@appxdigital/appx-core 0.1.129 → 0.1.131

package/CHANGELOG.md

@@ -14,6 +14,81 @@ This project follows the `MAJOR.MINOR.PATCH` scheme in `package.json`.
 
 ---
 
+## [0.1.131] — 2026-10-19
+
+### Changed
+
+- **`appx-core create` no longer requires npm 11.** New projects get `vitest ~4.0.18` and `unplugin-swc 1.5.10`: newer releases (vitest 4.1+ with vite 8, unplugin-swc 1.5.11+ with unplugin 3) bring peer graphs that npm 10 can't resolve (`Cannot read properties of null (reading 'edgesOut')` — an npm bug fixed only in npm 11.6). The created project no longer declares `engines.npm`.
+
+### Fixed
+
+- **A lockfile written by npm 10 now passes `npm ci` on npm 10.** npm 10 hoisted `ts-morph@16` (from `prisma-nestjs-graphql`) and `@opentelemetry/api@1.4.1` (from `prisma-case-format`) to the project root, where they don't satisfy the optional peer ranges of `@nestjs/graphql` (`ts-morph ^25`) and `vitest` (`@opentelemetry/api ^1.9`); its own `npm ci` then rejected the lockfile (`EUSAGE … does not satisfy`). The framework now depends on `ts-morph ^25.0.0` and `@opentelemetry/api ^1.9.0`, so those versions sit at the root and the older ones are nested — the layout npm 11 already produced. Projects declare nothing extra.
+- CI runs `appx-core create` and `npm ci` of the created project on npm 10.
+
+### Migration
+
+Drop-in for the framework. For **existing projects whose CI uses npm 10**: if `npm ci` fails with `EBADPLATFORM` (`@esbuild/*`) or `Missing: … from lock file` and the project uses vitest, either run CI with npm 11 (`npm install -g npm@11` before `npm ci`), or hold the test tooling the same way and regenerate the lockfile:
+
+```bash
+npm install -D vitest@~4.0.18 unplugin-swc@1.5.10
+```
+
+Update the lockfile in place (preferably with npm 11) — **don't delete it**: a fresh resolution re-pulls today's versions, and on npm 10 can hit the same crash.
+
+---
+
+## [0.1.130] — 2026-10-18
+
+Relations reached by a query now take part only through the related rows the caller can read — in filters, in nested selections at any depth, in `orderBy` and in `_count`.
+
+### Added
+
+- **`set` on a write rule — values the server writes.** `create: { set: { ownerId: '$USER_ID' } }`, `updateMany: { conditions: {…}, set: { updatedById: '$USER_ID' } }`, or a forced value (`status: 'draft'`). Applied in the data-access proxy on every write the rule allows — generated CRUD, service code and nested creates — overriding the client's value. Set values are authorized like any other: they must satisfy the rule's `conditions`, and a set foreign key needs an explicit `connect` rule (the app refuses to boot without one). Replaces `setUserIdField` (removed — see Migration).
+- **`appx-core create` requires npm 11.** It stops at startup with the upgrade command (`npm install -g npm@11`) when npm is older: npm 10 crashes resolving current dependency trees (`Cannot read properties of null (reading 'edgesOut')`). Created projects declare `engines.npm: ">=11.0.0"`.
+
+### Removed
+
+- **`setUserIdField`.** Use `set: { <column>: '$USER_ID' }` on the rule. A config that still contains `setUserIdField` refuses to boot (`removed-set-user-id-field`) with the exact replacement, so it can't be silently ignored.
+
+### Fixed
+
+- **Client relation filters respect the related model's read rules.** A `where` that crosses a relation (`some`/`every`/`none`/`is`/`isNot`, or the to-one shorthand) — at the top level, inside a nested selection or inside a `_count` entry — is evaluated over the related rows the role can read. A relation into a model with **no** read rule for the role is rejected (`403`, `Cannot filter by 'model.relation' …`). Applies to every read and to `updateMany`/`deleteMany`, on every transport (REST, GraphQL, service code).
+- **Relations selected below a to-one relation are filtered.** `include: { project: { include: { owner: true, tasks: true } } }` now applies `owner`'s and `tasks`'s read rules, as the first level already did: a deeper unreadable to-one drops the row (same rule as a first-level to-one), a deeper to-many list is narrowed, and a deeper model with no read rule throws `403`.
+- **`_count` counts readable rows only** (`select: { _count: { select: { tasks: true } } }`, `_count: true`). Counting a relation whose model has no read rule for the role throws `403`.
+- **`orderBy` on a related to-one field** requires that record to be readable, like including it: rows whose related record isn't readable are left out. **`orderBy` a to-many `_count`** requires an unconditional (`'ALL'`) read rule on the related model, or the model to be exposed; otherwise `403`.
+- **A nested selection's `where` / `orderBy` / `distinct` can't reference a `@Role`-hidden field** (`403`), as at the top level.
+- **`BYPASS_OMISSION` no longer disables row filtering on `include`d relations**, and a bare to-many `select: { rel: true }` under it no longer throws a `TypeError`.
+- **`RbacGuard` applies the documented read fallback.** `findFirst` / `findFirstOrThrow` / `findUnique` / `findUniqueOrThrow` / `count` are allowed by a `findMany` rule (then `findFirst`), as in the proxy — a config with only `findMany` no longer `403`s `GET /:id`. Custom `@Permission` actions never inherit a read rule.
+- **Schema annotations quoted in backticks are ignored.** A `///` comment that mentions a tag in prose — `` /// unlike `role` (`@NoWrite`) … `` — no longer applies `@NoWrite` / `@Role(...)` to the field (runtime and generated DTOs). Unquoted tags apply as before.
+- **Installing the framework works again since NestJS 12.** `@adminjs/nestjs` accepts any `@nestjs/common` / `@nestjs/core` from 9 up; as a peer, npm resolved it to Nest 12 before the framework's `~11` ranges and the install failed (`ERESOLVE`) — `appx-core create`, and any fresh install without a lockfile. `@adminjs/nestjs` is now a framework **dependency**, so it resolves against the framework's Nest 11; projects declare nothing extra. `create` also installs `@appxdigital/appx-core` from the public registry even when the `@appxdigital` scope is mapped elsewhere (e.g. GitHub Packages).
+
+### Changed
+
+- `src/prisma/prisma.service.ts` is held at 100% line and branch coverage in CI.
+- Docs: `withExposedModels` / `@ExposeModels` skip row filtering only — `@Role` field omission still applies; the per-call `BYPASS_*` options work on every proxied model method (untyped); exposing a model doesn't skip the target's `connect` rule.
+
+### Migration
+
+> **Behaviour change — a migrating agent MUST flag it to the developer before deploying.** Reads that previously returned data through a relation the role can't read now return less, or `403`. Nothing else changes: queries whose relations are all readable return exactly what they did.
+
+1. **Upgrade and run your test suite / exercise your main read endpoints as each role.** Look for new `403`s and for rows or nested lists that disappeared.
+2. **New `403 Missing permissions on model X` / `Cannot filter by …` / `Cannot order by …`** — the role reaches model `X` (selected below another relation, filtered through, counted, or sorted by) but has no read rule for it. Add a `findMany`/`findFirst` rule for that role on `X`, or expose `X` for that one request (`@ExposeModels('X')` / `withExposedModels(['X'], …)`) when the endpoint authorizes it itself.
+3. **A row disappeared (e.g. `findFirst` now `null` → `404`)** — the query selects a to-one relation, possibly several levels deep (`team → owner → user`), whose record the role's read rule doesn't cover. Widen that model's read rule to cover the records the endpoint legitimately shows (e.g. "users who share a team with me"), or stop selecting the relation.
+4. **A nested list, a `_count` or a filtered result got smaller** — it now covers only related rows the role can read. Same fix: widen the related model's read rule if the endpoint should see those rows.
+5. **Replace `setUserIdField` with `set`** (the app refuses to boot until you do — `removed-set-user-id-field`). For each rule:
+
+   ```ts
+   create: { conditions: {...}, setUserIdField: 'ownerId' }        // before
+   create: { conditions: {...}, set: { ownerId: '$USER_ID' } }     // after
+   ```
+
+   `set` applies on **every** create — generated `POST`, your services, nested creates — not only the generated `POST`. If a service creates these rows **on behalf of another user** under the same role, it now gets the caller's id instead: give that flow its own endpoint/rule or expose the model for it. The relationship still needs a `connect` rule (e.g. `relations: { owner: { connect: { conditions: { id: '$USER_ID' } } } }`); the boot error names it if missing.
+6. **`orderBy: { rel: { _count: … } }` now `403`s** when the related model's read rule has conditions. Select the scoped `_count` and sort in code, or expose the model for that request.
+
+> **For AI agents:** do not report this upgrade as complete after bumping the version. Run the project's tests and its main read flows per role, and list for the developer every new `403`, missing row and shrunken list you find, with the read rule that would restore it. Widening a read rule is a security decision — propose it, don't apply it silently.
+
+---
+
 ## [0.1.129] — 2026-08-17
 
 ### Added

package/dist/common/config/permissionsConfigTypes.d.ts

@@ -47,7 +47,8 @@ type MethodsWithWhere<C extends RuntimeClient, M extends ModelKey<C>> = {
 export type FieldConditions<M extends ModelKey<RuntimeClient>, A extends MethodsWithWhere<RuntimeClient, M>> = WhereOf<RuntimeClient, M, A>;
 export interface ActionPermission<M extends ModelKey<RuntimeClient> = ModelKey<RuntimeClient>, A extends MethodsWithWhere<RuntimeClient, M> = MethodsWithWhere<RuntimeClient, M>> {
     conditions: FieldConditions<M, A> | FieldConditions<M, A>[];
-    setUserIdField?: string;
+    /** Column values the server sets on every write this rule allows (overriding the client's). */
+    set?: Record<string, unknown>;
 }
 /**
  * A relation-scoped `connect` rule, declared on the SOURCE model and keyed by
@@ -72,7 +73,7 @@ export type RolePermissions<M extends ModelKey<RuntimeClient> = ModelKey<Runtime
 } & {
     [custom: string]: 'ALL' | RelationConnectMap | {
         conditions?: unknown | unknown[];
-        setUserIdField?: string;
+        set?: Record<string, unknown>;
     };
 };
 export type ModelPermissions<M extends ModelKey<RuntimeClient> = ModelKey<RuntimeClient>> = {

package/dist/common/config/permissionsConfigTypes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissionsConfigTypes.d.ts","sourceRoot":"","sources":["../../../src/common/config/permissionsConfigTypes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,MAAM,EAAE,YAAY,IAAI,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAC,SAAS,EAAC,MAAM,gCAAgC,CAAC;AAEzD,eAAO,MAAM,qBAAqB,EAAE;IAChC,OAAO,EAAE,GAAG,CAAC;CAGhB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAIlD,CAAC;AAEF,gEAAgE;AAChE,KAAK,aAAa,CAAC,CAAC,IAAI;KACnB,CAAC,IAAI,MAAM,CAAC,GACb,CAAC,CAAC,CAAC,CAAC,SAAS;QAAC,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;KAAC,GAAG,CAAC,GAAG,KAAK;CAC/D,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC;AAEpB,mDAAmD;AACnD,KAAK,iBAAiB,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC;AAE7C,8DAA8D;AAC9D,KAAK,QAAQ,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,IACjD,iBAAiB,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;AAE5D,4EAA4E;AAC5E,KAAK,cAAc,CACf,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,IAErB,CAAC,SAAS,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,GAC5B,CAAC,SAAS,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAC/E,KAAK,CAAC;AAEpB,oDAAoD;AACpD,KAAK,WAAW,CACZ,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,IACrB,CAAC,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAE5B,0CAA0C;AAC1C,KAAK,UAAU,CACX,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,IACrB;KACC,CAAC,IAAI,MAAM,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,GAC7B,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,GAAG,CAAC,GAAG,KAAK;CACnE,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;AAEpC,iEAAiE;AACjE,KAAK,aAAa,CACd,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,IACrB,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AAEzC,oFAAoF;AACpF,KAAK,MAAM,CACP,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,EACrB,CAAC,SAAS,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,IAC7B,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAEtC,4DAA4D;AAC5D,KAAK,OAAO,CACR,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,EACrB,CAAC,SAAS,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,IAE7B,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAA;CAAC,GAAG,CAAC,GACzC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS;IAAC,KAAK,EAAE,MAAM,CAAC,CAAA;CAAC,GAAG,CAAC,GACxC,KAAK,CAAC;AAElB,0DAA0D;AAC1D,KAAK,gBAAgB,CACjB,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,IACrB;KACC,CAAC,IAAI,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,GACzB,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,KAAK,GAAG,KAAK,GAAG,CAAC;CAC7C,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;AAEhC,6DAA6D;AAE7D,MAAM,MAAM,eAAe,CACvB,CAAC,SAAS,QAAQ,CAAC,aAAa,CAAC,EACjC,CAAC,SAAS,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC,IAC5C,OAAO,CAAC,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAEjC,MAAM,WAAW,gBAAgB,CAC7B,CAAC,SAAS,QAAQ,CAAC,aAAa,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,EAC3D,CAAC,SAAS,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC,GAAG,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC;IAEjF,UAAU,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAC5D,cAAc,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAChC,OAAO,EAAE,KAAK,GAAG;QAAE,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,EAAE,CAAA;KAAE,CAAC;CACzD;AACD,MAAM,MAAM,kBAAkB,GAAG;IAAE,CAAC,aAAa,EAAE,MAAM,GAAG,mBAAmB,CAAA;CAAE,CAAC;AAElF,MAAM,MAAM,eAAe,CACvB,CAAC,SAAS,QAAQ,CAAC,aAAa,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,IAE3D;KACK,CAAC,IAAI,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC;CAC7E,GAAG;IACA,SAAS,CAAC,EAAE,kBAAkB,CAAC;CAClC,GAAG;IAKJ,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,GAAG,kBAAkB,GAAG;QAC3C,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,EAAE,CAAC;QACjC,cAAc,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;CACL,CAAC;AAEF,MAAM,MAAM,gBAAgB,CACxB,CAAC,SAAS,QAAQ,CAAC,aAAa,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,IAC3D;IACA,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,qBAAqB,CAC7B,CAAC,SAAS,QAAQ,CAAC,aAAa,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,IAC3D;KACC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC;CACzC,CAAC"}
+{"version":3,"file":"permissionsConfigTypes.d.ts","sourceRoot":"","sources":["../../../src/common/config/permissionsConfigTypes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,MAAM,EAAE,YAAY,IAAI,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAC,SAAS,EAAC,MAAM,gCAAgC,CAAC;AAEzD,eAAO,MAAM,qBAAqB,EAAE;IAChC,OAAO,EAAE,GAAG,CAAC;CAGhB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAIlD,CAAC;AAEF,gEAAgE;AAChE,KAAK,aAAa,CAAC,CAAC,IAAI;KACnB,CAAC,IAAI,MAAM,CAAC,GACb,CAAC,CAAC,CAAC,CAAC,SAAS;QAAC,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;KAAC,GAAG,CAAC,GAAG,KAAK;CAC/D,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC;AAEpB,mDAAmD;AACnD,KAAK,iBAAiB,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC;AAE7C,8DAA8D;AAC9D,KAAK,QAAQ,CAAC,CAAC,SAAS,aAAa,GAAG,aAAa,IACjD,iBAAiB,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;AAE5D,4EAA4E;AAC5E,KAAK,cAAc,CACf,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,IAErB,CAAC,SAAS,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,GAC5B,CAAC,SAAS,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAC/E,KAAK,CAAC;AAEpB,oDAAoD;AACpD,KAAK,WAAW,CACZ,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,IACrB,CAAC,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAE5B,0CAA0C;AAC1C,KAAK,UAAU,CACX,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,IACrB;KACC,CAAC,IAAI,MAAM,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,GAC7B,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,GAAG,CAAC,GAAG,KAAK;CACnE,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;AAEpC,iEAAiE;AACjE,KAAK,aAAa,CACd,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,IACrB,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AAEzC,oFAAoF;AACpF,KAAK,MAAM,CACP,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,EACrB,CAAC,SAAS,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,IAC7B,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAEtC,4DAA4D;AAC5D,KAAK,OAAO,CACR,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,EACrB,CAAC,SAAS,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,IAE7B,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAA;CAAC,GAAG,CAAC,GACzC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS;IAAC,KAAK,EAAE,MAAM,CAAC,CAAA;CAAC,GAAG,CAAC,GACxC,KAAK,CAAC;AAElB,0DAA0D;AAC1D,KAAK,gBAAgB,CACjB,CAAC,SAAS,aAAa,EACvB,CAAC,SAAS,QAAQ,CAAC,CAAC,CAAC,IACrB;KACC,CAAC,IAAI,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,GACzB,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,KAAK,GAAG,KAAK,GAAG,CAAC;CAC7C,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;AAEhC,6DAA6D;AAE7D,MAAM,MAAM,eAAe,CACvB,CAAC,SAAS,QAAQ,CAAC,aAAa,CAAC,EACjC,CAAC,SAAS,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC,IAC5C,OAAO,CAAC,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAEjC,MAAM,WAAW,gBAAgB,CAC7B,CAAC,SAAS,QAAQ,CAAC,aAAa,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,EAC3D,CAAC,SAAS,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC,GAAG,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC;IAEjF,UAAU,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAC5D,+FAA+F;IAC/F,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAChC,OAAO,EAAE,KAAK,GAAG;QAAE,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,EAAE,CAAA;KAAE,CAAC;CACzD;AACD,MAAM,MAAM,kBAAkB,GAAG;IAAE,CAAC,aAAa,EAAE,MAAM,GAAG,mBAAmB,CAAA;CAAE,CAAC;AAElF,MAAM,MAAM,eAAe,CACvB,CAAC,SAAS,QAAQ,CAAC,aAAa,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,IAE3D;KACK,CAAC,IAAI,gBAAgB,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC;CAC7E,GAAG;IACA,SAAS,CAAC,EAAE,kBAAkB,CAAC;CAClC,GAAG;IAKJ,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,GAAG,kBAAkB,GAAG;QAC3C,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,EAAE,CAAC;QACjC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACjC,CAAC;CACL,CAAC;AAEF,MAAM,MAAM,gBAAgB,CACxB,CAAC,SAAS,QAAQ,CAAC,aAAa,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,IAC3D;IACA,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,qBAAqB,CAC7B,CAAC,SAAS,QAAQ,CAAC,aAAa,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,IAC3D;KACC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC;CACzC,CAAC"}

package/dist/common/guards/rbac.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rbac.guard.d.ts","sourceRoot":"","sources":["../../../src/common/guards/rbac.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,WAAW,EACX,gBAAgB,EAInB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAC,SAAS,EAAC,MAAM,cAAc,CAAC;AAGvC,OAAO,EAAC,qBAAqB,EAAmC,MAAM,kCAAkC,CAAC;AAEzG,qBACa,SAAU,YAAW,WAAW;IAErC,OAAO,CAAC,SAAS;IACiB,OAAO,CAAC,iBAAiB;gBADnD,SAAS,EAAE,SAAS,EACc,iBAAiB,EAAE,qBAAqB;IAGhF,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CA0CjE"}
+{"version":3,"file":"rbac.guard.d.ts","sourceRoot":"","sources":["../../../src/common/guards/rbac.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,WAAW,EACX,gBAAgB,EAInB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAC,SAAS,EAAC,MAAM,cAAc,CAAC;AAGvC,OAAO,EAAC,qBAAqB,EAAmC,MAAM,kCAAkC,CAAC;AAIzG,qBACa,SAAU,YAAW,WAAW;IAErC,OAAO,CAAC,SAAS;IACiB,OAAO,CAAC,iBAAiB;gBADnD,SAAS,EAAE,SAAS,EACc,iBAAiB,EAAE,qBAAqB;IAGhF,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CA+CjE"}

package/dist/common/guards/rbac.guard.js

@@ -18,6 +18,7 @@ const core_1 = require("@nestjs/core");
 const permission_decorator_1 = require("../decorators/permission.decorator");
 const permissions_config_provider_1 = require("../config/permissions.config.provider");
 const permissionsConfigTypes_1 = require("../config/permissionsConfigTypes");
+const READ_ACTIONS = ['findMany', 'findFirst', 'findFirstOrThrow', 'findUnique', 'findUniqueOrThrow', 'count'];
 let RbacGuard = exports.RbacGuard = class RbacGuard {
     constructor(reflector, permissionsConfig) {
         this.reflector = reflector;
@@ -46,6 +47,11 @@ let RbacGuard = exports.RbacGuard = class RbacGuard {
         if (!permission && permissionsConfigTypes_1.SINGULAR_ACTION[action]) {
             permission = rolePermissions[permissionsConfigTypes_1.SINGULAR_ACTION[action]];
         }
+        // Standard reads share one rule (count / findFirst / findUnique → findMany
+        // → findFirst), as in the proxy. Custom actions never inherit a read rule.
+        if (!permission && READ_ACTIONS.includes(action)) {
+            permission = rolePermissions.findMany || rolePermissions.findFirst;
+        }
         if (!permission) {
             throw new common_1.ForbiddenException(`Action ${action} not allowed for role ${user.role} on model ${model}`);
         }

package/dist/common/utils/schema-annotations.util.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The part of a schema `///` comment that carries annotations (`@Role(...)`,
+ * `@NoWrite`). Backtick-quoted spans are dropped, so a comment can mention a
+ * tag in prose — `` /// unlike `role` (`@NoWrite`) … `` — without applying it.
+ */
+export declare function annotationText(documentation?: string): string;
+//# sourceMappingURL=schema-annotations.util.d.ts.map

package/dist/common/utils/schema-annotations.util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-annotations.util.d.ts","sourceRoot":"","sources":["../../../src/common/utils/schema-annotations.util.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAE7D"}

package/dist/common/utils/schema-annotations.util.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.annotationText = void 0;
+/**
+ * The part of a schema `///` comment that carries annotations (`@Role(...)`,
+ * `@NoWrite`). Backtick-quoted spans are dropped, so a comment can mention a
+ * tag in prose — `` /// unlike `role` (`@NoWrite`) … `` — without applying it.
+ */
+function annotationText(documentation) {
+    return (documentation || '').replace(/`[^`]*`/g, '');
+}
+exports.annotationText = annotationText;

package/dist/config/generate-dtos.d.ts

@@ -1,3 +1,4 @@
+export declare function isNoWrite(documentation?: string): boolean;
 /**
  * Deploy-safe pass: (re)generate the DTO **base** classes under the gitignored
  * `src/generated/dto/`, one per non-framework model. Overwrite-only — never

package/dist/config/generate-dtos.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-dtos.d.ts","sourceRoot":"","sources":["../../src/config/generate-dtos.ts"],"names":[],"mappings":"AA0UA;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,IAAI,CAiBvD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAU3D"}
+{"version":3,"file":"generate-dtos.d.ts","sourceRoot":"","sources":["../../src/config/generate-dtos.ts"],"names":[],"mappings":"AAkEA,wBAAgB,SAAS,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAWzD;AA+PD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,IAAI,CAiBvD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAU3D"}

package/dist/config/generate-dtos.js

@@ -23,9 +23,10 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.scaffoldDtoSubclass = exports.generateDtoBases = void 0;
+exports.scaffoldDtoSubclass = exports.generateDtoBases = exports.isNoWrite = void 0;
 const path = __importStar(require("path"));
 const utils_1 = require("./utils");
+const schema_annotations_util_1 = require("../common/utils/schema-annotations.util");
 /**
  * DTO generator.
  *
@@ -63,7 +64,8 @@ const modulesRoot = path.join(cwd, 'src/modules');
 // A module-level lookup so the relation-nested-write renderer can resolve a
 // related model by name without threading it through every call.
 let modelsByName = {};
-function isNoWrite(doc) {
+function isNoWrite(documentation) {
+    const doc = (0, schema_annotations_util_1.annotationText)(documentation);
     if (!doc)
         return false;
     if (/@NoWrite\b/i.test(doc))
@@ -77,6 +79,7 @@ function isNoWrite(doc) {
     }
     return false;
 }
+exports.isNoWrite = isNoWrite;
 function isServerManagedTimestamp(field) {
     if (field.isUpdatedAt)
         return true;

package/dist/modules/core/core.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core.controller.d.ts","sourceRoot":"","sources":["../../../src/modules/core/core.controller.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,WAAW,EAAC,MAAM,gBAAgB,CAAC;AAI3C,OAAO,EAAC,kBAAkB,EAAC,MAAM,yCAAyC,CAAC;AAQ3E,8BACsB,cAAc,CAAC,CAAC;IAM9B,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;IAL9C,MAAM,KAAK,UAAU,IAAI,MAAM,CAE9B;IAED,SAAS,aACc,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;IAK9C,SAAS,CAAC,QAAQ,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;IAIrD,OAAO;IAMP,OAAO,CAAc,EAAE,EAAE,MAAM;IAM/B,MAAM,CAAS,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAC;IAiBtD,MAAM,CAAc,EAAE,EAAE,MAAM,EAAU,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAMxD,MAAM,CAAc,EAAE,EAAE,MAAM;CAGvC"}
+{"version":3,"file":"core.controller.d.ts","sourceRoot":"","sources":["../../../src/modules/core/core.controller.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,WAAW,EAAC,MAAM,gBAAgB,CAAC;AAG3C,OAAO,EAAC,kBAAkB,EAAC,MAAM,yCAAyC,CAAC;AAE3E,8BACsB,cAAc,CAAC,CAAC;IAM9B,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;IAL9C,MAAM,KAAK,UAAU,IAAI,MAAM,CAE9B;IAED,SAAS,aACc,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;IAK9C,SAAS,CAAC,QAAQ,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;IAIrD,OAAO;IAMP,OAAO,CAAc,EAAE,EAAE,MAAM;IAM/B,MAAM,CAAS,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAC;IAOtD,MAAM,CAAc,EAAE,EAAE,MAAM,EAAU,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAMxD,MAAM,CAAc,EAAE,EAAE,MAAM;CAGvC"}

package/dist/modules/core/core.controller.js

@@ -11,16 +11,14 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-var CoreController_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CoreController = void 0;
 const common_1 = require("@nestjs/common");
 const core_service_1 = require("./core.service");
 const permission_decorator_1 = require("../../common/decorators/permission.decorator");
 const rbac_guard_1 = require("../../common/guards/rbac.guard");
-const nestjs_request_context_1 = require("nestjs-request-context");
 const permissions_service_1 = require("../../common/config/permissions.service");
-let CoreController = exports.CoreController = CoreController_1 = class CoreController {
+let CoreController = exports.CoreController = class CoreController {
     static get entityName() {
         return '';
     }
@@ -34,15 +32,6 @@ let CoreController = exports.CoreController = CoreController_1 = class CoreContr
         return this.service.findById(id);
     }
     async create(data) {
-        const user = nestjs_request_context_1.RequestContext.currentContext.req.user;
-        const role = user?.role || 'GUEST';
-        const model = this.constructor.entityName;
-        const rolePermissions = this.permissionsService.getPermissionsConfig()[model]?.[role];
-        const actionPermission = rolePermissions?.['create'];
-        if (typeof actionPermission !== 'string' && actionPermission?.setUserIdField) {
-            // Force the server-owned user id (so a client can't forge ownership).
-            data[actionPermission.setUserIdField] = user.id;
-        }
         return this.service.create(data);
     }
     async update(id, data) {
@@ -96,7 +85,7 @@ __decorate([
     __metadata("design:paramtypes", [String]),
     __metadata("design:returntype", Promise)
 ], CoreController.prototype, "delete", null);
-exports.CoreController = CoreController = CoreController_1 = __decorate([
+exports.CoreController = CoreController = __decorate([
     (0, common_1.UseGuards)(rbac_guard_1.RbacGuard),
     __metadata("design:paramtypes", [core_service_1.CoreService])
 ], CoreController);

package/dist/prisma/permissions-validator.d.ts

@@ -26,7 +26,7 @@ export interface RelationMeta {
 /** Relations per model, keyed by the lower-cased model name. */
 export type SchemaRelations = Record<string, RelationMeta[]>;
 export type IssueLevel = 'error' | 'warning';
-export type IssueCode = 'relation-in-create-condition' | 'missing-connect-required' | 'missing-connect' | 'connect-on-unwritable' | 'unknown-relation';
+export type IssueCode = 'relation-in-create-condition' | 'missing-connect-required' | 'missing-connect' | 'connect-on-unwritable' | 'relation-in-set' | 'removed-set-user-id-field' | 'unknown-relation';
 export interface ValidationIssue {
     level: IssueLevel;
     code: IssueCode;

package/dist/prisma/permissions-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions-validator.d.ts","sourceRoot":"","sources":["../../src/prisma/permissions-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAErF,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,SAAS,CAAC;AAEnD,MAAM,WAAW,YAAY;IACzB,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,OAAO,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;IACnB,wGAAwG;IACxG,UAAU,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,gEAAgE;AAChE,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;AAE7D,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,SAAS,CAAC;AAE7C,MAAM,MAAM,SAAS,GACf,8BAA8B,GAC9B,0BAA0B,GAC1B,iBAAiB,GACjB,uBAAuB,GACvB,kBAAkB,CAAC;AAEzB,MAAM,WAAW,eAAe;IAC5B,KAAK,EAAE,UAAU,CAAC;IAClB,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACnB;AAmBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACrC,MAAM,EAAE,qBAAqB,EAC7B,SAAS,EAAE,eAAe,GAC3B,eAAe,EAAE,CA+HnB"}
+{"version":3,"file":"permissions-validator.d.ts","sourceRoot":"","sources":["../../src/prisma/permissions-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAErF,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,SAAS,CAAC;AAEnD,MAAM,WAAW,YAAY;IACzB,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,OAAO,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;IACnB,wGAAwG;IACxG,UAAU,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,gEAAgE;AAChE,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;AAE7D,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,SAAS,CAAC;AAE7C,MAAM,MAAM,SAAS,GACf,8BAA8B,GAC9B,0BAA0B,GAC1B,iBAAiB,GACjB,uBAAuB,GACvB,iBAAiB,GACjB,2BAA2B,GAC3B,kBAAkB,CAAC;AAEzB,MAAM,WAAW,eAAe;IAC5B,KAAK,EAAE,UAAU,CAAC;IAClB,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACnB;AAmBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACrC,MAAM,EAAE,qBAAqB,EAC7B,SAAS,EAAE,eAAe,GAC3B,eAAe,EAAE,CA0JnB"}

package/dist/prisma/permissions-validator.js

@@ -50,6 +50,8 @@ function validatePermissionsConfig(config, relations) {
     const hasRelationConnect = (sourceRules, field) => !!sourceRules?.relations?.[field]?.connect;
     const canCreate = (rules) => !!rules && (rules.create !== undefined || rules.createMany !== undefined);
     const canUpdate = (rules) => !!rules && (rules.update !== undefined || rules.updateMany !== undefined);
+    // Columns a rule's `set` writes server-side.
+    const setColumns = (...actionRules) => new Set(actionRules.flatMap((rule) => (rule && typeof rule === 'object' && rule.set ? Object.keys(rule.set) : [])));
     for (const modelKey of Object.keys(cfg)) {
         const roles = cfg[modelKey] || {};
         const rels = relations[modelKey.toLowerCase()] || [];
@@ -57,6 +59,20 @@ function validatePermissionsConfig(config, relations) {
         const relationFieldNames = new Set(rels.map((r) => r.field));
         for (const role of Object.keys(roles)) {
             const rules = roles[role];
+            // `setUserIdField` was removed; left in a config it would silently stop
+            // forcing the column, so it is rejected with its replacement.
+            for (const action of Object.keys(rules || {})) {
+                const field = rules[action]?.setUserIdField;
+                if (field !== undefined) {
+                    issues.push({
+                        level: 'error',
+                        code: 'removed-set-user-id-field',
+                        model: modelKey,
+                        role,
+                        message: `${modelKey}.${role}.${action}.setUserIdField was removed. Replace it with '${action}: { set: { ${field}: '$USER_ID' } }' (applied on every write path; its foreign key needs a 'connect' rule).`,
+                    });
+                }
+            }
             const creatable = canCreate(rules);
             const updatable = canUpdate(rules);
             if (!creatable && !updatable)
@@ -76,12 +92,26 @@ function validatePermissionsConfig(config, relations) {
             }
             // Every foreign key a write can SET must have a connect rule (target
             // or relation-scoped) — otherwise setting it is denied at runtime.
-            // A @NoWrite / @Role(none) column is never settable.
+            // A @NoWrite / @Role(none) column is never client-settable, but a
+            // column in the rule's `set` is written server-side.
+            const createSet = setColumns(rules.create, rules.createMany);
+            const updateSet = setColumns(rules.update, rules.updateMany);
+            for (const column of new Set([...createSet, ...updateSet])) {
+                if (relationFieldNames.has(column)) {
+                    issues.push({
+                        level: 'error',
+                        code: 'relation-in-set',
+                        model: modelKey,
+                        role,
+                        message: `'set' on ${modelKey}.${role} names relation '${column}'. Set its foreign key column instead.`,
+                    });
+                }
+            }
             for (const r of belongsTo) {
                 const col = r.referencingColumn;
                 const writable = r.fkWritable !== false; // not @NoWrite / @Role(none)
-                const settableOnCreate = writable && creatable;
-                const settableOnUpdate = writable && updatable;
+                const settableOnCreate = (writable || createSet.has(col)) && creatable;
+                const settableOnUpdate = (writable || updateSet.has(col)) && updatable;
                 const relRule = hasRelationConnect(rules, r.field);
                 if (!settableOnCreate && !settableOnUpdate) {
                     // A relation-scoped connect rule for a field that can't be
@@ -99,18 +129,14 @@ function validatePermissionsConfig(config, relations) {
                 }
                 if (relRule || hasConnectRule(r.model, role))
                     continue;
-                // A server-set owner FK (`setUserIdField`) still needs a connect
-                // rule — the value is trusted, but the framework authorizes every
+                // A server-set owner FK (`set`) still needs a connect
+                // rule — the server chose the value, but the framework authorizes every
                 // relationship a write establishes, uniformly. Point at the
                 // relation-scoped self-connect rather than a blanket rule on the
                 // target: `connect: 'ALL'` on User would let this role attach ANY
                 // user, which is far wider than what a self-owned create needs.
-                const createRule = rules?.create;
-                const ownerField = typeof createRule === 'object' && createRule
-                    ? createRule.setUserIdField
-                    : undefined;
-                const fix = ownerField === col
-                    ? `'${col}' is server-set via setUserIdField, but the relationship it creates still needs a connect rule. Scope it to the caller with '${modelKey}.${role}.relations.${r.field}.connect: {conditions: {id: "$USER_ID"}}' — prefer that over a blanket '${r.model}.${role}.connect', which would allow connecting to any ${r.model}.`
+                const fix = createSet.has(col) || updateSet.has(col)
+                    ? `'${col}' is server-set via 'set', but the relationship it creates still needs a connect rule. Scope it to the caller with '${modelKey}.${role}.relations.${r.field}.connect: {conditions: {id: "$USER_ID"}}' — prefer that over a blanket '${r.model}.${role}.connect', which would allow connecting to any ${r.model}.`
                     : `Declare '${r.model}.${role}.connect' (or 'ALL'), or scope it to this relation with '${modelKey}.${role}.relations.${r.field}.connect'.`;
                 if (settableOnCreate && r.isRequired) {
                     issues.push({

package/dist/prisma/prisma.service.d.ts

@@ -111,6 +111,48 @@ export declare class PrismaService {
      * conditions are injected, so it never blocks the framework's own conditions.
      */
     private assertFilterFieldsReadable;
+    /**
+     * The read args nested in a selection — each selected relation's args and
+     * each `_count` entry — paired with the model they read, so client
+     * filters are checked/scoped at every level.
+     */
+    private nestedReadArgs;
+    /**
+     * Rewrite every relation filter in the CLIENT's `where` (top level and in
+     * nested relation selections) so it only takes into account related rows
+     * this role can read. Runs on the client input, before the trusted ABAC
+     * conditions are injected, so those are never rewritten.
+     */
+    private scopeClientFilters;
+    /**
+     * Rewrite one client `where` clause: each relation filter is narrowed to the
+     * related rows the role can read (`some`/`none`/`is`/`isNot` AND the target's
+     * read conditions; `every` holds over the readable rows only). A relation
+     * into a model with no read rule for the role is rejected.
+     */
+    private scopeRelationFilters;
+    /**
+     * Applies `fn` to the filter inside each operator of a relation filter
+     * (`some`/`every`/`none`, `is`/`isNot`), or to the to-one shorthand
+     * (`rel: { ... }` ≡ `rel: { is: { ... } }`) as a whole, with no operator.
+     */
+    private static mapRelationFilter;
+    /**
+     * The resolved read conditions a relation's target imposes on this role, or
+     * `undefined` when it imposes none (exposed model or 'ALL'). A target with no
+     * read rule is rejected, naming the relation as the field being filtered or
+     * ordered by.
+     */
+    private relationReadConditions;
+    /**
+     * Makes a condition strictly true/false in SQL. A comparison on a nullable
+     * column is NULL (not false) when the column is NULL, and under a negation
+     * (`isNot`, `NOT`, which Prisma inlines for to-one relations) NULL stays NULL
+     * — so the outcome would depend on the rest of the filter. Guarding each
+     * such comparison with `IS NOT NULL` turns NULL into false; where the
+     * condition is used positively the result is unchanged.
+     */
+    private nullSafeConditions;
     /** Recursively assert no omitted field is referenced in a where/orderBy clause. */
     private assertClauseFieldsReadable;
     /**
@@ -123,6 +165,33 @@ export declare class PrismaService {
     private isPresenceOnlyPredicate;
     private throwUnreadableFilterField;
     private applyWhereConditions;
+    /**
+     * Merges a to-one relation's read conditions into a `where`. If the relation
+     * is optional, rows where it is null are kept.
+     */
+    private static mergeToOneConditions;
+    /**
+     * The to-one read conditions an `orderBy` brings in: ordering by a related
+     * field (at any depth) requires that related record to be readable, like
+     * selecting it. Ordering by a to-many relation's count is only allowed when
+     * the related model is fully readable (a count can't be scoped).
+     */
+    private orderByRelationConditions;
+    /**
+     * Scopes a `_count` selection: each counted to-many relation only counts the
+     * related rows the role can read. A relation into a model with no read rule
+     * is rejected, as selecting it would be. Left untouched when nothing needs
+     * scoping.
+     */
+    private applyCountConditions;
+    /**
+     * Writes the rule's `set` values into every row of a write's `data`,
+     * overriding what the client sent (placeholders such as `$USER_ID` are
+     * resolved). Runs before the write is authorized, so the set values are
+     * checked like any other: against the create `conditions`, and a set
+     * foreign key against its `connect` rule.
+     */
+    private applySetValues;
     /**
      * Enforces permission `conditions` on `create` / `createMany`.
      *

package/dist/prisma/prisma.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prisma.service.d.ts","sourceRoot":"","sources":["../../src/prisma/prisma.service.ts"],"names":[],"mappings":";AACA,OAAO,EAAC,MAAM,EAAE,YAAY,EAAC,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAC,qBAAqB,EAAkB,MAAM,yCAAyC,CAAC;AAG/F,OAAO,KAAK,EAAC,YAAY,IAAI,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAGlE,OAAO,EAAC,iBAAiB,EAAC,MAAM,kBAAkB,CAAC;AAEnD,eAAO,MAAM,iBAAiB;mBACX,MAAM,EAAE;EACvB,CAAC;AAEL,KAAK,QAAQ,GAAG,MAAM,aAAa,CAAC;AAEpC,oDAAoD;AACpD,MAAM,MAAM,iBAAiB,GAAG;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,4EAA4E;AAC5E,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AAEtE;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,YAAY,GAAG,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,CAAC,GAAG;IACjG,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACrC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACnD,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAClC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;CACrC,CAAC;AAGF,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,QAAQ,IAAI,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAAI;KAC7B,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;KAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACpG,CAAC;AAEF,qBACa,aAAa;IAaY,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAZpE,OAAO,CAAC,YAAY,CAA2B;IAC/C,YAAY,EAAE,YAAY,CAAC;IAC3B;;;;;OAKG;IACH,OAAO,CAAC,SAAS,CAAgB;gBAG7B,YAAY,EAAE,YAAY,EACqB,iBAAiB,EAAE,qBAAqB;IAQ3F;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IA6B3B,YAAY,CAAC,MAAM,EAAE,OAAO;IAO5B,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;IAWjE,OAAO,CAAC,KAAK;IAQb,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC;IAIpE,WAAW;IAuFX;;;;OAIG;IACH,gBAAgB,CAAC,CAAC,SAAS,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC;IAoBlE,IAAI,KAAK,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAU3C;IAED,IAAI,IAAI,IAAI,eAAe,CAAC,MAAM,CAAC,CAElC;IAED,IAAI,OAAO,IAAI,eAAe,CAAC,SAAS,CAAC,CAExC;IAED,IAAI,gBAAgB,QAEnB;IAED;;;OAGG;IACH,WAAW;IA+DX;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAkE1B,IAAI,2BAA2B,QAM9B;IAED;;;;;;;;;;;OAWG;IACH;;;;;;;OAOG;IACH,OAAO,CAAC,0BAA0B;IAYlC,mFAAmF;IACnF,OAAO,CAAC,0BAA0B;IAgDlC;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAQ/B,OAAO,CAAC,0BAA0B;IAOlC,OAAO,CAAC,oBAAoB;IA8K5B;;;;;;;;;;;;;;;;OAgBG;YACW,uBAAuB;IAkDrC;;;;;;;;;;;;;;;;;;;OAmBG;YACW,mBAAmB;IA2BjC,0EAA0E;YAC5D,wBAAwB;IAmCtC,yGAAyG;IACzG,OAAO,CAAC,gBAAgB;IAWxB,4FAA4F;IAC5F,OAAO,CAAC,eAAe;IAcvB;;;;;;;;OAQG;YACW,oBAAoB;IA6ClC;;;;OAIG;IACH,OAAO,CAAC,SAAS;IAKjB;;;;;;OAMG;YACW,2BAA2B;IAqBzC;;;;;;OAMG;IACH,OAAO,CAAC,yBAAyB;IAmBjC;;;;;;;OAOG;YACW,uBAAuB;IA8BrC,oGAAoG;IACpG,OAAO,CAAC,mBAAmB;IAwB3B;;;;;;;OAOG;WACW,gBAAgB,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,GAAG,GAAG;IAgBjE;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IA2BlC;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE;IAI5C;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAUvB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IA8EzB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,IAAI,GAAG;QAC5E,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,OAAO,CAAA;KACtB;IAoBD,gBAAgB,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAyBzF"}
+{"version":3,"file":"prisma.service.d.ts","sourceRoot":"","sources":["../../src/prisma/prisma.service.ts"],"names":[],"mappings":";AACA,OAAO,EAAC,MAAM,EAAE,YAAY,EAAC,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAC,qBAAqB,EAAkB,MAAM,yCAAyC,CAAC;AAG/F,OAAO,KAAK,EAAC,YAAY,IAAI,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAGlE,OAAO,EAAC,iBAAiB,EAAC,MAAM,kBAAkB,CAAC;AAGnD,eAAO,MAAM,iBAAiB;mBACX,MAAM,EAAE;EACvB,CAAC;AAEL,KAAK,QAAQ,GAAG,MAAM,aAAa,CAAC;AAEpC,oDAAoD;AACpD,MAAM,MAAM,iBAAiB,GAAG;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,4EAA4E;AAC5E,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AAEtE;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,YAAY,GAAG,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,CAAC,GAAG;IACjG,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACrC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACnD,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAClC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;CACrC,CAAC;AAGF,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,QAAQ,IAAI,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAAI;KAC7B,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;KAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACpG,CAAC;AAEF,qBACa,aAAa;IAaY,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAZpE,OAAO,CAAC,YAAY,CAA2B;IAC/C,YAAY,EAAE,YAAY,CAAC;IAC3B;;;;;OAKG;IACH,OAAO,CAAC,SAAS,CAAgB;gBAG7B,YAAY,EAAE,YAAY,EACqB,iBAAiB,EAAE,qBAAqB;IAQ3F;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IA6B3B,YAAY,CAAC,MAAM,EAAE,OAAO;IAO5B,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;IAWjE,OAAO,CAAC,KAAK;IAQb,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC;IAIpE,WAAW;IA4FX;;;;OAIG;IACH,gBAAgB,CAAC,CAAC,SAAS,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC;IAoBlE,IAAI,KAAK,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAU3C;IAED,IAAI,IAAI,IAAI,eAAe,CAAC,MAAM,CAAC,CAElC;IAED,IAAI,OAAO,IAAI,eAAe,CAAC,SAAS,CAAC,CAExC;IAED,IAAI,gBAAgB,QAEnB;IAED;;;OAGG;IACH,WAAW;IAoEX;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAkE1B,IAAI,2BAA2B,QAM9B;IAED;;;;;;;;;;;OAWG;IACH;;;;;;;OAOG;IACH,OAAO,CAAC,0BAA0B;IAelC;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAgBtB;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAS1B;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IA4B5B;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,iBAAiB;IAOhC;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;IAsB9B;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB;IA0B1B,mFAAmF;IACnF,OAAO,CAAC,0BAA0B;IAgDlC;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAQ/B,OAAO,CAAC,0BAA0B;IAOlC,OAAO,CAAC,oBAAoB;IA2K5B;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,oBAAoB;IA+BnC;;;;;OAKG;IACH,OAAO,CAAC,yBAAyB;IAqBjC;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAsB5B;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAYtB;;;;;;;;;;;;;;;;OAgBG;YACW,uBAAuB;IAkDrC;;;;;;;;;;;;;;;;;;;OAmBG;YACW,mBAAmB;IA2BjC,0EAA0E;YAC5D,wBAAwB;IAoCtC,yGAAyG;IACzG,OAAO,CAAC,gBAAgB;IAWxB,4FAA4F;IAC5F,OAAO,CAAC,eAAe;IAcvB;;;;;;;;OAQG;YACW,oBAAoB;IA6ClC;;;;OAIG;IACH,OAAO,CAAC,SAAS;IAKjB;;;;;;OAMG;YACW,2BAA2B;IAqBzC;;;;;;OAMG;IACH,OAAO,CAAC,yBAAyB;IAmBjC;;;;;;;OAOG;YACW,uBAAuB;IA8BrC,oGAAoG;IACpG,OAAO,CAAC,mBAAmB;IAwB3B;;;;;;;OAOG;WACW,gBAAgB,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,GAAG,GAAG;IAgBjE;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IA2BlC;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE;IAI5C;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAUvB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IA8EzB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,IAAI,GAAG;QAC5E,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,OAAO,CAAA;KACtB;IAoBD,gBAAgB,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAyBzF"}

package/dist/prisma/prisma.service.js

@@ -20,6 +20,7 @@ const permissionsConfigTypes_1 = require("../common/config/permissionsConfigType
 const permissions_validator_1 = require("./permissions-validator");
 const nestjs_request_context_1 = require("nestjs-request-context");
 const node_async_hooks_1 = require("node:async_hooks");
+const schema_annotations_util_1 = require("../common/utils/schema-annotations.util");
 exports.CorePrismaContext = new node_async_hooks_1.AsyncLocalStorage();
 let PrismaService = exports.PrismaService = PrismaService_1 = class PrismaService {
     constructor(prismaClient, permissionsConfig) {
@@ -128,6 +129,7 @@ let PrismaService = exports.PrismaService = PrismaService_1 = class PrismaServic
                                     }
                                     if (!options?.BYPASS_FILTERING) {
                                         if (['create', 'createMany'].includes(methodKey.toString())) {
+                                            this.applySetValues(String(propKey), userRole, params.data, user, methodKey.toString());
                                             // Conditions can't be pushed into a WHERE on insert, so
                                             // validate the incoming data satisfies them before insert.
                                             await this.enforceCreateConditions(String(propKey), userRole, params, user, methodKey.toString());
@@ -141,10 +143,14 @@ let PrismaService = exports.PrismaService = PrismaService_1 = class PrismaServic
                                             // field omission). Runs on the client input, BEFORE the
                                             // trusted ABAC conditions are injected below.
                                             this.assertFilterFieldsReadable(String(propKey), userRole, params);
+                                            // Scope the client's relation filters to related rows this
+                                            // role can read — also on the client input, before injection.
+                                            params = this.scopeClientFilters(String(propKey), userRole, params, user);
                                             params = this.applyWhereConditions(String(propKey), userRole, params, user, methodKey);
                                             // An update can re-point a foreign key (scalar column);
                                             // authorize those changes with the same connect rules as create.
                                             if (['update', 'updateMany'].includes(methodKey.toString())) {
+                                                this.applySetValues(String(propKey), userRole, params.data, user, methodKey.toString());
                                                 await this.enforceNestedWrites(String(propKey), params.data, user, userRole);
                                             }
                                         }
@@ -230,10 +236,11 @@ let PrismaService = exports.PrismaService = PrismaService_1 = class PrismaServic
             const scalarFields = [];
             const relationFields = {};
             const noWriteFields = [];
+            const nullableFields = [];
             for (const field of fields) {
                 let field_name = field.name;
                 const fieldType = field.type;
-                const commentPart = field.documentation || '';
+                const commentPart = (0, schema_annotations_util_1.annotationText)(field.documentation);
                 if (commentPart) {
                     const roleMatch = commentPart.match(/@Role\((.*?)\)/);
                     if (roleMatch) {
@@ -248,6 +255,9 @@ let PrismaService = exports.PrismaService = PrismaService_1 = class PrismaServic
                 fieldTypes[field_name] = fieldType;
                 if (field.kind === 'scalar' || field.kind === 'enum') {
                     scalarFields.push(field_name);
+                    if (!field.isRequired && !field.isList && fieldType !== 'Json') {
+                        nullableFields.push(field_name);
+                    }
                 }
                 else {
                     relationFields[field_name] = {
@@ -272,6 +282,7 @@ let PrismaService = exports.PrismaService = PrismaService_1 = class PrismaServic
                 scalarFields,
                 relationFields,
                 noWriteFields,
+                nullableFields,
             };
         }
     }
@@ -377,6 +388,152 @@ let PrismaService = exports.PrismaService = PrismaService_1 = class PrismaServic
                     this.throwUnreadableFilterField(modelName, field, userRole, 'distinct');
             }
         }
+        for (const [relatedModel, nested] of this.nestedReadArgs(modelName, args)) {
+            this.assertFilterFieldsReadable(relatedModel, userRole, nested);
+        }
+    }
+    /**
+     * The read args nested in a selection — each selected relation's args and
+     * each `_count` entry — paired with the model they read, so client
+     * filters are checked/scoped at every level.
+     */
+    nestedReadArgs(modelName, args) {
+        const projection = args.select ?? args.include;
+        if (!projection || typeof projection !== 'object')
+            return [];
+        const nested = [];
+        for (const key of Object.keys(projection)) {
+            const isCount = key === '_count';
+            const entries = isCount ? projection[key]?.select : { [key]: projection[key] };
+            if (!entries || typeof entries !== 'object')
+                continue;
+            for (const field of Object.keys(entries)) {
+                const relation = this.getRelation(modelName, field);
+                if (relation && entries[field] && typeof entries[field] === 'object')
+                    nested.push([relation.model, entries[field]]);
+            }
+        }
+        return nested;
+    }
+    /**
+     * Rewrite every relation filter in the CLIENT's `where` (top level and in
+     * nested relation selections) so it only takes into account related rows
+     * this role can read. Runs on the client input, before the trusted ABAC
+     * conditions are injected, so those are never rewritten.
+     */
+    scopeClientFilters(modelName, userRole, args, user) {
+        if (!args || typeof args !== 'object')
+            return args;
+        if (args.where)
+            args.where = this.scopeRelationFilters(modelName, userRole, args.where, user);
+        for (const [relatedModel, nested] of this.nestedReadArgs(modelName, args)) {
+            this.scopeClientFilters(relatedModel, userRole, nested, user);
+        }
+        return args;
+    }
+    /**
+     * Rewrite one client `where` clause: each relation filter is narrowed to the
+     * related rows the role can read (`some`/`none`/`is`/`isNot` AND the target's
+     * read conditions; `every` holds over the readable rows only). A relation
+     * into a model with no read rule for the role is rejected.
+     */
+    scopeRelationFilters(modelName, userRole, clause, user) {
+        if (Array.isArray(clause))
+            return clause.map((c) => this.scopeRelationFilters(modelName, userRole, c, user));
+        if (!clause || typeof clause !== 'object')
+            return clause;
+        const scoped = {};
+        for (const key of Object.keys(clause)) {
+            const value = clause[key];
+            if (key === 'AND' || key === 'OR' || key === 'NOT') {
+                scoped[key] = this.scopeRelationFilters(modelName, userRole, value, user);
+                continue;
+            }
+            const relation = this.getRelation(modelName, key);
+            if (!relation || !value || typeof value !== 'object') {
+                scoped[key] = value; // scalar filter, or a to-one presence check (`rel: null`)
+                continue;
+            }
+            const conditions = this.relationReadConditions(modelName, key, relation, userRole, user, 'where');
+            scoped[key] = PrismaService_1.mapRelationFilter(relation, value, (op, filter) => {
+                if (filter === null)
+                    return null; // `is: null` / `isNot: null`
+                const inner = this.scopeRelationFilters(relation.model, userRole, filter, user);
+                if (!conditions)
+                    return inner;
+                return op === 'every' ? { OR: [inner, { NOT: conditions }] } : { AND: [inner, conditions] };
+            });
+        }
+        return scoped;
+    }
+    /**
+     * Applies `fn` to the filter inside each operator of a relation filter
+     * (`some`/`every`/`none`, `is`/`isNot`), or to the to-one shorthand
+     * (`rel: { ... }` ≡ `rel: { is: { ... } }`) as a whole, with no operator.
+     */
+    static mapRelationFilter(relation, value, fn) {
+        const hasOperators = value && typeof value === 'object'
+            && (relation.relation === 'hasMany' || 'is' in value || 'isNot' in value);
+        if (!hasOperators)
+            return fn(null, value);
+        return Object.fromEntries(Object.keys(value).map((op) => [op, fn(op, value[op])]));
+    }
+    /**
+     * The resolved read conditions a relation's target imposes on this role, or
+     * `undefined` when it imposes none (exposed model or 'ALL'). A target with no
+     * read rule is rejected, naming the relation as the field being filtered or
+     * ordered by.
+     */
+    relationReadConditions(modelName, field, relation, userRole, user, kind) {
+        const exposedModels = (exports.CorePrismaContext.getStore()?.exposedModels || []).map((m) => m.toLowerCase());
+        if (exposedModels.includes(relation.model.toLowerCase()))
+            return undefined;
+        const permissions = this.normalizedPermissionsConfig[relation.model.toLowerCase()]?.[userRole] || {};
+        const action = relation.relation === 'belongsTo' ? 'findFirst' : 'findMany';
+        const relatedPermissions = this.selectPermission(permissions, action, relation.model, userRole);
+        if (!relatedPermissions) {
+            if (kind !== 'select')
+                this.throwUnreadableFilterField(modelName, field, userRole, kind);
+            console.debug(`No permissions found for action '${relation.model}.${action}()' on role ${userRole}`);
+            throw new common_1.HttpException('Missing permissions on model ' + relation.model, common_1.HttpStatus.FORBIDDEN);
+        }
+        if (relatedPermissions === 'ALL')
+            return undefined;
+        return this.nullSafeConditions(relation.model, PrismaService_1._buildConditions(relatedPermissions.conditions, user));
+    }
+    /**
+     * Makes a condition strictly true/false in SQL. A comparison on a nullable
+     * column is NULL (not false) when the column is NULL, and under a negation
+     * (`isNot`, `NOT`, which Prisma inlines for to-one relations) NULL stays NULL
+     * — so the outcome would depend on the rest of the filter. Guarding each
+     * such comparison with `IS NOT NULL` turns NULL into false; where the
+     * condition is used positively the result is unchanged.
+     */
+    nullSafeConditions(modelName, clause) {
+        if (Array.isArray(clause))
+            return clause.map((c) => this.nullSafeConditions(modelName, c));
+        if (!clause || typeof clause !== 'object')
+            return clause;
+        const nullableFields = this.fieldConfigs[modelName.toLowerCase()].nullableFields;
+        const guards = [];
+        const safe = {};
+        for (const key of Object.keys(clause)) {
+            const value = clause[key];
+            if (key === 'AND' || key === 'OR' || key === 'NOT') {
+                safe[key] = this.nullSafeConditions(modelName, value);
+                continue;
+            }
+            const relation = this.getRelation(modelName, key);
+            if (relation) {
+                safe[key] = PrismaService_1.mapRelationFilter(relation, value, (_op, filter) => this.nullSafeConditions(relation.model, filter));
+                continue;
+            }
+            if (nullableFields.includes(key) && value !== undefined && !this.isPresenceOnlyPredicate(value)) {
+                guards.push({ [key]: { not: null } });
+            }
+            safe[key] = value;
+        }
+        return guards.length ? { AND: [...guards, safe] } : safe;
     }
     /** Recursively assert no omitted field is referenced in a where/orderBy clause. */
     assertClauseFieldsReadable(modelName, userRole, clause, kind) {
@@ -467,14 +624,16 @@ let PrismaService = exports.PrismaService = PrismaService_1 = class PrismaServic
                 throw new common_1.HttpException('Missing permissions on model ' + modelName, common_1.HttpStatus.FORBIDDEN);
             }
         }
-        if (args.select) {
-            for (const field of Object.keys(args.select)) {
+        // `include` reaches here only when field omission was bypassed (omission
+        // rewrites it to `select`); relations are filtered the same either way.
+        const projection = args.select ?? args.include;
+        if (projection) {
+            for (const field of Object.keys(projection)) {
                 // If field is relation
                 let relation = this.getRelation(modelName, field);
                 if (!relation) {
                     if (field === '_count') {
-                        // TODO implement filtering on _count
-                        // args.select[field] = this.applyWhereConditions(modelName, userRole, args.select[field], user, action);
+                        projection[field] = this.applyCountConditions(modelName, userRole, projection[field], user);
                     }
                     continue;
                 }
@@ -482,24 +641,38 @@ let PrismaService = exports.PrismaService = PrismaService_1 = class PrismaServic
                     this.debug(`Found 1:1 / *:1 (belongsTo) relation to model '${relation.model}' from model '${modelName}' via field '${field}'. Filter will be applied to main conditions...`);
                     // findFirst permissions for related model
                     const relatedPermissions = this.selectPermission(permissionsConfig[relation.model.toLowerCase()]?.[userRole] || {}, 'findFirst', relation.model, userRole);
+                    let conditions;
                     // If model is exposed, do not apply conditions
                     if (exposedModels.includes(relation.model.toLowerCase())) {
                         this.debug(`Related model '${relation.model}' is exposed via @Permission() decorator. Skipping conditions for action '${String(action)}' on role ${userRole}.`);
-                        continue;
                     }
-                    if (!relatedPermissions) {
-                        console.debug(`No permissions found for action '${relation.model}.${String(action)}()' on role ${userRole}`);
-                        throw new common_1.HttpException('Missing permissions on model ' + relation.model, common_1.HttpStatus.FORBIDDEN);
+                    else {
+                        if (!relatedPermissions) {
+                            console.debug(`No permissions found for action '${relation.model}.${String(action)}()' on role ${userRole}`);
+                            throw new common_1.HttpException('Missing permissions on model ' + relation.model, common_1.HttpStatus.FORBIDDEN);
+                        }
+                        if (relatedPermissions === 'ALL') {
+                            this.debug(`Related model '${relation.model}' has 'ALL' permissions for action '${String(action)}' on role ${userRole}. No conditions to apply.`);
+                        }
+                        else {
+                            conditions = PrismaService_1._buildConditions(relatedPermissions?.conditions, user);
+                        }
                     }
-                    if (relatedPermissions === 'ALL') {
-                        this.debug(`Related model '${relation.model}' has 'ALL' permissions for action '${String(action)}' on role ${userRole}. No conditions to apply.`);
-                        continue;
+                    // Relations selected below this one are filtered too: the related
+                    // model's own to-one conditions merge into `conditions` (Prisma
+                    // can't take a `where` on a to-one selection), and its to-many
+                    // relations are filtered in place.
+                    const nested = projection[field];
+                    if (nested && typeof nested === 'object' && (nested.select || nested.include)) {
+                        conditions = this.applyWhereConditions(relation.model, userRole, { select: nested.select, include: nested.include }, user, 'findFirst').where;
+                    }
+                    if (conditions) {
+                        belongsToQueue.push({
+                            field,
+                            relation,
+                            conditions,
+                        });
                     }
-                    belongsToQueue.push({
-                        field,
-                        relation,
-                        relatedPermissions,
-                    });
                     continue;
                 }
                 this.debug(`Found 1:N / N:N (hasMany) relation to model '${relation.model}' from model '${modelName}' via field '${field}'. Applying filter to the relation...`);
@@ -517,54 +690,29 @@ let PrismaService = exports.PrismaService = PrismaService_1 = class PrismaServic
                   },
                 })
                  */
-                if (args.select[field] === true) {
-                    args.select[field] = {};
+                if (projection[field] === true) {
+                    projection[field] = {};
                 }
                 // findMany permissions for related model
-                args.select[field].where = this.applyWhereConditions(relation.model, userRole, args.select[field], user, 'findMany').where;
-                delete args.select[field].select.where;
+                projection[field].where = this.applyWhereConditions(relation.model, userRole, projection[field], user, 'findMany').where;
+                if (projection[field].select) {
+                    delete projection[field].select.where;
+                }
             }
         }
+        // Ordering by a related to-one field applies that model's read rules the
+        // same way selecting it does: rows whose related record isn't readable
+        // don't take part in the ordering.
+        belongsToQueue.push(...this.orderByRelationConditions(modelName, userRole, args.orderBy, user));
         if (belongsToQueue?.length > 0) {
             this.debug(`Merging belongsTo relation conditions into main ${modelName}.`, 'warn');
         }
         for (const entry of belongsToQueue) {
-            const { relatedPermissions, field, relation } = entry;
-            this.debug(`Merging conditions for belongsTo relation field '${field}': ${JSON.stringify(relatedPermissions?.conditions)}`, 'info');
-            let belongsToConditions = PrismaService_1._buildConditions(relatedPermissions?.conditions, user);
+            const { conditions, field, relation } = entry;
+            this.debug(`Merging conditions for belongsTo relation field '${field}': ${JSON.stringify(conditions)}`, 'info');
             if (!args.where)
                 args.where = {};
-            // If relation is optional allow for non-matching records
-            if (relation.isRequired === false) {
-                args.where = {
-                    OR: [
-                        {
-                            ...args.where,
-                            [field]: {
-                                AND: [
-                                    args?.where?.[field] ?? {},
-                                    belongsToConditions
-                                ]
-                            }
-                        },
-                        {
-                            ...args.where,
-                            [field]: { is: null }
-                        }
-                    ]
-                };
-            }
-            else {
-                args.where = {
-                    ...(args.where || {}),
-                    [field]: {
-                        AND: [
-                            args?.where?.[field] ?? {},
-                            belongsToConditions
-                        ]
-                    }
-                };
-            }
+            args.where = PrismaService_1.mergeToOneConditions(args.where, field, relation, conditions);
         }
         // If model is exposed, do not apply conditions
         if (exposedModels.includes(modelName.toLowerCase())) {
@@ -585,6 +733,122 @@ let PrismaService = exports.PrismaService = PrismaService_1 = class PrismaServic
         }
         return args;
     }
+    /**
+     * Merges a to-one relation's read conditions into a `where`. If the relation
+     * is optional, rows where it is null are kept.
+     */
+    static mergeToOneConditions(where, field, relation, conditions) {
+        if (relation.isRequired === false) {
+            return {
+                OR: [
+                    {
+                        ...where,
+                        [field]: {
+                            AND: [
+                                where[field] ?? {},
+                                conditions
+                            ]
+                        }
+                    },
+                    {
+                        ...where,
+                        [field]: { is: null }
+                    }
+                ]
+            };
+        }
+        return {
+            ...where,
+            [field]: {
+                AND: [
+                    where[field] ?? {},
+                    conditions
+                ]
+            }
+        };
+    }
+    /**
+     * The to-one read conditions an `orderBy` brings in: ordering by a related
+     * field (at any depth) requires that related record to be readable, like
+     * selecting it. Ordering by a to-many relation's count is only allowed when
+     * the related model is fully readable (a count can't be scoped).
+     */
+    orderByRelationConditions(modelName, userRole, orderBy, user) {
+        const entries = [];
+        for (const clause of [].concat(orderBy ?? [])) {
+            if (!clause || typeof clause !== 'object')
+                continue;
+            for (const field of Object.keys(clause)) {
+                const relation = this.getRelation(modelName, field);
+                if (!relation)
+                    continue;
+                let conditions = this.relationReadConditions(modelName, field, relation, userRole, user, 'orderBy');
+                if (relation.relation !== 'belongsTo') {
+                    if (conditions)
+                        this.throwUnreadableFilterField(modelName, field, userRole, 'orderBy');
+                    continue;
+                }
+                const deeper = this.orderByRelationConditions(relation.model, userRole, clause[field], user)
+                    .reduce((where, e) => PrismaService_1.mergeToOneConditions(where, e.field, e.relation, e.conditions), {});
+                if (Object.keys(deeper).length)
+                    conditions = conditions ? { AND: [conditions, deeper] } : deeper;
+                if (conditions)
+                    entries.push({ field, relation, conditions });
+            }
+        }
+        return entries;
+    }
+    /**
+     * Scopes a `_count` selection: each counted to-many relation only counts the
+     * related rows the role can read. A relation into a model with no read rule
+     * is rejected, as selecting it would be. Left untouched when nothing needs
+     * scoping.
+     */
+    applyCountConditions(modelName, userRole, value, user) {
+        const relationFields = this.fieldConfigs[modelName.toLowerCase()].relationFields;
+        // `_count: true` counts every to-many relation.
+        const counted = value === true
+            ? Object.fromEntries(Object.keys(relationFields).filter((f) => relationFields[f].relation === 'hasMany').map((f) => [f, true]))
+            : value?.select;
+        if (!counted || typeof counted !== 'object')
+            return value;
+        let scoped;
+        for (const field of Object.keys(counted)) {
+            const relation = this.getRelation(modelName, field);
+            if (!relation || !counted[field])
+                continue;
+            const conditions = this.relationReadConditions(modelName, field, relation, userRole, user, 'select');
+            if (!conditions)
+                continue;
+            const entry = typeof counted[field] === 'object' ? counted[field] : {};
+            scoped = scoped ?? { ...counted };
+            scoped[field] = { ...entry, where: entry.where ? { AND: [entry.where, conditions] } : conditions };
+        }
+        if (!scoped)
+            return value;
+        return { ...(value === true ? {} : value), select: scoped };
+    }
+    /**
+     * Writes the rule's `set` values into every row of a write's `data`,
+     * overriding what the client sent (placeholders such as `$USER_ID` are
+     * resolved). Runs before the write is authorized, so the set values are
+     * checked like any other: against the create `conditions`, and a set
+     * foreign key against its `connect` rule.
+     */
+    applySetValues(modelName, userRole, data, user, action) {
+        const exposedModels = (exports.CorePrismaContext.getStore()?.exposedModels || []).map((m) => m.toLowerCase());
+        if (exposedModels.includes(modelName.toLowerCase()))
+            return;
+        const permissions = this.normalizedPermissionsConfig[modelName.toLowerCase()]?.[userRole] || {};
+        const set = this.selectPermission(permissions, action, modelName, userRole)?.set;
+        if (!set)
+            return;
+        const values = PrismaService_1._buildConditions(set, user);
+        for (const row of Array.isArray(data) ? data : [data]) {
+            if (row && typeof row === 'object')
+                Object.assign(row, values);
+        }
+    }
     /**
      * Enforces permission `conditions` on `create` / `createMany`.
      *
@@ -619,7 +883,7 @@ let PrismaService = exports.PrismaService = PrismaService_1 = class PrismaServic
             return;
         const conditions = actionPermissions.conditions;
         if (!conditions)
-            return; // permission defined but no conditions (e.g. setUserIdField only) → allow
+            return; // permission defined but no conditions (e.g. `set` only) → allow
         const condObj = Array.isArray(conditions) ? { AND: conditions } : conditions;
         const resolved = PrismaService_1._buildConditions(condObj, user);
         const data = params?.data;
@@ -700,6 +964,7 @@ let PrismaService = exports.PrismaService = PrismaService_1 = class PrismaServic
             const items = Array.isArray(value) ? value : [value];
             if (op === 'create') {
                 for (const child of items) {
+                    this.applySetValues(relatedModel, userRole, child, user, 'create');
                     await this.enforceCreateConditions(relatedModel, userRole, { data: child }, user, 'create', backFk);
                     await this.enforceNestedWrites(relatedModel, child, user, userRole, backFk);
                 }
@@ -928,7 +1193,7 @@ let PrismaService = exports.PrismaService = PrismaService_1 = class PrismaServic
                         return false;
                     break;
                 default:
-                    throw new common_1.ForbiddenException(`create on ${modelName}: unsupported operator '${op}' on field '${key}' in a create condition. Use a simpler condition or setUserIdField.`);
+                    throw new common_1.ForbiddenException(`create on ${modelName}: unsupported operator '${op}' on field '${key}' in a create condition. Use a simpler condition or 'set'.`);
             }
         }
         return true;

package/docs/data-access.md

@@ -68,6 +68,22 @@ A column annotated `/// @Role(ADMIN)` is returned only to roles in the list; for
   - If the related model has **no** read rule for the role, including it throws `403`. Grant a read rule on every model you expose through an `include`.
   - If the related row exists but doesn't satisfy the rule, the **whole parent row is dropped** (`findFirst` → `null`, `findMany` → the row is omitted). The parent is **not** returned with the relation set to `null`. In short: you can't see a row whose related record you're not allowed to see. This is intentional and fails closed.
 - **To-many relations are filtered in place**: the parent is kept, and the child list is narrowed to the rows the caller may read (possibly empty).
+- **Both rules apply at every depth**, including below a to-one relation: in `include: { project: { include: { owner: true, tasks: true } } }`, `owner` gates the row like `project` does, and `tasks` is narrowed.
+- **`_count` counts readable rows only.** `select: { _count: { select: { tasks: true } } }` returns how many related tasks the caller may read. Counting a relation whose model has no read rule for the role throws `403`.
+
+### Filtering and ordering by a relation
+
+A client filter or sort that reaches into a related model only takes into account the related rows the caller can read:
+
+```ts
+// Projects with a task assigned to alice — evaluated over the tasks the caller can read.
+prisma.model.project.findMany({ where: { tasks: { some: { assignee: { email: 'alice@x.io' } } } } });
+```
+
+- `some` / `none` / `is` / `isNot` match readable related rows only; `every` must hold for every readable related row. The same applies to the `where` of a nested selection and of a `_count` entry, at any depth.
+- Filtering through a relation whose model has **no** read rule for the role throws `403` (`Cannot filter by 'project.tasks' …`). Give the role a read rule, or expose the model for that request.
+- **Ordering by a related to-one field** (`orderBy: { assignee: { name: 'asc' } }`) requires that record to be readable, like including it: rows whose related record isn't readable are left out (a null relation is kept). A related model with no read rule throws `403`.
+- **Ordering by a to-many count** (`orderBy: { tasks: { _count: 'desc' } }`) requires the related model to be readable without conditions (`'ALL'` or exposed); otherwise it throws `403`.
 
 ---
 
@@ -75,8 +91,8 @@ A column annotated `/// @Role(ADMIN)` is returned only to roles in the list; for
 
 Use sparingly and deliberately; each disables part of the protection.
 
-- **Per-call options** — `prisma.<accessor>.<method>(args, { BYPASS_FILTERING, BYPASS_OMISSION })`. `BYPASS_FILTERING` skips condition injection (and create-enforcement); `BYPASS_OMISSION` skips field omission. Available on the typed accessors (`prisma.user`, `prisma.session`, `prisma.userRefreshToken`).
-- **`@ExposeModels(...)` / `@Permission(action, [models])`** — expose models for a request so they skip row/field filtering, scoped to the handler. See [permissions.md](./permissions.md).
+- **Per-call options** — `prisma.<accessor>.<method>(args, { BYPASS_FILTERING, BYPASS_OMISSION })`. `BYPASS_FILTERING` skips condition injection (and create-enforcement); `BYPASS_OMISSION` skips field omission (relations are still row-filtered). Accepted as the second argument of every proxied model method, but not declared in the method types.
+- **`@ExposeModels(...)` / `@Permission(action, [models])`** — expose models for a request so they skip row filtering, scoped to the handler. Field omission (`@Role`) still applies; combine with `BYPASS_OMISSION` to read hidden columns. See [permissions.md](./permissions.md).
 - **`prismaService.withExposedModels(models, async () => { ... })`** — service-level scoped exposure for a block of code (e.g. registration pre-checks). Model names are lowercased/case-insensitive.
 
 Framework flows that must write without a permission (registration, sessions, tokens) use `BYPASS_FILTERING`.
@@ -89,7 +105,7 @@ Framework flows that must write without a permission (registration, sessions, to
 
 - Own-scalar conditions are checked against `data`; `belongsTo` relation conditions are checked by looking up the referenced parent.
 - A model/role with **no** `create` permission is **default-denied** (`403`).
-- It **fails closed**: unsupported condition shapes for create (list-relation `some`/`every`/`none`, exotic operators) throw rather than silently allow. For those, use `setUserIdField` to set an owner id server-side and validate inputs in DTOs.
+- It **fails closed**: unsupported condition shapes for create (list-relation `some`/`every`/`none`, exotic operators) throw rather than silently allow. For those, use `set` on the rule to write an owner id server-side and validate inputs in DTOs.
 - In development only, a warning fires if a just-created row wouldn't satisfy the model's *read* rule (i.e. the creator couldn't read it back).
 
 ---

package/docs/dtos.md

@@ -95,7 +95,7 @@ model Task {
 
 There is **no per-role field strip** — a field is either writable through the generated DTO or it isn't. If one role may write a field and another may not (e.g. only `ADMIN` sets `role`), the field is a **privileged** one: mark it `/// @NoWrite` so generic CRUD never accepts it from anyone, and set it out-of-band — a dedicated admin endpoint/service (with its own guard), AdminJS, or a direct data-access call. Trying to express "writable for role A, not role B" through one shared CRUD DTO isn't possible; model it as a separate endpoint instead.
 
-> **Migrating off `restrictedFields`.** Earlier versions had a `restrictedFields: ['x']` option on a permission action that stripped keys from the body per role. It has been **removed**. Replace it: for a field no client should write, use `/// @NoWrite` (or `/// @Role(none)`); for one endpoint, use `OmitType`; for a value the server owns (like an owner id), use `setUserIdField`; for a genuinely per-role write difference, use a dedicated endpoint as above.
+> **Migrating off `restrictedFields`.** Earlier versions had a `restrictedFields: ['x']` option on a permission action that stripped keys from the body per role. It has been **removed**. Replace it: for a field no client should write, use `/// @NoWrite` (or `/// @Role(none)`); for one endpoint, use `OmitType`; for a value the server owns (like an owner id), use `set` on the permission rule; for a genuinely per-role write difference, use a dedicated endpoint as above.
 
 ---
 

package/docs/limitations.md

@@ -31,11 +31,11 @@ Let the generated resolvers serve the data (they go through `PrismaService`); a
 
 ### Including an unreadable to-one relation drops the parent row
 
-`include`/`select` of a `belongsTo` relation whose target the caller can't read removes the **whole parent row** (returns `null` / omits it), rather than nulling just the relation. To-many relations filter in place and keep the parent. Fails closed; intentional. See [data-access.md](./data-access.md#relations-in-conditions-and-includes).
+`include`/`select` of a `belongsTo` relation whose target the caller can't read removes the **whole parent row** (returns `null` / omits it), rather than nulling just the relation — at any depth, so an unreadable `project.owner` drops the root row. Ordering by a related to-one field has the same effect. To-many relations filter in place and keep the parent. Fails closed; intentional. See [data-access.md](./data-access.md#relations-in-conditions-and-includes).
 
-### `_count` pseudo-field filtering is not implemented
+### Ordering by a to-many count needs an unconditional read rule
 
-You can `select: { _count: ... }`, but ABAC conditions are **not** applied inside a `_count` sub-selection. Don't rely on `_count` to reflect only rows the caller may see.
+`orderBy: { tasks: { _count: 'desc' } }` is allowed only when the role reads the related model with `'ALL'` (or it is exposed); with a conditional rule it throws `403`, since the count can't be limited to readable rows. Select `_count` (which is scoped) and sort in code, or expose the model for that request.
 
 ### Nested writes over HTTP CRUD are one level deep
 
@@ -46,10 +46,10 @@ Generated CRUD accepts nested `create`/`connect` **one level deep only** — a `
 ## Sharp edges to know about
 
 - **No per-role field strip.** A field is either writable through the generated DTO or not (`/// @NoWrite` / `OmitType`). There is no way to accept a field for one role and reject it for another on the same CRUD endpoint — model a privileged column as `/// @NoWrite` + a dedicated endpoint. (The old `restrictedFields` option was removed — see [dtos.md](./dtos.md#per-role-differences).)
-- **Per-call bypass options are only on three accessors.** `{ BYPASS_FILTERING, BYPASS_OMISSION }` are available on `prismaService.user` / `.session` / `.userRefreshToken`. For an unfiltered read of another model, use `withExposedModels([...])` or `@ExposeModels(...)`, not a per-call option on `prisma.model.<x>`.
+- **Per-call bypass options are untyped.** `{ BYPASS_FILTERING, BYPASS_OMISSION }` work as the second argument of every proxied model method, but the method types don't declare it. For an unfiltered read of a model, prefer `withExposedModels([...])` or `@ExposeModels(...)`.
 - **Role strings are not type-checked.** `PermissionsConfig` keys are plain strings; a typo (`ADIMN`) silently yields "no permissions" → default-deny for that role. Double-check role spelling against your `Role` enum.
 - **No audit logging of denials.** A refused request returns `403` but emits no structured audit event; per-request diagnostics are opt-in via `prismaService.debugQueries(true)`.
-- **Exposed models are a full bypass.** `@ExposeModels` / `@Permission(a, [models])` / `withExposedModels` disable row *and* field filtering for the listed models within that scope. Keep the scope as narrow as possible.
+- **Exposed models are a full bypass.** `@ExposeModels` / `@Permission(a, [models])` / `withExposedModels` disable row filtering for the listed models within that scope (field omission still applies — add `BYPASS_OMISSION` to read `@Role`-hidden columns). Keep the scope as narrow as possible.
 - **`connect` defaults to one rule per target model; override per relation when needed.** By default every foreign key that points at model `T` is authorized by the single `T.connect` rule for the role. When a specific relation needs a different (stricter) rule — "a class's teacher must be a teacher" — declare a **relation-scoped** `connect` on the source model (`Source[role].relations[field].connect`); it is ANDed with `T.connect`, or stands alone if `T` has none. See [permissions.md](./permissions.md#two-places-to-declare-a-connect-rule). A relation rule can only strengthen, never loosen, the target rule.
 - **A string `User.id` needs its two foreign keys changed with it.** `User.id` may be `String` (uuid/cuid) instead of the scaffold's `Int` — the framework is id-type-agnostic and coerces accordingly (see [authentication.md](./authentication.md#using-a-string-uuid--cuid-userid)). But `Session.userId` and `UserRefreshToken.userId` must be switched to `String` in the same edit; leaving one as `Int` is a schema/relation mismatch Prisma will reject at migrate time. Change all three together.
 - **The config is validated at boot; a bad config stops the app.** A create condition that references a relation, or a required foreign key whose target lacks a `connect` rule for a role that can create, is a startup error (not a runtime one). This is deliberate — the alternative is a silent runtime `403`. The error message names exactly what to fix.

package/docs/permissions.md

@@ -42,7 +42,7 @@ Shape: `PermissionsConfig[Model][Role][action]`, where each `action` value is ei
 
 - **`'ALL'`** — unrestricted for that action, or
 - **`{ conditions: <where> }`** — an ABAC rule. `conditions` is Prisma `where`-syntax (`AND`/`OR`/`NOT`, relation filters `some`/`every`/`none`, operators `in`/`not`/`lt`/…). `$USER_ID` is substituted with the caller's id at query time.
-- Optionally with **`setUserIdField`** (see below).
+- Optionally with **`set`** on a `create` / `update` rule — columns the server writes (see below).
 
 **Model and role keys are matched case-insensitively** against the model name and the caller's role string.
 
@@ -122,6 +122,8 @@ To keep configs compact, a missing action falls back:
 - **`findFirst` / `findUnique`-shape reads → `findMany`**.
 - **`createMany` → `create`**, **`updateMany` → `update`**, **`deleteMany` → `delete`** (a batch action inherits the singular rule).
 
+Both chains apply in the `RbacGuard` and in the proxy. A custom action (`@Permission('getTeam')`, `@Permission('findAllInvoices')`) never inherits a read rule — it needs its own entry.
+
 The `*Many` → singular fallback is **one-directional**: the singular is canonical. Declaring only `updateMany` does *not* enable `update`; declare `update` (or `create`/`delete`) and the `*Many` form is covered automatically. This holds in **both** the `RbacGuard` and the proxy.
 
 So a minimal USER config often needs just `findMany`, `create`, `update`, `delete`.
@@ -130,13 +132,19 @@ So a minimal USER config often needs just `findMany`, `create`, `update`, `delet
 
 - **`/// @Role(ADMIN)` on a schema column** — only listed roles can *read* that field. For everyone else the proxy omits it from results (it comes back `undefined`). `/// @Role(none)` hides it from all roles. Applies at every depth, including nested relation selections.
 - **`/// @NoWrite` on a schema column** — excludes the field from generated create/update DTOs (all roles). Use it for privileged columns (e.g. `role`) that should be set out-of-band, not through generic CRUD.
-- **`setUserIdField: 'ownerId'`** — the framework sets that field to the caller's id server-side on create (so a client can't forge ownership). **It does not exempt the field from the `connect` requirement**: `ownerId` is still a foreign key, and every relationship a write establishes is authorized. Declare a **relation-scoped** self-connect rather than a blanket rule on the target:
+- **`set: { ownerId: '$USER_ID' }`** on a `create` / `update` rule — values the server writes on every write that rule allows, overriding what the client sent (so a client can't forge ownership). Use it for the owner, audit columns (`updatedById`), or a value a role is forced to (`status: 'draft'`). It applies on every write path — generated CRUD, your services, nested creates. Pair the column with `/// @NoWrite` so the DTO doesn't accept it either.
+
+  Set values are authorized like any other: they must satisfy the rule's `conditions`, and **a set foreign key needs a `connect` rule** — the app refuses to boot without one. Declare a **relation-scoped** self-connect rather than a blanket rule on the target:
 
   ```ts
   Album: {
       USER: {
-          create: {setUserIdField: 'ownerId'},
-          relations: {owner: {connect: {conditions: {id: '$USER_ID'}}}},
+          create: {set: {ownerId: '$USER_ID'}},
+          updateMany: {conditions: {ownerId: '$USER_ID'}, set: {updatedById: '$USER_ID'}},
+          relations: {
+              owner: {connect: {conditions: {id: '$USER_ID'}}},
+              updatedBy: {connect: {conditions: {id: '$USER_ID'}}},
+          },
       },
   },
   ```
@@ -174,7 +182,8 @@ isEmailAvailable(@Query('email') email: string) { /* reads User unfiltered */ }
 ```
 
 - Sets **no action**, so `RbacGuard` demands no permission (a public / `GUEST` route works with no `GUEST` rule for the model).
-- The listed models **skip row and field filtering for that request only** (scoped via async context — it does not make the model globally readable).
+- On writes, an exposed model skips its own `create` rule, but a foreign key it sets is still authorized by the **target's** `connect` rule unless the target is exposed too.
+- The listed models **skip row filtering for that request only** — `@Role` field omission still applies (scoped via async context — it does not make the model globally readable).
 - Case-insensitive: `@ExposeModels('User')` and `@ExposeModels('user')` are equivalent.
 - Combine with `@Permission(...)` if you also want an action check — exposed models from both decorators are merged.
 - This is a deliberate **bypass**. Use it narrowly (e.g. registration pre-checks); prefer real ABAC rules where feasible.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@appxdigital/appx-core",
-    "version": "0.1.129",
+    "version": "0.1.131",
     "description": "Appx Core is a library that provides a set of tools to help you build your application faster.",
     "main": "dist/index.js",
     "types": "dist/index.d.ts",
@@ -30,7 +30,10 @@
         "url": "https://github.com/appxdigital/appx-core/issues"
     },
     "dependencies": {
-        "express": "^5.1.0"
+        "@adminjs/nestjs": "~7.0.0",
+        "@opentelemetry/api": "^1.9.0",
+        "express": "^5.1.0",
+        "ts-morph": "^25.0.0"
     },
     "devDependencies": {
         "@nestjs/testing": "~11.0.0",
@@ -56,7 +59,6 @@
     "peerDependencies": {
         "@adminjs/express": "~6.1.1",
         "@adminjs/import-export": "~3.0.0",
-        "@adminjs/nestjs": "~7.0.0",
         "@adminjs/passwords": "~4.0.0",
         "@adminjs/prisma": "~5.0.4",
         "@apollo/server": "^4.11.3",