@contember/engine-content-api 2.1.0-beta.1 → 2.2.0-alpha.1

package/dist/types/types.d.ts

@@ -1,6 +1,6 @@
 import { Acl } from '@contember/schema';
 import { Client } from '@contember/database';
-import { ExecutionContainer } from './ExecutionContainer';
+import { ExecutionContainer } from './ExecutionContainer.js';
 export interface Context {
     db: Client;
     identityVariables: Acl.VariablesMap;

package/dist/types/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAEzD,MAAM,WAAW,OAAO;IACvB,EAAE,EAAE,MAAM,CAAA;IACV,iBAAiB,EAAE,GAAG,CAAC,YAAY,CAAA;IACnC,kBAAkB,EAAE,kBAAkB,CAAA;IACtC,KAAK,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;CAC3C"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAE5D,MAAM,WAAW,OAAO;IACvB,EAAE,EAAE,MAAM,CAAA;IACV,iBAAiB,EAAE,GAAG,CAAC,YAAY,CAAA;IACnC,kBAAkB,EAAE,kBAAkB,CAAA;IACtC,KAAK,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;CAC3C"}

package/dist/types/utils/accessor.d.ts

@@ -1,4 +1,4 @@
-import { Interface } from './Interface';
+import { Interface } from './Interface.js';
 export declare class Accessor<T> {
     private val;
     get(): Interface<T>;

package/dist/types/utils/accessor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"accessor.d.ts","sourceRoot":"","sources":["../../../src/utils/accessor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEvC,qBAAa,QAAQ,CAAC,CAAC;IACtB,OAAO,CAAC,GAAG,CAAe;IAE1B,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC;IAQnB,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI;CAG5B"}
+{"version":3,"file":"accessor.d.ts","sourceRoot":"","sources":["../../../src/utils/accessor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1C,qBAAa,QAAQ,CAAC,CAAC;IACtB,OAAO,CAAC,GAAG,CAAe;IAE1B,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC;IAQnB,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI;CAG5B"}

package/dist/types/utils/index.d.ts

@@ -1,14 +1,14 @@
-export * from './accessor';
-export * from './assertNever';
-export * from './Interface';
-export * from './isIt';
-export * from './Mutex';
-export * from './object';
-export * from './paginationUtils';
-export * from './promises';
-export * from './ResolveInfoUtils';
-export * from './singletonFactory';
-export * from './strings';
-export * from './tuple';
-export * from './uniqueWhereFields';
+export * from './accessor.js';
+export * from './assertNever.js';
+export * from './Interface.js';
+export * from './isIt.js';
+export * from './Mutex.js';
+export * from './object.js';
+export * from './paginationUtils.js';
+export * from './promises.js';
+export * from './ResolveInfoUtils.js';
+export * from './singletonFactory.js';
+export * from './strings.js';
+export * from './tuple.js';
+export * from './uniqueWhereFields.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,QAAQ,CAAA;AACtB,cAAc,SAAS,CAAA;AACvB,cAAc,UAAU,CAAA;AACxB,cAAc,mBAAmB,CAAA;AACjC,cAAc,YAAY,CAAA;AAC1B,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,WAAW,CAAA;AACzB,cAAc,SAAS,CAAA;AACvB,cAAc,qBAAqB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAA;AAC7B,cAAc,kBAAkB,CAAA;AAChC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,WAAW,CAAA;AACzB,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,sBAAsB,CAAA;AACpC,cAAc,eAAe,CAAA;AAC7B,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,wBAAwB,CAAA"}

package/dist/types/utils/paginationUtils.d.ts

@@ -1,4 +1,4 @@
-import { ObjectNode } from '../inputProcessing';
+import { ObjectNode } from '../inputProcessing/index.js';
 import { Input } from '@contember/schema';
 export declare class PaginationHelper {
     readonly pageInfoField: ObjectNode | undefined;

package/dist/types/utils/paginationUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paginationUtils.d.ts","sourceRoot":"","sources":["../../../src/utils/paginationUtils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAC/C,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAEzC,qBAAa,gBAAgB;aAEX,aAAa,EAAE,UAAU,GAAG,SAAS;aACrC,SAAS,EAAE,UAAU,GAAG,SAAS;gBADjC,aAAa,EAAE,UAAU,GAAG,SAAS,EACrC,SAAS,EAAE,UAAU,GAAG,SAAS;IAGlD,IAAI,kBAAkB,YAErB;IAED,IAAI,aAAa,YAEhB;IAEM,cAAc,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,GAAG;CAc9E;AACD,eAAO,MAAM,sBAAsB,GAAI,UAAU,UAAU,CAAC,KAAK,CAAC,oBAAoB,CAAC,qBAmBtF,CAAA"}
+{"version":3,"file":"paginationUtils.d.ts","sourceRoot":"","sources":["../../../src/utils/paginationUtils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAA;AACxD,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAEzC,qBAAa,gBAAgB;aAEX,aAAa,EAAE,UAAU,GAAG,SAAS;aACrC,SAAS,EAAE,UAAU,GAAG,SAAS;gBADjC,aAAa,EAAE,UAAU,GAAG,SAAS,EACrC,SAAS,EAAE,UAAU,GAAG,SAAS;IAGlD,IAAI,kBAAkB,YAErB;IAED,IAAI,aAAa,YAEhB;IAEM,cAAc,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,GAAG;CAc9E;AACD,eAAO,MAAM,sBAAsB,GAAI,UAAU,UAAU,CAAC,KAAK,CAAC,oBAAoB,CAAC,qBAmBtF,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contember/engine-content-api",
-  "version": "2.1.0-beta.1",
+  "version": "2.2.0-alpha.1",
   "license": "Apache-2.0",
   "main": "./dist/production/index.js",
   "typings": "./dist/types/index.d.ts",
@@ -26,18 +26,17 @@
     "generate": "gql-gen --config graphql.codegen.yml"
   },
   "dependencies": {
-    "@contember/database": "2.1.0-beta.1",
-    "@contember/dic": "2.1.0-beta.1",
-    "@contember/graphql-utils": "2.1.0-beta.1",
-    "@contember/logger": "2.1.0-beta.1",
-    "@contember/schema": "2.1.0-beta.1",
-    "@contember/schema-definition": "2.1.0-beta.1",
-    "@contember/schema-utils": "2.1.0-beta.1",
+    "@contember/database": "2.1.0-beta.2",
+    "@contember/dic": "2.1.0-beta.2",
+    "@contember/graphql-utils": "2.1.0-beta.2",
+    "@contember/logger": "2.1.0-beta.2",
+    "@contember/schema": "2.1.0-beta.2",
+    "@contember/schema-definition": "2.1.0-beta.2",
+    "@contember/schema-utils": "2.1.0-beta.2",
     "fast-deep-equal": "^3.1.3"
   },
   "devDependencies": {
-    "@contember/database-tester": "2.1.0-beta.1",
-    "@contember/schema-definition": "2.1.0-beta.1",
+    "@contember/database-tester": "2.1.0-beta.2",
     "@types/node": "^24.12.0",
     "graphql": "^16.13.1",
     "pg": "^8.20.0"

package/src/ExecutionContainer.ts

@@ -1,7 +1,15 @@
-import { PredicateFactory, PredicatesInjector, VariableInjector } from './acl'
-import { ConditionBuilder, FieldsVisitorFactory, JoinBuilder, MetaHandler, OrderByBuilder, RelationFetcher, WhereBuilder } from './mapper/select'
-import { UniqueWhereExpander } from './inputProcessing'
-import { HasManyToHasOneReducer, HasManyToHasOneReducerExecutionHandler } from './extensions'
+import { PredicateFactory, PredicatesInjector, VariableInjector } from './acl/index.js'
+import {
+	ConditionBuilder,
+	FieldsVisitorFactory,
+	JoinBuilder,
+	MetaHandler,
+	OrderByBuilder,
+	RelationFetcher,
+	WhereBuilder,
+} from './mapper/select/index.js'
+import { UniqueWhereExpander } from './inputProcessing/index.js'
+import { HasManyToHasOneReducer, HasManyToHasOneReducerExecutionHandler } from './extensions/index.js'
 import {
 	DeleteExecutor,
 	InsertBuilderFactory,
@@ -16,16 +24,16 @@ import {
 	SelectHydrator,
 	UpdateBuilderFactory,
 	Updater,
-} from './mapper'
+} from './mapper/index.js'
 import { Builder } from '@contember/dic'
 import { Acl, Model, Schema } from '@contember/schema'
 import { Client, DatabaseMetadata, SelectBuilder as DbSelectBuilder } from '@contember/database'
 import { ParsedMembership, Providers } from '@contember/schema-utils'
-import { PaginatedHasManyExecutionHandler } from './extensions/paginatedHasMany/PaginatedHasManyExecutionHandler'
-import { PaginatedHasManyFieldProvider } from './extensions/paginatedHasMany/PaginatedHasManyFieldProvider'
-import { WhereOptimizer, WhereOptimizerOptions } from './mapper/select/optimizer/WhereOptimizer'
-import { ConditionOptimizer } from './mapper/select/optimizer/ConditionOptimizer'
-import { GraphQlQueryAstFactory, MutationResolver, ReadResolver, ValidationResolver } from './resolvers'
+import { PaginatedHasManyExecutionHandler } from './extensions/paginatedHasMany/PaginatedHasManyExecutionHandler.js'
+import { PaginatedHasManyFieldProvider } from './extensions/paginatedHasMany/PaginatedHasManyFieldProvider.js'
+import { WhereOptimizer, WhereOptimizerOptions } from './mapper/select/optimizer/WhereOptimizer.js'
+import { ConditionOptimizer } from './mapper/select/optimizer/ConditionOptimizer.js'
+import { GraphQlQueryAstFactory, MutationResolver, ReadResolver, ValidationResolver } from './resolvers/index.js'
 import {
 	ColumnValueResolver,
 	DependencyCollector,
@@ -33,8 +41,34 @@ import {
 	InputPreValidator,
 	QueryAstFactory,
 	ValidationDataSelector,
-} from './input-validation'
-import { RefreshViewResolver } from './resolvers/RefreshViewResolver'
+} from './input-validation/index.js'
+import { RefreshViewResolver } from './resolvers/RefreshViewResolver.js'
+
+export interface TriggeredActionEvent {
+	id: string
+	trigger: string
+	target: string
+	transactionId: string
+}
+
+export interface TriggeredActionsCollector {
+	add(events: readonly TriggeredActionEvent[]): void
+	getEvents(): readonly TriggeredActionEvent[]
+}
+
+export class InMemoryTriggeredActionsCollector implements TriggeredActionsCollector {
+	private events: TriggeredActionEvent[] = []
+
+	add(events: readonly TriggeredActionEvent[]): void {
+		for (const event of events) {
+			this.events.push(event)
+		}
+	}
+
+	getEvents(): readonly TriggeredActionEvent[] {
+		return this.events
+	}
+}
 
 export type ExecutionContainerArgs = {
 	schema: Schema
@@ -44,6 +78,7 @@ export type ExecutionContainerArgs = {
 	identityId: string
 	identityVariables: Acl.VariablesMap
 	permissions: Acl.Permissions
+	allPermissions?: Acl.Permissions
 	systemSchema: string
 	project: { slug: string }
 	stage: { id: string; slug: string }
@@ -55,6 +90,7 @@ export interface ExecutionContainer {
 	mutationResolver: MutationResolver
 	validationResolver: ValidationResolver
 	refreshViewResolver: RefreshViewResolver
+	triggeredActionsCollector: TriggeredActionsCollector | undefined
 }
 
 export type ExecutionContainerBuilder = ReturnType<ExecutionContainerFactory['createBuilderInternal']>
@@ -75,21 +111,40 @@ export class ExecutionContainerFactory {
 	}
 
 	createBuilderInternal(
-		{ permissions, identityVariables, identityId, db, schema, schemaMeta, systemSchema, stage, project, schemaDatabaseMetadata, userInfo }:
-			ExecutionContainerArgs,
+		{
+			permissions,
+			allPermissions,
+			identityVariables,
+			identityId,
+			db,
+			schema,
+			schemaMeta,
+			systemSchema,
+			stage,
+			project,
+			schemaDatabaseMetadata,
+			userInfo,
+		}: ExecutionContainerArgs,
 	) {
 		return new Builder({})
 			.addService('systemSchema', () => systemSchema)
 			.addService('db', () => db)
 			.addService('project', () => project)
 			.addService('stage', () => stage)
+			.addService('triggeredActionsCollector', (): TriggeredActionsCollector | undefined =>
+				schema.settings.actions?.returnTriggeredActions === true
+					? new InMemoryTriggeredActionsCollector()
+					: undefined)
 			.addService('schema', () => schema)
 			.addService('schemaMeta', () => schemaMeta)
 			.addService('schemaDatabaseMetadata', () => schemaDatabaseMetadata)
 			.addService('userInfo', () => userInfo)
 			.addService('providers', () => this.providers)
 			.addService('variableInjector', ({ schema }) => new VariableInjector(schema.model, identityVariables))
-			.addService('predicateFactory', ({ variableInjector, schema }) => new PredicateFactory(permissions, schema.model, variableInjector))
+			.addService(
+				'predicateFactory',
+				({ variableInjector, schema }) => new PredicateFactory(permissions, schema.model, variableInjector, allPermissions),
+			)
 			.addService('predicatesInjector', ({ predicateFactory, schema }) => new PredicatesInjector(schema.model, predicateFactory))
 			.addService('joinBuilder', ({ schema }) => new JoinBuilder(schema.model))
 			.addService('conditionBuilder', () => new ConditionBuilder())
@@ -232,6 +287,12 @@ export class ExecutionContainerFactory {
 	}
 
 	public create(args: ExecutionContainerArgs): ExecutionContainer {
-		return this.createBuilder(args).build().pick('validationResolver', 'readResolver', 'mutationResolver', 'refreshViewResolver')
+		return this.createBuilder(args).build().pick(
+			'validationResolver',
+			'readResolver',
+			'mutationResolver',
+			'refreshViewResolver',
+			'triggeredActionsCollector',
+		)
 	}
 }

package/src/acl/EvaluatedPredicateReplacer.ts

@@ -1,5 +1,5 @@
 import { Input, Model, Writable } from '@contember/schema'
-import { replaceWhere } from '../mapper/select/optimizer/WhereReplacer'
+import { replaceWhere } from '../mapper/select/optimizer/WhereReplacer.js'
 
 export class EvaluatedPredicateReplacer {
 	constructor(

package/src/acl/PermissionFactory.ts

@@ -1,23 +1,39 @@
 import { Acl, Model, Schema, Writable } from '@contember/schema'
 import { getEntity, PredicateDefinitionProcessor } from '@contember/schema-utils'
-import { mapObject } from '../utils'
-import { prefixVariable } from './VariableUtils'
+import { mapObject } from '../utils/index.js'
+import { prefixVariable } from './VariableUtils.js'
 
 export interface Identity {
 	projectRoles: readonly string[]
 }
 
+export interface ContextualPermissions {
+	root: Acl.Permissions
+	all: Acl.Permissions
+}
+
 export class PermissionFactory {
 	public create(schema: Schema, roles: readonly string[], prefix?: string): Acl.Permissions {
+		return this.createInternal(schema, roles, false, prefix)
+	}
+
+	public createContextual(schema: Schema, roles: readonly string[]): ContextualPermissions {
+		return {
+			root: this.createInternal(schema, roles, false),
+			all: this.createInternal(schema, roles, true),
+		}
+	}
+
+	private createInternal(schema: Schema, roles: readonly string[], includeThrough: boolean, prefix?: string): Acl.Permissions {
 		let result: Acl.Permissions = {}
 		for (let role of roles) {
 			const roleDefinition = schema.acl.roles[role] || { entities: {} }
 			let rolePermissions: Acl.Permissions = this.prefixPredicatesWithRole(schema.model, roleDefinition.entities, prefix || role)
 			if (roleDefinition.inherits) {
-				const inheritedPermissions = this.create(schema, roleDefinition.inherits, prefix || role)
-				rolePermissions = this.mergePermissions(inheritedPermissions, rolePermissions)
+				const inheritedPermissions = this.createInternal(schema, roleDefinition.inherits, includeThrough, prefix || role)
+				rolePermissions = this.mergePermissions(inheritedPermissions, rolePermissions, includeThrough)
 			}
-			result = this.mergePermissions(result, rolePermissions)
+			result = this.mergePermissions(result, rolePermissions, includeThrough)
 		}
 		result = this.makePrimaryPredicatesUnionOfAllFields(schema.model, result)
 
@@ -98,11 +114,11 @@ export class PermissionFactory {
 		})
 	}
 
-	private mergePermissions(left: Acl.Permissions, right: Acl.Permissions): Acl.Permissions {
+	private mergePermissions(left: Acl.Permissions, right: Acl.Permissions, includeThrough = false): Acl.Permissions {
 		const result = { ...left }
 		for (let entityName in right) {
 			if (result[entityName] !== undefined) {
-				result[entityName] = this.mergeEntityPermissions(result[entityName], right[entityName])
+				result[entityName] = this.mergeEntityPermissions(result[entityName], right[entityName], includeThrough)
 			} else {
 				result[entityName] = right[entityName]
 			}
@@ -110,7 +126,7 @@ export class PermissionFactory {
 		return result
 	}
 
-	private mergeEntityPermissions(left: Acl.EntityPermissions, right: Acl.EntityPermissions): Acl.EntityPermissions {
+	private mergeEntityPermissions(left: Acl.EntityPermissions, right: Acl.EntityPermissions, includeThrough = false): Acl.EntityPermissions {
 		let predicates: Writable<Acl.PredicateMap> = {}
 		const operations: Writable<Acl.EntityOperations> = {}
 		if (left.operations.customPrimary || right.operations.customPrimary) {
@@ -125,7 +141,12 @@ export class PermissionFactory {
 				'update',
 			] as const
 		) {
-			const { predicates: opPredicates, permissions: fieldPermissions, noRoot: opNoRoot } = this.mergeOperationPermissions(left, right, operation)
+			const { predicates: opPredicates, permissions: fieldPermissions, noRoot: opNoRoot } = this.mergeOperationPermissions(
+				left,
+				right,
+				operation,
+				includeThrough,
+			)
 
 			if (opNoRoot) {
 				noRoot.push(operation)
@@ -137,7 +158,7 @@ export class PermissionFactory {
 			}
 		}
 
-		const { predicateDefinition, predicate, noRoot: opNoRoot } = this.mergeDeletePermissions(left, right)
+		const { predicateDefinition, predicate, noRoot: opNoRoot } = this.mergeDeletePermissions(left, right, includeThrough)
 		if (opNoRoot) {
 			noRoot.push('delete')
 		}
@@ -158,12 +179,17 @@ export class PermissionFactory {
 		}
 	}
 
-	private mergeOperationPermissions(left: Acl.EntityPermissions, right: Acl.EntityPermissions, operation: 'create' | 'read' | 'update'): {
+	private mergeOperationPermissions(
+		left: Acl.EntityPermissions,
+		right: Acl.EntityPermissions,
+		operation: 'create' | 'read' | 'update',
+		includeThrough = false,
+	): {
 		noRoot: boolean
 		predicates: Acl.PredicateMap
 		permissions: Acl.FieldPermissions
 	} {
-		const { noRoot, leftPermissions, rightPermissions } = this.resolveNoRoot(left, right, operation)
+		const { noRoot, leftPermissions, rightPermissions } = this.resolveNoRoot(left, right, operation, includeThrough)
 		return {
 			noRoot,
 			...this.mergeFieldPermissions(
@@ -175,12 +201,12 @@ export class PermissionFactory {
 		}
 	}
 
-	private mergeDeletePermissions(left: Acl.EntityPermissions, right: Acl.EntityPermissions): {
+	private mergeDeletePermissions(left: Acl.EntityPermissions, right: Acl.EntityPermissions, includeThrough = false): {
 		noRoot: boolean
 		predicate: Acl.PredicateReference | boolean
 		predicateDefinition: Acl.PredicateDefinition | undefined
 	} {
-		const { noRoot, leftPermissions, rightPermissions } = this.resolveNoRoot(left, right, 'delete')
+		const { noRoot, leftPermissions, rightPermissions } = this.resolveNoRoot(left, right, 'delete', includeThrough)
 
 		return {
 			noRoot,
@@ -193,7 +219,12 @@ export class PermissionFactory {
 		}
 	}
 
-	private resolveNoRoot<const Op extends `${Acl.Operation}`>(left: Acl.EntityPermissions, right: Acl.EntityPermissions, operation: Op): {
+	private resolveNoRoot<const Op extends `${Acl.Operation}`>(
+		left: Acl.EntityPermissions,
+		right: Acl.EntityPermissions,
+		operation: Op,
+		includeThrough = false,
+	): {
 		noRoot: boolean
 		leftPermissions: Acl.EntityPermissions['operations'][Op] | undefined
 		rightPermissions: Acl.EntityPermissions['operations'][Op] | undefined
@@ -207,8 +238,10 @@ export class PermissionFactory {
 			|| (leftRootForbidden && !rightPermissions)
 			|| (rightRootForbidden && !leftPermissions)
 
-		const resolvedLeftPermissions = !rootForbidden && leftRootForbidden ? undefined : leftPermissions
-		const resolvedRightPermissions = !rootForbidden && rightRootForbidden ? undefined : rightPermissions
+		// When includeThrough is true, keep all permissions regardless of noRoot
+		// (used for "all" permissions that apply when accessing through relations)
+		const resolvedLeftPermissions = !includeThrough && !rootForbidden && leftRootForbidden ? undefined : leftPermissions
+		const resolvedRightPermissions = !includeThrough && !rootForbidden && rightRootForbidden ? undefined : rightPermissions
 
 		return {
 			noRoot: rootForbidden,

package/src/acl/PredicateFactory.ts

@@ -1,6 +1,6 @@
 import { Acl, Input, Model } from '@contember/schema'
-import { VariableInjector } from './VariableInjector'
-import { EvaluatedPredicateReplacer } from './EvaluatedPredicateReplacer'
+import { VariableInjector } from './VariableInjector.js'
+import { EvaluatedPredicateReplacer } from './EvaluatedPredicateReplacer.js'
 
 const getRowLevelPredicatePseudoField = (entity: Model.Entity) => entity.primary
 
@@ -14,14 +14,32 @@ export class PredicateFactory {
 		private readonly permissions: Acl.Permissions,
 		private readonly model: Model.Schema,
 		private readonly variableInjector: VariableInjector,
+		private readonly allPermissions?: Acl.Permissions,
 	) {}
 
+	/**
+	 * Selects the appropriate permission set based on query context:
+	 * - `isRoot === false` (nested/relation context): uses allPermissions (includes through-only permissions)
+	 * - `isRoot === true` or `isRoot === undefined` (root or unknown context): uses root-only permissions
+	 *
+	 * The `undefined` vs `true` distinction matters: `undefined` is the default for callers
+	 * that don't track root context, and must fall through to root permissions for safety.
+	 */
+	private getPermissionsForContext(isRoot?: boolean): Acl.Permissions {
+		if (isRoot === false && this.allPermissions) {
+			return this.allPermissions
+		}
+		return this.permissions
+	}
+
 	public getFieldPredicate(
 		entity: Model.Entity,
 		operation: Acl.Operation.update | Acl.Operation.read | Acl.Operation.create,
 		fieldName: string,
+		isRoot?: boolean,
 	): FieldRequiredPredicate {
-		const permissions = this.permissions[entity.name]?.operations?.[operation]
+		const perms = this.getPermissionsForContext(isRoot)
+		const permissions = perms[entity.name]?.operations?.[operation]
 		const predicate = permissions?.[fieldName] ?? false
 		const rowLevelField = getRowLevelPredicatePseudoField(entity)
 
@@ -38,12 +56,15 @@ export class PredicateFactory {
 		entity: Model.Entity,
 		operation: Acl.Operation.read,
 		fieldName: string,
+		isRoot?: boolean,
 	): boolean {
+		const perms = this.getPermissionsForContext(isRoot)
 		const rowLevelField = getRowLevelPredicatePseudoField(entity)
-		const permissions = this.permissions[entity.name]?.operations?.[operation]
+		const permissions = perms[entity.name]?.operations?.[operation]
 		return permissions?.[fieldName] !== permissions?.[rowLevelField]
 	}
 
+	/** Delete predicates are not context-aware — through-permission support is scoped to read operations only. */
 	public createDeletePredicate(entity: Model.Entity) {
 		const neverCondition: Input.Where = { [entity.primary]: { never: true } }
 		const entityPermissions = this.permissions[entity.name]
@@ -65,8 +86,10 @@ export class PredicateFactory {
 		operation: Acl.Operation.update | Acl.Operation.read | Acl.Operation.create,
 		fieldNames: string[] = [getRowLevelPredicatePseudoField(entity)],
 		relationContext?: Model.AnyRelationContext,
+		isRoot?: boolean,
 	): Input.OptionalWhere {
-		const entityPermissions: Acl.EntityPermissions = this.permissions[entity.name]
+		const perms = this.getPermissionsForContext(isRoot)
+		const entityPermissions: Acl.EntityPermissions = perms[entity.name]
 		const neverCondition: Input.Where = { [entity.primary]: { never: true } }
 
 		if (!entityPermissions) {
@@ -85,11 +108,17 @@ export class PredicateFactory {
 			return neverCondition
 		}
 
-		return this.buildPredicates(entity, operationPredicates, relationContext)
+		return this.buildPredicates(entity, operationPredicates, relationContext, isRoot)
 	}
 
-	public buildPredicates(entity: Model.Entity, predicates: Acl.PredicateReference[], relationContext?: Model.AnyRelationContext): Input.OptionalWhere {
-		const entityPermissions: Acl.EntityPermissions = this.permissions[entity.name] ?? {}
+	public buildPredicates(
+		entity: Model.Entity,
+		predicates: Acl.PredicateReference[],
+		relationContext?: Model.AnyRelationContext,
+		isRoot?: boolean,
+	): Input.OptionalWhere {
+		const perms = this.getPermissionsForContext(isRoot)
+		const entityPermissions: Acl.EntityPermissions = perms[entity.name] ?? {}
 
 		const predicatesWhere: Input.Where[] = predicates.reduce(
 			(result: Input.Where[], name: Acl.PredicateReference): Input.Where[] => {
@@ -105,7 +134,7 @@ export class PredicateFactory {
 			return {}
 		}
 		const where: Input.Where = predicatesWhere.length === 1 ? predicatesWhere[0] : { and: predicatesWhere }
-		return this.optimizePredicates(where, relationContext)
+		return this.optimizePredicates(where, relationContext, isRoot)
 	}
 
 	private getRequiredPredicates(
@@ -128,11 +157,11 @@ export class PredicateFactory {
 		return predicates
 	}
 
-	public optimizePredicates(where: Input.OptionalWhere, relationContext?: Model.AnyRelationContext) {
+	public optimizePredicates(where: Input.OptionalWhere, relationContext?: Model.AnyRelationContext, isRoot?: boolean) {
 		if (!relationContext || !relationContext.targetRelation) {
 			return where
 		}
-		const sourcePredicate = this.create(relationContext.entity, Acl.Operation.read, [relationContext.relation.name])
+		const sourcePredicate = this.create(relationContext.entity, Acl.Operation.read, [relationContext.relation.name], undefined, isRoot)
 		if (Object.keys(sourcePredicate).length === 0) {
 			return where
 		}