From e40779eb4a7a734e9bb6d17314f0376158ee6c19 Mon Sep 17 00:00:00 2001
From: Yiming <yiming@whimslab.io>
Date: Fri, 12 Jul 2024 10:05:46 -0700
Subject: [PATCH 1/2] merge dev to main (v2.3.0) (#1582)

Co-authored-by: Jason MacDonald <5718527+jasonmacdonald@users.noreply.github.com>
Co-authored-by: Jason MacDonald <jason.macdonald@veeva.com>
---
 packages/server/src/nestjs/zenstack.module.ts |  4 +-
 packages/server/tests/adapter/nestjs.test.ts  | 49 +++++++++++++++++++
 2 files changed, 51 insertions(+), 2 deletions(-)

diff --git a/packages/server/src/nestjs/zenstack.module.ts b/packages/server/src/nestjs/zenstack.module.ts
index f2ae601c6..a113fb84d 100644
--- a/packages/server/src/nestjs/zenstack.module.ts
+++ b/packages/server/src/nestjs/zenstack.module.ts
@@ -12,7 +12,7 @@ export interface ZenStackModuleOptions {
     /**
      * A callback for getting an enhanced `PrismaClient`.
      */
-    getEnhancedPrisma: () => unknown;
+    getEnhancedPrisma: (model?: string | symbol ) => unknown;
 }
 
 /**
@@ -79,7 +79,7 @@ export class ZenStackModule {
                             {
                                 get(_target, prop) {
                                     // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                                    const enhancedPrisma: any = getEnhancedPrisma();
+                                    const enhancedPrisma: any = getEnhancedPrisma(prop);
                                     if (!enhancedPrisma) {
                                         throw new Error('`getEnhancedPrisma` must return a valid Prisma client');
                                     }
diff --git a/packages/server/tests/adapter/nestjs.test.ts b/packages/server/tests/adapter/nestjs.test.ts
index 6cfa48617..d28a3ecc8 100644
--- a/packages/server/tests/adapter/nestjs.test.ts
+++ b/packages/server/tests/adapter/nestjs.test.ts
@@ -160,4 +160,53 @@ describe('NestJS adapter tests', () => {
         const postSvc = app.get('PostService');
         await expect(postSvc.findAll()).resolves.toHaveLength(1);
     });
+
+    it('pass property', async () => {
+        const { prisma, enhanceRaw } = await loadSchema(schema);
+
+        await prisma.user.create({
+            data: {
+                posts: {
+                    create: [
+                        { title: 'post1', published: true },
+                        { title: 'post2', published: false },
+                    ],
+                },
+            },
+        });
+
+        const moduleRef = await Test.createTestingModule({
+            imports: [
+                ZenStackModule.registerAsync({
+                    useFactory: (prismaService) => ({
+                        getEnhancedPrisma: (prop) => {
+                            return prop === 'post' ? prismaService : enhanceRaw(prismaService, { user: { id: 2 } });
+                        },
+                    }),
+                    inject: ['PrismaService'],
+                    extraProviders: [
+                        {
+                            provide: 'PrismaService',
+                            useValue: prisma,
+                        },
+                    ],
+                }),
+            ],
+            providers: [
+                {
+                    provide: 'PostService',
+                    useFactory: (enhancedPrismaService) => ({
+                        findAll: () => enhancedPrismaService.post.findMany(),
+                    }),
+                    inject: [ENHANCED_PRISMA],
+                },
+            ],
+        }).compile();
+
+        const app = moduleRef.createNestApplication();
+        await app.init();
+
+        const postSvc = app.get('PostService');
+        await expect(postSvc.findAll()).resolves.toHaveLength(2);
+    });
 });

From 5034fdc50387a0490693285cada09a18155564ee Mon Sep 17 00:00:00 2001
From: Yiming <yiming@whimslab.io>
Date: Sun, 14 Jul 2024 19:42:55 -0700
Subject: [PATCH 2/2] merge dev to main (v2.3.1) (#1593)

Co-authored-by: Jason MacDonald <5718527+jasonmacdonald@users.noreply.github.com>
Co-authored-by: Jason MacDonald <jason.macdonald@veeva.com>
---
 package.json                                  |   2 +-
 packages/ide/jetbrains/.idea/gradle.xml       |   1 +
 packages/ide/jetbrains/CHANGELOG.md           |   7 ++
 packages/ide/jetbrains/build.gradle.kts       |   2 +-
 packages/ide/jetbrains/package.json           |   2 +-
 packages/language/package.json                |   2 +-
 packages/misc/redwood/package.json            |   2 +-
 packages/plugins/openapi/package.json         |   2 +-
 packages/plugins/swr/package.json             |   2 +-
 packages/plugins/tanstack-query/package.json  |   2 +-
 packages/plugins/trpc/package.json            |   2 +-
 packages/runtime/package.json                 |   2 +-
 packages/runtime/src/enhancements/delegate.ts | 105 ++++++++---------
 .../src/enhancements/policy/handler.ts        |   2 +-
 .../src/enhancements/policy/policy-utils.ts   |   8 +-
 packages/runtime/src/enhancements/proxy.ts    |   4 +-
 packages/schema/package.json                  |   2 +-
 .../enhancer/enhance/auth-type-generator.ts   |  61 +++-------
 packages/sdk/package.json                     |   2 +-
 packages/server/package.json                  |   2 +-
 packages/testtools/package.json               |   2 +-
 .../with-delegate/enhanced-client.test.ts     | 108 +++++++++++++++++-
 .../enhancements/with-policy/auth.test.ts     |  26 +++++
 tests/regression/tests/issue-1574.test.ts     | 108 ++++++++++++++++++
 tests/regression/tests/issue-1576.test.ts     |  63 ++++++++++
 tests/regression/tests/issue-1585.test.ts     |  30 +++++
 26 files changed, 439 insertions(+), 112 deletions(-)
 create mode 100644 tests/regression/tests/issue-1574.test.ts
 create mode 100644 tests/regression/tests/issue-1576.test.ts
 create mode 100644 tests/regression/tests/issue-1585.test.ts

diff --git a/package.json b/package.json
index 0bb385fba..427a3c8e5 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
     "name": "zenstack-monorepo",
-    "version": "2.3.0",
+    "version": "2.3.1",
     "description": "",
     "scripts": {
         "build": "pnpm -r build",
diff --git a/packages/ide/jetbrains/.idea/gradle.xml b/packages/ide/jetbrains/.idea/gradle.xml
index ce1c62c7c..2e2f480f5 100644
--- a/packages/ide/jetbrains/.idea/gradle.xml
+++ b/packages/ide/jetbrains/.idea/gradle.xml
@@ -5,6 +5,7 @@
     <option name="linkedExternalProjectsSettings">
       <GradleProjectSettings>
         <option name="externalProjectPath" value="$PROJECT_DIR$" />
+        <option name="gradleJvm" value="22" />
         <option name="modules">
           <set>
             <option value="$PROJECT_DIR$" />
diff --git a/packages/ide/jetbrains/CHANGELOG.md b/packages/ide/jetbrains/CHANGELOG.md
index bf4b067fa..85a3c2e65 100644
--- a/packages/ide/jetbrains/CHANGELOG.md
+++ b/packages/ide/jetbrains/CHANGELOG.md
@@ -2,6 +2,13 @@
 
 ## [Unreleased]
 ### Added
+- New `check()` policy rule function.
+
+### Fixed
+- Fixed the issue with formatting schemas containing `Unsupported` type. 
+
+## 2.2.0
+### Added
 - Support comparing fields from different models in mutation policy rules ("create", "update", and "delete).
 
 ## 2.1.0
diff --git a/packages/ide/jetbrains/build.gradle.kts b/packages/ide/jetbrains/build.gradle.kts
index 4fdf18fce..10baf2598 100644
--- a/packages/ide/jetbrains/build.gradle.kts
+++ b/packages/ide/jetbrains/build.gradle.kts
@@ -9,7 +9,7 @@ plugins {
 }
 
 group = "dev.zenstack"
-version = "2.3.0"
+version = "2.3.1"
 
 repositories {
     mavenCentral()
diff --git a/packages/ide/jetbrains/package.json b/packages/ide/jetbrains/package.json
index 1046c0f6d..f193b0339 100644
--- a/packages/ide/jetbrains/package.json
+++ b/packages/ide/jetbrains/package.json
@@ -1,6 +1,6 @@
 {
   "name": "jetbrains",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "displayName": "ZenStack JetBrains IDE Plugin",
   "description": "ZenStack JetBrains IDE plugin",
   "homepage": "https://zenstack.dev",
diff --git a/packages/language/package.json b/packages/language/package.json
index 45edee4cd..9c98f0b6d 100644
--- a/packages/language/package.json
+++ b/packages/language/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@zenstackhq/language",
-    "version": "2.3.0",
+    "version": "2.3.1",
     "displayName": "ZenStack modeling language compiler",
     "description": "ZenStack modeling language compiler",
     "homepage": "https://zenstack.dev",
diff --git a/packages/misc/redwood/package.json b/packages/misc/redwood/package.json
index cd4681f2a..4207b19ea 100644
--- a/packages/misc/redwood/package.json
+++ b/packages/misc/redwood/package.json
@@ -1,7 +1,7 @@
 {
     "name": "@zenstackhq/redwood",
     "displayName": "ZenStack RedwoodJS Integration",
-    "version": "2.3.0",
+    "version": "2.3.1",
     "description": "CLI and runtime for integrating ZenStack with RedwoodJS projects.",
     "repository": {
         "type": "git",
diff --git a/packages/plugins/openapi/package.json b/packages/plugins/openapi/package.json
index 635a03f4b..900514e52 100644
--- a/packages/plugins/openapi/package.json
+++ b/packages/plugins/openapi/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@zenstackhq/openapi",
   "displayName": "ZenStack Plugin and Runtime for OpenAPI",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "description": "ZenStack plugin and runtime supporting OpenAPI",
   "main": "index.js",
   "repository": {
diff --git a/packages/plugins/swr/package.json b/packages/plugins/swr/package.json
index dac86fa6b..c11fbbdd2 100644
--- a/packages/plugins/swr/package.json
+++ b/packages/plugins/swr/package.json
@@ -1,7 +1,7 @@
 {
     "name": "@zenstackhq/swr",
     "displayName": "ZenStack plugin for generating SWR hooks",
-    "version": "2.3.0",
+    "version": "2.3.1",
     "description": "ZenStack plugin for generating SWR hooks",
     "main": "index.js",
     "repository": {
diff --git a/packages/plugins/tanstack-query/package.json b/packages/plugins/tanstack-query/package.json
index ca502d55b..0939e6494 100644
--- a/packages/plugins/tanstack-query/package.json
+++ b/packages/plugins/tanstack-query/package.json
@@ -1,7 +1,7 @@
 {
     "name": "@zenstackhq/tanstack-query",
     "displayName": "ZenStack plugin for generating tanstack-query hooks",
-    "version": "2.3.0",
+    "version": "2.3.1",
     "description": "ZenStack plugin for generating tanstack-query hooks",
     "main": "index.js",
     "exports": {
diff --git a/packages/plugins/trpc/package.json b/packages/plugins/trpc/package.json
index 62f86e900..0b2973825 100644
--- a/packages/plugins/trpc/package.json
+++ b/packages/plugins/trpc/package.json
@@ -1,7 +1,7 @@
 {
     "name": "@zenstackhq/trpc",
     "displayName": "ZenStack plugin for tRPC",
-    "version": "2.3.0",
+    "version": "2.3.1",
     "description": "ZenStack plugin for tRPC",
     "main": "index.js",
     "repository": {
diff --git a/packages/runtime/package.json b/packages/runtime/package.json
index 80ee0b2eb..7b8ea8b95 100644
--- a/packages/runtime/package.json
+++ b/packages/runtime/package.json
@@ -1,7 +1,7 @@
 {
     "name": "@zenstackhq/runtime",
     "displayName": "ZenStack Runtime Library",
-    "version": "2.3.0",
+    "version": "2.3.1",
     "description": "Runtime of ZenStack for both client-side and server-side environments.",
     "repository": {
         "type": "git",
diff --git a/packages/runtime/src/enhancements/delegate.ts b/packages/runtime/src/enhancements/delegate.ts
index fd8ad633a..d17861218 100644
--- a/packages/runtime/src/enhancements/delegate.ts
+++ b/packages/runtime/src/enhancements/delegate.ts
@@ -7,13 +7,13 @@ import {
     FieldInfo,
     ModelInfo,
     NestedWriteVisitor,
+    clone,
     enumerate,
     getIdFields,
     getModelInfo,
     isDelegateModel,
     resolveField,
 } from '../cross';
-import { clone } from '../cross';
 import type { CrudContract, DbClientContract } from '../types';
 import type { InternalEnhancementOptions } from './create-enhancement';
 import { Logger } from './logger';
@@ -79,7 +79,7 @@ export class DelegateProxyHandler extends DefaultPrismaProxyHandler {
 
         if (args.orderBy) {
             // `orderBy` may contain fields from base types
-            args.orderBy = this.buildWhereHierarchy(this.model, args.orderBy);
+            this.injectWhereHierarchy(this.model, args.orderBy);
         }
 
         if (this.options.logPrismaQuery) {
@@ -95,7 +95,7 @@ export class DelegateProxyHandler extends DefaultPrismaProxyHandler {
     }
 
     private injectWhereHierarchy(model: string, where: any) {
-        if (!where || typeof where !== 'object') {
+        if (!where || !isPlainObject(where)) {
             return;
         }
 
@@ -108,44 +108,9 @@ export class DelegateProxyHandler extends DefaultPrismaProxyHandler {
 
             const fieldInfo = resolveField(this.options.modelMeta, model, field);
             if (!fieldInfo?.inheritedFrom) {
-                return;
-            }
-
-            let base = this.getBaseModel(model);
-            let target = where;
-
-            while (base) {
-                const baseRelationName = this.makeAuxRelationName(base);
-
-                // prepare base layer where
-                let thisLayer: any;
-                if (target[baseRelationName]) {
-                    thisLayer = target[baseRelationName];
-                } else {
-                    thisLayer = target[baseRelationName] = {};
-                }
-
-                if (base.name === fieldInfo.inheritedFrom) {
-                    thisLayer[field] = value;
-                    delete where[field];
-                    break;
-                } else {
-                    target = thisLayer;
-                    base = this.getBaseModel(base.name);
+                if (fieldInfo?.isDataModel) {
+                    this.injectWhereHierarchy(fieldInfo.type, value);
                 }
-            }
-        });
-    }
-
-    private buildWhereHierarchy(model: string, where: any) {
-        if (!where) {
-            return undefined;
-        }
-
-        where = clone(where);
-        Object.entries(where).forEach(([field, value]) => {
-            const fieldInfo = resolveField(this.options.modelMeta, model, field);
-            if (!fieldInfo?.inheritedFrom) {
                 return;
             }
 
@@ -164,6 +129,9 @@ export class DelegateProxyHandler extends DefaultPrismaProxyHandler {
                 }
 
                 if (base.name === fieldInfo.inheritedFrom) {
+                    if (fieldInfo.isDataModel) {
+                        this.injectWhereHierarchy(base.name, value);
+                    }
                     thisLayer[field] = value;
                     delete where[field];
                     break;
@@ -173,8 +141,6 @@ export class DelegateProxyHandler extends DefaultPrismaProxyHandler {
                 }
             }
         });
-
-        return where;
     }
 
     private injectSelectIncludeHierarchy(model: string, args: any) {
@@ -189,7 +155,7 @@ export class DelegateProxyHandler extends DefaultPrismaProxyHandler {
                     if (fieldInfo && value !== undefined) {
                         if (value?.orderBy) {
                             // `orderBy` may contain fields from base types
-                            value.orderBy = this.buildWhereHierarchy(fieldInfo.type, value.orderBy);
+                            this.injectWhereHierarchy(fieldInfo.type, value.orderBy);
                         }
 
                         if (this.injectBaseFieldSelect(model, field, value, args, kind)) {
@@ -401,9 +367,46 @@ export class DelegateProxyHandler extends DefaultPrismaProxyHandler {
                     return this.doCreate(tx, this.model, { data: item });
                 })
             );
+            return { count: r.length };
+        });
+    }
 
-            // filter out undefined value (due to skipping duplicates)
-            return { count: r.filter((item) => !!item).length };
+    override createManyAndReturn(args: { data: any; select?: any; skipDuplicates?: boolean }): Promise<unknown[]> {
+        if (!args) {
+            throw prismaClientValidationError(this.prisma, this.options.prismaModule, 'query argument is required');
+        }
+        if (!args.data) {
+            throw prismaClientValidationError(
+                this.prisma,
+                this.options.prismaModule,
+                'data field is required in query argument'
+            );
+        }
+
+        if (!this.involvesDelegateModel(this.model)) {
+            return super.createManyAndReturn(args);
+        }
+
+        if (this.isDelegateOrDescendantOfDelegate(this.model) && args.skipDuplicates) {
+            throw prismaClientValidationError(
+                this.prisma,
+                this.options.prismaModule,
+                '`createManyAndReturn` with `skipDuplicates` set to true is not supported for delegated models'
+            );
+        }
+
+        // `createManyAndReturn` doesn't support nested create, which is needed for creating entities
+        // inheriting a delegate base, so we need to convert it to a regular `create` here.
+        // Note that the main difference is `create` doesn't support `skipDuplicates` as
+        // `createManyAndReturn` does.
+
+        return this.queryUtils.transaction(this.prisma, async (tx) => {
+            const r = await Promise.all(
+                enumerate(args.data).map(async (item) => {
+                    return this.doCreate(tx, this.model, { data: item, select: args.select });
+                })
+            );
+            return r;
         });
     }
 
@@ -921,15 +924,15 @@ export class DelegateProxyHandler extends DefaultPrismaProxyHandler {
         args = clone(args);
 
         if (args.cursor) {
-            args.cursor = this.buildWhereHierarchy(this.model, args.cursor);
+            this.injectWhereHierarchy(this.model, args.cursor);
         }
 
         if (args.orderBy) {
-            args.orderBy = this.buildWhereHierarchy(this.model, args.orderBy);
+            this.injectWhereHierarchy(this.model, args.orderBy);
         }
 
         if (args.where) {
-            args.where = this.buildWhereHierarchy(this.model, args.where);
+            this.injectWhereHierarchy(this.model, args.where);
         }
 
         if (this.options.logPrismaQuery) {
@@ -949,11 +952,11 @@ export class DelegateProxyHandler extends DefaultPrismaProxyHandler {
         args = clone(args);
 
         if (args?.cursor) {
-            args.cursor = this.buildWhereHierarchy(this.model, args.cursor);
+            this.injectWhereHierarchy(this.model, args.cursor);
         }
 
         if (args?.where) {
-            args.where = this.buildWhereHierarchy(this.model, args.where);
+            this.injectWhereHierarchy(this.model, args.where);
         }
 
         if (this.options.logPrismaQuery) {
@@ -989,7 +992,7 @@ export class DelegateProxyHandler extends DefaultPrismaProxyHandler {
         args = clone(args);
 
         if (args.where) {
-            args.where = this.buildWhereHierarchy(this.model, args.where);
+            this.injectWhereHierarchy(this.model, args.where);
         }
 
         if (this.options.logPrismaQuery) {
diff --git a/packages/runtime/src/enhancements/policy/handler.ts b/packages/runtime/src/enhancements/policy/handler.ts
index 4256582ab..4c5e5667f 100644
--- a/packages/runtime/src/enhancements/policy/handler.ts
+++ b/packages/runtime/src/enhancements/policy/handler.ts
@@ -461,7 +461,7 @@ export class PolicyProxyHandler<DbClient extends DbClientContract> implements Pr
         });
     }
 
-    createManyAndReturn(args: { select: any; include: any; data: any; skipDuplicates?: boolean }) {
+    createManyAndReturn(args: { data: any; select?: any; skipDuplicates?: boolean }) {
         if (!args) {
             throw prismaClientValidationError(this.prisma, this.prismaModule, 'query argument is required');
         }
diff --git a/packages/runtime/src/enhancements/policy/policy-utils.ts b/packages/runtime/src/enhancements/policy/policy-utils.ts
index dc2490b0a..91e460783 100644
--- a/packages/runtime/src/enhancements/policy/policy-utils.ts
+++ b/packages/runtime/src/enhancements/policy/policy-utils.ts
@@ -720,7 +720,13 @@ export class PolicyUtil extends QueryUtils {
                 }
             } else {
                 // hoist non-nullable to-one filter to the parent level
-                hoisted = this.getAuthGuard(db, fieldInfo.type, 'read');
+                let injected = this.safeClone(injectTarget[field]);
+                if (typeof injected !== 'object') {
+                    injected = {};
+                }
+                this.injectAuthGuardAsWhere(db, injected, fieldInfo.type, 'read');
+                hoisted = injected.where;
+
                 // recurse
                 const subHoisted = this.injectNestedReadConditions(db, fieldInfo.type, injectTarget[field]);
                 if (subHoisted.length > 0) {
diff --git a/packages/runtime/src/enhancements/proxy.ts b/packages/runtime/src/enhancements/proxy.ts
index 2e7e2e825..f99cdfab4 100644
--- a/packages/runtime/src/enhancements/proxy.ts
+++ b/packages/runtime/src/enhancements/proxy.ts
@@ -35,7 +35,7 @@ export interface PrismaProxyHandler {
 
     createMany(args: { data: any; skipDuplicates?: boolean }): Promise<BatchResult>;
 
-    createManyAndReturn(args: { data: any; select: any; include: any; skipDuplicates?: boolean }): Promise<unknown[]>;
+    createManyAndReturn(args: { data: any; select?: any; skipDuplicates?: boolean }): Promise<unknown[]>;
 
     update(args: any): Promise<unknown>;
 
@@ -124,7 +124,7 @@ export class DefaultPrismaProxyHandler implements PrismaProxyHandler {
         return this.deferred<{ count: number }>('createMany', args, false);
     }
 
-    createManyAndReturn(args: { data: any; select: any; include: any; skipDuplicates?: boolean }) {
+    createManyAndReturn(args: { data: any; select?: any; skipDuplicates?: boolean }) {
         return this.deferred<unknown[]>('createManyAndReturn', args);
     }
 
diff --git a/packages/schema/package.json b/packages/schema/package.json
index fa195575f..34d69addb 100644
--- a/packages/schema/package.json
+++ b/packages/schema/package.json
@@ -3,7 +3,7 @@
     "publisher": "zenstack",
     "displayName": "ZenStack Language Tools",
     "description": "Build scalable web apps with minimum code by defining authorization and validation rules inside the data schema that closer to the database",
-    "version": "2.3.0",
+    "version": "2.3.1",
     "author": {
         "name": "ZenStack Team"
     },
diff --git a/packages/schema/src/plugins/enhancer/enhance/auth-type-generator.ts b/packages/schema/src/plugins/enhancer/enhance/auth-type-generator.ts
index bf92d1c9d..a4e09fbb2 100644
--- a/packages/schema/src/plugins/enhancer/enhance/auth-type-generator.ts
+++ b/packages/schema/src/plugins/enhancer/enhance/auth-type-generator.ts
@@ -1,4 +1,4 @@
-import { getIdFields, hasAttribute, isAuthInvocation, isDataModelFieldReference } from '@zenstackhq/sdk';
+import { getIdFields, isAuthInvocation, isDataModelFieldReference } from '@zenstackhq/sdk';
 import {
     DataModel,
     DataModelField,
@@ -18,41 +18,27 @@ export function generateAuthType(model: Model, authModel: DataModel) {
     const types = new Map<
         string,
         {
-            // scalar fields to directly pick from Prisma-generated type
-            pickFields: string[];
-
-            // relation fields to include
-            addFields: { name: string; type: string }[];
+            // relation fields to require
+            requiredRelations: { name: string; type: string }[];
         }
     >();
 
-    types.set(authModel.name, { pickFields: getIdFields(authModel).map((f) => f.name), addFields: [] });
+    types.set(authModel.name, { requiredRelations: [] });
 
     const ensureType = (model: string) => {
         if (!types.has(model)) {
-            types.set(model, { pickFields: [], addFields: [] });
-        }
-    };
-
-    const addPickField = (model: string, field: string) => {
-        let fields = types.get(model);
-        if (!fields) {
-            fields = { pickFields: [], addFields: [] };
-            types.set(model, fields);
-        }
-        if (!fields.pickFields.includes(field)) {
-            fields.pickFields.push(field);
+            types.set(model, { requiredRelations: [] });
         }
     };
 
     const addAddField = (model: string, name: string, type: string, array: boolean) => {
         let fields = types.get(model);
         if (!fields) {
-            fields = { pickFields: [], addFields: [] };
+            fields = { requiredRelations: [] };
             types.set(model, fields);
         }
-        if (!fields.addFields.find((f) => f.name === name)) {
-            fields.addFields.push({ name, type: array ? `${type}[]` : type });
+        if (!fields.requiredRelations.find((f) => f.name === name)) {
+            fields.requiredRelations.push({ name, type: array ? `${type}[]` : type });
         }
     };
 
@@ -71,11 +57,6 @@ export function generateAuthType(model: Model, authModel: DataModel) {
                         const fieldType = memberDecl.type.reference.ref.name;
                         ensureType(fieldType);
                         addAddField(exprType.name, memberDecl.name, fieldType, memberDecl.type.array);
-                    } else {
-                        // member is a scalar
-                        if (!isIgnoredField(node.member.ref)) {
-                            addPickField(exprType.name, node.member.$refText);
-                        }
                     }
                 }
             }
@@ -88,11 +69,6 @@ export function generateAuthType(model: Model, authModel: DataModel) {
                     // field is a relation
                     ensureType(fieldType.name);
                     addAddField(fieldDecl.$container.name, node.target.$refText, fieldType.name, fieldDecl.type.array);
-                } else {
-                    if (!isIgnoredField(fieldDecl)) {
-                        // field is a scalar
-                        addPickField(fieldDecl.$container.name, node.target.$refText);
-                    }
                 }
             }
         });
@@ -112,16 +88,21 @@ ${Array.from(types.entries())
     .map(([model, fields]) => {
         let result = `Partial<_P.${model}>`;
 
-        if (fields.pickFields.length > 0) {
-            result = `WithRequired<${result}, ${fields.pickFields
-                .map((f) => `'${f}'`)
-                .join('|')}> & Record<string, unknown>`;
+        if (model === authModel.name) {
+            // auth model's id fields are always required
+            const idFields = getIdFields(authModel).map((f) => f.name);
+            if (idFields.length > 0) {
+                result = `WithRequired<${result}, ${idFields.map((f) => `'${f}'`).join('|')}>`;
+            }
         }
 
-        if (fields.addFields.length > 0) {
-            result = `${result} & { ${fields.addFields.map(({ name, type }) => `${name}: ${type}`).join('; ')} }`;
+        if (fields.requiredRelations.length > 0) {
+            // merge required relation fields
+            result = `${result} & { ${fields.requiredRelations.map((f) => `${f.name}: ${f.type}`).join('; ')} }`;
         }
 
+        result = `${result} & Record<string, unknown>`;
+
         return `    export type ${model} = ${result};`;
     })
     .join('\n')}
@@ -145,7 +126,3 @@ function isAuthAccess(node: AstNode): node is Expression {
 
     return false;
 }
-
-function isIgnoredField(field: DataModelField | undefined) {
-    return !!(field && hasAttribute(field, '@ignore'));
-}
diff --git a/packages/sdk/package.json b/packages/sdk/package.json
index 1b3e8309a..0dd455491 100644
--- a/packages/sdk/package.json
+++ b/packages/sdk/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@zenstackhq/sdk",
-    "version": "2.3.0",
+    "version": "2.3.1",
     "description": "ZenStack plugin development SDK",
     "main": "index.js",
     "scripts": {
diff --git a/packages/server/package.json b/packages/server/package.json
index 6b53ddb2d..f708a1e5c 100644
--- a/packages/server/package.json
+++ b/packages/server/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@zenstackhq/server",
-    "version": "2.3.0",
+    "version": "2.3.1",
     "displayName": "ZenStack Server-side Adapters",
     "description": "ZenStack server-side adapters",
     "homepage": "https://zenstack.dev",
diff --git a/packages/testtools/package.json b/packages/testtools/package.json
index 8d9d45ef5..6962bfd30 100644
--- a/packages/testtools/package.json
+++ b/packages/testtools/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@zenstackhq/testtools",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "description": "ZenStack Test Tools",
   "main": "index.js",
   "private": true,
diff --git a/tests/integration/tests/enhancements/with-delegate/enhanced-client.test.ts b/tests/integration/tests/enhancements/with-delegate/enhanced-client.test.ts
index ea9b8efca..73b25c1ca 100644
--- a/tests/integration/tests/enhancements/with-delegate/enhanced-client.test.ts
+++ b/tests/integration/tests/enhancements/with-delegate/enhanced-client.test.ts
@@ -129,14 +129,44 @@ describe('Polymorphism Test', () => {
             db.ratedVideo.createMany({ data: { viewCount: 1, duration: 100, url: 'xyz', rating: 100 } })
         ).resolves.toMatchObject({ count: 1 });
 
+        await expect(
+            db.ratedVideo.createManyAndReturn({ data: { viewCount: 1, duration: 100, url: 'xyz', rating: 100 } })
+        ).resolves.toEqual(
+            expect.arrayContaining([
+                expect.objectContaining({
+                    assetType: 'Video',
+                    videoType: 'RatedVideo',
+                    viewCount: 1,
+                    duration: 100,
+                    url: 'xyz',
+                    rating: 100,
+                }),
+            ])
+        );
+
         await expect(
             db.ratedVideo.createMany({
                 data: [
                     { viewCount: 2, duration: 200, url: 'xyz', rating: 100 },
-                    { viewCount: 3, duration: 300, url: 'xyz', rating: 100 },
+                    { viewCount: 3, duration: 300, url: 'xyz', rating: 200 },
                 ],
             })
         ).resolves.toMatchObject({ count: 2 });
+
+        await expect(
+            db.ratedVideo.createManyAndReturn({
+                data: [
+                    { viewCount: 2, duration: 200, url: 'xyz', rating: 100 },
+                    { viewCount: 3, duration: 300, url: 'xyz', rating: 200 },
+                ],
+                select: { videoType: true, viewCount: true, rating: true },
+            })
+        ).resolves.toEqual(
+            expect.arrayContaining([
+                { videoType: 'RatedVideo', viewCount: 2, rating: 100 },
+                { videoType: 'RatedVideo', viewCount: 3, rating: 200 },
+            ])
+        );
     });
 
     it('create many polymorphic relation', async () => {
@@ -284,6 +314,70 @@ describe('Polymorphism Test', () => {
         });
     });
 
+    it('read with compound filter', async () => {
+        const { enhance } = await loadSchema(
+            `
+            model Base {
+                id Int @id @default(autoincrement())
+                type String
+                viewCount Int
+                @@delegate(type)
+            }
+
+            model Foo extends Base {
+                name String
+            }
+            `,
+            { enhancements: ['delegate'] }
+        );
+
+        const db = enhance();
+        await db.foo.create({ data: { name: 'foo1', viewCount: 0 } });
+        await db.foo.create({ data: { name: 'foo2', viewCount: 1 } });
+
+        await expect(db.foo.findMany({ where: { viewCount: { gt: 0 } } })).resolves.toHaveLength(1);
+        await expect(db.foo.findMany({ where: { AND: { viewCount: { gt: 0 } } } })).resolves.toHaveLength(1);
+        await expect(db.foo.findMany({ where: { AND: [{ viewCount: { gt: 0 } }] } })).resolves.toHaveLength(1);
+        await expect(db.foo.findMany({ where: { OR: [{ viewCount: { gt: 0 } }] } })).resolves.toHaveLength(1);
+        await expect(db.foo.findMany({ where: { NOT: { viewCount: { lte: 0 } } } })).resolves.toHaveLength(1);
+    });
+
+    it('read with nested filter', async () => {
+        const { enhance } = await loadSchema(
+            `
+            model Base {
+                id Int @id @default(autoincrement())
+                type String
+                viewCount Int
+                @@delegate(type)
+            }
+
+            model Foo extends Base {
+                name String
+                bar Bar?
+            }
+
+            model Bar extends Base {
+                foo Foo @relation(fields: [fooId], references: [id])
+                fooId Int @unique
+            }
+            `,
+            { enhancements: ['delegate'] }
+        );
+
+        const db = enhance();
+
+        await db.bar.create({
+            data: { foo: { create: { name: 'foo', viewCount: 2 } }, viewCount: 1 },
+        });
+
+        await expect(
+            db.bar.findMany({
+                where: { viewCount: { gt: 0 }, foo: { viewCount: { gt: 1 } } },
+            })
+        ).resolves.toHaveLength(1);
+    });
+
     it('order by base fields', async () => {
         const { db, user } = await setup();
 
@@ -1013,6 +1107,18 @@ describe('Polymorphism Test', () => {
         });
         expect(count).toMatchObject({ _all: 1, rating: 1 });
 
+        count = await db.ratedVideo.count({
+            select: { _all: true, rating: true },
+            where: { AND: { viewCount: { gt: 0 }, rating: { gt: 10 } } },
+        });
+        expect(count).toMatchObject({ _all: 1, rating: 1 });
+
+        count = await db.ratedVideo.count({
+            select: { _all: true, rating: true },
+            where: { AND: [{ viewCount: { gt: 0 }, rating: { gt: 10 } }] },
+        });
+        expect(count).toMatchObject({ _all: 1, rating: 1 });
+
         expect(() => db.ratedVideo.count({ select: { rating: true, viewCount: true } })).toThrow(
             'count with fields from base type is not supported yet'
         );
diff --git a/tests/integration/tests/enhancements/with-policy/auth.test.ts b/tests/integration/tests/enhancements/with-policy/auth.test.ts
index ab2e55d73..f397fa804 100644
--- a/tests/integration/tests/enhancements/with-policy/auth.test.ts
+++ b/tests/integration/tests/enhancements/with-policy/auth.test.ts
@@ -809,4 +809,30 @@ describe('auth() compile-time test', () => {
             }
         );
     });
+
+    it('optional field stays optional', async () => {
+        await loadSchema(
+            `
+        model User {
+            id Int @id
+            age Int?
+
+            @@allow('all', auth().age > 0)
+        }
+        `,
+            {
+                compile: true,
+                extraSourceFiles: [
+                    {
+                        name: 'main.ts',
+                        content: `
+                import { enhance } from ".zenstack/enhance";
+                import { PrismaClient } from '@prisma/client';
+                enhance(new PrismaClient(), { user: { id: 1 } });
+                `,
+                    },
+                ],
+            }
+        );
+    });
 });
diff --git a/tests/regression/tests/issue-1574.test.ts b/tests/regression/tests/issue-1574.test.ts
new file mode 100644
index 000000000..946f54731
--- /dev/null
+++ b/tests/regression/tests/issue-1574.test.ts
@@ -0,0 +1,108 @@
+import { loadSchema } from '@zenstackhq/testtools';
+
+describe('issue 1574', () => {
+    it('regression', async () => {
+        const { enhance, prisma } = await loadSchema(
+            `
+model User {
+    id String @id @default(cuid())
+    modelA ModelA[]
+}
+
+//
+// ModelA has model-level access-all by owner, but read-all override for the name property
+//
+model ModelA {
+    id String @id @default(cuid())
+
+    owner User @relation(fields: [ownerId], references: [id])
+    ownerId String
+
+    name String @allow('read', true, true)
+    prop2 String?
+
+    refsB ModelB[]
+    refsC ModelC[]
+
+    @@allow('all', owner == auth())
+}
+
+//
+// ModelB and ModelC are both allow-all everyone.
+// They both have a reference to ModelA, but in ModelB that reference is optional.
+//
+model ModelB {
+    id String @id @default(cuid())
+
+    ref ModelA? @relation(fields: [refId], references: [id])
+    refId String?
+
+    @@allow('all', true)
+}
+model ModelC {
+    id String @id @default(cuid())
+
+    ref ModelA @relation(fields: [refId], references: [id])
+    refId String
+
+    @@allow('all', true)
+}
+        `,
+            { enhancements: ['policy'] }
+        );
+
+        // create two users
+        const user1 = await prisma.user.create({ data: { id: '1' } });
+        const user2 = await prisma.user.create({ data: { id: '2' } });
+
+        // create two db instances, enhanced for users 1 and 2
+        const db1 = enhance(user1);
+        const db2 = enhance(user2);
+
+        // create a ModelA owned by user1
+        const a = await db1.modelA.create({ data: { name: 'a', ownerId: user1.id } });
+
+        // create a ModelB and a ModelC with refs to ModelA
+        const b = await db1.modelB.create({ data: { refId: a.id } });
+        const c = await db2.modelC.create({ data: { refId: a.id } });
+
+        // works: user1 should be able to read b as well as the entire referenced a
+        const t1 = await db1.modelB.findFirst({ select: { ref: true } });
+        expect(t1.ref.name).toBeTruthy();
+
+        // works: user1 also should be able to read b as well as the name of the referenced a
+        const t2 = await db1.modelB.findFirst({ select: { ref: { select: { name: true } } } });
+        expect(t2.ref.name).toBeTruthy();
+
+        // works: user2 also should be able to read b as well as the name of the referenced a
+        const t3 = await db2.modelB.findFirst({ select: { ref: { select: { name: true } } } });
+        expect(t3.ref.name).toBeTruthy();
+
+        // works: but user2 should not be able to read b with the entire referenced a
+        const t4 = await db2.modelB.findFirst({ select: { ref: true } });
+        expect(t4.ref).toBeFalsy();
+
+        //
+        // The following are essentially the same tests, but with ModelC instead of ModelB
+        //
+
+        // works: user1 should be able to read c as well as the entire referenced a
+        const t5 = await db1.modelC.findFirst({ select: { ref: true } });
+        expect(t5.ref.name).toBeTruthy();
+
+        // works: user1 also should be able to read c as well as the name of the referenced a
+        const t6 = await db1.modelC.findFirst({ select: { ref: { select: { name: true } } } });
+        expect(t6.ref.name).toBeTruthy();
+
+        // works: user2 should not be able to read b along with the a reference.
+        // In this case, the entire query returns null because of the required (but inaccessible) ref.
+        await expect(db2.modelC.findFirst({ select: { ref: true } })).toResolveFalsy();
+
+        // works: if user2 queries c directly and gets the refId to a, it can get the a.name directly
+        const t7 = await db2.modelC.findFirstOrThrow();
+        await expect(db2.modelA.findFirst({ select: { name: true }, where: { id: t7.refId } })).toResolveTruthy();
+
+        // fails: since the last query worked, we'd expect to be able to query c along with the name of the referenced a directly
+        await expect(db2.modelC.findFirst({ select: { ref: { select: { name: true } } } })).toResolveTruthy();
+    });
+});
diff --git a/tests/regression/tests/issue-1576.test.ts b/tests/regression/tests/issue-1576.test.ts
new file mode 100644
index 000000000..d00b853d1
--- /dev/null
+++ b/tests/regression/tests/issue-1576.test.ts
@@ -0,0 +1,63 @@
+import { loadSchema } from '@zenstackhq/testtools';
+describe('issue 1576', () => {
+    it('regression', async () => {
+        const { enhance } = await loadSchema(
+            `
+model Profile {
+  id Int @id @default(autoincrement())
+  name String
+  items Item[]
+  type String
+  @@delegate(type)
+  @@allow('all', true)
+}
+
+model GoldProfile extends Profile {
+  ticket Int
+}
+
+model Item {
+  id Int @id @default(autoincrement())
+  profileId Int
+  profile Profile @relation(fields: [profileId], references: [id])
+  type String
+  @@delegate(type)
+  @@allow('all', true)
+}
+
+model GoldItem extends Item {
+  inventory Boolean
+}
+          `
+        );
+
+        const db = enhance();
+
+        const profile = await db.goldProfile.create({
+            data: {
+                name: 'hello',
+                ticket: 5,
+            },
+        });
+
+        await expect(
+            db.goldItem.createManyAndReturn({
+                data: [
+                    {
+                        profileId: profile.id,
+                        inventory: true,
+                    },
+                    {
+                        profileId: profile.id,
+                        inventory: true,
+                    },
+                ],
+            })
+        ).resolves.toEqual(
+            expect.arrayContaining([
+                expect.objectContaining({ profileId: profile.id, type: 'GoldItem', inventory: true }),
+                expect.objectContaining({ profileId: profile.id, type: 'GoldItem', inventory: true }),
+            ])
+        );
+    });
+});
diff --git a/tests/regression/tests/issue-1585.test.ts b/tests/regression/tests/issue-1585.test.ts
new file mode 100644
index 000000000..49ec333d4
--- /dev/null
+++ b/tests/regression/tests/issue-1585.test.ts
@@ -0,0 +1,30 @@
+import { loadSchema } from '@zenstackhq/testtools';
+describe('issue 1585', () => {
+    it('regression', async () => {
+        const { enhance } = await loadSchema(
+            `
+            model Asset {
+                id Int @id @default(autoincrement())
+                type String
+                views Int
+
+                @@allow('all', true)
+                @@delegate(type)
+            }
+            
+            model Post extends Asset {
+                title String
+            }
+            `
+        );
+
+        const db = enhance();
+        await db.post.create({ data: { title: 'Post1', views: 0 } });
+        await db.post.create({ data: { title: 'Post2', views: 1 } });
+        await expect(
+            db.post.count({
+                where: { views: { gt: 0 } },
+            })
+        ).resolves.toBe(1);
+    });
+});