@depup/payload 3.79.1-depup.0

package/dist/database/queryValidation/types.d.ts

@@ -0,0 +1,24 @@
+import type { CollectionPermission, GlobalPermission } from '../../auth/index.js';
+import type { FlattenedField } from '../../fields/config/types.js';
+export type EntityPolicies = {
+    collections?: {
+        [collectionSlug: string]: CollectionPermission;
+    };
+    globals?: {
+        [globalSlug: string]: GlobalPermission;
+    };
+};
+export type PathToQuery = {
+    collectionSlug?: string;
+    complete: boolean;
+    field: FlattenedField;
+    fields?: FlattenedField[];
+    globalSlug?: string;
+    invalid?: boolean;
+    /**
+     * @todo make required in v4.0
+     */
+    parentIsLocalized: boolean;
+    path: string;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/database/queryValidation/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/database/queryValidation/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACjF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAGlE,MAAM,MAAM,cAAc,GAAG;IAC3B,WAAW,CAAC,EAAE;QACZ,CAAC,cAAc,EAAE,MAAM,GAAG,oBAAoB,CAAA;KAC/C,CAAA;IACD,OAAO,CAAC,EAAE;QACR,CAAC,UAAU,EAAE,MAAM,GAAG,gBAAgB,CAAA;KACvC,CAAA;CACF,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,EAAE,OAAO,CAAA;IACjB,KAAK,EAAE,cAAc,CAAA;IACrB,MAAM,CAAC,EAAE,cAAc,EAAE,CAAA;IACzB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;OAEG;IACH,iBAAiB,EAAE,OAAO,CAAA;IAC1B,IAAI,EAAE,MAAM,CAAA;CACb,CAAA"}

package/dist/database/queryValidation/types.js

@@ -0,0 +1,3 @@
+export { };
+
+//# sourceMappingURL=types.js.map

package/dist/database/queryValidation/types.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/database/queryValidation/types.ts"],"sourcesContent":["import type { CollectionPermission, GlobalPermission } from '../../auth/index.js'\nimport type { FlattenedField } from '../../fields/config/types.js'\n\n// TODO: Rename to EntityPermissions in 4.0\nexport type EntityPolicies = {\n  collections?: {\n    [collectionSlug: string]: CollectionPermission\n  }\n  globals?: {\n    [globalSlug: string]: GlobalPermission\n  }\n}\n\nexport type PathToQuery = {\n  collectionSlug?: string\n  complete: boolean\n  field: FlattenedField\n  fields?: FlattenedField[]\n  globalSlug?: string\n  invalid?: boolean\n  /**\n   * @todo make required in v4.0\n   */\n  parentIsLocalized: boolean\n  path: string\n}\n"],"names":[],"mappings":"AAaA,WAYC"}

package/dist/database/queryValidation/validateQueryPaths.d.ts

@@ -0,0 +1,25 @@
+import type { SanitizedCollectionConfig } from '../../collections/config/types.js';
+import type { FlattenedField } from '../../fields/config/types.js';
+import type { SanitizedGlobalConfig } from '../../globals/config/types.js';
+import type { PayloadRequest, Where } from '../../types/index.js';
+import type { EntityPolicies } from './types.js';
+type Args = {
+    errors?: {
+        path: string;
+    }[];
+    overrideAccess: boolean;
+    policies?: EntityPolicies;
+    polymorphicJoin?: boolean;
+    req: PayloadRequest;
+    versionFields?: FlattenedField[];
+    where: Where;
+} & ({
+    collectionConfig: SanitizedCollectionConfig;
+    globalConfig?: never | undefined;
+} | {
+    collectionConfig?: never | undefined;
+    globalConfig: SanitizedGlobalConfig;
+});
+export declare function validateQueryPaths({ collectionConfig, errors, globalConfig, overrideAccess, policies, polymorphicJoin, req, versionFields, where, }: Args): Promise<void>;
+export {};
+//# sourceMappingURL=validateQueryPaths.d.ts.map

package/dist/database/queryValidation/validateQueryPaths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateQueryPaths.d.ts","sourceRoot":"","sources":["../../../src/database/queryValidation/validateQueryPaths.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAClF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAClE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAC1E,OAAO,KAAK,EAAY,cAAc,EAAE,KAAK,EAAc,MAAM,sBAAsB,CAAA;AACvF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAMhD,KAAK,IAAI,GAAG;IACV,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAC3B,cAAc,EAAE,OAAO,CAAA;IAEvB,QAAQ,CAAC,EAAE,cAAc,CAAA;IACzB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,GAAG,EAAE,cAAc,CAAA;IACnB,aAAa,CAAC,EAAE,cAAc,EAAE,CAAA;IAChC,KAAK,EAAE,KAAK,CAAA;CACb,GAAG,CACA;IACE,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,YAAY,CAAC,EAAE,KAAK,GAAG,SAAS,CAAA;CACjC,GACD;IACE,gBAAgB,CAAC,EAAE,KAAK,GAAG,SAAS,CAAA;IACpC,YAAY,EAAE,qBAAqB,CAAA;CACpC,CACJ,CAAA;AAED,wBAAsB,kBAAkB,CAAC,EACvC,gBAAgB,EAChB,MAAW,EACX,YAAY,EACZ,cAAc,EACd,QAGC,EACD,eAAe,EACf,GAAG,EACH,aAAa,EACb,KAAK,GACN,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAwEtB"}

package/dist/database/queryValidation/validateQueryPaths.js

@@ -0,0 +1,74 @@
+import { QueryError } from '../../errors/QueryError.js';
+import { validOperatorSet } from '../../types/constants.js';
+import { validateSearchParam } from './validateSearchParams.js';
+export async function validateQueryPaths({ collectionConfig, errors = [], globalConfig, overrideAccess, policies = {
+    collections: {},
+    globals: {}
+}, polymorphicJoin, req, versionFields, where }) {
+    const fields = versionFields || (globalConfig || collectionConfig).flattenedFields;
+    if (typeof where === 'object') {
+        // We need to determine if the whereKey is an AND, OR, or a schema path
+        const promises = [];
+        for(const path in where){
+            const constraint = where[path];
+            if ((path === 'and' || path === 'or') && Array.isArray(constraint)) {
+                for (const item of constraint){
+                    if (collectionConfig) {
+                        promises.push(validateQueryPaths({
+                            collectionConfig,
+                            errors,
+                            overrideAccess,
+                            policies,
+                            polymorphicJoin,
+                            req,
+                            versionFields,
+                            where: item
+                        }));
+                    } else {
+                        promises.push(validateQueryPaths({
+                            errors,
+                            globalConfig,
+                            overrideAccess,
+                            policies,
+                            polymorphicJoin,
+                            req,
+                            versionFields,
+                            where: item
+                        }));
+                    }
+                }
+            } else if (!Array.isArray(constraint)) {
+                for(const operator in constraint){
+                    const val = constraint[operator];
+                    if (validOperatorSet.has(operator)) {
+                        promises.push(validateSearchParam({
+                            collectionConfig,
+                            constraint: where,
+                            errors,
+                            fields,
+                            globalConfig,
+                            operator,
+                            overrideAccess,
+                            path,
+                            policies,
+                            polymorphicJoin,
+                            req,
+                            val,
+                            versionFields
+                        }));
+                    } else {
+                        errors.push({
+                            path: `${path}.${operator}`
+                        });
+                    }
+                }
+            }
+        }
+        await Promise.all(promises);
+        if (errors.length > 0) {
+            throw new QueryError(errors);
+        }
+    }
+}
+
+//# sourceMappingURL=validateQueryPaths.js.map

package/dist/database/queryValidation/validateQueryPaths.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/database/queryValidation/validateQueryPaths.ts"],"sourcesContent":["import type { SanitizedCollectionConfig } from '../../collections/config/types.js'\nimport type { FlattenedField } from '../../fields/config/types.js'\nimport type { SanitizedGlobalConfig } from '../../globals/config/types.js'\nimport type { Operator, PayloadRequest, Where, WhereField } from '../../types/index.js'\nimport type { EntityPolicies } from './types.js'\n\nimport { QueryError } from '../../errors/QueryError.js'\nimport { validOperatorSet } from '../../types/constants.js'\nimport { validateSearchParam } from './validateSearchParams.js'\n\ntype Args = {\n  errors?: { path: string }[]\n  overrideAccess: boolean\n  // TODO: Rename to permissions or entityPermissions in 4.0\n  policies?: EntityPolicies\n  polymorphicJoin?: boolean\n  req: PayloadRequest\n  versionFields?: FlattenedField[]\n  where: Where\n} & (\n  | {\n      collectionConfig: SanitizedCollectionConfig\n      globalConfig?: never | undefined\n    }\n  | {\n      collectionConfig?: never | undefined\n      globalConfig: SanitizedGlobalConfig\n    }\n)\n\nexport async function validateQueryPaths({\n  collectionConfig,\n  errors = [],\n  globalConfig,\n  overrideAccess,\n  policies = {\n    collections: {},\n    globals: {},\n  },\n  polymorphicJoin,\n  req,\n  versionFields,\n  where,\n}: Args): Promise<void> {\n  const fields = versionFields || (globalConfig || collectionConfig).flattenedFields\n\n  if (typeof where === 'object') {\n    // We need to determine if the whereKey is an AND, OR, or a schema path\n    const promises: Promise<void>[] = []\n    for (const path in where) {\n      const constraint = where[path]\n\n      if ((path === 'and' || path === 'or') && Array.isArray(constraint)) {\n        for (const item of constraint) {\n          if (collectionConfig) {\n            promises.push(\n              validateQueryPaths({\n                collectionConfig,\n                errors,\n                overrideAccess,\n                policies,\n                polymorphicJoin,\n                req,\n                versionFields,\n                where: item,\n              }),\n            )\n          } else {\n            promises.push(\n              validateQueryPaths({\n                errors,\n                globalConfig,\n                overrideAccess,\n                policies,\n                polymorphicJoin,\n                req,\n                versionFields,\n                where: item,\n              }),\n            )\n          }\n        }\n      } else if (!Array.isArray(constraint)) {\n        for (const operator in constraint) {\n          const val = constraint[operator as keyof typeof constraint]\n          if (validOperatorSet.has(operator as Operator)) {\n            promises.push(\n              validateSearchParam({\n                collectionConfig,\n                constraint: where as WhereField,\n                errors,\n                fields,\n                globalConfig,\n                operator,\n                overrideAccess,\n                path,\n                policies,\n                polymorphicJoin,\n                req,\n                val,\n                versionFields,\n              }),\n            )\n          } else {\n            errors.push({ path: `${path}.${operator}` })\n          }\n        }\n      }\n    }\n\n    await Promise.all(promises)\n    if (errors.length > 0) {\n      throw new QueryError(errors)\n    }\n  }\n}\n"],"names":["QueryError","validOperatorSet","validateSearchParam","validateQueryPaths","collectionConfig","errors","globalConfig","overrideAccess","policies","collections","globals","polymorphicJoin","req","versionFields","where","fields","flattenedFields","promises","path","constraint","Array","isArray","item","push","operator","val","has","Promise","all","length"],"mappings":"AAMA,SAASA,UAAU,QAAQ,6BAA4B;AACvD,SAASC,gBAAgB,QAAQ,2BAA0B;AAC3D,SAASC,mBAAmB,QAAQ,4BAA2B;AAsB/D,OAAO,eAAeC,mBAAmB,EACvCC,gBAAgB,EAChBC,SAAS,EAAE,EACXC,YAAY,EACZC,cAAc,EACdC,WAAW;IACTC,aAAa,CAAC;IACdC,SAAS,CAAC;AACZ,CAAC,EACDC,eAAe,EACfC,GAAG,EACHC,aAAa,EACbC,KAAK,EACA;IACL,MAAMC,SAASF,iBAAiB,AAACP,CAAAA,gBAAgBF,gBAAe,EAAGY,eAAe;IAElF,IAAI,OAAOF,UAAU,UAAU;QAC7B,uEAAuE;QACvE,MAAMG,WAA4B,EAAE;QACpC,IAAK,MAAMC,QAAQJ,MAAO;YACxB,MAAMK,aAAaL,KAAK,CAACI,KAAK;YAE9B,IAAI,AAACA,CAAAA,SAAS,SAASA,SAAS,IAAG,KAAME,MAAMC,OAAO,CAACF,aAAa;gBAClE,KAAK,MAAMG,QAAQH,WAAY;oBAC7B,IAAIf,kBAAkB;wBACpBa,SAASM,IAAI,CACXpB,mBAAmB;4BACjBC;4BACAC;4BACAE;4BACAC;4BACAG;4BACAC;4BACAC;4BACAC,OAAOQ;wBACT;oBAEJ,OAAO;wBACLL,SAASM,IAAI,CACXpB,mBAAmB;4BACjBE;4BACAC;4BACAC;4BACAC;4BACAG;4BACAC;4BACAC;4BACAC,OAAOQ;wBACT;oBAEJ;gBACF;YACF,OAAO,IAAI,CAACF,MAAMC,OAAO,CAACF,aAAa;gBACrC,IAAK,MAAMK,YAAYL,WAAY;oBACjC,MAAMM,MAAMN,UAAU,CAACK,SAAoC;oBAC3D,IAAIvB,iBAAiByB,GAAG,CAACF,WAAuB;wBAC9CP,SAASM,IAAI,CACXrB,oBAAoB;4BAClBE;4BACAe,YAAYL;4BACZT;4BACAU;4BACAT;4BACAkB;4BACAjB;4BACAW;4BACAV;4BACAG;4BACAC;4BACAa;4BACAZ;wBACF;oBAEJ,OAAO;wBACLR,OAAOkB,IAAI,CAAC;4BAAEL,MAAM,GAAGA,KAAK,CAAC,EAAEM,UAAU;wBAAC;oBAC5C;gBACF;YACF;QACF;QAEA,MAAMG,QAAQC,GAAG,CAACX;QAClB,IAAIZ,OAAOwB,MAAM,GAAG,GAAG;YACrB,MAAM,IAAI7B,WAAWK;QACvB;IACF;AACF"}

package/dist/database/queryValidation/validateSearchParams.d.ts

@@ -0,0 +1,29 @@
+import type { SanitizedCollectionConfig } from '../../collections/config/types.js';
+import type { FlattenedField } from '../../fields/config/types.js';
+import type { SanitizedGlobalConfig } from '../../globals/config/types.js';
+import type { PayloadRequest, WhereField } from '../../types/index.js';
+import type { EntityPolicies } from './types.js';
+type Args = {
+    collectionConfig?: SanitizedCollectionConfig;
+    constraint: WhereField;
+    errors: {
+        path: string;
+    }[];
+    fields: FlattenedField[];
+    globalConfig?: SanitizedGlobalConfig;
+    operator: string;
+    overrideAccess: boolean;
+    parentIsLocalized?: boolean;
+    path: string;
+    policies: EntityPolicies;
+    polymorphicJoin?: boolean;
+    req: PayloadRequest;
+    val: unknown;
+    versionFields?: FlattenedField[];
+};
+/**
+ * Validate the Payload key / value / operator
+ */
+export declare function validateSearchParam({ collectionConfig, constraint, errors, fields, globalConfig, operator, overrideAccess, parentIsLocalized, path: incomingPath, policies, polymorphicJoin, req, val, versionFields, }: Args): Promise<void>;
+export {};
+//# sourceMappingURL=validateSearchParams.d.ts.map

package/dist/database/queryValidation/validateSearchParams.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateSearchParams.d.ts","sourceRoot":"","sources":["../../../src/database/queryValidation/validateSearchParams.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAClF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAClE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtE,OAAO,KAAK,EAAE,cAAc,EAAe,MAAM,YAAY,CAAA;AAS7D,KAAK,IAAI,GAAG;IACV,gBAAgB,CAAC,EAAE,yBAAyB,CAAA;IAC5C,UAAU,EAAE,UAAU,CAAA;IACtB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAC1B,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,YAAY,CAAC,EAAE,qBAAqB,CAAA;IACpC,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,OAAO,CAAA;IACvB,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,IAAI,EAAE,MAAM,CAAA;IAEZ,QAAQ,EAAE,cAAc,CAAA;IACxB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,GAAG,EAAE,cAAc,CAAA;IACnB,GAAG,EAAE,OAAO,CAAA;IACZ,aAAa,CAAC,EAAE,cAAc,EAAE,CAAA;CACjC,CAAA;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,gBAAgB,EAChB,UAAU,EACV,MAAM,EACN,MAAM,EACN,YAAY,EACZ,QAAQ,EACR,cAAc,EACd,iBAAiB,EACjB,IAAI,EAAE,YAAY,EAClB,QAAQ,EACR,eAAe,EACf,GAAG,EACH,GAAG,EACH,aAAa,GACd,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAoLtB"}

package/dist/database/queryValidation/validateSearchParams.js

@@ -0,0 +1,165 @@
+import { fieldAffectsData } from '../../fields/config/types.js';
+import { SAFE_FIELD_PATH_REGEX } from '../../types/constants.js';
+import { getEntityPermissions } from '../../utilities/getEntityPermissions/getEntityPermissions.js';
+import { isolateObjectProperty } from '../../utilities/isolateObjectProperty.js';
+import { getLocalizedPaths } from '../getLocalizedPaths.js';
+import { validateQueryPaths } from './validateQueryPaths.js';
+/**
+ * Validate the Payload key / value / operator
+ */ export async function validateSearchParam({ collectionConfig, constraint, errors, fields, globalConfig, operator, overrideAccess, parentIsLocalized, path: incomingPath, policies, polymorphicJoin, req, val, versionFields }) {
+    // Replace GraphQL nested field double underscore formatting
+    let sanitizedPath;
+    if (incomingPath === '_id') {
+        sanitizedPath = 'id';
+    } else {
+        sanitizedPath = incomingPath.replace(/__/g, '.');
+    }
+    let paths = [];
+    const { slug } = collectionConfig || globalConfig;
+    const blockReferencesPermissions = {};
+    if (globalConfig && !policies.globals[slug]) {
+        policies.globals[slug] = await getEntityPermissions({
+            blockReferencesPermissions,
+            entity: globalConfig,
+            entityType: 'global',
+            fetchData: false,
+            operations: [
+                'read'
+            ],
+            req
+        });
+    }
+    if (sanitizedPath !== 'id') {
+        paths = getLocalizedPaths({
+            collectionSlug: collectionConfig?.slug,
+            fields,
+            globalSlug: globalConfig?.slug,
+            incomingPath: sanitizedPath,
+            locale: req.locale,
+            overrideAccess,
+            parentIsLocalized,
+            payload: req.payload
+        });
+    }
+    const promises = [];
+    // Sanitize relation.otherRelation.id to relation.otherRelation
+    if (paths.at(-1)?.path === 'id') {
+        const previousField = paths.at(-2)?.field;
+        if (previousField && (previousField.type === 'relationship' || previousField.type === 'upload') && typeof previousField.relationTo === 'string') {
+            paths.pop();
+        }
+    }
+    promises.push(...paths.map(async ({ collectionSlug, field, invalid, path }, i)=>{
+        if (invalid) {
+            if (!polymorphicJoin || !SAFE_FIELD_PATH_REGEX.test(incomingPath)) {
+                errors.push({
+                    path
+                });
+            }
+            return;
+        }
+        // where: { relatedPosts: { equals: 1}} -> { 'relatedPosts.id': { equals: 1}}
+        if (field.type === 'join' && path === incomingPath) {
+            constraint[`${path}.id`] = constraint[path];
+            delete constraint[path];
+        }
+        if ('virtual' in field && field.virtual) {
+            if (field.virtual === true) {
+                errors.push({
+                    path
+                });
+            }
+        }
+        if (polymorphicJoin && path === 'relationTo') {
+            return;
+        }
+        if (!overrideAccess && fieldAffectsData(field)) {
+            if (collectionSlug) {
+                if (!policies.collections[collectionSlug]) {
+                    policies.collections[collectionSlug] = await getEntityPermissions({
+                        blockReferencesPermissions,
+                        entity: req.payload.collections[collectionSlug].config,
+                        entityType: 'collection',
+                        fetchData: false,
+                        operations: [
+                            'read'
+                        ],
+                        req: isolateObjectProperty(req, 'transactionID')
+                    });
+                }
+                if ([
+                    'hash',
+                    'salt'
+                ].includes(incomingPath) && collectionConfig.auth && !collectionConfig.auth?.disableLocalStrategy) {
+                    errors.push({
+                        path: incomingPath
+                    });
+                }
+            }
+            let fieldPath = path;
+            // remove locale from end of path
+            if (path.endsWith(`.${req.locale}`)) {
+                fieldPath = path.slice(0, -(req.locale.length + 1));
+            }
+            // remove ".value" from ends of polymorphic relationship paths
+            if ((field.type === 'relationship' || field.type === 'upload') && Array.isArray(field.relationTo)) {
+                fieldPath = fieldPath.replace('.value', '');
+            }
+            const entityType = globalConfig ? 'globals' : 'collections';
+            const entitySlug = collectionSlug || globalConfig.slug;
+            const segments = fieldPath.split('.');
+            let fieldAccess;
+            if (versionFields) {
+                fieldAccess = policies[entityType][entitySlug].fields;
+                if (segments[0] === 'parent' || segments[0] === 'version' || segments[0] === 'snapshot' || segments[0] === 'latest') {
+                    segments.shift();
+                }
+            } else {
+                fieldAccess = policies[entityType][entitySlug].fields;
+            }
+            if (segments.length) {
+                segments.forEach((segment)=>{
+                    if (fieldAccess[segment]) {
+                        if ('fields' in fieldAccess[segment]) {
+                            fieldAccess = fieldAccess[segment].fields;
+                        } else {
+                            fieldAccess = fieldAccess[segment];
+                        }
+                    }
+                });
+                if (!fieldAccess?.read?.permission) {
+                    errors.push({
+                        path: fieldPath
+                    });
+                }
+            }
+        }
+        if (i > 1) {
+            // Remove top collection and reverse array
+            // to work backwards from top
+            const pathsToQuery = paths.slice(1).reverse();
+            pathsToQuery.forEach(({ collectionSlug: pathCollectionSlug, path: subPath }, pathToQueryIndex)=>{
+                // On the "deepest" collection,
+                // validate query of the relationship
+                if (pathToQueryIndex === 0) {
+                    promises.push(validateQueryPaths({
+                        collectionConfig: req.payload.collections[pathCollectionSlug].config,
+                        errors,
+                        globalConfig: undefined,
+                        overrideAccess,
+                        policies,
+                        req,
+                        where: {
+                            [subPath]: {
+                                [operator]: val
+                            }
+                        }
+                    }));
+                }
+            });
+        }
+    }));
+    await Promise.all(promises);
+}
+
+//# sourceMappingURL=validateSearchParams.js.map

package/dist/database/queryValidation/validateSearchParams.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/database/queryValidation/validateSearchParams.ts"],"sourcesContent":["import type { SanitizedCollectionConfig } from '../../collections/config/types.js'\nimport type { FlattenedField } from '../../fields/config/types.js'\nimport type { SanitizedGlobalConfig } from '../../globals/config/types.js'\nimport type { PayloadRequest, WhereField } from '../../types/index.js'\nimport type { EntityPolicies, PathToQuery } from './types.js'\n\nimport { fieldAffectsData } from '../../fields/config/types.js'\nimport { SAFE_FIELD_PATH_REGEX } from '../../types/constants.js'\nimport { getEntityPermissions } from '../../utilities/getEntityPermissions/getEntityPermissions.js'\nimport { isolateObjectProperty } from '../../utilities/isolateObjectProperty.js'\nimport { getLocalizedPaths } from '../getLocalizedPaths.js'\nimport { validateQueryPaths } from './validateQueryPaths.js'\n\ntype Args = {\n  collectionConfig?: SanitizedCollectionConfig\n  constraint: WhereField\n  errors: { path: string }[]\n  fields: FlattenedField[]\n  globalConfig?: SanitizedGlobalConfig\n  operator: string\n  overrideAccess: boolean\n  parentIsLocalized?: boolean\n  path: string\n  // TODO: Rename to permissions or entityPermissions in 4.0\n  policies: EntityPolicies\n  polymorphicJoin?: boolean\n  req: PayloadRequest\n  val: unknown\n  versionFields?: FlattenedField[]\n}\n\n/**\n * Validate the Payload key / value / operator\n */\nexport async function validateSearchParam({\n  collectionConfig,\n  constraint,\n  errors,\n  fields,\n  globalConfig,\n  operator,\n  overrideAccess,\n  parentIsLocalized,\n  path: incomingPath,\n  policies,\n  polymorphicJoin,\n  req,\n  val,\n  versionFields,\n}: Args): Promise<void> {\n  // Replace GraphQL nested field double underscore formatting\n  let sanitizedPath\n  if (incomingPath === '_id') {\n    sanitizedPath = 'id'\n  } else {\n    sanitizedPath = incomingPath.replace(/__/g, '.')\n  }\n  let paths: PathToQuery[] = []\n  const { slug } = (collectionConfig || globalConfig)!\n\n  const blockReferencesPermissions = {}\n\n  if (globalConfig && !policies.globals![slug]) {\n    policies.globals![slug] = await getEntityPermissions({\n      blockReferencesPermissions,\n      entity: globalConfig,\n      entityType: 'global',\n      fetchData: false,\n      operations: ['read'],\n      req,\n    })\n  }\n\n  if (sanitizedPath !== 'id') {\n    paths = getLocalizedPaths({\n      collectionSlug: collectionConfig?.slug,\n      fields,\n      globalSlug: globalConfig?.slug,\n      incomingPath: sanitizedPath,\n      locale: req.locale!,\n      overrideAccess,\n      parentIsLocalized,\n      payload: req.payload,\n    })\n  }\n  const promises: Promise<void>[] = []\n\n  // Sanitize relation.otherRelation.id to relation.otherRelation\n  if (paths.at(-1)?.path === 'id') {\n    const previousField = paths.at(-2)?.field\n    if (\n      previousField &&\n      (previousField.type === 'relationship' || previousField.type === 'upload') &&\n      typeof previousField.relationTo === 'string'\n    ) {\n      paths.pop()\n    }\n  }\n\n  promises.push(\n    ...paths.map(async ({ collectionSlug, field, invalid, path }, i) => {\n      if (invalid) {\n        if (!polymorphicJoin || !SAFE_FIELD_PATH_REGEX.test(incomingPath)) {\n          errors.push({ path })\n        }\n\n        return\n      }\n\n      // where: { relatedPosts: { equals: 1}} -> { 'relatedPosts.id': { equals: 1}}\n      if (field.type === 'join' && path === incomingPath) {\n        constraint[`${path}.id` as keyof WhereField] = constraint[path as keyof WhereField]\n        delete constraint[path as keyof WhereField]\n      }\n\n      if ('virtual' in field && field.virtual) {\n        if (field.virtual === true) {\n          errors.push({ path })\n        }\n      }\n\n      if (polymorphicJoin && path === 'relationTo') {\n        return\n      }\n\n      if (!overrideAccess && fieldAffectsData(field)) {\n        if (collectionSlug) {\n          if (!policies.collections![collectionSlug]) {\n            policies.collections![collectionSlug] = await getEntityPermissions({\n              blockReferencesPermissions,\n              entity: req.payload.collections[collectionSlug]!.config,\n              entityType: 'collection',\n              fetchData: false,\n              operations: ['read'],\n              req: isolateObjectProperty(req, 'transactionID'),\n            })\n          }\n\n          if (\n            ['hash', 'salt'].includes(incomingPath) &&\n            collectionConfig!.auth &&\n            !collectionConfig!.auth?.disableLocalStrategy\n          ) {\n            errors.push({ path: incomingPath })\n          }\n        }\n        let fieldPath = path\n        // remove locale from end of path\n        if (path.endsWith(`.${req.locale}`)) {\n          fieldPath = path.slice(0, -(req.locale!.length + 1))\n        }\n        // remove \".value\" from ends of polymorphic relationship paths\n        if (\n          (field.type === 'relationship' || field.type === 'upload') &&\n          Array.isArray(field.relationTo)\n        ) {\n          fieldPath = fieldPath.replace('.value', '')\n        }\n\n        const entityType: 'collections' | 'globals' = globalConfig ? 'globals' : 'collections'\n        const entitySlug = collectionSlug || globalConfig!.slug\n        const segments = fieldPath.split('.')\n\n        let fieldAccess: any\n\n        if (versionFields) {\n          fieldAccess = policies[entityType]![entitySlug]!.fields\n\n          if (\n            segments[0] === 'parent' ||\n            segments[0] === 'version' ||\n            segments[0] === 'snapshot' ||\n            segments[0] === 'latest'\n          ) {\n            segments.shift()\n          }\n        } else {\n          fieldAccess = policies[entityType]![entitySlug]!.fields\n        }\n\n        if (segments.length) {\n          segments.forEach((segment) => {\n            if (fieldAccess[segment]) {\n              if ('fields' in fieldAccess[segment]) {\n                fieldAccess = fieldAccess[segment].fields\n              } else {\n                fieldAccess = fieldAccess[segment]\n              }\n            }\n          })\n\n          if (!fieldAccess?.read?.permission) {\n            errors.push({ path: fieldPath })\n          }\n        }\n      }\n\n      if (i > 1) {\n        // Remove top collection and reverse array\n        // to work backwards from top\n        const pathsToQuery = paths.slice(1).reverse()\n\n        pathsToQuery.forEach(\n          ({ collectionSlug: pathCollectionSlug, path: subPath }, pathToQueryIndex) => {\n            // On the \"deepest\" collection,\n            // validate query of the relationship\n            if (pathToQueryIndex === 0) {\n              promises.push(\n                validateQueryPaths({\n                  collectionConfig: req.payload.collections[pathCollectionSlug!]!.config,\n                  errors,\n                  globalConfig: undefined,\n                  overrideAccess,\n                  policies,\n                  req,\n                  where: {\n                    [subPath]: {\n                      [operator]: val,\n                    },\n                  },\n                }),\n              )\n            }\n          },\n        )\n      }\n    }),\n  )\n  await Promise.all(promises)\n}\n"],"names":["fieldAffectsData","SAFE_FIELD_PATH_REGEX","getEntityPermissions","isolateObjectProperty","getLocalizedPaths","validateQueryPaths","validateSearchParam","collectionConfig","constraint","errors","fields","globalConfig","operator","overrideAccess","parentIsLocalized","path","incomingPath","policies","polymorphicJoin","req","val","versionFields","sanitizedPath","replace","paths","slug","blockReferencesPermissions","globals","entity","entityType","fetchData","operations","collectionSlug","globalSlug","locale","payload","promises","at","previousField","field","type","relationTo","pop","push","map","invalid","i","test","virtual","collections","config","includes","auth","disableLocalStrategy","fieldPath","endsWith","slice","length","Array","isArray","entitySlug","segments","split","fieldAccess","shift","forEach","segment","read","permission","pathsToQuery","reverse","pathCollectionSlug","subPath","pathToQueryIndex","undefined","where","Promise","all"],"mappings":"AAMA,SAASA,gBAAgB,QAAQ,+BAA8B;AAC/D,SAASC,qBAAqB,QAAQ,2BAA0B;AAChE,SAASC,oBAAoB,QAAQ,+DAA8D;AACnG,SAASC,qBAAqB,QAAQ,2CAA0C;AAChF,SAASC,iBAAiB,QAAQ,0BAAyB;AAC3D,SAASC,kBAAkB,QAAQ,0BAAyB;AAoB5D;;CAEC,GACD,OAAO,eAAeC,oBAAoB,EACxCC,gBAAgB,EAChBC,UAAU,EACVC,MAAM,EACNC,MAAM,EACNC,YAAY,EACZC,QAAQ,EACRC,cAAc,EACdC,iBAAiB,EACjBC,MAAMC,YAAY,EAClBC,QAAQ,EACRC,eAAe,EACfC,GAAG,EACHC,GAAG,EACHC,aAAa,EACR;IACL,4DAA4D;IAC5D,IAAIC;IACJ,IAAIN,iBAAiB,OAAO;QAC1BM,gBAAgB;IAClB,OAAO;QACLA,gBAAgBN,aAAaO,OAAO,CAAC,OAAO;IAC9C;IACA,IAAIC,QAAuB,EAAE;IAC7B,MAAM,EAAEC,IAAI,EAAE,GAAIlB,oBAAoBI;IAEtC,MAAMe,6BAA6B,CAAC;IAEpC,IAAIf,gBAAgB,CAACM,SAASU,OAAO,AAAC,CAACF,KAAK,EAAE;QAC5CR,SAASU,OAAO,AAAC,CAACF,KAAK,GAAG,MAAMvB,qBAAqB;YACnDwB;YACAE,QAAQjB;YACRkB,YAAY;YACZC,WAAW;YACXC,YAAY;gBAAC;aAAO;YACpBZ;QACF;IACF;IAEA,IAAIG,kBAAkB,MAAM;QAC1BE,QAAQpB,kBAAkB;YACxB4B,gBAAgBzB,kBAAkBkB;YAClCf;YACAuB,YAAYtB,cAAcc;YAC1BT,cAAcM;YACdY,QAAQf,IAAIe,MAAM;YAClBrB;YACAC;YACAqB,SAAShB,IAAIgB,OAAO;QACtB;IACF;IACA,MAAMC,WAA4B,EAAE;IAEpC,+DAA+D;IAC/D,IAAIZ,MAAMa,EAAE,CAAC,CAAC,IAAItB,SAAS,MAAM;QAC/B,MAAMuB,gBAAgBd,MAAMa,EAAE,CAAC,CAAC,IAAIE;QACpC,IACED,iBACCA,CAAAA,cAAcE,IAAI,KAAK,kBAAkBF,cAAcE,IAAI,KAAK,QAAO,KACxE,OAAOF,cAAcG,UAAU,KAAK,UACpC;YACAjB,MAAMkB,GAAG;QACX;IACF;IAEAN,SAASO,IAAI,IACRnB,MAAMoB,GAAG,CAAC,OAAO,EAAEZ,cAAc,EAAEO,KAAK,EAAEM,OAAO,EAAE9B,IAAI,EAAE,EAAE+B;QAC5D,IAAID,SAAS;YACX,IAAI,CAAC3B,mBAAmB,CAACjB,sBAAsB8C,IAAI,CAAC/B,eAAe;gBACjEP,OAAOkC,IAAI,CAAC;oBAAE5B;gBAAK;YACrB;YAEA;QACF;QAEA,6EAA6E;QAC7E,IAAIwB,MAAMC,IAAI,KAAK,UAAUzB,SAASC,cAAc;YAClDR,UAAU,CAAC,GAAGO,KAAK,GAAG,CAAC,CAAqB,GAAGP,UAAU,CAACO,KAAyB;YACnF,OAAOP,UAAU,CAACO,KAAyB;QAC7C;QAEA,IAAI,aAAawB,SAASA,MAAMS,OAAO,EAAE;YACvC,IAAIT,MAAMS,OAAO,KAAK,MAAM;gBAC1BvC,OAAOkC,IAAI,CAAC;oBAAE5B;gBAAK;YACrB;QACF;QAEA,IAAIG,mBAAmBH,SAAS,cAAc;YAC5C;QACF;QAEA,IAAI,CAACF,kBAAkBb,iBAAiBuC,QAAQ;YAC9C,IAAIP,gBAAgB;gBAClB,IAAI,CAACf,SAASgC,WAAW,AAAC,CAACjB,eAAe,EAAE;oBAC1Cf,SAASgC,WAAW,AAAC,CAACjB,eAAe,GAAG,MAAM9B,qBAAqB;wBACjEwB;wBACAE,QAAQT,IAAIgB,OAAO,CAACc,WAAW,CAACjB,eAAe,CAAEkB,MAAM;wBACvDrB,YAAY;wBACZC,WAAW;wBACXC,YAAY;4BAAC;yBAAO;wBACpBZ,KAAKhB,sBAAsBgB,KAAK;oBAClC;gBACF;gBAEA,IACE;oBAAC;oBAAQ;iBAAO,CAACgC,QAAQ,CAACnC,iBAC1BT,iBAAkB6C,IAAI,IACtB,CAAC7C,iBAAkB6C,IAAI,EAAEC,sBACzB;oBACA5C,OAAOkC,IAAI,CAAC;wBAAE5B,MAAMC;oBAAa;gBACnC;YACF;YACA,IAAIsC,YAAYvC;YAChB,iCAAiC;YACjC,IAAIA,KAAKwC,QAAQ,CAAC,CAAC,CAAC,EAAEpC,IAAIe,MAAM,EAAE,GAAG;gBACnCoB,YAAYvC,KAAKyC,KAAK,CAAC,GAAG,CAAErC,CAAAA,IAAIe,MAAM,CAAEuB,MAAM,GAAG,CAAA;YACnD;YACA,8DAA8D;YAC9D,IACE,AAAClB,CAAAA,MAAMC,IAAI,KAAK,kBAAkBD,MAAMC,IAAI,KAAK,QAAO,KACxDkB,MAAMC,OAAO,CAACpB,MAAME,UAAU,GAC9B;gBACAa,YAAYA,UAAU/B,OAAO,CAAC,UAAU;YAC1C;YAEA,MAAMM,aAAwClB,eAAe,YAAY;YACzE,MAAMiD,aAAa5B,kBAAkBrB,aAAcc,IAAI;YACvD,MAAMoC,WAAWP,UAAUQ,KAAK,CAAC;YAEjC,IAAIC;YAEJ,IAAI1C,eAAe;gBACjB0C,cAAc9C,QAAQ,CAACY,WAAW,AAAC,CAAC+B,WAAW,CAAElD,MAAM;gBAEvD,IACEmD,QAAQ,CAAC,EAAE,KAAK,YAChBA,QAAQ,CAAC,EAAE,KAAK,aAChBA,QAAQ,CAAC,EAAE,KAAK,cAChBA,QAAQ,CAAC,EAAE,KAAK,UAChB;oBACAA,SAASG,KAAK;gBAChB;YACF,OAAO;gBACLD,cAAc9C,QAAQ,CAACY,WAAW,AAAC,CAAC+B,WAAW,CAAElD,MAAM;YACzD;YAEA,IAAImD,SAASJ,MAAM,EAAE;gBACnBI,SAASI,OAAO,CAAC,CAACC;oBAChB,IAAIH,WAAW,CAACG,QAAQ,EAAE;wBACxB,IAAI,YAAYH,WAAW,CAACG,QAAQ,EAAE;4BACpCH,cAAcA,WAAW,CAACG,QAAQ,CAACxD,MAAM;wBAC3C,OAAO;4BACLqD,cAAcA,WAAW,CAACG,QAAQ;wBACpC;oBACF;gBACF;gBAEA,IAAI,CAACH,aAAaI,MAAMC,YAAY;oBAClC3D,OAAOkC,IAAI,CAAC;wBAAE5B,MAAMuC;oBAAU;gBAChC;YACF;QACF;QAEA,IAAIR,IAAI,GAAG;YACT,0CAA0C;YAC1C,6BAA6B;YAC7B,MAAMuB,eAAe7C,MAAMgC,KAAK,CAAC,GAAGc,OAAO;YAE3CD,aAAaJ,OAAO,CAClB,CAAC,EAAEjC,gBAAgBuC,kBAAkB,EAAExD,MAAMyD,OAAO,EAAE,EAAEC;gBACtD,+BAA+B;gBAC/B,qCAAqC;gBACrC,IAAIA,qBAAqB,GAAG;oBAC1BrC,SAASO,IAAI,CACXtC,mBAAmB;wBACjBE,kBAAkBY,IAAIgB,OAAO,CAACc,WAAW,CAACsB,mBAAoB,CAAErB,MAAM;wBACtEzC;wBACAE,cAAc+D;wBACd7D;wBACAI;wBACAE;wBACAwD,OAAO;4BACL,CAACH,QAAQ,EAAE;gCACT,CAAC5D,SAAS,EAAEQ;4BACd;wBACF;oBACF;gBAEJ;YACF;QAEJ;IACF;IAEF,MAAMwD,QAAQC,GAAG,CAACzC;AACpB"}

package/dist/database/sanitizeJoinQuery.d.ts

@@ -0,0 +1,24 @@
+import type { SanitizedCollectionConfig } from '../collections/config/types.js';
+import type { JoinQuery, PayloadRequest } from '../types/index.js';
+type Args = {
+    collectionConfig: SanitizedCollectionConfig;
+    joins?: JoinQuery;
+    overrideAccess: boolean;
+    req: PayloadRequest;
+};
+/**
+ * * Validates `where` for each join
+ * * Combines the access result for joined collection
+ * * Combines the default join's `where`
+ */
+export declare const sanitizeJoinQuery: ({ collectionConfig, joins: joinsQuery, overrideAccess, req, }: Args) => Promise<false | Partial<{
+    [x: string]: false | {
+        count?: boolean;
+        limit?: number;
+        page?: number;
+        sort?: string;
+        where?: import("../types/index.js").Where;
+    };
+}>>;
+export {};
+//# sourceMappingURL=sanitizeJoinQuery.d.ts.map

package/dist/database/sanitizeJoinQuery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitizeJoinQuery.d.ts","sourceRoot":"","sources":["../../src/database/sanitizeJoinQuery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAiB,MAAM,gCAAgC,CAAA;AAC9F,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAQlE,KAAK,IAAI,GAAG;IACV,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,cAAc,EAAE,OAAO,CAAA;IACvB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AA0ED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,kEAK3B,IAAI;;;;;;;;GA+CN,CAAA"}

package/dist/database/sanitizeJoinQuery.js

@@ -0,0 +1,97 @@
+import { executeAccess } from '../auth/executeAccess.js';
+import { QueryError } from '../errors/QueryError.js';
+import { combineQueries } from './combineQueries.js';
+import { validateQueryPaths } from './queryValidation/validateQueryPaths.js';
+import { sanitizeWhereQuery } from './sanitizeWhereQuery.js';
+const sanitizeJoinFieldQuery = async ({ collectionSlug, errors, join, joinsQuery, overrideAccess, promises, req })=>{
+    const { joinPath } = join;
+    // TODO: fix any's in joinsQuery[joinPath]
+    if (joinsQuery[joinPath] === false) {
+        return;
+    }
+    const joinCollectionConfig = req.payload.collections[collectionSlug].config;
+    const accessResult = !overrideAccess ? await executeAccess({
+        disableErrors: true,
+        req
+    }, joinCollectionConfig.access.read) : true;
+    if (accessResult === false) {
+        ;
+        joinsQuery[joinPath] = false;
+        return;
+    }
+    if (!joinsQuery[joinPath]) {
+        ;
+        joinsQuery[joinPath] = {};
+    }
+    const joinQuery = joinsQuery[joinPath];
+    if (!joinQuery.where) {
+        joinQuery.where = {};
+    }
+    if (join.field.where) {
+        joinQuery.where = combineQueries(joinQuery.where, join.field.where);
+    }
+    promises.push(validateQueryPaths({
+        collectionConfig: joinCollectionConfig,
+        errors,
+        overrideAccess,
+        polymorphicJoin: Array.isArray(join.field.collection),
+        req,
+        // incoming where input, but we shouldn't validate generated from the access control.
+        where: joinQuery.where
+    }));
+    if (typeof accessResult === 'object') {
+        sanitizeWhereQuery({
+            fields: joinCollectionConfig.flattenedFields,
+            payload: req.payload,
+            where: accessResult
+        });
+        joinQuery.where = combineQueries(joinQuery.where, accessResult);
+    }
+};
+/**
+ * * Validates `where` for each join
+ * * Combines the access result for joined collection
+ * * Combines the default join's `where`
+ */ export const sanitizeJoinQuery = async ({ collectionConfig, joins: joinsQuery, overrideAccess, req })=>{
+    if (joinsQuery === false) {
+        return false;
+    }
+    if (!joinsQuery) {
+        joinsQuery = {};
+    }
+    const errors = [];
+    const promises = [];
+    for(const collectionSlug in collectionConfig.joins){
+        for (const join of collectionConfig.joins[collectionSlug]){
+            await sanitizeJoinFieldQuery({
+                collectionSlug,
+                errors,
+                join,
+                joinsQuery,
+                overrideAccess,
+                promises,
+                req
+            });
+        }
+    }
+    for (const join of collectionConfig.polymorphicJoins){
+        for (const collectionSlug of join.field.collection){
+            await sanitizeJoinFieldQuery({
+                collectionSlug,
+                errors,
+                join,
+                joinsQuery,
+                overrideAccess,
+                promises,
+                req
+            });
+        }
+    }
+    await Promise.all(promises);
+    if (errors.length > 0) {
+        throw new QueryError(errors);
+    }
+    return joinsQuery;
+};
+
+//# sourceMappingURL=sanitizeJoinQuery.js.map

package/dist/database/sanitizeJoinQuery.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/database/sanitizeJoinQuery.ts"],"sourcesContent":["import type { SanitizedCollectionConfig, SanitizedJoin } from '../collections/config/types.js'\nimport type { JoinQuery, PayloadRequest } from '../types/index.js'\n\nimport { executeAccess } from '../auth/executeAccess.js'\nimport { QueryError } from '../errors/QueryError.js'\nimport { combineQueries } from './combineQueries.js'\nimport { validateQueryPaths } from './queryValidation/validateQueryPaths.js'\nimport { sanitizeWhereQuery } from './sanitizeWhereQuery.js'\n\ntype Args = {\n  collectionConfig: SanitizedCollectionConfig\n  joins?: JoinQuery\n  overrideAccess: boolean\n  req: PayloadRequest\n}\n\nconst sanitizeJoinFieldQuery = async ({\n  collectionSlug,\n  errors,\n  join,\n  joinsQuery,\n  overrideAccess,\n  promises,\n  req,\n}: {\n  collectionSlug: string\n  errors: { path: string }[]\n  join: SanitizedJoin\n  joinsQuery: JoinQuery\n  overrideAccess: boolean\n  promises: Promise<void>[]\n  req: PayloadRequest\n}) => {\n  const { joinPath } = join\n\n  // TODO: fix any's in joinsQuery[joinPath]\n\n  if ((joinsQuery as any)[joinPath] === false) {\n    return\n  }\n\n  const joinCollectionConfig = req.payload.collections[collectionSlug]!.config\n\n  const accessResult = !overrideAccess\n    ? await executeAccess({ disableErrors: true, req }, joinCollectionConfig.access.read)\n    : true\n\n  if (accessResult === false) {\n    ;(joinsQuery as any)[joinPath] = false\n    return\n  }\n\n  if (!(joinsQuery as any)[joinPath]) {\n    ;(joinsQuery as any)[joinPath] = {}\n  }\n\n  const joinQuery = (joinsQuery as any)[joinPath]\n\n  if (!joinQuery.where) {\n    joinQuery.where = {}\n  }\n\n  if (join.field.where) {\n    joinQuery.where = combineQueries(joinQuery.where, join.field.where)\n  }\n\n  promises.push(\n    validateQueryPaths({\n      collectionConfig: joinCollectionConfig,\n      errors,\n      overrideAccess,\n      polymorphicJoin: Array.isArray(join.field.collection),\n      req,\n      // incoming where input, but we shouldn't validate generated from the access control.\n      where: joinQuery.where,\n    }),\n  )\n\n  if (typeof accessResult === 'object') {\n    sanitizeWhereQuery({\n      fields: joinCollectionConfig.flattenedFields,\n      payload: req.payload,\n      where: accessResult,\n    })\n    joinQuery.where = combineQueries(joinQuery.where, accessResult)\n  }\n}\n\n/**\n * * Validates `where` for each join\n * * Combines the access result for joined collection\n * * Combines the default join's `where`\n */\nexport const sanitizeJoinQuery = async ({\n  collectionConfig,\n  joins: joinsQuery,\n  overrideAccess,\n  req,\n}: Args) => {\n  if (joinsQuery === false) {\n    return false\n  }\n\n  if (!joinsQuery) {\n    joinsQuery = {}\n  }\n\n  const errors: { path: string }[] = []\n  const promises: Promise<void>[] = []\n\n  for (const collectionSlug in collectionConfig.joins) {\n    for (const join of collectionConfig.joins[collectionSlug]!) {\n      await sanitizeJoinFieldQuery({\n        collectionSlug,\n        errors,\n        join,\n        joinsQuery,\n        overrideAccess,\n        promises,\n        req,\n      })\n    }\n  }\n\n  for (const join of collectionConfig.polymorphicJoins) {\n    for (const collectionSlug of join.field.collection) {\n      await sanitizeJoinFieldQuery({\n        collectionSlug,\n        errors,\n        join,\n        joinsQuery,\n        overrideAccess,\n        promises,\n        req,\n      })\n    }\n  }\n\n  await Promise.all(promises)\n\n  if (errors.length > 0) {\n    throw new QueryError(errors)\n  }\n\n  return joinsQuery\n}\n"],"names":["executeAccess","QueryError","combineQueries","validateQueryPaths","sanitizeWhereQuery","sanitizeJoinFieldQuery","collectionSlug","errors","join","joinsQuery","overrideAccess","promises","req","joinPath","joinCollectionConfig","payload","collections","config","accessResult","disableErrors","access","read","joinQuery","where","field","push","collectionConfig","polymorphicJoin","Array","isArray","collection","fields","flattenedFields","sanitizeJoinQuery","joins","polymorphicJoins","Promise","all","length"],"mappings":"AAGA,SAASA,aAAa,QAAQ,2BAA0B;AACxD,SAASC,UAAU,QAAQ,0BAAyB;AACpD,SAASC,cAAc,QAAQ,sBAAqB;AACpD,SAASC,kBAAkB,QAAQ,0CAAyC;AAC5E,SAASC,kBAAkB,QAAQ,0BAAyB;AAS5D,MAAMC,yBAAyB,OAAO,EACpCC,cAAc,EACdC,MAAM,EACNC,IAAI,EACJC,UAAU,EACVC,cAAc,EACdC,QAAQ,EACRC,GAAG,EASJ;IACC,MAAM,EAAEC,QAAQ,EAAE,GAAGL;IAErB,0CAA0C;IAE1C,IAAI,AAACC,UAAkB,CAACI,SAAS,KAAK,OAAO;QAC3C;IACF;IAEA,MAAMC,uBAAuBF,IAAIG,OAAO,CAACC,WAAW,CAACV,eAAe,CAAEW,MAAM;IAE5E,MAAMC,eAAe,CAACR,iBAClB,MAAMV,cAAc;QAAEmB,eAAe;QAAMP;IAAI,GAAGE,qBAAqBM,MAAM,CAACC,IAAI,IAClF;IAEJ,IAAIH,iBAAiB,OAAO;;QACxBT,UAAkB,CAACI,SAAS,GAAG;QACjC;IACF;IAEA,IAAI,CAAC,AAACJ,UAAkB,CAACI,SAAS,EAAE;;QAChCJ,UAAkB,CAACI,SAAS,GAAG,CAAC;IACpC;IAEA,MAAMS,YAAY,AAACb,UAAkB,CAACI,SAAS;IAE/C,IAAI,CAACS,UAAUC,KAAK,EAAE;QACpBD,UAAUC,KAAK,GAAG,CAAC;IACrB;IAEA,IAAIf,KAAKgB,KAAK,CAACD,KAAK,EAAE;QACpBD,UAAUC,KAAK,GAAGrB,eAAeoB,UAAUC,KAAK,EAAEf,KAAKgB,KAAK,CAACD,KAAK;IACpE;IAEAZ,SAASc,IAAI,CACXtB,mBAAmB;QACjBuB,kBAAkBZ;QAClBP;QACAG;QACAiB,iBAAiBC,MAAMC,OAAO,CAACrB,KAAKgB,KAAK,CAACM,UAAU;QACpDlB;QACA,qFAAqF;QACrFW,OAAOD,UAAUC,KAAK;IACxB;IAGF,IAAI,OAAOL,iBAAiB,UAAU;QACpCd,mBAAmB;YACjB2B,QAAQjB,qBAAqBkB,eAAe;YAC5CjB,SAASH,IAAIG,OAAO;YACpBQ,OAAOL;QACT;QACAI,UAAUC,KAAK,GAAGrB,eAAeoB,UAAUC,KAAK,EAAEL;IACpD;AACF;AAEA;;;;CAIC,GACD,OAAO,MAAMe,oBAAoB,OAAO,EACtCP,gBAAgB,EAChBQ,OAAOzB,UAAU,EACjBC,cAAc,EACdE,GAAG,EACE;IACL,IAAIH,eAAe,OAAO;QACxB,OAAO;IACT;IAEA,IAAI,CAACA,YAAY;QACfA,aAAa,CAAC;IAChB;IAEA,MAAMF,SAA6B,EAAE;IACrC,MAAMI,WAA4B,EAAE;IAEpC,IAAK,MAAML,kBAAkBoB,iBAAiBQ,KAAK,CAAE;QACnD,KAAK,MAAM1B,QAAQkB,iBAAiBQ,KAAK,CAAC5B,eAAe,CAAG;YAC1D,MAAMD,uBAAuB;gBAC3BC;gBACAC;gBACAC;gBACAC;gBACAC;gBACAC;gBACAC;YACF;QACF;IACF;IAEA,KAAK,MAAMJ,QAAQkB,iBAAiBS,gBAAgB,CAAE;QACpD,KAAK,MAAM7B,kBAAkBE,KAAKgB,KAAK,CAACM,UAAU,CAAE;YAClD,MAAMzB,uBAAuB;gBAC3BC;gBACAC;gBACAC;gBACAC;gBACAC;gBACAC;gBACAC;YACF;QACF;IACF;IAEA,MAAMwB,QAAQC,GAAG,CAAC1B;IAElB,IAAIJ,OAAO+B,MAAM,GAAG,GAAG;QACrB,MAAM,IAAIrC,WAAWM;IACvB;IAEA,OAAOE;AACT,EAAC"}

package/dist/database/sanitizeWhereQuery.d.ts

@@ -0,0 +1,11 @@
+import type { FlattenedField } from '../fields/config/types.js';
+import type { Payload, Where } from '../types/index.js';
+/**
+ * Currently used only for virtual fields linked with relationships
+ */
+export declare const sanitizeWhereQuery: ({ fields, payload, where, }: {
+    fields: FlattenedField[];
+    payload: Payload;
+    where: Where;
+}) => void;
+//# sourceMappingURL=sanitizeWhereQuery.d.ts.map

package/dist/database/sanitizeWhereQuery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitizeWhereQuery.d.ts","sourceRoot":"","sources":["../../src/database/sanitizeWhereQuery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAEvD;;GAEG;AACH,eAAO,MAAM,kBAAkB,gCAI5B;IACD,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,KAAK,CAAA;CACb,SAiDA,CAAA"}

package/dist/database/sanitizeWhereQuery.js

@@ -0,0 +1,49 @@
+/**
+ * Currently used only for virtual fields linked with relationships
+ */ export const sanitizeWhereQuery = ({ fields, payload, where })=>{
+    for(const key in where){
+        const value = where[key];
+        if ([
+            'and',
+            'or'
+        ].includes(key.toLowerCase()) && Array.isArray(value)) {
+            for (const where of value){
+                sanitizeWhereQuery({
+                    fields,
+                    payload,
+                    where
+                });
+            }
+            continue;
+        }
+        const paths = key.split('.');
+        let pathHasChanged = false;
+        let currentFields = fields;
+        for(let i = 0; i < paths.length; i++){
+            const path = paths[i];
+            const field = currentFields.find((each)=>each.name === path);
+            if (!field) {
+                break;
+            }
+            if ('virtual' in field && field.virtual && typeof field.virtual === 'string') {
+                paths[i] = field.virtual;
+                pathHasChanged = true;
+            }
+            if ('flattenedFields' in field) {
+                currentFields = field.flattenedFields;
+            }
+            if ((field.type === 'relationship' || field.type === 'upload') && typeof field.relationTo === 'string') {
+                const relatedCollection = payload.collections[field.relationTo];
+                if (relatedCollection) {
+                    currentFields = relatedCollection.config.flattenedFields;
+                }
+            }
+        }
+        if (pathHasChanged) {
+            where[paths.join('.')] = where[key];
+            delete where[key];
+        }
+    }
+};
+
+//# sourceMappingURL=sanitizeWhereQuery.js.map

package/dist/database/sanitizeWhereQuery.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/database/sanitizeWhereQuery.ts"],"sourcesContent":["import type { FlattenedField } from '../fields/config/types.js'\nimport type { Payload, Where } from '../types/index.js'\n\n/**\n * Currently used only for virtual fields linked with relationships\n */\nexport const sanitizeWhereQuery = ({\n  fields,\n  payload,\n  where,\n}: {\n  fields: FlattenedField[]\n  payload: Payload\n  where: Where\n}) => {\n  for (const key in where) {\n    const value = where[key]\n\n    if (['and', 'or'].includes(key.toLowerCase()) && Array.isArray(value)) {\n      for (const where of value) {\n        sanitizeWhereQuery({ fields, payload, where })\n      }\n      continue\n    }\n\n    const paths = key.split('.')\n    let pathHasChanged = false\n\n    let currentFields = fields\n\n    for (let i = 0; i < paths.length; i++) {\n      const path = paths[i]!\n      const field = currentFields.find((each) => each.name === path)\n\n      if (!field) {\n        break\n      }\n\n      if ('virtual' in field && field.virtual && typeof field.virtual === 'string') {\n        paths[i] = field.virtual\n        pathHasChanged = true\n      }\n\n      if ('flattenedFields' in field) {\n        currentFields = field.flattenedFields\n      }\n\n      if (\n        (field.type === 'relationship' || field.type === 'upload') &&\n        typeof field.relationTo === 'string'\n      ) {\n        const relatedCollection = payload.collections[field.relationTo]\n        if (relatedCollection) {\n          currentFields = relatedCollection.config.flattenedFields\n        }\n      }\n    }\n\n    if (pathHasChanged) {\n      where[paths.join('.')] = where[key]!\n      delete where[key]\n    }\n  }\n}\n"],"names":["sanitizeWhereQuery","fields","payload","where","key","value","includes","toLowerCase","Array","isArray","paths","split","pathHasChanged","currentFields","i","length","path","field","find","each","name","virtual","flattenedFields","type","relationTo","relatedCollection","collections","config","join"],"mappings":"AAGA;;CAEC,GACD,OAAO,MAAMA,qBAAqB,CAAC,EACjCC,MAAM,EACNC,OAAO,EACPC,KAAK,EAKN;IACC,IAAK,MAAMC,OAAOD,MAAO;QACvB,MAAME,QAAQF,KAAK,CAACC,IAAI;QAExB,IAAI;YAAC;YAAO;SAAK,CAACE,QAAQ,CAACF,IAAIG,WAAW,OAAOC,MAAMC,OAAO,CAACJ,QAAQ;YACrE,KAAK,MAAMF,SAASE,MAAO;gBACzBL,mBAAmB;oBAAEC;oBAAQC;oBAASC;gBAAM;YAC9C;YACA;QACF;QAEA,MAAMO,QAAQN,IAAIO,KAAK,CAAC;QACxB,IAAIC,iBAAiB;QAErB,IAAIC,gBAAgBZ;QAEpB,IAAK,IAAIa,IAAI,GAAGA,IAAIJ,MAAMK,MAAM,EAAED,IAAK;YACrC,MAAME,OAAON,KAAK,CAACI,EAAE;YACrB,MAAMG,QAAQJ,cAAcK,IAAI,CAAC,CAACC,OAASA,KAAKC,IAAI,KAAKJ;YAEzD,IAAI,CAACC,OAAO;gBACV;YACF;YAEA,IAAI,aAAaA,SAASA,MAAMI,OAAO,IAAI,OAAOJ,MAAMI,OAAO,KAAK,UAAU;gBAC5EX,KAAK,CAACI,EAAE,GAAGG,MAAMI,OAAO;gBACxBT,iBAAiB;YACnB;YAEA,IAAI,qBAAqBK,OAAO;gBAC9BJ,gBAAgBI,MAAMK,eAAe;YACvC;YAEA,IACE,AAACL,CAAAA,MAAMM,IAAI,KAAK,kBAAkBN,MAAMM,IAAI,KAAK,QAAO,KACxD,OAAON,MAAMO,UAAU,KAAK,UAC5B;gBACA,MAAMC,oBAAoBvB,QAAQwB,WAAW,CAACT,MAAMO,UAAU,CAAC;gBAC/D,IAAIC,mBAAmB;oBACrBZ,gBAAgBY,kBAAkBE,MAAM,CAACL,eAAe;gBAC1D;YACF;QACF;QAEA,IAAIV,gBAAgB;YAClBT,KAAK,CAACO,MAAMkB,IAAI,CAAC,KAAK,GAAGzB,KAAK,CAACC,IAAI;YACnC,OAAOD,KAAK,CAACC,IAAI;QACnB;IACF;AACF,EAAC"}