fix(policy): compare before() enum fields as text on PostgreSQL

packages/plugins/policy/src/expression-transformer.ts

@@ -326,14 +326,13 @@ export class ExpressionTransformer<Schema extends SchemaDef> {
             const rightFieldDef = this.getFieldDefFromFieldRef(normalizedRight, context);
             // Map ZModel operator to SQL operator string
             const sqlOp = op === '==' ? '=' : op;
+            // `before()` enums are text in the VALUES table and pg can't compare text to a native enum
+            const asText =
+                this.isBeforeEnumField(normalizedLeft, context) || this.isBeforeEnumField(normalizedRight, context);
+            const operand = (node: OperationNode) =>
+                asText ? this.dialect.castText(new ExpressionWrapper(node)) : new ExpressionWrapper(node);
             return this.dialect
-                .buildComparison(
-                    new ExpressionWrapper(left),
-                    leftFieldDef,
-                    sqlOp,
-                    new ExpressionWrapper(right),
-                    rightFieldDef,
-                )
+                .buildComparison(operand(left), leftFieldDef, sqlOp, operand(right), rightFieldDef)
                 .toOperationNode();
         }
     }
@@ -1195,6 +1194,16 @@ export class ExpressionTransformer<Schema extends SchemaDef> {
         return !!fieldDef?.relation;
     }
 
+    private isBeforeEnumField(expr: Expression, context: ExpressionTransformerContext) {
+        if (!ExpressionUtils.isMember(expr) || !isBeforeInvocation(expr.receiver)) {
+            return false;
+        }
+        // `before()` always refers to the model being updated (`thisType`), even inside
+        // collection predicates where `modelOrType` is the related model
+        const fieldDef = QueryUtils.getField(this.schema, context.thisType, expr.members[0]!);
+        return !!fieldDef && QueryUtils.isEnum(this.schema, fieldDef.type);
+    }
+
     private getFieldDefFromFieldRef(expr: Expression, context: ExpressionTransformerContext): FieldDef | undefined {
         return this.resolveFieldRef(expr, context)?.fieldDef;
     }

tests/regression/test/issue-2727.test.ts

@@ -0,0 +1,60 @@
+import { createPolicyTestClient } from '@zenstackhq/testtools';
+import { describe, expect, it } from 'vitest';
+
+describe('Regression for issue #2727', () => {
+    it('compares before() enum fields in post-update rules on PostgreSQL native enums', async () => {
+        const db = await createPolicyTestClient(
+            `
+enum State {
+    DRAFT
+    IN_PROGRESS
+    DONE
+}
+
+model Post {
+    id    Int   @id
+    state State @default(DRAFT)
+    @@allow('all', true)
+    @@deny('post-update', before().state != state && before().state == DRAFT && state != IN_PROGRESS)
+}
+            `,
+            { provider: 'postgresql', usePrismaPush: true },
+        );
+
+        await db.post.create({ data: { id: 1 } });
+        await expect(db.post.update({ where: { id: 1 }, data: { state: 'DONE' } })).toBeRejectedByPolicy();
+        await db.post.update({ where: { id: 1 }, data: { state: 'IN_PROGRESS' } });
+    });
+
+    it('compares before() enum fields inside collection predicates on PostgreSQL native enums', async () => {
+        const db = await createPolicyTestClient(
+            `
+enum State {
+    DRAFT
+    IN_PROGRESS
+    DONE
+}
+
+model Post {
+    id       Int       @id
+    state    State     @default(DRAFT)
+    comments Comment[]
+    @@allow('all', true)
+    @@deny('post-update', comments?[before().state != this.state] && state == DONE)
+}
+
+model Comment {
+    id     Int  @id
+    post   Post @relation(fields: [postId], references: [id])
+    postId Int
+    @@allow('all', true)
+}
+            `,
+            { provider: 'postgresql', usePrismaPush: true },
+        );
+
+        await db.post.create({ data: { id: 1, comments: { create: { id: 1 } } } });
+        await expect(db.post.update({ where: { id: 1 }, data: { state: 'DONE' } })).toBeRejectedByPolicy();
+        await db.post.update({ where: { id: 1 }, data: { state: 'IN_PROGRESS' } });
+    });
+});