { name: 'type CrudContract' },
-                    { name: 'allFieldsEqual' },
-                    { name: 'type PolicyDef' },
-                    { name: 'type CheckerContext' },
-                    { name: 'type CheckerConstraint' },
-                ],
-                moduleSpecifier: `${sdk_1.RUNTIME_PACKAGE}`,
-            });
-            // import enums
-            const prismaImport = (0, prisma_1.getPrismaClientImportSpec)(output, options);
-            for (const e of model.declarations.filter((d) => (0, ast_1.isEnum)(d) && this.isEnumReferenced(model, d))) {
-                sf.addImportDeclaration({
-                    namedImports: [{ name: e.name }],
-                    moduleSpecifier: prismaImport,
-                });
-            }
+            this.writeImports(model, output, sf);
             const models = (0, sdk_1.getDataModels)(model);
-            // policy guard functions
-            const policyMap = {};
-            for (const model of models) {
-                policyMap[model.name] = yield this.generateQueryGuardForModel(model, sf);
-            }
-            const generatePermissionChecker = options.generatePermissionChecker === true;
-            // CRUD checker functions
-            const checkerMap = {};
-            if (generatePermissionChecker) {
-                for (const model of models) {
-                    checkerMap[model.name] = yield this.generateCheckerForModel(model, sf);
-                }
-            }
-            const authSelector = this.generateAuthSelector(models);
             sf.addVariableStatement({
                 declarationKind: ts_morph_1.VariableDeclarationKind.Const,
                 declarations: [
@@ -76,53 +43,9 @@ class PolicyGenerator {
                         type: 'PolicyDef',
                         initializer: (writer) => {
                             writer.block(() => {
-                                writer.write('guard:');
-                                writer.inlineBlock(() => {
-                                    for (const [model, map] of Object.entries(policyMap)) {
-                                        writer.write(`${(0, lower_case_first_1.lowerCaseFirst)(model)}:`);
-                                        writer.inlineBlock(() => {
-                                            for (const [op, func] of Object.entries(map)) {
-                                                if (typeof func === 'object') {
-                                                    writer.write(`${op}: ${JSON.stringify(func)},`);
-                                                }
-                                                else {
-                                                    writer.write(`${op}: ${func},`);
-                                                }
-                                            }
-                                        });
-                                        writer.write(',');
-                                    }
-                                });
-                                writer.writeLine(',');
-                                if (generatePermissionChecker) {
-                                    writer.write('checker:');
-                                    writer.inlineBlock(() => {
-                                        for (const [model, map] of Object.entries(checkerMap)) {
-                                            writer.write(`${(0, lower_case_first_1.lowerCaseFirst)(model)}:`);
-                                            writer.inlineBlock(() => {
-                                                Object.entries(map).forEach(([op, func]) => {
-                                                    writer.write(`${op}: ${func},`);
-                                                });
-                                            });
-                                            writer.writeLine(',');
-                                        }
-                                    });
-                                    writer.writeLine(',');
-                                }
-                                writer.write('validation:');
-                                writer.inlineBlock(() => {
-                                    for (const model of models) {
-                                        writer.write(`${(0, lower_case_first_1.lowerCaseFirst)(model.name)}:`);
-                                        writer.inlineBlock(() => {
-                                            writer.write(`hasValidation: ${(0, sdk_1.hasValidationAttributes)(model)}`);
-                                        });
-                                        writer.writeLine(',');
-                                    }
-                                });
-                                if (authSelector) {
-                                    writer.writeLine(',');
-                                    writer.write(`authSelector: ${JSON.stringify(authSelector)}`);
-                                }
+                                this.writePolicy(writer, models, sf);
+                                this.writeValidationMeta(writer, models);
+                                this.writeAuthSelector(models, writer);
                             });
                         },
                     },
@@ -130,200 +53,138 @@ class PolicyGenerator {
             });
             sf.addStatements('export default policy');
             // save ts files if requested explicitly or the user provided
-            const preserveTsFiles = options.preserveTsFiles === true || !!options.output;
+            const preserveTsFiles = this.options.preserveTsFiles === true || !!this.options.output;
             if (preserveTsFiles) {
                 yield sf.save();
             }
         });
     }
-    // Generates a { select: ... } object to select `auth()` fields used in policy rules
-    generateAuthSelector(models) {
-        const authRules = [];
-        models.forEach((model) => {
-            // model-level rules
-            const modelPolicyAttrs = model.attributes.filter((attr) => ['@@allow', '@@deny'].includes(attr.decl.$refText));
-            // field-level rules
-            const fieldPolicyAttrs = model.fields
-                .flatMap((f) => f.attributes)
-                .filter((attr) => ['@allow', '@deny'].includes(attr.decl.$refText));
-            // all rule expression
-            const allExpressions = [...modelPolicyAttrs, ...fieldPolicyAttrs]
-                .filter((attr) => attr.args.length > 1)
-                .map((attr) => attr.args[1].value);
-            // collect `auth()` member access
-            allExpressions.forEach((rule) => {
-                (0, langium_1.streamAst)(rule).forEach((node) => {
-                    if ((0, ast_1.isMemberAccessExpr)(node) && (0, sdk_1.isAuthInvocation)(node.operand)) {
-                        authRules.push(node);
-                    }
-                });
-            });
+    writeImports(model, output, sf) {
+        sf.addImportDeclaration({
+            namedImports: [
+                { name: 'type QueryContext' },
+                { name: 'type CrudContract' },
+                { name: 'allFieldsEqual' },
+                { name: 'type PolicyDef' },
+                { name: 'type PermissionCheckerContext' },
+                { name: 'type PermissionCheckerConstraint' },
+            ],
+            moduleSpecifier: `${sdk_1.RUNTIME_PACKAGE}`,
         });
-        if (authRules.length > 0) {
-            return this.generateSelectForRules(authRules, true);
-        }
-        else {
-            return undefined;
+        // import enums
+        const prismaImport = (0, prisma_1.getPrismaClientImportSpec)(output, this.options);
+        for (const e of model.declarations.filter((d) => (0, ast_1.isEnum)(d) && (0, utils_1.isEnumReferenced)(model, d))) {
+            sf.addImportDeclaration({
+                namedImports: [{ name: e.name }],
+                moduleSpecifier: prismaImport,
+            });
         }
     }
-    isEnumReferenced(model, decl) {
-        return (0, langium_1.streamAllContents)(model).some((node) => {
-            var _a, _b;
-            if ((0, ast_1.isDataModelField)(node) && ((_a = node.type.reference) === null || _a === void 0 ? void 0 : _a.ref) === decl) {
-                // referenced as field type
-                return true;
-            }
-            if ((0, sdk_1.isEnumFieldReference)(node) && ((_b = node.target.ref) === null || _b === void 0 ? void 0 : _b.$container) === decl) {
-                // enum field is referenced
-                return true;
+    writePolicy(writer, models, sourceFile) {
+        writer.write('policy:');
+        writer.inlineBlock(() => {
+            for (const model of models) {
+                writer.write(`${(0, lower_case_first_1.lowerCaseFirst)(model.name)}:`);
+                writer.block(() => {
+                    // model-level guards
+                    this.writeModelLevelDefs(model, writer, sourceFile);
+                    // field-level guards
+                    this.writeFieldLevelDefs(model, writer, sourceFile);
+                });
+                writer.writeLine(',');
             }
-            return false;
         });
+        writer.writeLine(',');
     }
-    getPolicyExpressions(target, kind, operation, override = false) {
-        const attributes = target.attributes;
-        const attrName = (0, ast_1.isDataModel)(target) ? `@@${kind}` : `@${kind}`;
-        const attrs = attributes.filter((attr) => {
-            var _a;
-            if (((_a = attr.decl.ref) === null || _a === void 0 ? void 0 : _a.name) !== attrName) {
-                return false;
-            }
-            if (override) {
-                const overrideArg = (0, sdk_1.getAttributeArg)(attr, 'override');
-                return overrideArg && (0, sdk_1.getLiteral)(overrideArg) === true;
-            }
-            else {
-                return true;
-            }
+    // #region Model-level definitions
+    // writes model-level policy def for each operation kind for a model
+    // `[modelName]: { [operationKind]: [funcName] },`
+    writeModelLevelDefs(model, writer, sourceFile) {
+        const policies = (0, sdk_1.analyzePolicies)(model);
+        writer.write('modelLevel:');
+        writer.inlineBlock(() => {
+            this.writeModelReadDef(model, policies, writer, sourceFile);
+            this.writeModelCreateDef(model, policies, writer, sourceFile);
+            this.writeModelUpdateDef(model, policies, writer, sourceFile);
+            this.writeModelPostUpdateDef(model, policies, writer, sourceFile);
+            this.writeModelDeleteDef(model, policies, writer, sourceFile);
         });
-        const checkOperation = operation === 'postUpdate' ? 'update' : operation;
-        let result = attrs
-            .filter((attr) => {
-            const opsValue = (0, sdk_1.getLiteral)(attr.args[0].value);
-            if (!opsValue) {
-                return false;
-            }
-            const ops = opsValue.split(',').map((s) => s.trim());
-            return ops.includes(checkOperation) || ops.includes('all');
-        })
-            .map((attr) => attr.args[1].value);
-        if (operation === 'update') {
-            result = this.processUpdatePolicies(result, false);
-        }
-        else if (operation === 'postUpdate') {
-            result = this.processUpdatePolicies(result, true);
-        }
-        return result;
+        writer.writeLine(',');
     }
-    processUpdatePolicies(expressions, postUpdate) {
-        const hasFutureReference = expressions.some((expr) => this.hasFutureReference(expr));
-        if (postUpdate) {
-            // when compiling post-update rules, if any rule contains `future()` reference,
-            // we include all as post-update rules
-            return hasFutureReference ? expressions : [];
-        }
-        else {
-            // when compiling pre-update rules, if any rule contains `future()` reference,
-            // we completely skip pre-update check and defer them to post-update
-            return hasFutureReference ? [] : expressions;
-        }
+    // writes `read: ...` for a given model
+    writeModelReadDef(model, policies, writer, sourceFile) {
+        writer.write(`read:`);
+        writer.inlineBlock(() => {
+            this.writeCommonModelDef(model, 'read', policies, writer, sourceFile);
+        });
+        writer.writeLine(',');
     }
-    hasFutureReference(expr) {
-        var _a;
-        for (const node of (0, langium_1.streamAst)(expr)) {
-            if ((0, ast_1.isInvocationExpr)(node) && ((_a = node.function.ref) === null || _a === void 0 ? void 0 : _a.name) === 'future' && (0, sdk_1.isFromStdlib)(node.function.ref)) {
-                return true;
-            }
+    // writes `create: ...` for a given model
+    writeModelCreateDef(model, policies, writer, sourceFile) {
+        writer.write(`create:`);
+        writer.inlineBlock(() => {
+            this.writeCommonModelDef(model, 'create', policies, writer, sourceFile);
+            // create policy has an additional input checker for validating the payload
+            this.writeCreateInputChecker(model, writer, sourceFile);
+        });
+        writer.writeLine(',');
+    }
+    // writes `inputChecker: [funcName]` for a given model
+    writeCreateInputChecker(model, writer, sourceFile) {
+        if (this.canCheckCreateBasedOnInput(model)) {
+            const inputCheckFunc = this.generateCreateInputCheckerFunction(model, sourceFile);
+            writer.write(`inputChecker: ${inputCheckFunc.getName()},`);
         }
-        return false;
     }
-    generateQueryGuardForModel(model, sourceFile) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const result = {};
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            const policies = (0, sdk_1.analyzePolicies)(model);
-            for (const kind of plugin_utils_1.ALL_OPERATION_KINDS) {
-                if (policies[kind] === true || policies[kind] === false) {
-                    result[kind] = policies[kind];
-                    if (kind === 'create') {
-                        result[kind + '_input'] = policies[kind];
-                    }
-                    continue;
+    canCheckCreateBasedOnInput(model) {
+        const allows = (0, utils_1.getPolicyExpressions)(model, 'allow', 'create', false, 'all');
+        const denies = (0, utils_1.getPolicyExpressions)(model, 'deny', 'create', false, 'all');
+        return [...allows, ...denies].every((rule) => {
+            return (0, langium_1.streamAst)(rule).every((expr) => {
+                var _a;
+                if ((0, ast_1.isThisExpr)(expr)) {
+                    return false;
                 }
-                const denies = this.getPolicyExpressions(model, 'deny', kind);
-                const allows = this.getPolicyExpressions(model, 'allow', kind);
-                if (kind === 'update' && allows.length === 0) {
-                    // no allow rule for 'update', policy is constant based on if there's
-                    // post-update counterpart
-                    if (this.getPolicyExpressions(model, 'allow', 'postUpdate').length === 0) {
-                        result[kind] = false;
-                        continue;
+                if ((0, ast_1.isReferenceExpr)(expr)) {
+                    if ((0, ast_1.isDataModel)((_a = expr.$resolvedType) === null || _a === void 0 ? void 0 : _a.decl)) {
+                        // if policy rules uses relation fields,
+                        // we can't check based on create input
+                        return false;
                     }
-                    else {
-                        result[kind] = true;
-                        continue;
+                    if ((0, ast_1.isDataModelField)(expr.target.ref) &&
+                        expr.target.ref.$container === model &&
+                        (0, sdk_1.hasAttribute)(expr.target.ref, '@default')) {
+                        // reference to field of current model
+                        // if it has default value, we can't check
+                        // based on create input
+                        return false;
                     }
-                }
-                if (kind === 'postUpdate' && allows.length === 0 && denies.length === 0) {
-                    // no rule 'postUpdate', always allow
-                    result[kind] = true;
-                    continue;
-                }
-                const guardFunc = this.generateQueryGuardFunction(sourceFile, model, kind, allows, denies);
-                result[kind] = guardFunc.getName();
-                if (kind === 'postUpdate') {
-                    const preValueSelect = this.generateSelectForRules([...allows, ...denies]);
-                    if (preValueSelect) {
-                        result[runtime_1.PRE_UPDATE_VALUE_SELECTOR] = preValueSelect;
+                    if ((0, ast_1.isDataModelField)(expr.target.ref) && (0, sdk_1.isForeignKeyField)(expr.target.ref)) {
+                        // reference to foreign key field
+                        // we can't check based on create input
+                        return false;
                     }
                 }
-                if (kind === 'create' && this.canCheckCreateBasedOnInput(model, allows, denies)) {
-                    const inputCheckFunc = this.generateInputCheckFunction(sourceFile, model, kind, allows, denies);
-                    result[kind + '_input'] = inputCheckFunc.getName();
-                }
-            }
-            // generate field read checkers
-            this.generateReadFieldsCheckers(model, sourceFile, result);
-            // generate field read override guards
-            this.generateReadFieldsOverrideGuards(model, sourceFile, result);
-            // generate field update guards
-            this.generateUpdateFieldsGuards(model, sourceFile, result);
-            return result;
+                return true;
+            });
         });
     }
-    generateReadFieldsCheckers(model, sourceFile, result) {
-        const allFieldsAllows = [];
-        const allFieldsDenies = [];
-        for (const field of model.fields) {
-            const allows = this.getPolicyExpressions(field, 'allow', 'read');
-            const denies = this.getPolicyExpressions(field, 'deny', 'read');
-            if (denies.length === 0 && allows.length === 0) {
-                continue;
-            }
-            allFieldsAllows.push(...allows);
-            allFieldsDenies.push(...denies);
-            const guardFunc = this.generateReadFieldCheckerFunction(sourceFile, field, allows, denies);
-            // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-            result[`${runtime_1.FIELD_LEVEL_READ_CHECKER_PREFIX}${field.name}`] = guardFunc.getName();
-        }
-        if (allFieldsAllows.length > 0 || allFieldsDenies.length > 0) {
-            result[runtime_1.HAS_FIELD_LEVEL_POLICY_FLAG] = true;
-            const readFieldCheckSelect = this.generateSelectForRules([...allFieldsAllows, ...allFieldsDenies]);
-            if (readFieldCheckSelect) {
-                result[runtime_1.FIELD_LEVEL_READ_CHECKER_SELECTOR] = readFieldCheckSelect;
-            }
-        }
-    }
-    generateReadFieldCheckerFunction(sourceFile, field, allows, denies) {
+    // generates a function for checking "create" input
+    generateCreateInputCheckerFunction(model, sourceFile) {
         const statements = [];
-        this.generateNormalizedAuthRef(field.$container, allows, denies, statements);
-        // compile rules down to typescript expressions
+        const allows = (0, utils_1.getPolicyExpressions)(model, 'allow', 'create');
+        const denies = (0, utils_1.getPolicyExpressions)(model, 'deny', 'create');
+        (0, utils_1.generateNormalizedAuthRef)(model, allows, denies, statements);
         statements.push((writer) => {
+            if (allows.length === 0) {
+                writer.write('return false;');
+                return;
+            }
             const transformer = new sdk_1.TypeScriptExpressionTransformer({
                 context: sdk_1.ExpressionContext.AccessPolicy,
                 fieldReferenceContext: 'input',
             });
-            const denyStmt = denies.length > 0
+            let expr = denies.length > 0
                 ? '!(' +
                     denies
                         .map((deny) => {
@@ -332,32 +193,16 @@ class PolicyGenerator {
                         .join(' || ') +
                     ')'
                 : undefined;
-            const allowStmt = allows.length > 0
-                ? '(' +
-                    allows
-                        .map((allow) => {
-                        return transformer.transform(allow);
-                    })
-                        .join(' || ') +
-                    ')'
-                : undefined;
-            let expr;
-            if (denyStmt && allowStmt) {
-                expr = `${denyStmt} && ${allowStmt}`;
-            }
-            else if (denyStmt) {
-                expr = denyStmt;
-            }
-            else if (allowStmt) {
-                expr = allowStmt;
-            }
-            else {
-                throw new Error('should not happen');
-            }
+            const allowStmt = allows
+                .map((allow) => {
+                return transformer.transform(allow);
+            })
+                .join(' || ');
+            expr = expr ? `${expr} && (${allowStmt})` : allowStmt;
             writer.write('return ' + expr);
         });
         const func = sourceFile.addFunction({
-            name: `${field.$container.name}$${field.name}_read`,
+            name: model.name + '_create_input',
             returnType: 'boolean',
             parameters: [
                 {
@@ -373,294 +218,221 @@ class PolicyGenerator {
         });
         return func;
     }
-    generateReadFieldsOverrideGuards(model, sourceFile, result) {
-        for (const field of model.fields) {
-            const overrideAllows = this.getPolicyExpressions(field, 'allow', 'read', true);
-            if (overrideAllows.length > 0) {
-                const denies = this.getPolicyExpressions(field, 'deny', 'read');
-                const overrideGuardFunc = this.generateQueryGuardFunction(sourceFile, model, 'read', overrideAllows, denies, field, true);
-                result[`${runtime_1.FIELD_LEVEL_OVERRIDE_READ_GUARD_PREFIX}${field.name}`] = overrideGuardFunc.getName();
-            }
-        }
+    // writes `update: ...` for a given model
+    writeModelUpdateDef(model, policies, writer, sourceFile) {
+        writer.write(`update:`);
+        writer.inlineBlock(() => {
+            this.writeCommonModelDef(model, 'update', policies, writer, sourceFile);
+        });
+        writer.writeLine(',');
     }
-    generateUpdateFieldsGuards(model, sourceFile, result) {
-        for (const field of model.fields) {
-            const allows = this.getPolicyExpressions(field, 'allow', 'update');
-            const denies = this.getPolicyExpressions(field, 'deny', 'update');
-            if (denies.length === 0 && allows.length === 0) {
-                continue;
-            }
-            const guardFunc = this.generateQueryGuardFunction(sourceFile, model, 'update', allows, denies, field);
-            // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-            result[`${runtime_1.FIELD_LEVEL_UPDATE_GUARD_PREFIX}${field.name}`] = guardFunc.getName();
-            const overrideAllows = this.getPolicyExpressions(field, 'allow', 'update', true);
-            if (overrideAllows.length > 0) {
-                const overrideGuardFunc = this.generateQueryGuardFunction(sourceFile, model, 'update', overrideAllows, denies, field, true);
-                result[`${runtime_1.FIELD_LEVEL_OVERRIDE_UPDATE_GUARD_PREFIX}${field.name}`] = overrideGuardFunc.getName();
-            }
+    // writes `postUpdate: ...` for a given model
+    writeModelPostUpdateDef(model, policies, writer, sourceFile) {
+        writer.write(`postUpdate:`);
+        writer.inlineBlock(() => {
+            this.writeCommonModelDef(model, 'postUpdate', policies, writer, sourceFile);
+            // post-update policy has an additional selector for reading the pre-update entity data
+            this.writePostUpdatePreValueSelector(model, writer);
+        });
+        writer.writeLine(',');
+    }
+    writePostUpdatePreValueSelector(model, writer) {
+        const allows = (0, utils_1.getPolicyExpressions)(model, 'allow', 'postUpdate');
+        const denies = (0, utils_1.getPolicyExpressions)(model, 'deny', 'postUpdate');
+        const preValueSelect = (0, utils_1.generateSelectForRules)([...allows, ...denies]);
+        if (preValueSelect) {
+            writer.writeLine(`preUpdateSelector: ${JSON.stringify(preValueSelect)},`);
         }
     }
-    canCheckCreateBasedOnInput(model, allows, denies) {
-        return [...allows, ...denies].every((rule) => {
-            return (0, langium_1.streamAst)(rule).every((expr) => {
-                var _a;
-                if ((0, ast_1.isThisExpr)(expr)) {
-                    return false;
-                }
-                if ((0, ast_1.isReferenceExpr)(expr)) {
-                    if ((0, ast_1.isDataModel)((_a = expr.$resolvedType) === null || _a === void 0 ? void 0 : _a.decl)) {
-                        // if policy rules uses relation fields,
-                        // we can't check based on create input
-                        return false;
-                    }
-                    if ((0, ast_1.isDataModelField)(expr.target.ref) &&
-                        expr.target.ref.$container === model &&
-                        (0, sdk_1.hasAttribute)(expr.target.ref, '@default')) {
-                        // reference to field of current model
-                        // if it has default value, we can't check
-                        // based on create input
-                        return false;
-                    }
-                    if ((0, ast_1.isDataModelField)(expr.target.ref) && (0, sdk_1.isForeignKeyField)(expr.target.ref)) {
-                        // reference to foreign key field
-                        // we can't check based on create input
-                        return false;
-                    }
-                }
-                return true;
-            });
+    // writes `delete: ...` for a given model
+    writeModelDeleteDef(model, policies, writer, sourceFile) {
+        writer.write(`delete:`);
+        writer.inlineBlock(() => {
+            this.writeCommonModelDef(model, 'delete', policies, writer, sourceFile);
         });
     }
-    // generates a "select" object that contains (recursively) fields referenced by the
-    // given policy rules
-    generateSelectForRules(rules, forAuthContext = false) {
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        const result = {};
-        const addPath = (path) => {
-            let curr = result;
-            path.forEach((seg, i) => {
-                if (i === path.length - 1) {
-                    curr[seg] = true;
-                }
-                else {
-                    if (!curr[seg]) {
-                        curr[seg] = { select: {} };
-                    }
-                    curr = curr[seg].select;
-                }
-            });
-        };
-        // visit a reference or member access expression to build a
-        // selection path
-        const visit = (node) => {
-            if ((0, ast_1.isThisExpr)(node)) {
-                return [];
-            }
-            if ((0, ast_1.isReferenceExpr)(node)) {
-                const target = (0, sdk_1.resolved)(node.target);
-                if ((0, ast_1.isDataModelField)(target)) {
-                    // a field selection, it's a terminal
-                    return [target.name];
-                }
-            }
-            if ((0, ast_1.isMemberAccessExpr)(node)) {
-                if (forAuthContext && (0, sdk_1.isAuthInvocation)(node.operand)) {
-                    return [node.member.$refText];
-                }
-                if ((0, sdk_1.isFutureExpr)(node.operand)) {
-                    // future().field is not subject to pre-update select
-                    return undefined;
-                }
-                // build a selection path inside-out for chained member access
-                const inner = visit(node.operand);
-                if (inner) {
-                    return [...inner, node.member.$refText];
-                }
-            }
-            return undefined;
-        };
-        // collect selection paths from the given expression
-        const collectReferencePaths = (expr) => {
-            var _a, _b, _c;
-            if ((0, ast_1.isThisExpr)(expr) && !(0, ast_1.isMemberAccessExpr)(expr.$container)) {
-                // a standalone `this` expression, include all id fields
-                const model = (_a = expr.$resolvedType) === null || _a === void 0 ? void 0 : _a.decl;
-                const idFields = (0, sdk_1.getIdFields)(model);
-                return idFields.map((field) => [field.name]);
-            }
-            if ((0, ast_1.isMemberAccessExpr)(expr) || (0, ast_1.isReferenceExpr)(expr)) {
-                const path = visit(expr);
-                if (path) {
-                    if ((0, ast_1.isDataModel)((_b = expr.$resolvedType) === null || _b === void 0 ? void 0 : _b.decl)) {
-                        // member selection ended at a data model field, include its id fields
-                        const idFields = (0, sdk_1.getIdFields)((_c = expr.$resolvedType) === null || _c === void 0 ? void 0 : _c.decl);
-                        return idFields.map((field) => [...path, field.name]);
-                    }
-                    else {
-                        return [path];
-                    }
-                }
-                else {
-                    return [];
-                }
+    // writes `[kind]: ...` for a given model
+    writeCommonModelDef(model, kind, policies, writer, sourceFile) {
+        const allows = (0, utils_1.getPolicyExpressions)(model, 'allow', kind);
+        const denies = (0, utils_1.getPolicyExpressions)(model, 'deny', kind);
+        // policy guard
+        this.writePolicyGuard(model, kind, policies, allows, denies, writer, sourceFile);
+        // permission checker
+        if (kind !== 'postUpdate') {
+            this.writePermissionChecker(model, kind, policies, allows, denies, writer, sourceFile);
+        }
+        // write cross-model comparison rules as entity checker functions
+        // because they cannot be checked inside Prisma
+        this.writeEntityChecker(model, kind, writer, sourceFile, true);
+    }
+    writeEntityChecker(target, kind, writer, sourceFile, onlyCrossModelComparison = false, forOverride = false) {
+        var _a;
+        const allows = (0, utils_1.getPolicyExpressions)(target, 'allow', kind, forOverride, onlyCrossModelComparison ? 'onlyCrossModelComparison' : 'all');
+        const denies = (0, utils_1.getPolicyExpressions)(target, 'deny', kind, forOverride, onlyCrossModelComparison ? 'onlyCrossModelComparison' : 'all');
+        if (allows.length === 0 && denies.length === 0) {
+            return;
+        }
+        const model = (0, ast_1.isDataModel)(target) ? target : target.$container;
+        const func = (0, utils_1.generateEntityCheckerFunction)(sourceFile, model, kind, allows, denies, (0, ast_1.isDataModelField)(target) ? target : undefined, forOverride);
+        const selector = (_a = (0, utils_1.generateSelectForRules)([...allows, ...denies], false, kind !== 'postUpdate')) !== null && _a !== void 0 ? _a : {};
+        const key = forOverride ? 'overrideEntityChecker' : 'entityChecker';
+        writer.write(`${key}: { func: ${func.getName()}, selector: ${JSON.stringify(selector)} },`);
+    }
+    // writes `guard: ...` for a given policy operation kind
+    writePolicyGuard(model, kind, policies, allows, denies, writer, sourceFile) {
+        if (kind === 'update' && allows.length === 0) {
+            // no allow rule for 'update', policy is constant based on if there's
+            // post-update counterpart
+            if ((0, utils_1.getPolicyExpressions)(model, 'allow', 'postUpdate').length === 0) {
+                writer.write(`guard: false,`);
             }
-            else if ((0, ast_utils_1.isCollectionPredicate)(expr)) {
-                const path = visit(expr.left);
-                if (path) {
-                    // recurse into RHS
-                    const rhs = collectReferencePaths(expr.right);
-                    // combine path of LHS and RHS
-                    return rhs.map((r) => [...path, ...r]);
-                }
-                else {
-                    return [];
-                }
+            else {
+                writer.write(`guard: true,`);
             }
-            else if ((0, ast_1.isInvocationExpr)(expr)) {
-                // recurse into function arguments
-                return expr.args.flatMap((arg) => collectReferencePaths(arg.value));
+            return;
+        }
+        if (kind === 'postUpdate' && allows.length === 0 && denies.length === 0) {
+            // no 'postUpdate' rule, always allow
+            writer.write(`guard: true,`);
+            return;
+        }
+        if (kind in policies && typeof policies[kind] === 'boolean') {
+            // constant policy
+            writer.write(`guard: ${policies[kind]},`);
+            return;
+        }
+        // generate a policy function that evaluates a partial prisma query
+        const guardFunc = (0, utils_1.generateQueryGuardFunction)(sourceFile, model, kind, allows, denies);
+        writer.write(`guard: ${guardFunc.getName()},`);
+    }
+    // writes `permissionChecker: ...` for a given policy operation kind
+    writePermissionChecker(model, kind, policies, allows, denies, writer, sourceFile) {
+        if (this.options.generatePermissionChecker !== true) {
+            return;
+        }
+        if (policies[kind] === true || policies[kind] === false) {
+            // constant policy
+            writer.write(`permissionChecker: ${policies[kind]},`);
+            return;
+        }
+        if (kind === 'update' && allows.length === 0) {
+            // no allow rule for 'update', policy is constant based on if there's
+            // post-update counterpart
+            if ((0, utils_1.getPolicyExpressions)(model, 'allow', 'postUpdate').length === 0) {
+                writer.write(`permissionChecker: false,`);
             }
             else {
-                // recurse
-                const children = (0, langium_1.streamContents)(expr)
-                    .filter((child) => (0, ast_1.isExpression)(child))
-                    .toArray();
-                return children.flatMap((child) => collectReferencePaths(child));
+                writer.write(`permissionChecker: true,`);
             }
-        };
-        for (const rule of rules) {
-            const paths = collectReferencePaths(rule);
-            paths.forEach((p) => addPath(p));
+            return;
         }
-        return Object.keys(result).length === 0 ? undefined : result;
+        const guardFunc = this.generatePermissionCheckerFunction(model, kind, allows, denies, sourceFile);
+        writer.write(`permissionChecker: ${guardFunc.getName()},`);
     }
-    generateQueryGuardFunction(sourceFile, model, kind, allows, denies, forField, fieldOverride = false) {
+    generatePermissionCheckerFunction(model, kind, allows, denies, sourceFile) {
         const statements = [];
-        this.generateNormalizedAuthRef(model, allows, denies, statements);
-        const hasFieldAccess = [...denies, ...allows].some((rule) => (0, langium_1.streamAst)(rule).some((child) => 
-        // this.???
-        (0, ast_1.isThisExpr)(child) ||
-            // future().???
-            (0, sdk_1.isFutureExpr)(child) ||
-            // field reference
-            ((0, ast_1.isReferenceExpr)(child) && (0, ast_1.isDataModelField)(child.target.ref))));
-        if (!hasFieldAccess) {
-            // none of the rules reference model fields, we can compile down to a plain boolean
-            // function in this case (so we can skip doing SQL queries when validating)
-            statements.push((writer) => {
-                const transformer = new sdk_1.TypeScriptExpressionTransformer({
-                    context: sdk_1.ExpressionContext.AccessPolicy,
-                    isPostGuard: kind === 'postUpdate',
-                });
-                try {
-                    denies.forEach((rule) => {
-                        writer.write(`if (${transformer.transform(rule, false)}) { return ${expression_writer_1.FALSE}; }`);
-                    });
-                    allows.forEach((rule) => {
-                        writer.write(`if (${transformer.transform(rule, false)}) { return ${expression_writer_1.TRUE}; }`);
-                    });
-                }
-                catch (err) {
-                    if (err instanceof sdk_1.TypeScriptExpressionTransformerError) {
-                        throw new sdk_1.PluginError(__1.name, err.message);
-                    }
-                    else {
-                        throw err;
-                    }
-                }
-                if (forField) {
-                    if (allows.length === 0) {
-                        // if there's no allow rule, for field-level rules, by default we allow
-                        writer.write(`return ${expression_writer_1.TRUE};`);
-                    }
-                    else {
-                        // if there's any allow rule, we deny unless any allow rule evaluates to true
-                        writer.write(`return ${expression_writer_1.FALSE};`);
-                    }
-                }
-                else {
-                    // for model-level rules, the default is always deny
-                    writer.write(`return ${expression_writer_1.FALSE};`);
-                }
-            });
-        }
-        else {
-            statements.push((writer) => {
-                writer.write('return ');
-                const exprWriter = new expression_writer_1.ExpressionWriter(writer, kind === 'postUpdate');
-                const writeDenies = () => {
-                    writer.conditionalWrite(denies.length > 1, '{ AND: [');
-                    denies.forEach((expr, i) => {
-                        writer.inlineBlock(() => {
-                            writer.write('NOT: ');
-                            exprWriter.write(expr);
-                        });
-                        writer.conditionalWrite(i !== denies.length - 1, ',');
-                    });
-                    writer.conditionalWrite(denies.length > 1, ']}');
-                };
-                const writeAllows = () => {
-                    writer.conditionalWrite(allows.length > 1, '{ OR: [');
-                    allows.forEach((expr, i) => {
-                        exprWriter.write(expr);
-                        writer.conditionalWrite(i !== allows.length - 1, ',');
-                    });
-                    writer.conditionalWrite(allows.length > 1, ']}');
-                };
-                if (allows.length > 0 && denies.length > 0) {
-                    // include both allow and deny rules
-                    writer.write('{ AND: [');
-                    writeDenies();
-                    writer.write(',');
-                    writeAllows();
-                    writer.write(']}');
-                }
-                else if (denies.length > 0) {
-                    // only deny rules
-                    writeDenies();
-                }
-                else if (allows.length > 0) {
-                    // only allow rules
-                    writeAllows();
-                }
-                else {
-                    // disallow any operation
-                    writer.write(`{ OR: [] }`);
-                }
-                writer.write(';');
-            });
-        }
+        (0, utils_1.generateNormalizedAuthRef)(model, allows, denies, statements);
+        const transformed = new constraint_transformer_1.ConstraintTransformer({
+            authAccessor: 'user',
+        }).transformRules(allows, denies);
+        statements.push(`return ${transformed};`);
         const func = sourceFile.addFunction({
-            name: `${model.name}${forField ? '$' + forField.name : ''}${fieldOverride ? '$override' : ''}_${kind}`,
-            returnType: 'any',
+            name: `${model.name}$checker$${kind}`,
+            returnType: 'PermissionCheckerConstraint',
             parameters: [
                 {
                     name: 'context',
-                    type: 'QueryContext',
-                },
-                {
-                    // for generating field references used by field comparison in the same model
-                    name: 'db',
-                    type: 'CrudContract',
+                    type: 'PermissionCheckerContext',
                 },
             ],
             statements,
         });
         return func;
     }
-    generateInputCheckFunction(sourceFile, model, kind, allows, denies) {
+    // #endregion
+    // #region Field-level definitions
+    writeFieldLevelDefs(model, writer, sf) {
+        writer.write('fieldLevel:');
+        writer.inlineBlock(() => {
+            this.writeFieldReadDef(model, writer, sf);
+            this.writeFieldUpdateDef(model, writer, sf);
+        });
+        writer.writeLine(',');
+    }
+    writeFieldReadDef(model, writer, sourceFile) {
+        writer.writeLine('read:');
+        writer.block(() => {
+            for (const field of model.fields) {
+                const allows = (0, utils_1.getPolicyExpressions)(field, 'allow', 'read');
+                const denies = (0, utils_1.getPolicyExpressions)(field, 'deny', 'read');
+                const overrideAllows = (0, utils_1.getPolicyExpressions)(field, 'allow', 'read', true);
+                if (allows.length === 0 && denies.length === 0 && overrideAllows.length === 0) {
+                    continue;
+                }
+                writer.write(`${field.name}:`);
+                writer.block(() => {
+                    // guard
+                    const guardFunc = (0, utils_1.generateQueryGuardFunction)(sourceFile, model, 'read', allows, denies, field);
+                    writer.write(`guard: ${guardFunc.getName()},`);
+                    // checker function
+                    // write all field-level rules as entity checker function
+                    this.writeEntityChecker(field, 'read', writer, sourceFile, false, false);
+                    if (overrideAllows.length > 0) {
+                        // override guard function
+                        const denies = (0, utils_1.getPolicyExpressions)(field, 'deny', 'read');
+                        const overrideGuardFunc = (0, utils_1.generateQueryGuardFunction)(sourceFile, model, 'read', overrideAllows, denies, field, true);
+                        writer.write(`overrideGuard: ${overrideGuardFunc.getName()},`);
+                        // additional entity checker for override
+                        this.writeEntityChecker(field, 'read', writer, sourceFile, false, true);
+                    }
+                });
+                writer.writeLine(',');
+            }
+        });
+        writer.writeLine(',');
+    }
+    writeFieldUpdateDef(model, writer, sourceFile) {
+        writer.writeLine('update:');
+        writer.block(() => {
+            for (const field of model.fields) {
+                const allows = (0, utils_1.getPolicyExpressions)(field, 'allow', 'update');
+                const denies = (0, utils_1.getPolicyExpressions)(field, 'deny', 'update');
+                const overrideAllows = (0, utils_1.getPolicyExpressions)(field, 'allow', 'update', true);
+                if (allows.length === 0 && denies.length === 0 && overrideAllows.length === 0) {
+                    continue;
+                }
+                writer.write(`${field.name}:`);
+                writer.block(() => {
+                    // guard
+                    const guardFunc = (0, utils_1.generateQueryGuardFunction)(sourceFile, model, 'update', allows, denies, field);
+                    writer.write(`guard: ${guardFunc.getName()},`);
+                    // write cross-model comparison rules as entity checker functions
+                    // because they cannot be checked inside Prisma
+                    this.writeEntityChecker(field, 'update', writer, sourceFile, true, false);
+                    if (overrideAllows.length > 0) {
+                        // override guard
+                        const overrideGuardFunc = (0, utils_1.generateQueryGuardFunction)(sourceFile, model, 'update', overrideAllows, denies, field, true);
+                        writer.write(`overrideGuard: ${overrideGuardFunc.getName()},`);
+                        // write cross-model comparison override rules as entity checker functions
+                        // because they cannot be checked inside Prisma
+                        this.writeEntityChecker(field, 'update', writer, sourceFile, true, true);
+                    }
+                });
+                writer.writeLine(',');
+            }
+        });
+        writer.writeLine(',');
+    }
+    generateFieldReadCheckerFunction(sourceFile, field, allows, denies) {
         const statements = [];
-        this.generateNormalizedAuthRef(model, allows, denies, statements);
+        (0, utils_1.generateNormalizedAuthRef)(field.$container, allows, denies, statements);
+        // compile rules down to typescript expressions
         statements.push((writer) => {
-            if (allows.length === 0) {
-                writer.write('return false;');
-                return;
-            }
             const transformer = new sdk_1.TypeScriptExpressionTransformer({
                 context: sdk_1.ExpressionContext.AccessPolicy,
                 fieldReferenceContext: 'input',
             });
-            let expr = denies.length > 0
+            const denyStmt = denies.length > 0
                 ? '!(' +
                     denies
                         .map((deny) => {
@@ -669,16 +441,32 @@ class PolicyGenerator {
                         .join(' || ') +
                     ')'
                 : undefined;
-            const allowStmt = allows
-                .map((allow) => {
-                return transformer.transform(allow);
-            })
-                .join(' || ');
-            expr = expr ? `${expr} && (${allowStmt})` : allowStmt;
+            const allowStmt = allows.length > 0
+                ? '(' +
+                    allows
+                        .map((allow) => {
+                        return transformer.transform(allow);
+                    })
+                        .join(' || ') +
+                    ')'
+                : undefined;
+            let expr;
+            if (denyStmt && allowStmt) {
+                expr = `${denyStmt} && ${allowStmt}`;
+            }
+            else if (denyStmt) {
+                expr = denyStmt;
+            }
+            else if (allowStmt) {
+                expr = allowStmt;
+            }
+            else {
+                throw new Error('should not happen');
+            }
             writer.write('return ' + expr);
         });
         const func = sourceFile.addFunction({
-            name: model.name + '_' + kind + '_input',
+            name: `${field.$container.name}$${field.name}_read`,
             returnType: 'boolean',
             parameters: [
                 {
@@ -694,71 +482,58 @@ class PolicyGenerator {
         });
         return func;
     }
-    generateNormalizedAuthRef(model, allows, denies, statements) {
-        // check if any allow or deny rule contains 'auth()' invocation
-        const hasAuthRef = [...allows, ...denies].some((rule) => (0, langium_1.streamAst)(rule).some((child) => (0, sdk_1.isAuthInvocation)(child)));
-        if (hasAuthRef) {
-            const authModel = (0, sdk_1.getAuthModel)((0, sdk_1.getDataModels)(model.$container, true));
-            if (!authModel) {
-                throw new sdk_1.PluginError(__1.name, 'Auth model not found');
-            }
-            const userIdFields = (0, sdk_1.getIdFields)(authModel);
-            if (!userIdFields || userIdFields.length === 0) {
-                throw new sdk_1.PluginError(__1.name, 'User model does not have an id field');
-            }
-            // normalize user to null to avoid accidentally use undefined in filter
-            statements.push(`const user: any = context.user ?? null;`);
+    // #endregion
+    //#region Auth selector
+    writeAuthSelector(models, writer) {
+        const authSelector = this.generateAuthSelector(models);
+        if (authSelector) {
+            writer.write(`authSelector: ${JSON.stringify(authSelector)},`);
         }
     }
-    generateCheckerForModel(model, sourceFile) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const result = {};
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            const policies = (0, sdk_1.analyzePolicies)(model);
-            for (const kind of ['create', 'read', 'update', 'delete']) {
-                if (policies[kind] === true || policies[kind] === false) {
-                    result[kind] = policies[kind];
-                    continue;
-                }
-                const denies = this.getPolicyExpressions(model, 'deny', kind);
-                const allows = this.getPolicyExpressions(model, 'allow', kind);
-                if (kind === 'update' && allows.length === 0) {
-                    // no allow rule for 'update', policy is constant based on if there's
-                    // post-update counterpart
-                    if (this.getPolicyExpressions(model, 'allow', 'postUpdate').length === 0) {
-                        result[kind] = false;
-                        continue;
-                    }
-                    else {
-                        result[kind] = true;
-                        continue;
+    // Generates a { select: ... } object to select `auth()` fields used in policy rules
+    generateAuthSelector(models) {
+        const authRules = [];
+        models.forEach((model) => {
+            // model-level rules
+            const modelPolicyAttrs = model.attributes.filter((attr) => ['@@allow', '@@deny'].includes(attr.decl.$refText));
+            // field-level rules
+            const fieldPolicyAttrs = model.fields
+                .flatMap((f) => f.attributes)
+                .filter((attr) => ['@allow', '@deny'].includes(attr.decl.$refText));
+            // all rule expression
+            const allExpressions = [...modelPolicyAttrs, ...fieldPolicyAttrs]
+                .filter((attr) => attr.args.length > 1)
+                .map((attr) => attr.args[1].value);
+            // collect `auth()` member access
+            allExpressions.forEach((rule) => {
+                (0, langium_1.streamAst)(rule).forEach((node) => {
+                    if ((0, ast_1.isMemberAccessExpr)(node) && (0, sdk_1.isAuthInvocation)(node.operand)) {
+                        authRules.push(node);
                     }
-                }
-                const guardFunc = this.generateCheckerFunction(sourceFile, model, kind, allows, denies);
-                result[kind] = guardFunc.getName();
-            }
-            return result;
+                });
+            });
         });
+        if (authRules.length > 0) {
+            return (0, utils_1.generateSelectForRules)(authRules, true);
+        }
+        else {
+            return undefined;
+        }
     }
-    generateCheckerFunction(sourceFile, model, kind, allows, denies) {
-        const statements = [];
-        this.generateNormalizedAuthRef(model, allows, denies, statements);
-        const transformed = new constraint_transformer_1.ConstraintTransformer({
-            authAccessor: 'user',
-        }).transformRules(allows, denies);
-        statements.push(`return ${transformed};`);
-        const func = sourceFile.addFunction({
-            name: `${model.name}$checker$${kind}`,
-            returnType: 'CheckerConstraint',
-            parameters: [
-                {
-                    name: 'context',
-                    type: 'CheckerContext',
-                },
-            ],
-            statements,
+    // #endregion
+    // #region Validation meta
+    writeValidationMeta(writer, models) {
+        writer.write('validation:');
+        writer.inlineBlock(() => {
+            for (const model of models) {
+                writer.write(`${(0, lower_case_first_1.lowerCaseFirst)(model.name)}:`);
+                writer.inlineBlock(() => {
+                    writer.write(`hasValidation: ${(0, sdk_1.hasValidationAttributes)(model)}`);
+                });
+                writer.writeLine(',');
+            }
         });
-        return func;
+        writer.writeLine(',');
     }
 }
 exports.PolicyGenerator = PolicyGenerator;