zenstack
zenstack copied to clipboard
[Bug] Access Policy: check() function is being ignored if future() is being used
Description and expected behavior
After trying to implement the new check() function in the access control, I found out that when adding the future() function in another policy, it will kinda overwrite the delegated policies. After removing @@allow('update', future().title == 'hello') everything seems to be working normally.
Example
// delegating all operations
model Post {
id Int @id
title String
description String
author User @relation(fields: [authorId], references: [id])
authorId Int
// delegate all access policies to the author:
@@allow('all', check(author))
@@allow('update', future().title == 'hello')
}
// imagine I have update permission in the author relation of a post.
// the following db query will fail
const updatedPost = db.post.update({
where: {id: 'some_id'},
data: {description: 'new_description'},
});
Environment (please complete the following information):
- ZenStack version: v2.4.1
- Prisma version: v5.17.0
- Database type: Postgresql