fix issues with nested read; getting more test cases to pass

BREAKINGCHANGES.md

@@ -1,2 +1,3 @@
 1. `auth()` cannot be directly compared with a relation anymore
 2. `update` and `delete` policy rejection throws `NotFoundError`
+3. non-optional to-one relation doesn't automatically filter parent read when evaluating access policies

packages/runtime/src/client/crud/dialects/sqlite.ts

@@ -1,3 +1,4 @@
+import type Decimal from 'decimal.js';
 import {
     ExpressionWrapper,
     sql,
@@ -17,7 +18,6 @@ import {
     requireModel,
 } from '../../query-utils';
 import { BaseCrudDialect } from './base';
-import type Decimal from 'decimal.js';
 
 export class SqliteCrudDialect<
     Schema extends SchemaDef
@@ -123,11 +123,11 @@ export class SqliteCrudDialect<
         }
 
         tbl = tbl.select(() => {
-            const objArgs: Array<
+            type ArgsType =
                 | Expression<any>
                 | RawBuilder<any>
-                | SelectQueryBuilder<any, any, {}>
-            > = [];
+                | SelectQueryBuilder<any, any, {}>;
+            const objArgs: ArgsType[] = [];
 
             if (payload === true || !payload.select) {
                 // select all scalar fields
@@ -156,18 +156,36 @@ export class SqliteCrudDialect<
             } else if (payload.select) {
                 // select specific fields
                 objArgs.push(
-                    ...Object.entries(payload.select)
+                    ...Object.entries<any>(payload.select)
                         .filter(([, value]) => value)
-                        .map(([field]) => [
-                            sql.lit(field),
-                            buildFieldRef(
+                        .map(([field, value]) => {
+                            const fieldDef = requireField(
                                 this.schema,
                                 relationModel,
-                                field,
-                                this.options,
-                                eb
-                            ),
-                        ])
+                                field
+                            );
+                            if (fieldDef.relation) {
+                                const subJson = this.buildRelationJSON(
+                                    relationModel as GetModels<Schema>,
+                                    eb,
+                                    field,
+                                    `${parentName}$${relationField}`,
+                                    value
+                                );
+                                return [sql.lit(field), subJson as ArgsType];
+                            } else {
+                                return [
+                                    sql.lit(field),
+                                    buildFieldRef(
+                                        this.schema,
+                                        relationModel,
+                                        field,
+                                        this.options,
+                                        eb
+                                    ) as ArgsType,
+                                ];
+                            }
+                        })
                         .flatMap((v) => v)
                 );
             }

packages/runtime/src/client/crud/operations/create.ts

@@ -51,6 +51,7 @@ export class CreateOperationHandler<
 
         if (!result) {
             throw new RejectedByPolicyError(
+                this.model,
                 `result is not allowed to be read back`
             );
         }

packages/runtime/src/client/crud/operations/update.ts

@@ -40,6 +40,7 @@ export class UpdateOperationHandler<
 
         if (!result) {
             throw new RejectedByPolicyError(
+                this.model,
                 'result is not allowed to be read back'
             );
         }

packages/runtime/src/client/executor/zenstack-query-executor.ts

@@ -26,7 +26,7 @@ import type { PromiseType } from 'utility-types';
 import type { GetModels, SchemaDef } from '../../schema';
 import type { ClientImpl } from '../client-impl';
 import type { ClientContract } from '../contract';
-import { InternalError } from '../errors';
+import { InternalError, QueryError } from '../errors';
 import type {
     MutationInterceptionFilterResult,
     OnKyselyQueryTransactionCallback,
@@ -158,17 +158,23 @@ export class ZenStackQueryExecutor<
         return proceed(queryNode);
     }
 
-    private proceedQuery(query: RootOperationNode, queryId: QueryId) {
+    private async proceedQuery(query: RootOperationNode, queryId: QueryId) {
         // run built-in transformers
         const finalQuery = this.nameMapper.transformNode(query);
         const compiled = this.compileQuery(finalQuery);
-        return this.driver.txConnection
-            ? super
-                  .withConnectionProvider(
-                      new SingleConnectionProvider(this.driver.txConnection)
-                  )
-                  .executeQuery<any>(compiled, queryId)
-            : super.executeQuery<any>(compiled, queryId);
+        try {
+            return this.driver.txConnection
+                ? await super
+                      .withConnectionProvider(
+                          new SingleConnectionProvider(this.driver.txConnection)
+                      )
+                      .executeQuery<any>(compiled, queryId)
+                : await super.executeQuery<any>(compiled, queryId);
+        } catch (err) {
+            throw new QueryError(
+                `Policy: failed to execute query: ${err}, sql: ${compiled.sql}, parameters: ${compiled.parameters}`
+            );
+        }
     }
 
     private isMutationNode(queryNode: RootOperationNode) {

packages/runtime/src/plugins/policy/errors.ts

@@ -2,7 +2,12 @@
  * Error thrown when an operation is rejected by access policy.
  */
 export class RejectedByPolicyError extends Error {
-    constructor(reason?: string) {
-        super(reason ?? `Operation rejected by policy`);
+    constructor(
+        public readonly model: string | undefined,
+        public readonly reason?: string
+    ) {
+        super(
+            reason ?? `Operation rejected by policy${model ? ': ' + model : ''}`
+        );
     }
 }