fix(policy): incorrect policy injection for createManyAndReturn whe…

…n the model contains array fields (#1956)
zenstackhq · Jan 13, 2025 · cc3cd8c · cc3cd8c
1 parent 8e3b675
commit cc3cd8c
Show file tree

Hide file tree

Showing 17 changed files with 130 additions and 25 deletions.
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
     "name": "zenstack-monorepo",
-    "version": "2.11.1",
+    "version": "2.11.2",
     "description": "",
     "scripts": {
         "build": "pnpm -r --filter=\"!./packages/ide/*\" build",

diff --git a/packages/ide/jetbrains/build.gradle.kts b/packages/ide/jetbrains/build.gradle.kts
@@ -9,7 +9,7 @@ plugins {
 }
 
 group = "dev.zenstack"
-version = "2.11.1"
+version = "2.11.2"
 
 repositories {
     mavenCentral()

diff --git a/packages/ide/jetbrains/package.json b/packages/ide/jetbrains/package.json
@@ -1,6 +1,6 @@
 {
   "name": "jetbrains",
-  "version": "2.11.1",
+  "version": "2.11.2",
   "displayName": "ZenStack JetBrains IDE Plugin",
   "description": "ZenStack JetBrains IDE plugin",
   "homepage": "https://zenstack.dev",

diff --git a/packages/language/package.json b/packages/language/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@zenstackhq/language",
-    "version": "2.11.1",
+    "version": "2.11.2",
     "displayName": "ZenStack modeling language compiler",
     "description": "ZenStack modeling language compiler",
     "homepage": "https://zenstack.dev",

diff --git a/packages/misc/redwood/package.json b/packages/misc/redwood/package.json
@@ -1,7 +1,7 @@
 {
     "name": "@zenstackhq/redwood",
     "displayName": "ZenStack RedwoodJS Integration",
-    "version": "2.11.1",
+    "version": "2.11.2",
     "description": "CLI and runtime for integrating ZenStack with RedwoodJS projects.",
     "repository": {
         "type": "git",

diff --git a/packages/plugins/openapi/package.json b/packages/plugins/openapi/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@zenstackhq/openapi",
   "displayName": "ZenStack Plugin and Runtime for OpenAPI",
-  "version": "2.11.1",
+  "version": "2.11.2",
   "description": "ZenStack plugin and runtime supporting OpenAPI",
   "main": "index.js",
   "repository": {

diff --git a/packages/plugins/swr/package.json b/packages/plugins/swr/package.json
@@ -1,7 +1,7 @@
 {
     "name": "@zenstackhq/swr",
     "displayName": "ZenStack plugin for generating SWR hooks",
-    "version": "2.11.1",
+    "version": "2.11.2",
     "description": "ZenStack plugin for generating SWR hooks",
     "main": "index.js",
     "repository": {

diff --git a/packages/plugins/tanstack-query/package.json b/packages/plugins/tanstack-query/package.json
@@ -1,7 +1,7 @@
 {
     "name": "@zenstackhq/tanstack-query",
     "displayName": "ZenStack plugin for generating tanstack-query hooks",
-    "version": "2.11.1",
+    "version": "2.11.2",
     "description": "ZenStack plugin for generating tanstack-query hooks",
     "main": "index.js",
     "exports": {

diff --git a/packages/plugins/trpc/package.json b/packages/plugins/trpc/package.json
@@ -1,7 +1,7 @@
 {
     "name": "@zenstackhq/trpc",
     "displayName": "ZenStack plugin for tRPC",
-    "version": "2.11.1",
+    "version": "2.11.2",
     "description": "ZenStack plugin for tRPC",
     "main": "index.js",
     "repository": {

diff --git a/packages/runtime/package.json b/packages/runtime/package.json
@@ -1,7 +1,7 @@
 {
     "name": "@zenstackhq/runtime",
     "displayName": "ZenStack Runtime Library",
-    "version": "2.11.1",
+    "version": "2.11.2",
     "description": "Runtime of ZenStack for both client-side and server-side environments.",
     "repository": {
         "type": "git",

diff --git a/packages/runtime/src/enhancements/node/policy/handler.ts b/packages/runtime/src/enhancements/node/policy/handler.ts
@@ -478,8 +478,14 @@ export class PolicyProxyHandler<DbClient extends DbClientContract> implements Pr
             let result: { result: unknown; error?: Error }[];
 
             if (!shouldConvertToCreate) {
-                // direct `createManyAndReturn`
-                const created = await this.modelClient.createManyAndReturn(args);
+                // direct `createManyAndReturn`, make sure we only select id fields for return
+                // so we can use the results directly for read-back check
+                const updatedArgs = {
+                    ...args,
+                    select: this.policyUtils.makeIdSelection(this.model),
+                    include: undefined,
+                };
+                const created = await this.modelClient.createManyAndReturn(updatedArgs);
 
                 // process read-back
                 result = await Promise.all(

diff --git a/packages/schema/package.json b/packages/schema/package.json
@@ -3,7 +3,7 @@
     "publisher": "zenstack",
     "displayName": "ZenStack Language Tools",
     "description": "FullStack enhancement for Prisma ORM: seamless integration from database to UI",
-    "version": "2.11.1",
+    "version": "2.11.2",
     "author": {
         "name": "ZenStack Team"
     },

diff --git a/packages/sdk/package.json b/packages/sdk/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@zenstackhq/sdk",
-    "version": "2.11.1",
+    "version": "2.11.2",
     "description": "ZenStack plugin development SDK",
     "main": "index.js",
     "scripts": {

diff --git a/packages/server/package.json b/packages/server/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@zenstackhq/server",
-    "version": "2.11.1",
+    "version": "2.11.2",
     "displayName": "ZenStack Server-side Adapters",
     "description": "ZenStack server-side adapters",
     "homepage": "https://zenstack.dev",

diff --git a/packages/testtools/package.json b/packages/testtools/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@zenstackhq/testtools",
-  "version": "2.11.1",
+  "version": "2.11.2",
   "description": "ZenStack Test Tools",
   "main": "index.js",
   "private": true,

diff --git a/tests/integration/tests/enhancements/with-policy/create-many-and-return.test.ts b/tests/integration/tests/enhancements/with-policy/create-many-and-return.test.ts
@@ -92,15 +92,17 @@ describe('Test API createManyAndReturn', () => {
 
         const db = enhance();
 
-        // create should succeed but one result can't be read back
-        await expect(
-            db.post.createManyAndReturn({
-                data: [
-                    { title: 'post1', published: true },
-                    { title: 'post2', published: false },
-                ],
-            })
-        ).toBeRejectedByPolicy();
+        // create should succeed but one result's title field can't be read back
+        const r = await db.post.createManyAndReturn({
+            data: [
+                { title: 'post1', published: true },
+                { title: 'post2', published: false },
+            ],
+        });
+
+        expect(r.length).toBe(2);
+        expect(r[0].title).toBeTruthy();
+        expect(r[1].title).toBeUndefined();
 
         // check posts are created
         await expect(prisma.post.findMany()).resolves.toHaveLength(2);

diff --git a/tests/regression/tests/issue-1955.test.ts b/tests/regression/tests/issue-1955.test.ts
@@ -0,0 +1,97 @@
+import { createPostgresDb, dropPostgresDb, loadSchema } from '@zenstackhq/testtools';
+
+describe('issue 1955', () => {
+    it('simple policy', async () => {
+        const dbUrl = await createPostgresDb('issue-1955-1');
+        let _prisma: any;
+
+        try {
+            const { enhance, prisma } = await loadSchema(
+                `
+            model Post {
+                id Int @id @default(autoincrement())
+                name String
+                expections String[]
+
+                @@allow('all', true)
+            }
+            `,
+                { provider: 'postgresql', dbUrl }
+            );
+            _prisma = prisma;
+
+            const db = enhance();
+            await expect(
+                db.post.createManyAndReturn({
+                    data: [
+                        {
+                            name: 'bla',
+                        },
+                        {
+                            name: 'blu',
+                        },
+                    ],
+                })
+            ).resolves.toEqual(
+                expect.arrayContaining([
+                    expect.objectContaining({ name: 'bla' }),
+                    expect.objectContaining({ name: 'blu' }),
+                ])
+            );
+        } finally {
+            await _prisma.$disconnect();
+            await dropPostgresDb('issue-1955');
+        }
+    });
+
+    it('complex policy', async () => {
+        const dbUrl = await createPostgresDb('issue-1955-2');
+        let _prisma: any;
+
+        try {
+            const { enhance, prisma } = await loadSchema(
+                `
+            model Post {
+                id Int @id @default(autoincrement())
+                name String
+                expections String[]
+                comments Comment[]
+
+                @@allow('all', comments^[private])
+            }
+
+            model Comment {
+                id Int @id @default(autoincrement())
+                private Boolean @default(false)
+                postId Int
+                post Post @relation(fields: [postId], references: [id])
+            }
+            `,
+                { provider: 'postgresql', dbUrl }
+            );
+            _prisma = prisma;
+
+            const db = enhance();
+            await expect(
+                db.post.createManyAndReturn({
+                    data: [
+                        {
+                            name: 'bla',
+                        },
+                        {
+                            name: 'blu',
+                        },
+                    ],
+                })
+            ).resolves.toEqual(
+                expect.arrayContaining([
+                    expect.objectContaining({ name: 'bla' }),
+                    expect.objectContaining({ name: 'blu' }),
+                ])
+            );
+        } finally {
+            await _prisma.$disconnect();
+            await dropPostgresDb('issue-1955-2');
+        }
+    });
+});