@contember/engine-content-api 2.1.0-beta.1 → 2.1.0-beta.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contember/engine-content-api",
-  "version": "2.1.0-beta.1",
+  "version": "2.1.0-beta.2",
   "license": "Apache-2.0",
   "main": "./dist/production/index.js",
   "typings": "./dist/types/index.d.ts",
@@ -37,7 +37,6 @@
   },
   "devDependencies": {
     "@contember/database-tester": "2.1.0-beta.1",
-    "@contember/schema-definition": "2.1.0-beta.1",
     "@types/node": "^24.12.0",
     "graphql": "^16.13.1",
     "pg": "^8.20.0"

package/src/ExecutionContainer.ts

@@ -36,6 +36,32 @@ import {
 } from './input-validation'
 import { RefreshViewResolver } from './resolvers/RefreshViewResolver'
 
+export interface TriggeredActionEvent {
+	id: string
+	trigger: string
+	target: string
+	transactionId: string
+}
+
+export interface TriggeredActionsCollector {
+	add(events: readonly TriggeredActionEvent[]): void
+	getEvents(): readonly TriggeredActionEvent[]
+}
+
+export class InMemoryTriggeredActionsCollector implements TriggeredActionsCollector {
+	private events: TriggeredActionEvent[] = []
+
+	add(events: readonly TriggeredActionEvent[]): void {
+		for (const event of events) {
+			this.events.push(event)
+		}
+	}
+
+	getEvents(): readonly TriggeredActionEvent[] {
+		return this.events
+	}
+}
+
 export type ExecutionContainerArgs = {
 	schema: Schema
 	schemaMeta: { id?: number }
@@ -44,6 +70,7 @@ export type ExecutionContainerArgs = {
 	identityId: string
 	identityVariables: Acl.VariablesMap
 	permissions: Acl.Permissions
+	allPermissions?: Acl.Permissions
 	systemSchema: string
 	project: { slug: string }
 	stage: { id: string; slug: string }
@@ -55,6 +82,7 @@ export interface ExecutionContainer {
 	mutationResolver: MutationResolver
 	validationResolver: ValidationResolver
 	refreshViewResolver: RefreshViewResolver
+	triggeredActionsCollector: TriggeredActionsCollector | undefined
 }
 
 export type ExecutionContainerBuilder = ReturnType<ExecutionContainerFactory['createBuilderInternal']>
@@ -75,21 +103,40 @@ export class ExecutionContainerFactory {
 	}
 
 	createBuilderInternal(
-		{ permissions, identityVariables, identityId, db, schema, schemaMeta, systemSchema, stage, project, schemaDatabaseMetadata, userInfo }:
-			ExecutionContainerArgs,
+		{
+			permissions,
+			allPermissions,
+			identityVariables,
+			identityId,
+			db,
+			schema,
+			schemaMeta,
+			systemSchema,
+			stage,
+			project,
+			schemaDatabaseMetadata,
+			userInfo,
+		}: ExecutionContainerArgs,
 	) {
 		return new Builder({})
 			.addService('systemSchema', () => systemSchema)
 			.addService('db', () => db)
 			.addService('project', () => project)
 			.addService('stage', () => stage)
+			.addService('triggeredActionsCollector', (): TriggeredActionsCollector | undefined =>
+				schema.settings.actions?.returnTriggeredActions === true
+					? new InMemoryTriggeredActionsCollector()
+					: undefined)
 			.addService('schema', () => schema)
 			.addService('schemaMeta', () => schemaMeta)
 			.addService('schemaDatabaseMetadata', () => schemaDatabaseMetadata)
 			.addService('userInfo', () => userInfo)
 			.addService('providers', () => this.providers)
 			.addService('variableInjector', ({ schema }) => new VariableInjector(schema.model, identityVariables))
-			.addService('predicateFactory', ({ variableInjector, schema }) => new PredicateFactory(permissions, schema.model, variableInjector))
+			.addService(
+				'predicateFactory',
+				({ variableInjector, schema }) => new PredicateFactory(permissions, schema.model, variableInjector, allPermissions),
+			)
 			.addService('predicatesInjector', ({ predicateFactory, schema }) => new PredicatesInjector(schema.model, predicateFactory))
 			.addService('joinBuilder', ({ schema }) => new JoinBuilder(schema.model))
 			.addService('conditionBuilder', () => new ConditionBuilder())
@@ -232,6 +279,12 @@ export class ExecutionContainerFactory {
 	}
 
 	public create(args: ExecutionContainerArgs): ExecutionContainer {
-		return this.createBuilder(args).build().pick('validationResolver', 'readResolver', 'mutationResolver', 'refreshViewResolver')
+		return this.createBuilder(args).build().pick(
+			'validationResolver',
+			'readResolver',
+			'mutationResolver',
+			'refreshViewResolver',
+			'triggeredActionsCollector',
+		)
 	}
 }

package/src/acl/PermissionFactory.ts

@@ -7,17 +7,33 @@ export interface Identity {
 	projectRoles: readonly string[]
 }
 
+export interface ContextualPermissions {
+	root: Acl.Permissions
+	all: Acl.Permissions
+}
+
 export class PermissionFactory {
 	public create(schema: Schema, roles: readonly string[], prefix?: string): Acl.Permissions {
+		return this.createInternal(schema, roles, false, prefix)
+	}
+
+	public createContextual(schema: Schema, roles: readonly string[]): ContextualPermissions {
+		return {
+			root: this.createInternal(schema, roles, false),
+			all: this.createInternal(schema, roles, true),
+		}
+	}
+
+	private createInternal(schema: Schema, roles: readonly string[], includeThrough: boolean, prefix?: string): Acl.Permissions {
 		let result: Acl.Permissions = {}
 		for (let role of roles) {
 			const roleDefinition = schema.acl.roles[role] || { entities: {} }
 			let rolePermissions: Acl.Permissions = this.prefixPredicatesWithRole(schema.model, roleDefinition.entities, prefix || role)
 			if (roleDefinition.inherits) {
-				const inheritedPermissions = this.create(schema, roleDefinition.inherits, prefix || role)
-				rolePermissions = this.mergePermissions(inheritedPermissions, rolePermissions)
+				const inheritedPermissions = this.createInternal(schema, roleDefinition.inherits, includeThrough, prefix || role)
+				rolePermissions = this.mergePermissions(inheritedPermissions, rolePermissions, includeThrough)
 			}
-			result = this.mergePermissions(result, rolePermissions)
+			result = this.mergePermissions(result, rolePermissions, includeThrough)
 		}
 		result = this.makePrimaryPredicatesUnionOfAllFields(schema.model, result)
 
@@ -98,11 +114,11 @@ export class PermissionFactory {
 		})
 	}
 
-	private mergePermissions(left: Acl.Permissions, right: Acl.Permissions): Acl.Permissions {
+	private mergePermissions(left: Acl.Permissions, right: Acl.Permissions, includeThrough = false): Acl.Permissions {
 		const result = { ...left }
 		for (let entityName in right) {
 			if (result[entityName] !== undefined) {
-				result[entityName] = this.mergeEntityPermissions(result[entityName], right[entityName])
+				result[entityName] = this.mergeEntityPermissions(result[entityName], right[entityName], includeThrough)
 			} else {
 				result[entityName] = right[entityName]
 			}
@@ -110,7 +126,7 @@ export class PermissionFactory {
 		return result
 	}
 
-	private mergeEntityPermissions(left: Acl.EntityPermissions, right: Acl.EntityPermissions): Acl.EntityPermissions {
+	private mergeEntityPermissions(left: Acl.EntityPermissions, right: Acl.EntityPermissions, includeThrough = false): Acl.EntityPermissions {
 		let predicates: Writable<Acl.PredicateMap> = {}
 		const operations: Writable<Acl.EntityOperations> = {}
 		if (left.operations.customPrimary || right.operations.customPrimary) {
@@ -125,7 +141,12 @@ export class PermissionFactory {
 				'update',
 			] as const
 		) {
-			const { predicates: opPredicates, permissions: fieldPermissions, noRoot: opNoRoot } = this.mergeOperationPermissions(left, right, operation)
+			const { predicates: opPredicates, permissions: fieldPermissions, noRoot: opNoRoot } = this.mergeOperationPermissions(
+				left,
+				right,
+				operation,
+				includeThrough,
+			)
 
 			if (opNoRoot) {
 				noRoot.push(operation)
@@ -137,7 +158,7 @@ export class PermissionFactory {
 			}
 		}
 
-		const { predicateDefinition, predicate, noRoot: opNoRoot } = this.mergeDeletePermissions(left, right)
+		const { predicateDefinition, predicate, noRoot: opNoRoot } = this.mergeDeletePermissions(left, right, includeThrough)
 		if (opNoRoot) {
 			noRoot.push('delete')
 		}
@@ -158,12 +179,17 @@ export class PermissionFactory {
 		}
 	}
 
-	private mergeOperationPermissions(left: Acl.EntityPermissions, right: Acl.EntityPermissions, operation: 'create' | 'read' | 'update'): {
+	private mergeOperationPermissions(
+		left: Acl.EntityPermissions,
+		right: Acl.EntityPermissions,
+		operation: 'create' | 'read' | 'update',
+		includeThrough = false,
+	): {
 		noRoot: boolean
 		predicates: Acl.PredicateMap
 		permissions: Acl.FieldPermissions
 	} {
-		const { noRoot, leftPermissions, rightPermissions } = this.resolveNoRoot(left, right, operation)
+		const { noRoot, leftPermissions, rightPermissions } = this.resolveNoRoot(left, right, operation, includeThrough)
 		return {
 			noRoot,
 			...this.mergeFieldPermissions(
@@ -175,12 +201,12 @@ export class PermissionFactory {
 		}
 	}
 
-	private mergeDeletePermissions(left: Acl.EntityPermissions, right: Acl.EntityPermissions): {
+	private mergeDeletePermissions(left: Acl.EntityPermissions, right: Acl.EntityPermissions, includeThrough = false): {
 		noRoot: boolean
 		predicate: Acl.PredicateReference | boolean
 		predicateDefinition: Acl.PredicateDefinition | undefined
 	} {
-		const { noRoot, leftPermissions, rightPermissions } = this.resolveNoRoot(left, right, 'delete')
+		const { noRoot, leftPermissions, rightPermissions } = this.resolveNoRoot(left, right, 'delete', includeThrough)
 
 		return {
 			noRoot,
@@ -193,7 +219,12 @@ export class PermissionFactory {
 		}
 	}
 
-	private resolveNoRoot<const Op extends `${Acl.Operation}`>(left: Acl.EntityPermissions, right: Acl.EntityPermissions, operation: Op): {
+	private resolveNoRoot<const Op extends `${Acl.Operation}`>(
+		left: Acl.EntityPermissions,
+		right: Acl.EntityPermissions,
+		operation: Op,
+		includeThrough = false,
+	): {
 		noRoot: boolean
 		leftPermissions: Acl.EntityPermissions['operations'][Op] | undefined
 		rightPermissions: Acl.EntityPermissions['operations'][Op] | undefined
@@ -207,8 +238,10 @@ export class PermissionFactory {
 			|| (leftRootForbidden && !rightPermissions)
 			|| (rightRootForbidden && !leftPermissions)
 
-		const resolvedLeftPermissions = !rootForbidden && leftRootForbidden ? undefined : leftPermissions
-		const resolvedRightPermissions = !rootForbidden && rightRootForbidden ? undefined : rightPermissions
+		// When includeThrough is true, keep all permissions regardless of noRoot
+		// (used for "all" permissions that apply when accessing through relations)
+		const resolvedLeftPermissions = !includeThrough && !rootForbidden && leftRootForbidden ? undefined : leftPermissions
+		const resolvedRightPermissions = !includeThrough && !rootForbidden && rightRootForbidden ? undefined : rightPermissions
 
 		return {
 			noRoot: rootForbidden,

package/src/acl/PredicateFactory.ts

@@ -14,14 +14,32 @@ export class PredicateFactory {
 		private readonly permissions: Acl.Permissions,
 		private readonly model: Model.Schema,
 		private readonly variableInjector: VariableInjector,
+		private readonly allPermissions?: Acl.Permissions,
 	) {}
 
+	/**
+	 * Selects the appropriate permission set based on query context:
+	 * - `isRoot === false` (nested/relation context): uses allPermissions (includes through-only permissions)
+	 * - `isRoot === true` or `isRoot === undefined` (root or unknown context): uses root-only permissions
+	 *
+	 * The `undefined` vs `true` distinction matters: `undefined` is the default for callers
+	 * that don't track root context, and must fall through to root permissions for safety.
+	 */
+	private getPermissionsForContext(isRoot?: boolean): Acl.Permissions {
+		if (isRoot === false && this.allPermissions) {
+			return this.allPermissions
+		}
+		return this.permissions
+	}
+
 	public getFieldPredicate(
 		entity: Model.Entity,
 		operation: Acl.Operation.update | Acl.Operation.read | Acl.Operation.create,
 		fieldName: string,
+		isRoot?: boolean,
 	): FieldRequiredPredicate {
-		const permissions = this.permissions[entity.name]?.operations?.[operation]
+		const perms = this.getPermissionsForContext(isRoot)
+		const permissions = perms[entity.name]?.operations?.[operation]
 		const predicate = permissions?.[fieldName] ?? false
 		const rowLevelField = getRowLevelPredicatePseudoField(entity)
 
@@ -38,12 +56,15 @@ export class PredicateFactory {
 		entity: Model.Entity,
 		operation: Acl.Operation.read,
 		fieldName: string,
+		isRoot?: boolean,
 	): boolean {
+		const perms = this.getPermissionsForContext(isRoot)
 		const rowLevelField = getRowLevelPredicatePseudoField(entity)
-		const permissions = this.permissions[entity.name]?.operations?.[operation]
+		const permissions = perms[entity.name]?.operations?.[operation]
 		return permissions?.[fieldName] !== permissions?.[rowLevelField]
 	}
 
+	/** Delete predicates are not context-aware — through-permission support is scoped to read operations only. */
 	public createDeletePredicate(entity: Model.Entity) {
 		const neverCondition: Input.Where = { [entity.primary]: { never: true } }
 		const entityPermissions = this.permissions[entity.name]
@@ -65,8 +86,10 @@ export class PredicateFactory {
 		operation: Acl.Operation.update | Acl.Operation.read | Acl.Operation.create,
 		fieldNames: string[] = [getRowLevelPredicatePseudoField(entity)],
 		relationContext?: Model.AnyRelationContext,
+		isRoot?: boolean,
 	): Input.OptionalWhere {
-		const entityPermissions: Acl.EntityPermissions = this.permissions[entity.name]
+		const perms = this.getPermissionsForContext(isRoot)
+		const entityPermissions: Acl.EntityPermissions = perms[entity.name]
 		const neverCondition: Input.Where = { [entity.primary]: { never: true } }
 
 		if (!entityPermissions) {
@@ -85,11 +108,17 @@ export class PredicateFactory {
 			return neverCondition
 		}
 
-		return this.buildPredicates(entity, operationPredicates, relationContext)
+		return this.buildPredicates(entity, operationPredicates, relationContext, isRoot)
 	}
 
-	public buildPredicates(entity: Model.Entity, predicates: Acl.PredicateReference[], relationContext?: Model.AnyRelationContext): Input.OptionalWhere {
-		const entityPermissions: Acl.EntityPermissions = this.permissions[entity.name] ?? {}
+	public buildPredicates(
+		entity: Model.Entity,
+		predicates: Acl.PredicateReference[],
+		relationContext?: Model.AnyRelationContext,
+		isRoot?: boolean,
+	): Input.OptionalWhere {
+		const perms = this.getPermissionsForContext(isRoot)
+		const entityPermissions: Acl.EntityPermissions = perms[entity.name] ?? {}
 
 		const predicatesWhere: Input.Where[] = predicates.reduce(
 			(result: Input.Where[], name: Acl.PredicateReference): Input.Where[] => {
@@ -105,7 +134,7 @@ export class PredicateFactory {
 			return {}
 		}
 		const where: Input.Where = predicatesWhere.length === 1 ? predicatesWhere[0] : { and: predicatesWhere }
-		return this.optimizePredicates(where, relationContext)
+		return this.optimizePredicates(where, relationContext, isRoot)
 	}
 
 	private getRequiredPredicates(
@@ -128,11 +157,11 @@ export class PredicateFactory {
 		return predicates
 	}
 
-	public optimizePredicates(where: Input.OptionalWhere, relationContext?: Model.AnyRelationContext) {
+	public optimizePredicates(where: Input.OptionalWhere, relationContext?: Model.AnyRelationContext, isRoot?: boolean) {
 		if (!relationContext || !relationContext.targetRelation) {
 			return where
 		}
-		const sourcePredicate = this.create(relationContext.entity, Acl.Operation.read, [relationContext.relation.name])
+		const sourcePredicate = this.create(relationContext.entity, Acl.Operation.read, [relationContext.relation.name], undefined, isRoot)
 		if (Object.keys(sourcePredicate).length === 0) {
 			return where
 		}

package/src/acl/PredicatesInjector.ts

@@ -11,8 +11,9 @@ export class PredicatesInjector {
 		relationContext?: Model.AnyRelationContext,
 		ancestorPath?: readonly Model.AnyRelationContext[],
 	): Input.OptionalWhere {
-		const restrictedWhere = this.injectToWhere(where, entity, true, relationContext, false, ancestorPath ?? [])
-		return this.createWhere(entity, undefined, restrictedWhere, relationContext, false, ancestorPath ?? [])
+		const isQueryRoot = !relationContext && (!ancestorPath || ancestorPath.length === 0)
+		const restrictedWhere = this.injectToWhere(where, entity, true, relationContext, false, ancestorPath ?? [], isQueryRoot)
+		return this.createWhere(entity, undefined, restrictedWhere, relationContext, false, ancestorPath ?? [], isQueryRoot)
 	}
 
 	/**
@@ -40,6 +41,7 @@ export class PredicatesInjector {
 		relationContext?: Model.AnyRelationContext,
 		isBackReferenceContext?: boolean,
 		ancestorPath?: readonly Model.AnyRelationContext[],
+		isQueryRoot?: boolean,
 	): Input.OptionalWhere {
 		// Simplify predicates when:
 		// 1. We're in a back-reference context (inside a filter that traverses back)
@@ -55,13 +57,14 @@ export class PredicatesInjector {
 		if (shouldSimplify) {
 			predicatesWhere = { [entity.primary]: { always: true } }
 		} else {
-			const rawPredicate = this.predicateFactory.create(entity, Acl.Operation.read, fieldNames, relationContext)
+			const rawPredicate = this.predicateFactory.create(entity, Acl.Operation.read, fieldNames, relationContext, isQueryRoot)
 			// Process the predicate to inject nested entity predicates
 			predicatesWhere = this.injectPredicatesToPredicate(
 				rawPredicate,
 				entity,
 				isBackReferenceContext ?? false,
 				ancestorPath ?? [],
+				isQueryRoot,
 			)
 		}
 
@@ -85,21 +88,22 @@ export class PredicatesInjector {
 		entity: Model.Entity,
 		isBackReferenceContext: boolean,
 		ancestorPath: readonly Model.AnyRelationContext[],
+		isQueryRoot?: boolean,
 	): Input.OptionalWhere {
 		const resultWhere: Writable<Input.OptionalWhere> = {}
 
 		if (where.and) {
 			resultWhere.and = where.and
 				.filter((it): it is Input.Where => !!it)
-				.map(it => this.injectPredicatesToPredicate(it, entity, isBackReferenceContext, ancestorPath))
+				.map(it => this.injectPredicatesToPredicate(it, entity, isBackReferenceContext, ancestorPath, isQueryRoot))
 		}
 		if (where.or) {
 			resultWhere.or = where.or
 				.filter((it): it is Input.Where => !!it)
-				.map(it => this.injectPredicatesToPredicate(it, entity, isBackReferenceContext, ancestorPath))
+				.map(it => this.injectPredicatesToPredicate(it, entity, isBackReferenceContext, ancestorPath, isQueryRoot))
 		}
 		if (where.not) {
-			resultWhere.not = this.injectPredicatesToPredicate(where.not, entity, isBackReferenceContext, ancestorPath)
+			resultWhere.not = this.injectPredicatesToPredicate(where.not, entity, isBackReferenceContext, ancestorPath, isQueryRoot)
 		}
 
 		const fields = Object.keys(where).filter(it => !['and', 'or', 'not'].includes(it))
@@ -128,6 +132,7 @@ export class PredicatesInjector {
 						context.targetEntity,
 						nestedIsBackReferenceContext,
 						nestedAncestorPath,
+						isQueryRoot,
 					)
 
 					// Check if we should simplify the target entity's predicate
@@ -137,7 +142,7 @@ export class PredicatesInjector {
 					// Get target entity's predicate (simplified if back-reference)
 					const targetPredicate = shouldSimplifyNested
 						? { [context.targetEntity.primary]: { always: true } }
-						: this.predicateFactory.create(context.targetEntity, Acl.Operation.read, undefined, context)
+						: this.predicateFactory.create(context.targetEntity, Acl.Operation.read, undefined, context, isQueryRoot)
 
 					// Optimization: avoid duplicate { id: always } when both are simplified
 					const primaryKey = context.targetEntity.primary
@@ -175,20 +180,21 @@ export class PredicatesInjector {
 		relationContext: Model.AnyRelationContext | undefined,
 		isBackReferenceContext: boolean,
 		ancestorPath: readonly Model.AnyRelationContext[],
+		isQueryRoot?: boolean,
 	): Input.OptionalWhere {
 		const resultWhere: Writable<Input.OptionalWhere> = {}
 		if (where.and) {
 			resultWhere.and = where.and.filter((it): it is Input.Where => !!it).map(it =>
-				this.injectToWhere(it, entity, isRoot, relationContext, isBackReferenceContext, ancestorPath)
+				this.injectToWhere(it, entity, isRoot, relationContext, isBackReferenceContext, ancestorPath, isQueryRoot)
 			)
 		}
 		if (where.or) {
 			resultWhere.or = where.or.filter((it): it is Input.Where => !!it).map(it =>
-				this.injectToWhere(it, entity, isRoot, relationContext, isBackReferenceContext, ancestorPath)
+				this.injectToWhere(it, entity, isRoot, relationContext, isBackReferenceContext, ancestorPath, isQueryRoot)
 			)
 		}
 		if (where.not) {
-			resultWhere.not = this.injectToWhere(where.not, entity, isRoot, relationContext, isBackReferenceContext, ancestorPath)
+			resultWhere.not = this.injectToWhere(where.not, entity, isRoot, relationContext, isBackReferenceContext, ancestorPath, isQueryRoot)
 		}
 
 		const fields = Object.keys(where).filter(it => !['and', 'or', 'not'].includes(it))
@@ -210,14 +216,14 @@ export class PredicatesInjector {
 					const nestedIsBackReferenceContext = isBackReference || isBackReferenceContext
 					// Build extended ancestor path for nested traversal
 					const nestedAncestorPath: Model.AnyRelationContext[] = [...ancestorPath, context]
-					return this.injectToWhere(relationWhere, context.targetEntity, false, context, nestedIsBackReferenceContext, nestedAncestorPath)
+					return this.injectToWhere(relationWhere, context.targetEntity, false, context, nestedIsBackReferenceContext, nestedAncestorPath, isQueryRoot)
 				},
 			})
 		}
 		const fieldsForPredicate = !isRoot
 			? fields
-			: fields.filter(it => this.predicateFactory.shouldApplyCellLevelPredicate(entity, Acl.Operation.read, it))
+			: fields.filter(it => this.predicateFactory.shouldApplyCellLevelPredicate(entity, Acl.Operation.read, it, isQueryRoot))
 
-		return this.createWhere(entity, fieldsForPredicate, resultWhere, relationContext, isBackReferenceContext, ancestorPath)
+		return this.createWhere(entity, fieldsForPredicate, resultWhere, relationContext, isBackReferenceContext, ancestorPath, isQueryRoot)
 	}
 }

package/src/mapper/select/handlers/FieldsVisitor.ts

@@ -220,7 +220,8 @@ export class FieldsVisitor implements Model.RelationByTypeVisitor<void>, Model.C
 	}
 
 	private getRequiredPredicate(entity: Model.Entity, field: Model.AnyField): Acl.Predicate | undefined {
-		const fieldPredicate = this.predicateFactory.getFieldPredicate(entity, Acl.Operation.read, field.name)
+		const isRoot = this.relationPath.length === 0
+		const fieldPredicate = this.predicateFactory.getFieldPredicate(entity, Acl.Operation.read, field.name, isRoot)
 		return fieldPredicate.isSameAsPrimary ? undefined : fieldPredicate.predicate
 	}
 }

package/tests/cases/unit/permissionMerger.test.ts

@@ -11,6 +11,13 @@ interface Test {
 	result: Acl.Permissions
 }
 
+interface ContextualTest {
+	acl: Acl.Schema
+	roles: string[]
+	rootResult: Acl.Permissions
+	allResult: Acl.Permissions
+}
+
 const execute = (test: Test) => {
 	const model: Model.Schema = new SchemaBuilder()
 		.entity('Entity1', e => e.column('lorem').column('bar'))
@@ -27,6 +34,21 @@ const execute = (test: Test) => {
 	assert.deepStrictEqual(test.acl, initialAcl)
 }
 
+const executeContextual = (test: ContextualTest) => {
+	const model: Model.Schema = new SchemaBuilder()
+		.entity('Entity1', e => e.column('lorem').column('bar'))
+		.entity('Entity2', e => e.oneHasOne('xyz', r => r.target('Entity1')))
+		.buildSchema()
+	const factory = new PermissionFactory()
+	const { root, all } = factory.createContextual({
+		...emptySchema,
+		model,
+		acl: test.acl,
+	}, test.roles)
+	assert.deepStrictEqual(root, test.rootResult)
+	assert.deepStrictEqual(all, test.allResult)
+}
+
 describe('Permission merger', () => {
 	it('merge inheritance', () => {
 		execute({
@@ -845,3 +867,143 @@ describe('Permission merger', () => {
 		})
 	})
 })
+
+describe('Contextual permission merger', () => {
+	it('createContextual: root drops through-only, all includes both', () => {
+		executeContextual({
+			acl: {
+				roles: {
+					throughRole: {
+						variables: {},
+						entities: {
+							Entity2: {
+								predicates: {
+									foo: { xyz: { lorem: { eq: 'through' } } },
+								},
+								operations: {
+									read: {
+										title: 'foo',
+									},
+									noRoot: ['read'],
+								},
+							},
+						},
+					},
+					rootRole: {
+						variables: {},
+						entities: {
+							Entity2: {
+								predicates: {
+									bar: { xyz: { lorem: { eq: 'root' } } },
+								},
+								operations: {
+									read: {
+										title: 'bar',
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			roles: ['throughRole', 'rootRole'],
+			rootResult: {
+				Entity2: {
+					operations: {
+						read: {
+							title: 'bar',
+							id: 'bar',
+						},
+					},
+					predicates: {
+						bar: {
+							xyz: {
+								lorem: { eq: 'root' },
+							},
+						},
+					},
+				},
+			},
+			allResult: {
+				Entity2: {
+					operations: {
+						read: {
+							title: '__merge__foo__bar',
+							id: '__merge__foo__bar',
+						},
+					},
+					predicates: {
+						__merge__foo__bar: {
+							or: [
+								{ xyz: { lorem: { eq: 'through' } } },
+								{ xyz: { lorem: { eq: 'root' } } },
+							],
+						},
+					},
+				},
+			},
+		})
+	})
+
+	it('createContextual: both roles without noRoot produce same root and all', () => {
+		executeContextual({
+			acl: {
+				roles: {
+					role1: {
+						variables: {},
+						entities: {
+							Entity1: {
+								predicates: {},
+								operations: {
+									read: {
+										id: true,
+										lorem: true,
+									},
+								},
+							},
+						},
+					},
+					role2: {
+						variables: {},
+						entities: {
+							Entity1: {
+								predicates: {},
+								operations: {
+									read: {
+										id: true,
+										bar: true,
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			roles: ['role1', 'role2'],
+			rootResult: {
+				Entity1: {
+					predicates: {},
+					operations: {
+						read: {
+							id: true,
+							lorem: true,
+							bar: true,
+						},
+					},
+				},
+			},
+			allResult: {
+				Entity1: {
+					predicates: {},
+					operations: {
+						read: {
+							id: true,
+							lorem: true,
+							bar: true,
+						},
+					},
+				},
+			},
+		})
+	})
+})