@appxdigital/appx-core 0.1.128-beta.0 → 0.1.128-beta.1

package/CHANGELOG.md

@@ -21,26 +21,27 @@ Read-only GraphQL, reworked into a **namespaced, opt-in-per-module** API.
 ### Added
 
 - **Namespaced read API.** Each exposed model gets one root query field (its camelCase name) with three operations: `find` (→ list), `get` (→ first match or null), `count` (→ Int). Example: `query { project { find(where:{…}){ id } get(where:{…}){ id } count } }`. Short names live on the per-model namespace, so they never collide, aliases work (`recent: find(...)`), and several models can be queried in one request.
-- **Opt-in per module — one line, no resolver file.** Expose a model by adding `CoreGraphqlResolver(<Model>Graphql)` to its module `providers` (the generated module ships this commented, copy-paste-ready). `<Model>Graphql` is a generated bundle at `src/generated/<model>/graphql.ts` (deploy-safe pass). Remove the line to un-expose.
+- **Opt-in per module — one line, no resolver file.** Expose a model by importing its generated resolver and adding it to `providers`: `import { <Model>Resolver } from '../../generated/<model>/graphql'; providers: [<Model>Service, <Model>Resolver]`. The generated module ships this commented, copy-paste-ready. `<Model>Resolver` (and the underlying `<Model>Graphql` bundle) live at `src/generated/<model>/graphql.ts`, emitted by the deploy-safe pass. Remove the line to un-expose.
 - **`/graphql` mounted by default** in new projects (Apollo; Sandbox on `GET /graphql`). The schema stays valid before any model opts in.
-- **Same ABAC as REST, verified end-to-end** (`test/http/graphql-abac.spec.ts`): unauthorized rows aren't returned (incl. `count`, which is filtered — no total leak), restricted fields come back null at top level and nested (`@Role`), and an inaccessible nested **record** is filtered while the parent stays accessible. GraphQL requests now populate the user across transports (`UserPopulationGuard` uses `transformContext`).
+- **Same ABAC as REST, verified end-to-end** (`test/http/graphql-abac.spec.ts`): unauthorized rows aren't returned (`count` included — it's filtered to accessible rows), restricted fields (`@Role`) come back null at the top level and nested, and an inaccessible nested **record** is filtered while the parent stays accessible. GraphQL requests now populate the user across transports (`UserPopulationGuard` uses `transformContext`).
+- **Filter/sort limited to readable fields.** A client `where` / `orderBy` / `distinct` that references a field the caller's role can't read is **rejected** (`403`), recursing through relations and `AND`/`OR`/`NOT` — the input-side counterpart to output field omission, applied in `PrismaService` for every transport.
 
 ### Changed / Removed
 
-- The old root-level `findAll<Model>s` / `findOne<Model>` / `findFirst<Model>` queries and the `GenericResolverFactory` export are **removed**, replaced by `CoreGraphqlResolver`.
+- The old root-level `findAll<Model>s` / `findOne<Model>` / `findFirst<Model>` queries and the `GenericResolverFactory` export are **removed**, replaced by the generated per-model `<Model>Resolver` (built on the exported `CoreGraphqlResolver`).
 - `appx-core generate models` **no longer scaffolds a per-module `*.resolver.ts` file**; GraphQL is opt-in via the one-liner above.
+- **`@apollo/server` is now a declared peer dependency** (`GraphqlModule` mounts Apollo by default). A normal `npm install` pulls it — no manual install.
 
 ### Migration
 
 > **Behaviour change — the GraphQL resolver API changed and per-module resolver files are no longer generated.** Only relevant if you use GraphQL.
 
 1. **Delete the generated `src/modules/<model>/<model>.resolver.ts` files** — they import the removed `GenericResolverFactory` and will not compile. Remove `<Model>Resolver` from each module's `providers`.
-2. Run **`appx-core generate`** to emit the new `src/generated/<model>/graphql.ts` bundles.
+2. Run **`appx-core generate`** to emit the new `src/generated/<model>/graphql.ts` bundles, then **`npm install`** (pulls the newly-declared `@apollo/server` peer that `GraphqlModule` needs).
 3. Add **`GraphqlModule`** to your `app.module` imports (new projects already have it): `import { GraphqlModule } from '@appxdigital/appx-core';`.
-4. **Expose each model** you want in GraphQL by adding one provider line to its module: `CoreGraphqlResolver(<Model>Graphql)` (import `<Model>Graphql` from `../../generated/<model>/graphql`). See [docs/graphql.md](./docs/graphql.md).
+4. **Expose each model** you want in GraphQL by adding one provider line to its module: import `<Model>Resolver` from `../../generated/<model>/graphql` and add it to `providers`. See [docs/graphql.md](./docs/graphql.md).
 5. **Update clients:** `findAllProjects(...)` → `project { find(...) }`, `findFirstProject` / `findOneProject` → `project { get(...) }`. Mutations remain REST-only.
-
-> **Security caveat (unchanged, still open):** generated `where`/`orderBy` inputs include `@Role`/`@NoWrite` columns (a filter-oracle; output values are omitted). Don't expose models with sensitive filterable columns to untrusted roles until the input scrub lands.
+6. **If a client filtered or ordered by a field a role can't read, that now returns `403`** — move such queries to a role that may read the field, or don't reference it.
 
 ---
 

package/README.md

@@ -81,7 +81,11 @@ AppX Core puts **security and data-access control first**, while keeping develop
   - JWT auth (recommended)
 - **Fast CRUD acceleration**
   - Generated modules, controllers, and services per model
-  - Standard REST CRUD endpoints
+  - Standard REST CRUD endpoints (the write surface)
+- **GraphQL read API — recommended for querying**
+  - Namespaced, **opt-in per model**: `model { find get count }`
+  - **Native pagination** (`take` / `skip` / `cursor`), nested relations, and several models per request — prefer it over the CRUD list endpoint for reads/filtering, and enable it on your main queryable models
+  - Same ABAC as REST (row / field / nested-record filtering; filter & sort limited to readable fields)
 - **Developer-friendly extension points**
   - Add custom endpoints with `@Permission(...)`
   - Use services for business logic, controllers as transport layer
@@ -614,7 +618,7 @@ Operational guidance:
 
 ### GraphQL status
 
-GraphQL exposes a **read-only** API — `find` / `get` / `count`, namespaced per model and **opt-in per module** (one line) — that runs through the same ABAC proxy as REST, so row filtering, field omission, and nested-relation filtering all apply. See **[docs/graphql.md](./docs/graphql.md)**. Not yet: mutations and full aggregates. One caveat before exposing sensitive models to untrusted roles — the generated `where`/`orderBy` inputs still include restricted columns (a filter-oracle; output values are omitted). REST CRUD + AdminJS remain the primary write surfaces.
+GraphQL exposes a **read-only** API — `find` / `get` / `count`, namespaced per model and **opt-in per module** (one line) — that runs through the same ABAC proxy as REST: row filtering, field omission, nested-relation filtering, and filter/sort limited to fields the role can read all apply. It supports nested selections and native pagination (`take`/`skip`/`cursor`), so it's the recommended surface for querying/filtering/paginating reads. See **[docs/graphql.md](./docs/graphql.md)**. Not yet: mutations and full aggregates — REST CRUD + AdminJS remain the write surfaces.
 
 ---
 

package/dist/config/generate-graphql.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-graphql.d.ts","sourceRoot":"","sources":["../../src/config/generate-graphql.ts"],"names":[],"mappings":"AAmCA;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,EAAE,GAAG,IAAI,CAUxE"}
+{"version":3,"file":"generate-graphql.d.ts","sourceRoot":"","sources":["../../src/config/generate-graphql.ts"],"names":[],"mappings":"AA6CA;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,EAAE,GAAG,IAAI,CAUxE"}

package/dist/config/generate-graphql.js

@@ -41,11 +41,11 @@ const generatedRoot = path.join(process.cwd(), 'src/generated');
  */
 const bundleTemplate = (model, folder) => {
     const camel = model.charAt(0).toLowerCase() + model.slice(1);
-    return `import { ${model} } from './${folder}.model';
+    return `import { CoreGraphqlResolver, GraphqlModelBundle } from '@appxdigital/appx-core';
+import { ${model} } from './${folder}.model';
 import { FindMany${model}Args } from './find-many-${folder}.args';
 import { FindFirst${model}Args } from './find-first-${folder}.args';
 import { ${model}WhereInput } from './${folder}-where.input';
-import type { GraphqlModelBundle } from '@appxdigital/appx-core';
 
 export const ${model}Graphql: GraphqlModelBundle<${model}> = {
   model: ${model},
@@ -54,6 +54,16 @@ export const ${model}Graphql: GraphqlModelBundle<${model}> = {
   findFirstArgs: FindFirst${model}Args,
   whereInput: ${model}WhereInput,
 };
+
+/**
+ * Ready-to-register read-only GraphQL resolver for ${model} (\`${camel} { find get count }\`).
+ * Add it to your ${model} module's \`providers\` to expose the model — no CoreGraphqlResolver
+ * import or resolver file needed:
+ *
+ *   import { ${model}Resolver } from '../../generated/${folder}/graphql';
+ *   providers: [${model}Service, ${model}Resolver]
+ */
+export const ${model}Resolver = CoreGraphqlResolver(${model}Graphql);
 `;
 };
 /**

package/dist/config/generate-modules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-modules.d.ts","sourceRoot":"","sources":["../../src/config/generate-modules.ts"],"names":[],"mappings":"AAoCA,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAItD;AAyCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,2BAA2B,CACvC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAAE,GACrB;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAC,CAkDpC;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,IAAI,CASrE"}
+{"version":3,"file":"generate-modules.d.ts","sourceRoot":"","sources":["../../src/config/generate-modules.ts"],"names":[],"mappings":"AAmCA,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAItD;AAyCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,2BAA2B,CACvC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAAE,GACrB;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAC,CAkDpC;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,IAAI,CASrE"}

package/dist/config/generate-modules.js

@@ -42,16 +42,15 @@ import { PrismaModule } from '../../prisma/prisma.module';
 import { ${model}Controller } from './${folder}.controller';
 import { ${model}Service } from './${folder}.service';
 // To expose this model over GraphQL (read-only: \`${camel} { find get count }\`),
-// uncomment the two imports and the provider line below. See docs/graphql.md.
-// import { CoreGraphqlResolver } from '@appxdigital/appx-core';
-// import { ${model}Graphql } from '../../generated/${folder}/graphql';
+// uncomment the import and the provider line below. See docs/graphql.md.
+// import { ${model}Resolver } from '../../generated/${folder}/graphql';
 
 @Module({
   imports: [PrismaModule],
   controllers: [${model}Controller],
   providers: [
     ${model}Service,
-    // CoreGraphqlResolver(${model}Graphql),
+    // ${model}Resolver,
   ],
 })
 export class ${model}Module {}

package/dist/prisma/prisma.service.d.ts

@@ -102,6 +102,18 @@ export declare class PrismaService {
      * @returns The modified query arguments with the appropriate `where` conditions applied.
      * @throws ForbiddenException if no valid `where` conditions are present after applying permissions.
      */
+    /**
+     * Reject a client `where` / `orderBy` / `distinct` that references a field
+     * this role cannot read (per `@Role` / `getFieldsToOmit`) — the input-side
+     * counterpart to `applyFieldOmission` on output, so a field the caller can't
+     * read can't be used to filter or sort either. Recurses through relations and
+     * AND/OR/NOT. Runs on the CLIENT args, before the trusted author-defined
+     * conditions are injected, so it never blocks the framework's own conditions.
+     */
+    private assertFilterFieldsReadable;
+    /** Recursively assert no omitted field is referenced in a where/orderBy clause. */
+    private assertClauseFieldsReadable;
+    private throwUnreadableFilterField;
     private applyWhereConditions;
     /**
      * Enforces permission `conditions` on `create` / `createMany`.

package/dist/prisma/prisma.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prisma.service.d.ts","sourceRoot":"","sources":["../../src/prisma/prisma.service.ts"],"names":[],"mappings":";AACA,OAAO,EAAC,MAAM,EAAE,YAAY,EAAC,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAC,qBAAqB,EAAkB,MAAM,yCAAyC,CAAC;AAG/F,OAAO,KAAK,EAAC,YAAY,IAAI,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAGlE,OAAO,EAAC,iBAAiB,EAAC,MAAM,kBAAkB,CAAC;AAEnD,eAAO,MAAM,iBAAiB;mBACX,MAAM,EAAE;EACvB,CAAC;AAEL,KAAK,QAAQ,GAAG,MAAM,aAAa,CAAC;AAEpC,oDAAoD;AACpD,MAAM,MAAM,iBAAiB,GAAG;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,4EAA4E;AAC5E,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AAEtE;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,YAAY,GAAG,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,CAAC,GAAG;IACjG,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACrC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACnD,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAClC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;CACrC,CAAC;AAGF,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,QAAQ,IAAI,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAAI;KAC7B,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;KAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACpG,CAAC;AAEF,qBACa,aAAa;IAaY,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAZpE,OAAO,CAAC,YAAY,CAA2B;IAC/C,YAAY,EAAE,YAAY,CAAC;IAC3B;;;;;OAKG;IACH,OAAO,CAAC,SAAS,CAAgB;gBAG7B,YAAY,EAAE,YAAY,EACqB,iBAAiB,EAAE,qBAAqB;IAQ3F;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IA6B3B,YAAY,CAAC,MAAM,EAAE,OAAO;IAO5B,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;IAWjE,OAAO,CAAC,KAAK;IAQb,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC;IAIpE,WAAW;IAkFX;;;;OAIG;IACH,gBAAgB,CAAC,CAAC,SAAS,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC;IAYlE,IAAI,KAAK,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAU3C;IAED,IAAI,IAAI,IAAI,eAAe,CAAC,MAAM,CAAC,CAElC;IAED,IAAI,OAAO,IAAI,eAAe,CAAC,SAAS,CAAC,CAExC;IAED,IAAI,gBAAgB,QAEnB;IAED;;;OAGG;IACH,WAAW;IA+DX;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAkE1B,IAAI,2BAA2B,QAM9B;IAED;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,oBAAoB;IA8K5B;;;;;;;;;;;;;;;;OAgBG;YACW,uBAAuB;IAkDrC;;;;;;;;;;;;;;;;;;;OAmBG;YACW,mBAAmB;IA2BjC,0EAA0E;YAC5D,wBAAwB;IAmCtC,yGAAyG;IACzG,OAAO,CAAC,gBAAgB;IAWxB,4FAA4F;IAC5F,OAAO,CAAC,eAAe;IAcvB;;;;;;;;OAQG;YACW,oBAAoB;IA6ClC;;;;OAIG;IACH,OAAO,CAAC,SAAS;IAKjB;;;;;;OAMG;YACW,2BAA2B;IAqBzC;;;;;;OAMG;IACH,OAAO,CAAC,yBAAyB;IAmBjC;;;;;;;OAOG;YACW,uBAAuB;IA8BrC,oGAAoG;IACpG,OAAO,CAAC,mBAAmB;IAwB3B;;;;;;;OAOG;WACW,gBAAgB,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,GAAG,GAAG;IAgBjE;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IA2BlC;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAUvB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IA8EzB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,IAAI,GAAG;QAC5E,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,OAAO,CAAA;KACtB;IAoBD,gBAAgB,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAyBzF"}
+{"version":3,"file":"prisma.service.d.ts","sourceRoot":"","sources":["../../src/prisma/prisma.service.ts"],"names":[],"mappings":";AACA,OAAO,EAAC,MAAM,EAAE,YAAY,EAAC,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAC,qBAAqB,EAAkB,MAAM,yCAAyC,CAAC;AAG/F,OAAO,KAAK,EAAC,YAAY,IAAI,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAGlE,OAAO,EAAC,iBAAiB,EAAC,MAAM,kBAAkB,CAAC;AAEnD,eAAO,MAAM,iBAAiB;mBACX,MAAM,EAAE;EACvB,CAAC;AAEL,KAAK,QAAQ,GAAG,MAAM,aAAa,CAAC;AAEpC,oDAAoD;AACpD,MAAM,MAAM,iBAAiB,GAAG;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,4EAA4E;AAC5E,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AAEtE;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,YAAY,GAAG,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,CAAC,GAAG;IACjG,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACrC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACnD,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAClC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;CACrC,CAAC;AAGF,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,QAAQ,IAAI,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAAI;KAC7B,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;KAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACpG,CAAC;AAEF,qBACa,aAAa;IAaY,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAZpE,OAAO,CAAC,YAAY,CAA2B;IAC/C,YAAY,EAAE,YAAY,CAAC;IAC3B;;;;;OAKG;IACH,OAAO,CAAC,SAAS,CAAgB;gBAG7B,YAAY,EAAE,YAAY,EACqB,iBAAiB,EAAE,qBAAqB;IAQ3F;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IA6B3B,YAAY,CAAC,MAAM,EAAE,OAAO;IAO5B,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;IAWjE,OAAO,CAAC,KAAK;IAQb,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC;IAIpE,WAAW;IAuFX;;;;OAIG;IACH,gBAAgB,CAAC,CAAC,SAAS,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC;IAYlE,IAAI,KAAK,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAU3C;IAED,IAAI,IAAI,IAAI,eAAe,CAAC,MAAM,CAAC,CAElC;IAED,IAAI,OAAO,IAAI,eAAe,CAAC,SAAS,CAAC,CAExC;IAED,IAAI,gBAAgB,QAEnB;IAED;;;OAGG;IACH,WAAW;IA+DX;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAkE1B,IAAI,2BAA2B,QAM9B;IAED;;;;;;;;;;;OAWG;IACH;;;;;;;OAOG;IACH,OAAO,CAAC,0BAA0B;IAYlC,mFAAmF;IACnF,OAAO,CAAC,0BAA0B;IA0ClC,OAAO,CAAC,0BAA0B;IAOlC,OAAO,CAAC,oBAAoB;IA8K5B;;;;;;;;;;;;;;;;OAgBG;YACW,uBAAuB;IAkDrC;;;;;;;;;;;;;;;;;;;OAmBG;YACW,mBAAmB;IA2BjC,0EAA0E;YAC5D,wBAAwB;IAmCtC,yGAAyG;IACzG,OAAO,CAAC,gBAAgB;IAWxB,4FAA4F;IAC5F,OAAO,CAAC,eAAe;IAcvB;;;;;;;;OAQG;YACW,oBAAoB;IA6ClC;;;;OAIG;IACH,OAAO,CAAC,SAAS;IAKjB;;;;;;OAMG;YACW,2BAA2B;IAqBzC;;;;;;OAMG;IACH,OAAO,CAAC,yBAAyB;IAmBjC;;;;;;;OAOG;YACW,uBAAuB;IA8BrC,oGAAoG;IACpG,OAAO,CAAC,mBAAmB;IAwB3B;;;;;;;OAOG;WACW,gBAAgB,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,GAAG,GAAG;IAgBjE;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IA2BlC;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAUvB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IA8EzB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,IAAI,GAAG;QAC5E,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,OAAO,CAAA;KACtB;IAoBD,gBAAgB,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAyBzF"}

package/dist/prisma/prisma.service.js

@@ -136,6 +136,11 @@ let PrismaService = exports.PrismaService = PrismaService_1 = class PrismaServic
                                             await this.enforceNestedWrites(String(propKey), params.data, user, userRole);
                                         }
                                         else {
+                                            // Reject a client where/orderBy/distinct that references a
+                                            // field this role can't read (input counterpart to output
+                                            // field omission). Runs on the client input, BEFORE the
+                                            // trusted ABAC conditions are injected below.
+                                            this.assertFilterFieldsReadable(String(propKey), userRole, params);
                                             params = this.applyWhereConditions(String(propKey), userRole, params, user, methodKey);
                                             // An update can re-point a foreign key (scalar column);
                                             // authorize those changes with the same connect rules as create.
@@ -342,6 +347,70 @@ let PrismaService = exports.PrismaService = PrismaService_1 = class PrismaServic
      * @returns The modified query arguments with the appropriate `where` conditions applied.
      * @throws ForbiddenException if no valid `where` conditions are present after applying permissions.
      */
+    /**
+     * Reject a client `where` / `orderBy` / `distinct` that references a field
+     * this role cannot read (per `@Role` / `getFieldsToOmit`) — the input-side
+     * counterpart to `applyFieldOmission` on output, so a field the caller can't
+     * read can't be used to filter or sort either. Recurses through relations and
+     * AND/OR/NOT. Runs on the CLIENT args, before the trusted author-defined
+     * conditions are injected, so it never blocks the framework's own conditions.
+     */
+    assertFilterFieldsReadable(modelName, userRole, args) {
+        if (!args || typeof args !== 'object')
+            return;
+        if (args.where)
+            this.assertClauseFieldsReadable(modelName, userRole, args.where, 'where');
+        if (args.orderBy)
+            this.assertClauseFieldsReadable(modelName, userRole, args.orderBy, 'orderBy');
+        if (args.distinct) {
+            const omit = new Set(this.getFieldsToOmit(modelName, userRole));
+            for (const field of [].concat(args.distinct)) {
+                if (omit.has(field))
+                    this.throwUnreadableFilterField(modelName, field, userRole, 'distinct');
+            }
+        }
+    }
+    /** Recursively assert no omitted field is referenced in a where/orderBy clause. */
+    assertClauseFieldsReadable(modelName, userRole, clause, kind) {
+        if (Array.isArray(clause)) {
+            for (const c of clause)
+                this.assertClauseFieldsReadable(modelName, userRole, c, kind);
+            return;
+        }
+        if (!clause || typeof clause !== 'object')
+            return;
+        const omit = new Set(this.getFieldsToOmit(modelName, userRole));
+        for (const key of Object.keys(clause)) {
+            const value = clause[key];
+            // Logical grouping — recurse on the same model.
+            if (key === 'AND' || key === 'OR' || key === 'NOT') {
+                this.assertClauseFieldsReadable(modelName, userRole, value, kind);
+                continue;
+            }
+            // Direct reference to a field the role can't read.
+            if (omit.has(key)) {
+                this.throwUnreadableFilterField(modelName, key, userRole, kind);
+            }
+            // Relation — recurse into the related model (unwrapping list/one filters).
+            const relation = this.getRelation(modelName, key);
+            if (relation) {
+                const wrappers = ['some', 'every', 'none', 'is', 'isNot'];
+                const wrapped = value && typeof value === 'object' ? wrappers.filter((w) => w in value) : [];
+                if (wrapped.length) {
+                    for (const w of wrapped)
+                        this.assertClauseFieldsReadable(relation.model, userRole, value[w], kind);
+                }
+                else {
+                    this.assertClauseFieldsReadable(relation.model, userRole, value, kind);
+                }
+            }
+            // Otherwise: a readable scalar field. Its value is an operator object
+            // (where) or 'asc'/'desc' (orderBy) — not a field map, so no recursion.
+        }
+    }
+    throwUnreadableFilterField(modelName, field, userRole, kind) {
+        throw new common_1.HttpException(`Cannot ${kind === 'orderBy' ? 'order by' : 'filter by'} '${modelName}.${field}' — not readable by role ${userRole}.`, common_1.HttpStatus.FORBIDDEN);
+    }
     applyWhereConditions(modelName, userRole, args, user, action) {
         if (!args) {
             args = {};

package/docs/graphql.md

@@ -4,6 +4,8 @@ AppX Core exposes a **read-only GraphQL API** generated from your Prisma schema.
 
 > **Scope:** **read only** — `find`, `get`, `count`. Writes (create/update/delete) are **not** exposed; use the REST CRUD endpoints. See [limitations.md](./limitations.md).
 
+> **Recommended for reads.** For querying, filtering, and **pagination** (native `take` / `skip` / `cursor`) prefer GraphQL over the generated CRUD list endpoint — one request can select several models, alias repeated queries, and pull nested relations in a single round-trip. Enable it on your main queryable models (one line per module, below); keep REST for writes.
+
 ---
 
 ## The endpoint
@@ -30,21 +32,20 @@ import { Module } from '@nestjs/common';
 import { PrismaModule } from '../../prisma/prisma.module';
 import { AlbumController } from './album.controller';
 import { AlbumService } from './album.service';
-import { CoreGraphqlResolver } from '@appxdigital/appx-core';
-import { AlbumGraphql } from '../../generated/album/graphql';   // generated by `appx-core generate`
+import { AlbumResolver } from '../../generated/album/graphql';   // generated by `appx-core generate`
 
 @Module({
   imports: [PrismaModule],
   controllers: [AlbumController],
   providers: [
     AlbumService,
-    CoreGraphqlResolver(AlbumGraphql),   // ← add = exposed; remove = not exposed
+    AlbumResolver,   // ← add = exposed; remove = not exposed
   ],
 })
 export class AlbumModule {}
 ```
 
-`AlbumGraphql` is a small bundle of generated types emitted by the deploy-safe pass (`appx-core generate`) at `src/generated/album/graphql.ts` — regenerated from the schema, never hand-edited.
+`AlbumResolver` is a ready-to-register resolver class emitted by the deploy-safe pass (`appx-core generate`) at `src/generated/album/graphql.ts` — regenerated from the schema, never hand-edited. (The same file exports the underlying `AlbumGraphql` bundle if you'd rather build the resolver yourself via the exported `CoreGraphqlResolver`.)
 
 ---
 
@@ -112,6 +113,7 @@ All three operations route through `PrismaService.getModelDelegate`, so the rule
 - **Unauthorized rows are not returned.** `find` returns only rows the role may read; `get` returns `null` for a row the caller can't access even if asked for by unique field; `count` counts only accessible rows.
 - **Restricted fields are omitted.** A column the role can't read (`/// @Role(...)`) comes back **`null`** even though the GraphQL type exposes it — at the top level *and* nested. (`prisma-nestjs-graphql` types every scalar; the proxy is what strips the values.)
 - **Inaccessible nested records are filtered.** If a nested relation points at a record the caller can't read, that relation is filtered out — a to-many yields only the visible rows; an inaccessible to-one drops the parent row. You can hold access to a record while a record it links to is withheld.
+- **You can only filter/sort by fields you can read.** A `where` / `orderBy` / `distinct` that references a field the role can't read (`@Role`) is rejected with `403` — top level or nested — so a hidden column can't be used to filter or order either.
 - **Anonymous callers are `GUEST`.** With no valid `Authorization: Bearer <jwt>` (or session), the request is a GUEST; a model with no GUEST rule is denied.
 
 > Because relation records and fields are filtered by ABAC, "empty / null" means "not visible to you", not "does not exist". Design queries and UI accordingly.
@@ -125,8 +127,6 @@ Always let the generated resolver serve the data — a custom resolver that reac
 - **Mutations** (create/update/delete) — use REST.
 - **Full `aggregate`** (sum/avg/min/max/groupBy) — only `count` is exposed today.
 
-> **Security note (before exposing sensitive models widely).** `prisma-nestjs-graphql` generates `where` / `orderBy` inputs that include *every* scalar, ignoring `/// @Role` / `/// @NoWrite`. Field **values** are omitted on output, but a `where`/`orderBy` over a restricted column (e.g. filtering by a password hash prefix) can still act as an oracle. Scrubbing restricted columns from the generated inputs is tracked as a follow-up; until then, avoid exposing models with sensitive filterable columns to untrusted roles.
-
 ---
 
 ## After changing the schema

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@appxdigital/appx-core",
-    "version": "0.1.128-beta.0",
+    "version": "0.1.128-beta.1",
     "description": "Appx Core is a library that provides a set of tools to help you build your application faster.",
     "main": "dist/index.js",
     "types": "dist/index.d.ts",
@@ -59,6 +59,7 @@
         "@adminjs/nestjs": "~7.0.0",
         "@adminjs/passwords": "~4.0.0",
         "@adminjs/prisma": "~5.0.4",
+        "@apollo/server": "^4.11.3",
         "@as-integrations/express5": "~1.1.2",
         "@aws-sdk/client-s3": "~3.850.0",
         "@aws-sdk/s3-request-presigner": "~3.850.0",