merge dev to main (v3.5.3)

[ymc9]

Summary by CodeRabbit

• New Features

  • Added currentModel() and currentOperation() functions for policy expressions to reference the active model and CRUD operation.

• Bug Fixes

  • Improved PostgreSQL compatibility for policy comparisons involving UUID-typed fields and multi-hop relation traversals.

• Chores

  • Version bumped to 3.5.3 across all packages.
  • Enhanced package metadata (display names, repository links, funding information).

[claude]

Claude finished @ymc9's task —— View job

---

PR Review: merge dev to main (v3.5.3)

I've completed my analysis of this release PR that merges dev to main for v3.5.3. Here's my comprehensive review:

Todo List:

• Analyze the scope of changes (package.json vs core code)
• Review new regression test files
• Review ORM dialect changes
• Review policy expression transformer changes
• Check for potential bugs or issues
• Evaluate performance considerations
• Check for security concerns
• Assess test coverage
• Provide comprehensive feedback

Scope Analysis

This is a standard release PR with primarily version bumps across 20+ packages (v3.5.2 → v3.5.3), plus some important core functionality improvements:

Core Changes:

1. PostgreSQL UUID type handling - New casting logic in postgresql.ts:468-489
2. Policy expression improvements - Support for currentModel() and currentOperation() functions
3. Two regression test additions - Issues PostgreSQL: policy check fails with "operator does not exist: text = uuid" when auth() field has @db.Uuid #2394 and currentModel() / currentOperation() does not work inside of collection predicates #2536

---

Code Quality & Best Practices ✅

Excellent Standards:

• Proper type safety with TypeScript throughout
• Good use of invariants for runtime validation
• Well-structured dialect pattern with clear separation of concerns
• Comprehensive test coverage for new features

Minor Observations:

• The UUID type casting logic is defensive and well-implemented
• Policy expression evaluation follows existing patterns consistently

---

Potential Bugs & Issues ✅

No Critical Issues Found:

1. PostgreSQL Type Casting (postgresql.ts:468-489):

   • The new buildComparison() override correctly handles UUID/text type mismatches
   • Only activates when necessary (at least one side has @db.* override)
   • Proper fallback to base ZModel SQL types
   • Risk: Very Low - Defensive implementation

2. Policy Expression Functions (expression-evaluator.ts:50-53):

   • Simple context access for currentModel() and currentOperation()
   • No side effects or complex logic
   • Risk: Very Low - Straightforward implementation

3. Expression Transformer Updates (expression-transformer.ts:990-1021):

   • Enhanced getFieldDefFromFieldRef() with multi-hop relation support
   • Maintains backwards compatibility
   • Risk: Low - Extends existing functionality safely

---

Performance Considerations ✅

Positive Impact:

• UUID type casting only triggers when type mismatch detected (conditional execution)
• Policy expression evaluation remains O(1) for new functions
• No performance regressions identified

Multi-hop Relation Traversal:

• The enhanced field resolution walks relation chains efficiently
• No unnecessary iterations or memory allocations

---

Security Concerns ✅

No Security Issues:

• No exposure of sensitive data
• Type casting is database-level only (no user input processing)
• Policy expression functions don't expose internal state
• All changes maintain existing authorization patterns

---

Test Coverage ✅

Excellent Coverage:

1. Issue PostgreSQL: policy check fails with "operator does not exist: text = uuid" when auth() field has @db.Uuid #2394 Tests (issue-2394.test.ts):

   • 5 comprehensive test cases covering UUID field scenarios
   • Tests post-update policies, field comparisons, relation traversals, and auth integration
   • Coverage: Excellent

2. Issue currentModel() / currentOperation() does not work inside of collection predicates #2536 Tests (issue-2536.test.ts):

   • Tests currentModel() and currentOperation() in nested expressions
   • Validates mixin application behavior
   • Coverage: Good

---

Overall Assessment ✅

This is a high-quality release PR with:

Strengths:

• ✅ Solid bug fixes - Addresses real PostgreSQL type compatibility issues
• ✅ Feature enhancement - Adds useful policy expression functions
• ✅ Comprehensive testing - Excellent regression test coverage
• ✅ Minimal risk - All changes are defensive and backwards compatible
• ✅ Clean implementation - Follows established patterns and conventions

Minor Suggestions:

• Consider adding inline documentation for the UUID casting logic
• The multi-hop field resolution could benefit from performance metrics in larger schemas

Recommendation: APPROVE ✅

This release is ready for production. The changes address legitimate issues with proper testing, maintain backwards compatibility, and follow ZenStack's architectural patterns consistently.

---

[coderabbitai]

📝 Walkthrough

Walkthrough

Monorepo version bump from 3.5.2 to 3.5.3 across package.json files with metadata restructuring (displayName, structured author/repository/funding fields). Enhanced ORM dialect system with type-aware SQL comparison logic. Extended policy plugin with operation/thisType context and currentModel/currentOperation expression functions, including relation-aware field resolution.

Changes

Cohort / File(s)	Summary
Package Version & Metadata Updates Root package.json, packages/{auth-adapters/better-auth, cli, clients/client-helpers, clients/tanstack-query, common-helpers, config/\*, create-zenstack, ide/vscode, language, orm, plugins/policy, schema, sdk, server, testtools, zod}/package.json, samples/orm/package.json, tests/{e2e, regression, runtimes/\*}/package.json	Version bumped to 3.5.3 across 28 package.json files; added structured metadata fields (displayName, author object with email, homepage, repository, funding) and removed redundant string author/license fields in non-config packages.
ORM SQL Comparison Logic packages/orm/src/client/crud/dialects/base-dialect.ts, packages/orm/src/client/crud/dialects/postgresql.ts	Added buildComparison() method to BaseCrudDialect for expression-based SQL comparisons. PostgreSQL dialect enhanced with dbAttributeToSqlTypeMap, resolveFieldSqlType(), and buildValuesTableSelect() to handle native @db.* type overrides and cast mismatched SQL types before comparison.
Policy Plugin Extensions packages/plugins/policy/src/expression-evaluator.ts, packages/plugins/policy/src/expression-transformer.ts, packages/plugins/policy/package.json	Added operation and thisType to ExpressionEvaluatorContext; implemented currentModel() and currentOperation() call-expression functions. Enhanced expression-transformer to resolve relation-chain field access and use full context for binary comparisons via buildComparison(). Updated metadata in package.json.
Regression Tests tests/regression/test/issue-2394.test.ts, tests/regression/test/issue-2536.test.ts	New test coverage for UUID-typed field policies in PostgreSQL and currentModel()/currentOperation() functions within nested auth policy expressions.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Possibly related PRs

• #2057: Adds handling for currentModel() and currentOperation() policy expression functions with related evaluation and validation logic.

Poem

🐰 Version hops from 3.5 to 3.5.3,
Metadata blooms in structured harmony,
SQL types now match with PostgreSQL care,
Relations resolved through the policy air,
Tests guide us true through UUID snare! 🌟

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title 'merge dev to main (v3.5.3)' is vague and generic, using non-descriptive terms that don't convey meaningful information about the substantive changes in the PR.	Replace with a descriptive title highlighting the main changes, such as 'Bump version to v3.5.3 and update package metadata' or 'v3.5.3: Add package metadata and fix policy field comparisons'.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

packages/orm/src/client/crud/dialects/base-dialect.ts (1)

1498-1506: Add a comment documenting why MySQL/SQLite don't override buildComparison for @db.* attributes.

PostgreSQL explicitly overrides buildComparison to handle @db.* type-override attributes with type casting logic (see resolveFieldSqlType and the casting in lines 477-489). MySQL and SQLite inherit the base implementation and silently ignore @db.* attributes. Add a brief comment here clarifying whether this is intentional (those providers don't need type casting) or if it warrants follow-up.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/orm/src/client/crud/dialects/base-dialect.ts` around lines 1498 -
1506, The buildComparison method in base-dialect.ts currently returns
this.eb(...) without handling `@db`.* type-override attributes; add a concise
inline comment above buildComparison explaining why MySQL/SQLite dialects do not
override this (e.g., "MySQL/SQLite intentionally inherit base buildComparison
because these providers do not require explicit type casting for `@db`.* overrides
at comparison time" or if uncertain, mark as TODO to follow up), and mention
resolveFieldSqlType and the PostgreSQL override as the contrasting example so
future readers know where to look (reference: buildComparison and
resolveFieldSqlType).

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@packages/orm/src/client/crud/dialects/base-dialect.ts`:
- Around line 1498-1506: The buildComparison method in base-dialect.ts currently
returns this.eb(...) without handling `@db`.* type-override attributes; add a
concise inline comment above buildComparison explaining why MySQL/SQLite
dialects do not override this (e.g., "MySQL/SQLite intentionally inherit base
buildComparison because these providers do not require explicit type casting for
`@db`.* overrides at comparison time" or if uncertain, mark as TODO to follow up),
and mention resolveFieldSqlType and the PostgreSQL override as the contrasting
example so future readers know where to look (reference: buildComparison and
resolveFieldSqlType).

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: a7043b30-c62c-4155-a93c-252da89f33d5

📥 Commits

Reviewing files that changed from the base of the PR and between 554f82f and 28ae08d.

📒 Files selected for processing (30)

• package.json
• packages/auth-adapters/better-auth/package.json
• packages/cli/package.json
• packages/clients/client-helpers/package.json
• packages/clients/tanstack-query/package.json
• packages/common-helpers/package.json
• packages/config/eslint-config/package.json
• packages/config/typescript-config/package.json
• packages/config/vitest-config/package.json
• packages/create-zenstack/package.json
• packages/ide/vscode/package.json
• packages/language/package.json
• packages/orm/package.json
• packages/orm/src/client/crud/dialects/base-dialect.ts
• packages/orm/src/client/crud/dialects/postgresql.ts
• packages/plugins/policy/package.json
• packages/plugins/policy/src/expression-evaluator.ts
• packages/plugins/policy/src/expression-transformer.ts
• packages/schema/package.json
• packages/sdk/package.json
• packages/server/package.json
• packages/testtools/package.json
• packages/zod/package.json
• samples/orm/package.json
• tests/e2e/package.json
• tests/regression/package.json
• tests/regression/test/issue-2394.test.ts
• tests/regression/test/issue-2536.test.ts
• tests/runtimes/bun/package.json
• tests/runtimes/edge-runtime/package.json