feat: add @@auth option for declaring auth model

packages/schema/src/language-server/zmodel-linker.ts

@@ -53,7 +53,7 @@ import {
 } from 'langium';
 import { match } from 'ts-pattern';
 import { CancellationToken } from 'vscode-jsonrpc';
-import { getAllDeclarationsFromImports } from '../utils/ast-utils';
+import { getAllDeclarationsFromImports, getModelAttributeValue } from '../utils/ast-utils';
 import { mapBuiltinTypeToExpressionType } from './validator/utils';
 
 interface DefaultReference extends Reference {
@@ -278,9 +278,11 @@ export class ZModelLinker extends DefaultLinker {
                 const model = getContainingModel(node);
 
                 if (model) {
-                    const userModel = getAllDeclarationsFromImports(this.langiumDocuments(), model).find(
-                        (d) => isDataModel(d) && d.name === 'User'
-                    );
+                    const dataModel = this.getContainingDataModel(node);
+                    const customAuthModel = dataModel && getModelAttributeValue('@@auth', dataModel);
+                    const userModel = getAllDeclarationsFromImports(this.langiumDocuments(), model).find((d) => {
+                        return isDataModel(d) && d.name === (customAuthModel ?? 'User');
+                    });
                     if (userModel) {
                         node.$resolvedType = { decl: userModel, nullable: true };
                     }

packages/schema/src/res/stdlib.zmodel

@@ -376,6 +376,11 @@ attribute @@deny(_ operation: String, _ condition: Boolean)
  */
 attribute @deny(_ operation: String, _ condition: Boolean)
 
+/**
+ * Defines the model to use when when checking access policies.
+ */
+attribute @@auth(_ modelName: String)
+
 /**
  * Indicates that the field is a password field and needs to be hashed before persistence.
  * 

packages/schema/src/utils/ast-utils.ts

@@ -156,3 +156,18 @@ export function getAllDeclarationsFromImports(documents: LangiumDocuments, model
 export function isCollectionPredicate(expr: Expression): expr is BinaryExpr {
     return isBinaryExpr(expr) && ['?', '!', '^'].includes(expr.operator);
 }
+
+export function findModelAttributeByName(name: string, dataModel: DataModel) {
+    return dataModel.attributes.find((attr) => attr.decl.$refNode?.text == name);
+}
+
+export function getModelAttributeValue(name: string, dataModel: DataModel) {
+    const attr = findModelAttributeByName(name, dataModel);
+    if (attr) {
+        const arg = attr.args.find((arg) => arg.value);
+        if (arg && arg.value && arg.value.$type == 'StringLiteral') {
+            return arg.value.value;
+        }
+    }
+    return undefined;
+}

packages/schema/tests/generator/expression-writer.test.ts

@@ -883,6 +883,39 @@ describe('Expression Writer Tests', () => {
         );
     });
 
+    it('auth using different model check', async () => {
+        await check(
+            `
+            model Membership {
+                id String @id
+                t Test?
+            }
+
+            model Test {
+                id String @id
+                owner Membership @relation(fields: [ownerId], references: [id])
+                ownerId String @unique @allow('all', auth().id == owner.id)
+                value Int
+                @@allow('all', auth().id == owner.id)
+                @@auth('Membership')
+            }
+                `,
+            (model) => {
+                const args = model.attributes[0].args[1];
+                return args.value;
+            },
+            `((user?.id??null)==null)?{
+                OR:[]
+            }:{
+                owner:{
+                     id:{
+                         equals:(user?.id??null)
+                    }
+                }
+            }`
+        );
+    });
+
     it('relation field null check', async () => {
         await check(
             `
@@ -903,8 +936,7 @@ describe('Expression Writer Tests', () => {
             `
             {
                 OR: [{ m: { is: null } }, { m: { s: { equals: null } } }]
-            }
-            `
+            }`
         );
 
         await check(