Skip to content

Prisma extensions break zenstack authorization #1859

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
JoeRoddy opened this issue Nov 14, 2024 · 1 comment
Closed

Prisma extensions break zenstack authorization #1859

JoeRoddy opened this issue Nov 14, 2024 · 1 comment
Milestone

Comments

@JoeRoddy
Copy link

Description and expected behavior
Currently I'm running into an issue with zenstack authorization and prisma extensions. The problem is like so:

Approach 1:

1. extend base prisma client (add custom methods that rely on other prisma calls)
2. pass extended prisma client to enhance()
^ custom methods are not authorized, (base methods working)

Approach 2 (what I would think should work):

1. pass base prisma client to enhance()
2. extend the enhanced zenstack client
^ custom methods are authorized, all base methods (findFirst, findMany) lose authorization

I have a prisma extension like so:

export const extendPrismaClient = (db: PrismaClient) =>
  db.$extends({
    model: {
      blogs: {
        findManyListView: (
          args: Parameters<typeof db.blogs.findMany>[0],
        ) => {
          return db.blogs.findMany({
            ...args,
            include: {
              // extra stuff
            },
          });
        },
      },
    },
  });

and then, to generate my zenstack client:

const getPrisma = () => {
  const session = await auth();
  const zenClient = enhance(prismaClient, {
    user: (_session?.user || undefined) as any,
  });

  return extendPrismaClient(zenClient);
}

^ If I extend my zenstack client (after enhancing), my authorization rules stop working, EXCEPT for my custom function

If I extend my prisma client, and pass that to enhance(), normal prisma functions are authorized, but my extended function is not.

@ymc9
Copy link
Member

ymc9 commented Nov 19, 2024

Fixed in 2.9.0

@ymc9 ymc9 closed this as completed Nov 19, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants