fix: infinite recursion when injecting field selection for field-level permission check

ymc9 · ymc9 · commit 5441665a1f8a · 2024-05-15T21:44:32.000+08:00
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
     "name": "zenstack-monorepo",
-    "version": "2.1.0",
+    "version": "2.1.1",
     "description": "",
     "scripts": {
         "build": "pnpm -r build",
diff --git a/packages/ide/jetbrains/build.gradle.kts b/packages/ide/jetbrains/build.gradle.kts
@@ -9,7 +9,7 @@ plugins {
 }
 
 group = "dev.zenstack"
-version = "2.1.0"
+version = "2.1.1"
 
 repositories {
     mavenCentral()
diff --git a/packages/ide/jetbrains/package.json b/packages/ide/jetbrains/package.json
@@ -1,6 +1,6 @@
 {
   "name": "jetbrains",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "displayName": "ZenStack JetBrains IDE Plugin",
   "description": "ZenStack JetBrains IDE plugin",
   "homepage": "https://zenstack.dev",
diff --git a/packages/language/package.json b/packages/language/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@zenstackhq/language",
-    "version": "2.1.0",
+    "version": "2.1.1",
     "displayName": "ZenStack modeling language compiler",
     "description": "ZenStack modeling language compiler",
     "homepage": "https://zenstack.dev",
diff --git a/packages/misc/redwood/package.json b/packages/misc/redwood/package.json
@@ -1,7 +1,7 @@
 {
     "name": "@zenstackhq/redwood",
     "displayName": "ZenStack RedwoodJS Integration",
-    "version": "2.1.0",
+    "version": "2.1.1",
     "description": "CLI and runtime for integrating ZenStack with RedwoodJS projects.",
     "repository": {
         "type": "git",
diff --git a/packages/plugins/openapi/package.json b/packages/plugins/openapi/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@zenstackhq/openapi",
   "displayName": "ZenStack Plugin and Runtime for OpenAPI",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "description": "ZenStack plugin and runtime supporting OpenAPI",
   "main": "index.js",
   "repository": {
diff --git a/packages/plugins/swr/package.json b/packages/plugins/swr/package.json
@@ -1,7 +1,7 @@
 {
     "name": "@zenstackhq/swr",
     "displayName": "ZenStack plugin for generating SWR hooks",
-    "version": "2.1.0",
+    "version": "2.1.1",
     "description": "ZenStack plugin for generating SWR hooks",
     "main": "index.js",
     "repository": {
diff --git a/packages/plugins/tanstack-query/package.json b/packages/plugins/tanstack-query/package.json
@@ -1,7 +1,7 @@
 {
     "name": "@zenstackhq/tanstack-query",
     "displayName": "ZenStack plugin for generating tanstack-query hooks",
-    "version": "2.1.0",
+    "version": "2.1.1",
     "description": "ZenStack plugin for generating tanstack-query hooks",
     "main": "index.js",
     "exports": {
diff --git a/packages/plugins/trpc/package.json b/packages/plugins/trpc/package.json
@@ -1,7 +1,7 @@
 {
     "name": "@zenstackhq/trpc",
     "displayName": "ZenStack plugin for tRPC",
-    "version": "2.1.0",
+    "version": "2.1.1",
     "description": "ZenStack plugin for tRPC",
     "main": "index.js",
     "repository": {
diff --git a/packages/plugins/trpc/tests/projects/t3-trpc-v10/package.json b/packages/plugins/trpc/tests/projects/t3-trpc-v10/package.json
@@ -20,6 +20,9 @@
     "@trpc/next": "^10.43.6",
     "@trpc/react-query": "^10.43.6",
     "@trpc/server": "^10.43.6",
+    "@zenstackhq/language": "file:../../../../../../.build/zenstackhq-language-2.1.0.tgz",
+    "@zenstackhq/runtime": "file:../../../../../../.build/zenstackhq-runtime-2.1.0.tgz",
+    "@zenstackhq/sdk": "file:../../../../../../.build/zenstackhq-sdk-2.1.0.tgz",
     "next": "^14.0.4",
     "react": "18.2.0",
     "react-dom": "18.2.0",
diff --git a/packages/runtime/package.json b/packages/runtime/package.json
@@ -1,7 +1,7 @@
 {
     "name": "@zenstackhq/runtime",
     "displayName": "ZenStack Runtime Library",
-    "version": "2.1.0",
+    "version": "2.1.1",
     "description": "Runtime of ZenStack for both client-side and server-side environments.",
     "repository": {
         "type": "git",
diff --git a/packages/runtime/src/enhancements/policy/policy-utils.ts b/packages/runtime/src/enhancements/policy/policy-utils.ts
@@ -960,13 +960,9 @@ export class PolicyUtil extends QueryUtils {
      * @returns
      */
     injectReadCheckSelect(model: string, args: any) {
-        if (this.hasFieldLevelPolicy(model)) {
-            // recursively inject selection for fields needed for field-level read checks
-            const readFieldSelect = this.getReadFieldSelect(model);
-            if (readFieldSelect) {
-                this.doInjectReadCheckSelect(model, args, { select: readFieldSelect });
-            }
-        }
+        // we need to recurse into relation fields before injecting the current level, because
+        // injection into current level can result in relation being selected/included, which
+        // can then cause infinite recursion when we visit relation later
 
         // recurse into relation fields
         for (const [k, v] of Object.entries<any>(args.select ?? args.include ?? {})) {
@@ -975,6 +971,14 @@ export class PolicyUtil extends QueryUtils {
                 this.injectReadCheckSelect(field.type, v);
             }
         }
+
+        if (this.hasFieldLevelPolicy(model)) {
+            // recursively inject selection for fields needed for field-level read checks
+            const readFieldSelect = this.getReadFieldSelect(model);
+            if (readFieldSelect) {
+                this.doInjectReadCheckSelect(model, args, { select: readFieldSelect });
+            }
+        }
     }
 
     private doInjectReadCheckSelect(model: string, args: any, input: any) {
diff --git a/packages/schema/package.json b/packages/schema/package.json
@@ -3,7 +3,7 @@
     "publisher": "zenstack",
     "displayName": "ZenStack Language Tools",
     "description": "Build scalable web apps with minimum code by defining authorization and validation rules inside the data schema that closer to the database",
-    "version": "2.1.0",
+    "version": "2.1.1",
     "author": {
         "name": "ZenStack Team"
     },
diff --git a/packages/sdk/package.json b/packages/sdk/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@zenstackhq/sdk",
-    "version": "2.1.0",
+    "version": "2.1.1",
     "description": "ZenStack plugin development SDK",
     "main": "index.js",
     "scripts": {
diff --git a/packages/server/package.json b/packages/server/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@zenstackhq/server",
-    "version": "2.1.0",
+    "version": "2.1.1",
     "displayName": "ZenStack Server-side Adapters",
     "description": "ZenStack server-side adapters",
     "homepage": "https://zenstack.dev",
diff --git a/packages/testtools/package.json b/packages/testtools/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@zenstackhq/testtools",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "description": "ZenStack Test Tools",
   "main": "index.js",
   "private": true,
diff --git a/tests/regression/tests/issue-1451.test.ts b/tests/regression/tests/issue-1451.test.ts
@@ -0,0 +1,58 @@
+import { loadSchema } from '@zenstackhq/testtools';
+
+describe('issue 1452', () => {
+    it('regression', async () => {
+        const { prisma, enhance } = await loadSchema(
+            `
+            model User {
+                id    String     @id
+                memberships Membership[]
+            }
+
+            model Space {
+                id           String          @id
+                memberships  Membership[]
+            }
+
+            model Membership {
+                userId            String
+                user              User       @relation(fields: [userId], references: [id], onDelete: Cascade)
+                spaceId           String
+                space             Space      @relation(fields: [spaceId], references: [id], onDelete: Cascade)
+              
+                role              String     @deny("update", auth() == user)
+                employeeReference String?    @deny("read, update", space.memberships?[auth() == user && !(role in ['owner', 'admin'])])
+              
+                createdAt         DateTime   @default(now())
+                updatedAt         DateTime   @updatedAt
+              
+                @@id([userId, spaceId])
+                @@allow('all', true)
+            }            
+            `,
+            { logPrismaQuery: true }
+        );
+
+        await prisma.user.create({
+            data: { id: '1' },
+        });
+
+        await prisma.space.create({
+            data: { id: '1' },
+        });
+
+        await prisma.membership.create({
+            data: {
+                user: { connect: { id: '1' } },
+                space: { connect: { id: '1' } },
+                role: 'foo',
+                employeeReference: 'xyz',
+            },
+        });
+
+        const db = enhance({ id: '1' });
+        const r = await db.membership.findMany();
+        expect(r).toHaveLength(1);
+        expect(r[0].employeeReference).toBeUndefined();
+    });
+});

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "zenstack-monorepo",`
`3`		`- "version": "2.1.0",`
	`3`	`+ "version": "2.1.1",`
`4`	`4`	`"description": "",`
`5`	`5`	`"scripts": {`
`6`	`6`	`"build": "pnpm -r build",`
Original file line number	Diff line number	Diff line change
`@@ -9,7 +9,7 @@ plugins {`
`9`	`9`	`}`
`10`	`10`
`11`	`11`	`group = "dev.zenstack"`
`12`		`-version = "2.1.0"`
	`12`	`+version = "2.1.1"`
`13`	`13`
`14`	`14`	`repositories {`
`15`	`15`	`mavenCentral()`
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "jetbrains",`
`3`		`- "version": "2.1.0",`
	`3`	`+ "version": "2.1.1",`
`4`	`4`	`"displayName": "ZenStack JetBrains IDE Plugin",`
`5`	`5`	`"description": "ZenStack JetBrains IDE plugin",`
`6`	`6`	`"homepage": "https://zenstack.dev",`
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "@zenstackhq/language",`
`3`		`- "version": "2.1.0",`
	`3`	`+ "version": "2.1.1",`
`4`	`4`	`"displayName": "ZenStack modeling language compiler",`
`5`	`5`	`"description": "ZenStack modeling language compiler",`
`6`	`6`	`"homepage": "https://zenstack.dev",`
Original file line number	Diff line number	Diff line change
`@@ -1,7 +1,7 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "@zenstackhq/redwood",`
`3`	`3`	`"displayName": "ZenStack RedwoodJS Integration",`
`4`		`- "version": "2.1.0",`
	`4`	`+ "version": "2.1.1",`
`5`	`5`	`"description": "CLI and runtime for integrating ZenStack with RedwoodJS projects.",`
`6`	`6`	`"repository": {`
`7`	`7`	`"type": "git",`
Original file line number	Diff line number	Diff line change
`@@ -1,7 +1,7 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "@zenstackhq/openapi",`
`3`	`3`	`"displayName": "ZenStack Plugin and Runtime for OpenAPI",`
`4`		`- "version": "2.1.0",`
	`4`	`+ "version": "2.1.1",`
`5`	`5`	`"description": "ZenStack plugin and runtime supporting OpenAPI",`
`6`	`6`	`"main": "index.js",`
`7`	`7`	`"repository": {`
Original file line number	Diff line number	Diff line change
`@@ -1,7 +1,7 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "@zenstackhq/swr",`
`3`	`3`	`"displayName": "ZenStack plugin for generating SWR hooks",`
`4`		`- "version": "2.1.0",`
	`4`	`+ "version": "2.1.1",`
`5`	`5`	`"description": "ZenStack plugin for generating SWR hooks",`
`6`	`6`	`"main": "index.js",`
`7`	`7`	`"repository": {`
Original file line number	Diff line number	Diff line change
`@@ -1,7 +1,7 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "@zenstackhq/tanstack-query",`
`3`	`3`	`"displayName": "ZenStack plugin for generating tanstack-query hooks",`
`4`		`- "version": "2.1.0",`
	`4`	`+ "version": "2.1.1",`
`5`	`5`	`"description": "ZenStack plugin for generating tanstack-query hooks",`
`6`	`6`	`"main": "index.js",`
`7`	`7`	`"exports": {`
Original file line number	Diff line number	Diff line change
`@@ -1,7 +1,7 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "@zenstackhq/trpc",`
`3`	`3`	`"displayName": "ZenStack plugin for tRPC",`
`4`		`- "version": "2.1.0",`
	`4`	`+ "version": "2.1.1",`
`5`	`5`	`"description": "ZenStack plugin for tRPC",`
`6`	`6`	`"main": "index.js",`
`7`	`7`	`"repository": {`