@m1212e/rumble 0.25.3 → 0.26.2

package/out/index.mjs

@@ -1,15 +1,15 @@
 import { t as lazy } from "./lazy-C7IyM4M4.mjs";
-import { t as generateFromSchema } from "./generate-BAZg-eXa.mjs";
+import { t as generateFromSchema } from "./generate-BySnFVve.mjs";
 import { createRequire } from "node:module";
+import { One, aliasedTable, asc, count, desc, getTableColumns, getTableName, is, isTable, or, relationsFilterToSQL, sql } from "drizzle-orm";
 import { GraphQLError, GraphQLScalarType, GraphQLSchema, Kind, execute as defaultExecute, getOperationAST, print, subscribe as defaultSubscribe } from "graphql";
-import { EnvelopArmorPlugin } from "@escape.tech/graphql-armor";
-import { useDisableIntrospection } from "@graphql-yoga/plugin-disable-introspection";
-import { SpanStatusCode, isSpanContextValid, trace } from "@opentelemetry/api";
 import { capitalize, cloneDeep, debounce, merge, toMerged } from "es-toolkit";
-import { createPubSub, createYoga } from "graphql-yoga";
-import { One, aliasedTable, count, getTableColumns, getTableName, is, isTable, or, relationsFilterToSQL, sql } from "drizzle-orm";
+import { SpanStatusCode, isSpanContextValid, trace } from "@opentelemetry/api";
 import { ATTR_GRAPHQL_DOCUMENT, ATTR_GRAPHQL_OPERATION_NAME, ATTR_GRAPHQL_OPERATION_TYPE } from "@opentelemetry/semantic-conventions/incubating";
 import { AttributeNames, SpanNames, createOpenTelemetryWrapper } from "@pothos/tracing-opentelemetry";
+import { EnvelopArmorPlugin } from "@escape.tech/graphql-armor";
+import { useDisableIntrospection } from "@graphql-yoga/plugin-disable-introspection";
+import { createPubSub, createYoga } from "graphql-yoga";
 import { toCamelCase } from "drizzle-orm/casing";
 import { PgColumn, PgEnumColumn, PgEnumObjectColumn, PgTable, getTableConfig, isPgEnum } from "drizzle-orm/pg-core";
 import { MySqlEnumColumn, MySqlEnumObjectColumn, MySqlTable, getTableConfig as getTableConfig$1 } from "drizzle-orm/mysql-core";
@@ -42,152 +42,6 @@ var RumbleError = class extends Error {
 */
 var RumbleErrorSafe = class extends GraphQLError {};
 //#endregion
-//#region lib/helpers/asserts.ts
-/**
-*
-* Helper function to map a drizzle findFirst query result,
-* which may be optional, to a correct drizzle type.
-*
-* @throws RumbleError
-*
-* @example
-*
-* ```ts
-* schemaBuilder.queryFields((t) => {
-return {
-findFirstUser: t.drizzleField({
-type: UserRef,
-resolve: (query, root, args, ctx, info) => {
-return (
-db.query.users
-.findFirst({
-...query,
-where: (await ctx.abilities.users.filter("read")).single.where,
-})
-// note that we need to manually raise an error if the value is not found
-.then(assertFindFirstExists)
-);
-},
-}),
-};
-});
-* ```
-*/
-const assertFindFirstExists = (value) => {
-	if (!value) throw new RumbleErrorSafe("Value not found but required (findFirst)");
-	return value;
-};
-/**
-*
-* Helper function to map a drizzle findFirst query result,
-* which may be optional, to a correct drizzle type.
-*
-* @throws RumbleError
-*
-* @example
-*
-* ```ts
-schemaBuilder.mutationFields((t) => {
-return {
-updateUsername: t.drizzleField({
-type: UserRef,
-args: {
-userId: t.arg.int({ required: true }),
-newName: t.arg.string({ required: true }),
-},
-resolve: (query, root, args, ctx, info) => {
-return db
-.update(schema.users)
-.set({
-name: args.newName,
-})
-.where(
-and(
-eq(schema.users.id, args.userId),
-(await ctx.abilities.users.filter("update")).single.where
-)
-)
-.returning({ id: schema.users.id, name: schema.users.name })
-// note that we need to manually raise an error if the value is not found
-.then(assertFirstEntryExists);
-},
-}),
-};
-});
-* ```
-*/
-const assertFirstEntryExists = (value) => {
-	const v = value.at(0);
-	if (!v) throw new RumbleErrorSafe("Value not found but required (firstEntry)");
-	return v;
-};
-//#endregion
-//#region lib/helpers/mapNullFieldsToUndefined.ts
-/**
-* Helper to map null fields to undefined
-* @param obj The object to map
-* @returns The mapped object with all fields of 'null' transformed to 'undefined'
-* 
-* This becomes useful for update mutations where you do not want to pass null (unset value in db)
-* but undefined (do not touch value in db) in case of a value not beeing set in the args of said mutation
-* @example
-* ```ts
-*  updateUser: t.drizzleField({
-type: User,
-args: {
-id: t.arg.string({ required: true }),
-email: t.arg.string(),
-lastName: t.arg.string(),
-firstName: t.arg.string(),
-},
-resolve: async (query, root, args, ctx, info) => {
-const mappedArgs = mapNullFieldsToUndefined(args);
-const user = await db.transaction(async (tx) => {
-const user = await tx
-.update(schema.user)
-.set({
-
-// email: args.email ?? undefined,
-// lastName: args.lastName ?? undefined,
-// firstName: args.firstName ?? undefined,
-
-// becomes this
-
-email: mappedArgs.email,
-lastName: mappedArgs.lastName,
-firstName: mappedArgs.firstName,
-})
-.returning()
-.then(assertFirstEntryExists);
-return user;
-});
-
-pubsub.updated(user.id);
-
-return db.query.user
-.findFirst(
-query(
-(await ctx.abilities.user.filter('read')).merge(
-{
-where: { id: user.id },
-}
-1).query.single,
-),
-)
-.then(assertFindFirstExists);
-},
-}),
-* 
-* 
-* ```
-*/
-function mapNullFieldsToUndefined(obj) {
-	return Object.fromEntries(Object.entries(obj).map(([key, value]) => [key, value === null ? void 0 : value]));
-}
-//#endregion
-//#region package.json
-var version = "0.25.3";
-//#endregion
 //#region lib/helpers/tableHelpers.ts
 const indexCache = /* @__PURE__ */ new WeakMap();
 function buildIndex(db) {
@@ -321,6 +175,8 @@ function sanitizeFilterValue(value) {
 const ACTION_FLAG_KEY = "__rumble_action";
 const columnFlagKey = (group) => `__rumble_columns_${group}`;
 const columnMaskKey = Symbol.for("rumble:columnMask");
+const columnVisibilityKey = Symbol.for("rumble:columnVisibility");
+const guardInputKey = Symbol.for("rumble:guardInput");
 const resolvedFilterKey = Symbol.for("rumble:resolvedFilter");
 const requestStateKey = Symbol.for("rumble:requestState");
 //#endregion
@@ -328,6 +184,7 @@ const requestStateKey = Symbol.for("rumble:requestState");
 function createRequestState() {
 	return {
 		masked: /* @__PURE__ */ new WeakMap(),
+		hidden: /* @__PURE__ */ new WeakMap(),
 		actions: /* @__PURE__ */ new Map(),
 		filterLoaders: /* @__PURE__ */ new Map()
 	};
@@ -410,7 +267,7 @@ function createColumnAccessResolver({ db, actions }, tableSchema) {
 	const toSQL = (table, wheres) => or(...wheres.map((where) => relationsFilterToSQL(table, sanitizeFilterValue(where), tableSchema.relations, db._.relations)));
 	const uncorrelated = (table, wheres, group) => {
 		const inner = aliasedTable(tableSchema.table, `rumble_columns_${group}`);
-		return sql`${table[primaryKeyName]} in (${db.select({ pk: inner[primaryKeyName] }).from(inner).where(toSQL(inner, wheres))})`;
+		return sql`exists ${db.select({ pk: inner[primaryKeyName] }).from(inner).where(sql`${inner[primaryKeyName]} = ${table[primaryKeyName]} and (${toSQL(inner, wheres)})`)}`;
 	};
 	return function resolveColumnAccess(action, filters) {
 		const rules = filters.map((f) => ({
@@ -424,7 +281,14 @@ function createColumnAccessResolver({ db, actions }, tableSchema) {
 		if (guaranteed.size === allColumnNames.length) return {
 			columns,
 			extras: void 0,
-			mask: void 0
+			mask: void 0,
+			visibility: void 0
+		};
+		const visibility = (column) => {
+			if (guaranteed.has(column)) return true;
+			const wheres = rules.filter((rule) => rule.columns.has(column)).map((rule) => rule.where);
+			if (wheres.length === 0) return false;
+			return wheres.length === 1 ? wheres[0] : { OR: wheres };
 		};
 		const mask = {
 			guaranteed,
@@ -444,7 +308,8 @@ function createColumnAccessResolver({ db, actions }, tableSchema) {
 		return {
 			columns,
 			extras,
-			mask
+			mask,
+			visibility
 		};
 	};
 }
@@ -503,12 +368,22 @@ function createColumnMasker({ actions }, tables) {
 			const hidden = hiddenColumns(mask, matchedGroups(row, mask.flags), columnNames, primaryKey);
 			maskRow(row, mask, hidden);
 			state.masked.set(row, hidden.primaryKey);
+			state.hidden.set(row, hidden);
 		}
 	};
+	/**
+	* Whether masking hid any of the columns on the row. A hidden primary key
+	* counts for the columns it consists of.
+	*/
+	const columnsHidden = (abilities, row, columns, primaryKey) => {
+		const hidden = stateOf(abilities).hidden.get(row);
+		return !!hidden && columns.some((column) => hidden.cleared.includes(column) || hidden.primaryKey && primaryKey.includes(column));
+	};
 	return {
 		maskColumns,
 		maskedActions,
-		primaryKeyHidden
+		primaryKeyHidden,
+		columnsHidden
 	};
 }
 //#endregion
@@ -889,10 +764,11 @@ function createFilterResponder({ db, defaultLimit }, tableSchema) {
 	/**
 	* Packs the filters into a response object that can be applied for queries by the user
 	*/
-	return function transformToResponse(queryFilters, columnMask) {
+	return function transformToResponse(queryFilters, columnMask, columnVisibility) {
 		const ret = internalTransformer(queryFilters);
 		ret.merge = (filters) => internalTransformer(mergeFilters(ret.query.many, filters), filters.limit);
 		ret[columnMaskKey] = columnMask;
+		ret[columnVisibilityKey] = columnVisibility;
 		return ret;
 	};
 }
@@ -1072,7 +948,7 @@ const createTableAbilities = (settings, tableName, queryFilters) => {
 		const mergedFilters = allQueryFilters.length === 1 ? { ...allQueryFilters[0] } : allQueryFilters.reduce((a, b) => {
 			return mergeFilters(a, b, "OR");
 		});
-		const { columns, extras, mask } = resolveColumnAccess(action, allQueryFilters);
+		const { columns, extras, mask, visibility } = resolveColumnAccess(action, allQueryFilters);
 		if (columns) mergedFilters.columns = columns;
 		else delete mergedFilters.columns;
 		if (extras) mergedFilters.extras = {
@@ -1080,7 +956,7 @@ const createTableAbilities = (settings, tableName, queryFilters) => {
 			...extras
 		};
 		attributes[ATTR_ABILITIES_STATUS] = "applied";
-		return transformToResponse(mergedFilters, mask);
+		return transformToResponse(mergedFilters, mask, visibility);
 	};
 	return { withContext: (userContext) => {
 		const prepare = (action) => traceAbilityPreparation(settings, String(tableName), action, (attributes) => assembleAbilities(userContext, action, attributes));
@@ -1100,6 +976,140 @@ const createTableAbilities = (settings, tableName, queryFilters) => {
 	} };
 };
 //#endregion
+//#region lib/abilityBuilder/inputGuard.ts
+/** The ts names of the columns a relation joins on, on either side. */
+function relationColumnKeys(db, table, columns) {
+	const known = tableHelper({
+		db,
+		table
+	}).columns;
+	return (columns ?? []).flatMap((column) => {
+		const raw = column?._?.column ?? column;
+		const key = Object.entries(known).find(([name, candidate]) => candidate === raw || name === raw?.name)?.[0];
+		return key ? [key] : [];
+	});
+}
+const isObject = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+/**
+* Column masking hides values after the query ran, but a `where` or `orderBy`
+* argument is applied by the database on the real values: filtering for
+* `{ salary: { gt: 5000 } }` reveals which rows exceed it whether or not the
+* column may be read. This restricts such arguments to what the abilities
+* expose:
+*
+* - a column only matches on rows which expose it, for all other rows the
+*   condition is false
+* - sorting by a column treats it as empty on rows which do not expose it
+* - a relation filter requires the columns the relation joins on to be
+*   exposed, and is restricted to the rows the caller may read of the related
+*   table, whose masked columns follow the same rules
+*/
+function createInputGuard({ db, abilities, readActionOf }) {
+	const visibilityOf = async (table, action) => (await abilities[table].filter(action))[columnVisibilityKey];
+	const never = (table) => createBlockEverythingFilter(table, tableHelper({
+		db,
+		table
+	})).where;
+	/** The conditions under which the given columns are exposed. */
+	const exposed = async (table, action, keys) => {
+		const visibility = await visibilityOf(table, action);
+		if (!visibility) return [];
+		const conditions = [];
+		for (const key of keys) {
+			const condition = visibility(key);
+			if (condition === true) continue;
+			conditions.push(condition === false ? never(table) : condition);
+		}
+		return conditions;
+	};
+	/** The filter of a relation: the related rows the caller may read, exposing what it joins on. */
+	const guardRelation = async (table, action, key, value, guarded, conditions) => {
+		const relation = tableHelper({
+			db,
+			table
+		}).relations[key];
+		const target = relation.targetTableName;
+		const targetAction = readActionOf(target);
+		const targetKeys = relationColumnKeys(db, target, relation.targetColumns);
+		conditions.push(...await exposed(table, action, relationColumnKeys(db, table, relation.sourceColumns)));
+		const readable = (await abilities[target].filter(targetAction)).query.many.where;
+		const related = [...readable ? [readable] : [], ...await exposed(target, targetAction, targetKeys)];
+		const inner = isObject(value) ? await guardWhere(target, targetAction, value) : {};
+		if (related.length === 0) guarded[key] = isObject(value) ? inner : value;
+		else if (value === false) conditions.push({ NOT: { [key]: { AND: related } } });
+		else guarded[key] = {
+			...inner,
+			AND: [...inner.AND ?? [], ...related]
+		};
+	};
+	const guardLogic = (table, action, value) => Array.isArray(value) ? Promise.all(value.map((v) => guardWhere(table, action, v))) : guardWhere(table, action, value);
+	/** A single entry of a where: a logical operator, a relation or a column. */
+	const guardEntry = async (table, action, [key, value], guarded, conditions) => {
+		const schema = tableHelper({
+			db,
+			table
+		});
+		if (key === "AND" || key === "OR" || key === "NOT") guarded[key] = await guardLogic(table, action, value);
+		else if (key in schema.relations) await guardRelation(table, action, key, value, guarded, conditions);
+		else {
+			guarded[key] = value;
+			if (key in schema.columns) conditions.push(...await exposed(table, action, [key]));
+		}
+	};
+	const guardWhere = async (table, action, where) => {
+		if (!isObject(where)) return where;
+		const guarded = {};
+		const conditions = [];
+		for (const entry of Object.entries(where)) await guardEntry(table, action, entry, guarded, conditions);
+		if (conditions.length === 0) return guarded;
+		return {
+			...guarded,
+			AND: [...guarded.AND ?? [], ...conditions]
+		};
+	};
+	const guardOrderBy = async (table, action, orderBy) => {
+		if (!isObject(orderBy)) return orderBy;
+		const visibility = await visibilityOf(table, action);
+		if (!visibility) return orderBy;
+		const entries = Object.entries(orderBy).filter(([, direction]) => direction);
+		if (entries.every(([key]) => visibility(key) === true)) return orderBy;
+		const schema = tableHelper({
+			db,
+			table
+		});
+		return (aliased, { asc, desc }) => entries.map(([key, direction]) => {
+			const condition = visibility(key);
+			const column = aliased[key];
+			const value = condition === true ? column : condition === false ? null : sql`case when ${relationsFilterToSQL(aliased, sanitizeFilterValue(condition), schema.relations, db._.relations)} then ${column} end`;
+			return (direction === "asc" ? asc : desc)(value ?? sql`null`);
+		});
+	};
+	return {
+		input: async (table, action, input) => ({
+			...input,
+			where: await guardWhere(table, action, input.where),
+			orderBy: await guardOrderBy(table, action, input.orderBy)
+		}),
+		exposed
+	};
+}
+/**
+* Restricts client supplied `where` and `orderBy` arguments to what the
+* abilities of the request let the caller read, see `createInputGuard`.
+*/
+function guardFilterInput(abilities, table, action, input) {
+	const guard = abilities[guardInputKey];
+	return guard ? guard.input(table, action, input) : Promise.resolve(input);
+}
+/**
+* The conditions a row of the related table has to meet to be reached through
+* a relation: the columns the relation joins on have to be exposed on it.
+*/
+async function relationExposure(abilities, table, action, columns) {
+	const guard = abilities[guardInputKey];
+	return guard ? guard.exposed(table, action, columns) : [];
+}
+//#endregion
 //#region lib/abilityBuilder/tableBuilder.ts
 /**
 * Creates the registration API (allow/filter) of a single table.
@@ -1210,7 +1220,7 @@ const createAbilityBuilder = ({ db, actions, defaultLimit, otel, logger: loggerC
 		actions: settings.actions,
 		isBuilt: () => hasBeenBuilt
 	})]));
-	const { maskColumns, maskedActions, primaryKeyHidden } = createColumnMasker(settings, new Map(tableRelationNames.map((tableName) => {
+	const { maskColumns, maskedActions, primaryKeyHidden, columnsHidden } = createColumnMasker(settings, new Map(tableRelationNames.map((tableName) => {
 		const tableSchema = tableHelper({
 			db,
 			table: tableName
@@ -1233,6 +1243,8 @@ const createAbilityBuilder = ({ db, actions, defaultLimit, otel, logger: loggerC
 			maskedActions: (abilities, table) => maskedActions(abilities, table),
 			/** Whether masking in this request hid the primary key of the row. */
 			primaryKeyHidden: (abilities, row) => primaryKeyHidden(abilities, row),
+			/** Whether masking in this request hid one of the columns on the row. */
+			columnsHidden: (abilities, row, columns, primaryKey) => columnsHidden(abilities, row, columns, primaryKey),
 			registerReadAction(table, action) {
 				readActionPerTable.set(table, action);
 			},
@@ -1249,6 +1261,11 @@ const createAbilityBuilder = ({ db, actions, defaultLimit, otel, logger: loggerC
 					const state = createRequestState();
 					const abilities = Object.fromEntries(tableRelationNames.map((tableName) => [tableName, abilitiesPerTable[tableName].withContext(ctx)]));
 					attachRequestState(abilities, state);
+					Object.defineProperty(abilities, guardInputKey, { value: createInputGuard({
+						db,
+						abilities,
+						readActionOf: (table) => readActionPerTable.get(table) ?? "read"
+					}) });
 					return abilities;
 				};
 			}
@@ -1256,6 +1273,152 @@ const createAbilityBuilder = ({ db, actions, defaultLimit, otel, logger: loggerC
 	};
 };
 //#endregion
+//#region lib/helpers/asserts.ts
+/**
+*
+* Helper function to map a drizzle findFirst query result,
+* which may be optional, to a correct drizzle type.
+*
+* @throws RumbleError
+*
+* @example
+*
+* ```ts
+* schemaBuilder.queryFields((t) => {
+return {
+findFirstUser: t.drizzleField({
+type: UserRef,
+resolve: (query, root, args, ctx, info) => {
+return (
+db.query.users
+.findFirst({
+...query,
+where: (await ctx.abilities.users.filter("read")).single.where,
+})
+// note that we need to manually raise an error if the value is not found
+.then(assertFindFirstExists)
+);
+},
+}),
+};
+});
+* ```
+*/
+const assertFindFirstExists = (value) => {
+	if (!value) throw new RumbleErrorSafe("Value not found but required (findFirst)");
+	return value;
+};
+/**
+*
+* Helper function to map a drizzle findFirst query result,
+* which may be optional, to a correct drizzle type.
+*
+* @throws RumbleError
+*
+* @example
+*
+* ```ts
+schemaBuilder.mutationFields((t) => {
+return {
+updateUsername: t.drizzleField({
+type: UserRef,
+args: {
+userId: t.arg.int({ required: true }),
+newName: t.arg.string({ required: true }),
+},
+resolve: (query, root, args, ctx, info) => {
+return db
+.update(schema.users)
+.set({
+name: args.newName,
+})
+.where(
+and(
+eq(schema.users.id, args.userId),
+(await ctx.abilities.users.filter("update")).single.where
+)
+)
+.returning({ id: schema.users.id, name: schema.users.name })
+// note that we need to manually raise an error if the value is not found
+.then(assertFirstEntryExists);
+},
+}),
+};
+});
+* ```
+*/
+const assertFirstEntryExists = (value) => {
+	const v = value.at(0);
+	if (!v) throw new RumbleErrorSafe("Value not found but required (firstEntry)");
+	return v;
+};
+//#endregion
+//#region lib/helpers/mapNullFieldsToUndefined.ts
+/**
+* Helper to map null fields to undefined
+* @param obj The object to map
+* @returns The mapped object with all fields of 'null' transformed to 'undefined'
+* 
+* This becomes useful for update mutations where you do not want to pass null (unset value in db)
+* but undefined (do not touch value in db) in case of a value not beeing set in the args of said mutation
+* @example
+* ```ts
+*  updateUser: t.drizzleField({
+type: User,
+args: {
+id: t.arg.string({ required: true }),
+email: t.arg.string(),
+lastName: t.arg.string(),
+firstName: t.arg.string(),
+},
+resolve: async (query, root, args, ctx, info) => {
+const mappedArgs = mapNullFieldsToUndefined(args);
+const user = await db.transaction(async (tx) => {
+const user = await tx
+.update(schema.user)
+.set({
+
+// email: args.email ?? undefined,
+// lastName: args.lastName ?? undefined,
+// firstName: args.firstName ?? undefined,
+
+// becomes this
+
+email: mappedArgs.email,
+lastName: mappedArgs.lastName,
+firstName: mappedArgs.firstName,
+})
+.returning()
+.then(assertFirstEntryExists);
+return user;
+});
+
+pubsub.updated(user.id);
+
+return db.query.user
+.findFirst(
+query(
+(await ctx.abilities.user.filter('read')).merge(
+{
+where: { id: user.id },
+}
+1).query.single,
+),
+)
+.then(assertFindFirstExists);
+},
+}),
+* 
+* 
+* ```
+*/
+function mapNullFieldsToUndefined(obj) {
+	return Object.fromEntries(Object.entries(obj).map(([key, value]) => [key, value === null ? void 0 : value]));
+}
+//#endregion
+//#region package.json
+var version = "0.26.2";
+//#endregion
 //#region lib/args/orderArg.ts
 const makeDefaultName$1 = (dbName) => `${capitalize(toCamelCase(dbName.toString()))}OrderInputArgument`;
 const createOrderArgImplementer = ({ db, schemaBuilder }) => {
@@ -1682,6 +1845,8 @@ const createCountQueryImplementer = ({ db, schemaBuilder, whereArgImplementer, m
 				resolve: async (_root, args, ctx, _info) => {
 					if (isAllowed && !await isAllowed(ctx)) throw new RumbleErrorSafe("Not allowed to perform this action");
 					deepSetProto(args);
+					const guarded = await guardFilterInput(ctx.abilities, String(table), listAction, { where: args.where });
+					if (args.where) args.where = guarded.where;
 					return db.select({ count: count() }).from(tableSchema.table).where((await ctx.abilities[table].filter(listAction)).merge(mapNullFieldsToUndefined(args)).sql.where).then(assertFirstEntryExists).then((r) => r.count);
 				}
 			}) };
@@ -2079,9 +2244,12 @@ function adjustQueryArgsForSearch({ search, args, tableSchema, abilities }) {
 		args.extras = { search_distance: (table) => sql`${sql.join(columnsToSearch.map(([key]) => {
 			return sql`COALESCE((${table[key]}::TEXT <-> ${searchParam}), 1)`;
 		}), sql.raw(" + "))}` };
-		const originalOrderBy = cloneDeep(args.orderBy);
+		const originalOrderBy = typeof args.orderBy === "function" ? args.orderBy : cloneDeep(args.orderBy);
 		args.orderBy = (table) => {
-			const argsOrderBySQL = sql.join(Object.entries(originalOrderBy ?? {}).map(([key, value]) => {
+			const argsOrderBySQL = sql.join(typeof originalOrderBy === "function" ? originalOrderBy(table, {
+				asc,
+				desc
+			}) : Object.entries(originalOrderBy ?? {}).map(([key, value]) => {
 				if (value === "asc") return sql`${table[key]} ASC`;
 				else if (value === "desc") return sql`${table[key]} DESC`;
 				else throw new Error(`Invalid value ${value} for orderBy`);
@@ -2165,6 +2333,13 @@ const createObjectImplementer = ({ db, search, otel, logger: loggerConfig, schem
 				fields: Object.keys(tableSchema.primaryKey),
 				isHidden: (context, row) => abilityBuilder._.primaryKeyHidden(context.abilities, row)
 			},
+			maskRelations: {
+				fields: Object.fromEntries(Object.entries(tableSchema.relations ?? {}).map(([key, relation]) => [key, {
+					many: !is(relation, One),
+					sourceColumns: relationColumnKeys(db, tableSchema.tsName, relation.sourceColumns)
+				}])),
+				isHidden: (context, row, columns) => abilityBuilder._.columnsHidden(context.abilities, row, columns, Object.keys(tableSchema.primaryKey))
+			},
 			fields: (t) => {
 				const columns = tableSchema.columns;
 				const configMap = /* @__PURE__ */ new Map();
@@ -2231,7 +2406,7 @@ const createObjectImplementer = ({ db, search, otel, logger: loggerConfig, schem
 					let filterSpecifier = "many";
 					if (is(value, One)) {
 						isMany = false;
-						nullable = value.optional || !value.sourceColumns.every((column) => column.notNull);
+						nullable = value.optional || !value.sourceColumns.every((column) => (column._?.column ?? column).notNull);
 						filterSpecifier = "single";
 					}
 					const subscribe = (subscriptions, _element) => {
@@ -2274,14 +2449,21 @@ const createObjectImplementer = ({ db, search, otel, logger: loggerConfig, schem
 						description: `Get the ${pluralize.plural(relationSchema.tsName)} related to this ${pluralize.singular(tableSchema.tsName)}`,
 						query: async (args, ctx) => {
 							args = JSON.parse(JSON.stringify(args));
+							const guarded = await guardFilterInput(ctx.abilities, relationSchema.tsName, readAction, {
+								where: args.where,
+								orderBy: args.orderBy
+							});
+							if (args.where) args.where = guarded.where;
+							if (args.orderBy) args.orderBy = guarded.orderBy;
 							if (isMany) adjustQueryArgsForSearch({
 								search,
 								args,
 								tableSchema: relationSchema,
 								abilities: await ctx.abilities[relationSchema.tsName].filter(readAction)
 							});
+							const joined = await relationExposure(ctx.abilities, relationSchema.tsName, readAction, relationColumnKeys(db, relationSchema.tsName, value.targetColumns));
 							const filter = (await ctx.abilities[relationSchema.tsName].filter(readAction)).merge({
-								where: args.where,
+								where: joined.length ? { AND: [...args.where ? [args.where] : [], ...joined] } : args.where,
 								limit: args.limit,
 								extras: args.extras
 							}).query[filterSpecifier];
@@ -2443,6 +2625,12 @@ const createQueryImplementer = ({ db, schemaBuilder, search, otel, logger: logge
 					args: manyArgs,
 					resolve: async (query, _root, args, ctx, _info) => {
 						deepSetProto(args);
+						const guarded = await guardFilterInput(ctx.abilities, String(table), listAction, {
+							where: args.where,
+							orderBy: args.orderBy
+						});
+						if (args.where) args.where = guarded.where;
+						if (args.orderBy) args.orderBy = guarded.orderBy;
 						adjustQueryArgsForSearch({
 							search,
 							args,
@@ -2770,12 +2958,19 @@ function registerPluginOnce(name, plugin) {
 const maskColumnsKey = "maskColumns";
 const maskColumnsActionKey = "maskColumnsAction";
 const maskPrimaryKeysKey = "maskPrimaryKeys";
+const maskRelationsKey = "maskRelations";
 const columnMaskPluginName = "ColumnMaskPlugin";
 //#endregion
 //#region lib/columnMaskPlugin/columnMaskPlugin.ts
 var ColumnMaskPlugin = class extends BasePlugin {
 	wrapResolve(resolver, fieldConfig) {
-		return this.maskResult(this.maskPrimaryKey(resolver, fieldConfig), fieldConfig);
+		return this.maskResult(this.maskRelation(this.maskPrimaryKey(resolver, fieldConfig), fieldConfig), fieldConfig);
+	}
+	maskRelation(resolver, fieldConfig) {
+		const relations = this.buildCache.getTypeConfig(fieldConfig.parentType).pothosOptions[maskRelationsKey];
+		const relation = relations?.fields[fieldConfig.name];
+		if (!relations || !relation) return resolver;
+		return (parent, args, context, info) => relations.isHidden(context, parent, relation.sourceColumns) ? relation.many ? [] : null : resolver(parent, args, context, info);
 	}
 	maskPrimaryKey(resolver, fieldConfig) {
 		const primaryKeys = this.buildCache.getTypeConfig(fieldConfig.parentType).pothosOptions[maskPrimaryKeysKey];
@@ -3591,6 +3786,6 @@ export const r = rumble({
 	};
 };
 //#endregion
-export { RumbleError, RumbleErrorSafe, assertFindFirstExists, assertFirstEntryExists, mapNullFieldsToUndefined, normalizeEmailAddress, normalizePersonName, parsePhoneNumber, rumble };
+export { RumbleError, RumbleErrorSafe, assertFindFirstExists, assertFirstEntryExists, guardFilterInput, mapNullFieldsToUndefined, normalizeEmailAddress, normalizePersonName, parsePhoneNumber, rumble };
 
 //# sourceMappingURL=index.mjs.map