@opensaas/stack-auth 0.39.2 → 0.41.0

package/tests/credential-field-read-deny-e2e.test.ts

@@ -0,0 +1,295 @@
+import { describe, it, expect, afterAll } from 'vitest'
+import { execFile } from 'node:child_process'
+import { promisify } from 'node:util'
+import { existsSync } from 'node:fs'
+import fsp from 'node:fs/promises'
+import os from 'node:os'
+import path from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { createAuth } from '../src/server/index.js'
+import type { OpenSaasConfig, AccessContext } from '@opensaas/stack-core'
+
+/**
+ * Live end-to-end proof for issue #981 / ADR-0036: the credential-bearing
+ * fields the auth plugin now ships read-denied (`Session.token`,
+ * `Verification.value`, `Account.password`/`accessToken`/`refreshToken`/
+ * `idToken`) are actually stripped from an opened list's `context.db` reads,
+ * `sudo()` still reads them, and — the part a unit test on `deriveAuthLists`
+ * cannot show — better-auth's own sign-up/sign-in/password-reset flows are
+ * unaffected because they write through the raw Prisma adapter, never
+ * through the access-controlled context these denies gate.
+ *
+ * Generates a real Prisma schema, pushes it to a real SQLite database,
+ * drives a real `betterAuth()` instance (via `createAuth()`, this package's
+ * own source) through real sign-up/sign-in/password-reset requests, and
+ * reads the resulting rows back through both an access-opened context and a
+ * sudo context. Follows the same opt-in/offline-toolchain pattern as
+ * `rate-limit-e2e.test.ts` (see ADR-0002) — kept out of the fast unit lane,
+ * run only in the `e2e` CI job where `pnpm install && pnpm build` have
+ * already run.
+ */
+
+const run = promisify(execFile)
+const here = path.dirname(new URL(import.meta.url).pathname)
+const repoRoot = path.resolve(here, '../../..')
+
+const opensaasCli = path.join(repoRoot, 'packages/cli/dist/index.js')
+const coreDist = path.join(repoRoot, 'packages/core/dist')
+const authDist = path.join(repoRoot, 'packages/auth/dist')
+const toolchainNodeModules = path.join(repoRoot, 'examples/starter-auth/node_modules')
+
+const guardEnabled = process.env.RUN_CREDENTIAL_DENY_E2E === '1'
+
+const prerequisitesPresent =
+  guardEnabled &&
+  existsSync(opensaasCli) &&
+  existsSync(coreDist) &&
+  existsSync(authDist) &&
+  existsSync(path.join(toolchainNodeModules, '.bin', 'opensaas')) &&
+  existsSync(path.join(toolchainNodeModules, '.bin', 'prisma')) &&
+  existsSync(path.join(toolchainNodeModules, '@prisma', 'adapter-better-sqlite3')) &&
+  existsSync(path.join(toolchainNodeModules, 'better-auth', 'dist', 'test-utils'))
+
+/**
+ * The temp project's `opensaas.config.ts` — sqlite + email/password auth with
+ * every derived Auth list opened for `query`, so a `context.db` read is what
+ * exercises the field-level deny (a closed list would return `null`/`[]`
+ * outright and prove nothing about field stripping). `sendResetPassword`
+ * writes the reset token to a file the test reads back, since it runs in the
+ * temp project's own module scope, not the test process's.
+ */
+function configSource(resetTokenFile: string): string {
+  return `import { config } from '@opensaas/stack-core'
+import { authPlugin } from '@opensaas/stack-auth'
+import { PrismaBetterSqlite3 } from '@prisma/adapter-better-sqlite3'
+import { writeFile } from 'node:fs/promises'
+
+const openQuery = { operation: { query: () => true } }
+
+export default config({
+  plugins: [
+    authPlugin({
+      emailAndPassword: {
+        enabled: true,
+        sendResetPassword: async ({ token }) => {
+          await writeFile(${JSON.stringify(resetTokenFile)}, token, 'utf-8')
+        },
+      },
+      passwordReset: { enabled: true },
+      access: {
+        user: openQuery,
+        session: openQuery,
+        account: openQuery,
+        verification: openQuery,
+      },
+    }),
+  ],
+  db: {
+    provider: 'sqlite',
+    prismaClientConstructor: (PrismaClient) => {
+      const adapter = new PrismaBetterSqlite3({ url: process.env.DATABASE_URL || './dev.db' })
+      return new PrismaClient({ adapter })
+    },
+  },
+  lists: {},
+})
+`
+}
+
+async function setupProject(): Promise<{ dir: string; resetTokenFile: string }> {
+  const tmpRoot = await fsp.mkdtemp(path.join(os.tmpdir(), 'opensaas-credential-deny-e2e-'))
+  const dir = path.join(tmpRoot, 'project')
+  await fsp.mkdir(dir, { recursive: true })
+  const resetTokenFile = path.join(dir, 'reset-token.txt')
+
+  await fsp.writeFile(path.join(dir, 'opensaas.config.ts'), configSource(resetTokenFile))
+  await fsp.writeFile(
+    path.join(dir, 'package.json'),
+    JSON.stringify(
+      { name: 'credential-deny-e2e-project', version: '0.0.0', private: true, type: 'module' },
+      null,
+      2,
+    ),
+  )
+  await fsp.writeFile(path.join(dir, '.env'), 'DATABASE_URL=file:./dev.db\n')
+  await fsp.symlink(toolchainNodeModules, path.join(dir, 'node_modules'))
+
+  const env = {
+    ...process.env,
+    DATABASE_URL: 'file:./dev.db',
+    BETTER_AUTH_SECRET: 'e2e-test-secret-not-for-production-0000000000',
+    BETTER_AUTH_URL: 'http://localhost:3000',
+  }
+  const binDir = path.join(dir, 'node_modules', '.bin')
+  await run(path.join(binDir, 'opensaas'), ['generate'], { cwd: dir, env })
+  await run(path.join(binDir, 'prisma'), ['db', 'push'], { cwd: dir, env })
+
+  return { dir, resetTokenFile }
+}
+
+/** Import the temp project's config + generated context and build a real auth instance via `createAuth()`. */
+async function createAuthInstanceForProject(dir: string) {
+  process.env.DATABASE_URL = `file:${path.join(dir, 'dev.db')}`
+
+  const config = (
+    (await import(/* @vite-ignore */ pathToFileURL(path.join(dir, 'opensaas.config.ts')).href)) as {
+      default: OpenSaasConfig | Promise<OpenSaasConfig>
+    }
+  ).default
+  const { rawOpensaasContext } = (await import(
+    /* @vite-ignore */ pathToFileURL(path.join(dir, '.opensaas/context.ts')).href
+  )) as { rawOpensaasContext: Promise<AccessContext> }
+
+  const resolvedContext = await rawOpensaasContext
+
+  return { auth: createAuth(config, resolvedContext), context: resolvedContext }
+}
+
+async function cleanupProject(dir: string): Promise<void> {
+  delete (globalThis as { prisma?: unknown }).prisma
+  const linkPath = path.join(dir, 'node_modules')
+  if (existsSync(linkPath)) {
+    await fsp.unlink(linkPath)
+  }
+  await fsp.rm(path.dirname(dir), { recursive: true, force: true })
+}
+
+describe.skipIf(!prerequisitesPresent)(
+  'plugin-derived credential fields ship read-denied — live end-to-end (issue #981, ADR-0036)',
+  () => {
+    it('strips credential fields from an opened context.db read, keeps them under sudo(), and leaves sign-up/sign-in/session-refresh/password-reset unaffected', async () => {
+      const { dir, resetTokenFile } = await setupProject()
+      try {
+        const { auth, context } = await createAuthInstanceForProject(dir)
+        const { convertSetCookieToCookie } = (await import(
+          /* @vite-ignore */ pathToFileURL(
+            path.join(dir, 'node_modules/better-auth/dist/test-utils/index.mjs'),
+          ).href
+        )) as { convertSetCookieToCookie: (h: Headers) => Headers }
+
+        const email = 'reader@example.com'
+        const password = 'correct horse battery staple'
+
+        // Sign-up writes User + Account (with the hashed password) through
+        // better-auth's own raw-Prisma adapter — unaffected by the deny.
+        const signUpRes = await auth.api.signUpEmail({
+          body: { name: 'Reader', email, password },
+          asResponse: true,
+        })
+        expect(signUpRes.status).toBe(200)
+
+        // Sign-in writes a Session row and returns a session cookie.
+        const signInRes = await auth.api.signInEmail({
+          body: { email, password },
+          asResponse: true,
+        })
+        expect(signInRes.status).toBe(200)
+        const cookieHeaders = convertSetCookieToCookie(signInRes.headers)
+
+        // Session refresh: the cookie from sign-in resolves a session twice.
+        for (let i = 0; i < 2; i++) {
+          const session = await auth.api.getSession({ headers: cookieHeaders })
+          expect(session?.user.email).toBe(email)
+        }
+
+        // --- context.db reads, with operation-level access opened ---
+
+        const sessions = await context.db.session.findMany({})
+        expect(sessions.length).toBeGreaterThan(0)
+        for (const s of sessions) {
+          expect(s.token).toBeUndefined()
+          expect(s.ipAddress === null || typeof s.ipAddress === 'string').toBe(true)
+        }
+
+        const accounts = await context.db.account.findMany({})
+        expect(accounts.length).toBeGreaterThan(0)
+        for (const a of accounts) {
+          expect(a.password).toBeUndefined()
+          expect(a.accessToken).toBeUndefined()
+          expect(a.refreshToken).toBeUndefined()
+          expect(a.idToken).toBeUndefined()
+          // Identifying fields stay open.
+          expect(a.providerId).toBe('credential')
+        }
+
+        // --- sudo() still reads every one of these fields ---
+
+        const sudoAccounts = await context.sudo().db.account.findMany({})
+        expect(sudoAccounts.length).toBeGreaterThan(0)
+        expect(typeof sudoAccounts[0].password).toBe('string')
+        expect(sudoAccounts[0].password!.length).toBeGreaterThan(0)
+
+        const sudoSessions = await context.sudo().db.session.findMany({})
+        expect(typeof sudoSessions[0].token).toBe('string')
+        expect(sudoSessions[0].token!.length).toBeGreaterThan(0)
+
+        // Naming a denied field in findMany's where/orderBy is rejected up
+        // front by the predicate-time read-access check, not silently
+        // stripped (findUnique's `where` isn't walked by that check at all —
+        // it only unique-selects the row, so it still returns the row with
+        // `token` stripped from the output, same as any other read).
+        await expect(
+          context.db.session.findMany({ where: { token: sudoSessions[0].token } }),
+        ).rejects.toThrow()
+        await expect(
+          context.sudo().db.session.findMany({ where: { token: sudoSessions[0].token } }),
+        ).resolves.not.toHaveLength(0)
+
+        // --- password reset: exercises Verification.value end-to-end ---
+
+        const resetReq = await auth.api.requestPasswordReset({
+          body: { email },
+          asResponse: true,
+        })
+        expect(resetReq.status).toBe(200)
+
+        // context.db strips Verification.value even though a live reset token exists.
+        const verifications = await context.db.verification.findMany({})
+        expect(verifications.length).toBeGreaterThan(0)
+        for (const v of verifications) {
+          expect(v.value).toBeUndefined()
+          expect(typeof v.identifier).toBe('string')
+        }
+        const sudoVerifications = await context.sudo().db.verification.findMany({})
+        expect(typeof sudoVerifications[0].value).toBe('string')
+
+        const resetToken = (await fsp.readFile(resetTokenFile, 'utf-8')).trim()
+        expect(resetToken.length).toBeGreaterThan(0)
+
+        const newPassword = 'a new correct horse battery staple'
+        const resetRes = await auth.api.resetPassword({
+          body: { newPassword, token: resetToken },
+          asResponse: true,
+        })
+        expect(resetRes.status).toBe(200)
+
+        // Sign in with the new password proves the reset (through the raw
+        // adapter, past the field-level deny) actually took effect.
+        const signInAfterReset = await auth.api.signInEmail({
+          body: { email, password: newPassword },
+          asResponse: true,
+        })
+        expect(signInAfterReset.status).toBe(200)
+
+        await context.prisma.$disconnect()
+      } finally {
+        await cleanupProject(dir)
+      }
+    }, 120_000)
+  },
+)
+
+// Surface, in a normal unit run, why this guard was skipped.
+describe.runIf(!prerequisitesPresent)('credential field read-deny e2e (skipped)', () => {
+  it('runs only in the e2e job (set RUN_CREDENTIAL_DENY_E2E=1 after install + build)', () => {
+    expect(prerequisitesPresent).toBe(false)
+  })
+
+  afterAll(() => {
+    if (!guardEnabled) return
+    console.warn(
+      '[credential-field-read-deny-e2e] RUN_CREDENTIAL_DENY_E2E=1 was set but prerequisites are missing. ' +
+        'Run `pnpm install && pnpm build` (and ensure examples/starter-auth has been installed) first.',
+    )
+  })
+})

package/tests/derive-auth-lists.test.ts

@@ -1,4 +1,6 @@
 import { describe, it, expect } from 'vitest'
+import { mcp } from '@better-auth/mcp'
+import { twoFactor } from 'better-auth/plugins'
 import { deriveAuthLists } from '../src/config/derive-auth-lists.js'
 import type { NormalizedAuthModels } from '../src/config/types.js'
 
@@ -61,8 +63,11 @@ describe('deriveAuthLists - default behaviour (no overrides)', () => {
 
     expect(lists.User.fields.name.db?.map).toBeUndefined()
     expect(lists.Session.fields.token.db?.map).toBeUndefined()
-    // FK column not overridden -> no foreignKey map on the relationship
-    expect(lists.Session.fields.user.db?.foreignKey).toBeUndefined()
+    // FK column not overridden -> still defaults to better-auth's own
+    // `userId` column name, not the generator's Keystone-parity default
+    // (issue #935)
+    expect(lists.Session.fields.user.db?.foreignKey).toEqual({ map: 'userId' })
+    expect(lists.Account.fields.user.db?.foreignKey).toEqual({ map: 'userId' })
   })
 
   it('opts every auth list into auto-timestamps', () => {
@@ -79,12 +84,18 @@ describe('deriveAuthLists - default behaviour (no overrides)', () => {
   })
 })
 
-describe('deriveAuthLists - user FK shape mirrors better-auth (issue #679)', () => {
-  it('disables the default FK index on Session.user and Account.user', () => {
+describe('deriveAuthLists - user FK shape mirrors better-auth (issue #679/#937)', () => {
+  it('indexes the user FK on Session.user and Account.user, matching better-auth', () => {
     const { lists } = deriveAuthLists(defaultModels)
 
-    expect(lists.Session.fields.user.isIndexed).toBe(false)
-    expect(lists.Account.fields.user.isIndexed).toBe(false)
+    expect(lists.Session.fields.user.isIndexed).toBe(true)
+    expect(lists.Account.fields.user.isIndexed).toBe(true)
+  })
+
+  it('indexes Verification.identifier, matching better-auth', () => {
+    const { lists } = deriveAuthLists(defaultModels)
+
+    expect(lists.Verification.fields.identifier.isIndexed).toBe(true)
   })
 
   it('does not touch isIndexed on the email/token unique fields', () => {
@@ -448,6 +459,252 @@ describe('deriveAuthLists - RateLimit list (rateLimit.storage === "database")',
   })
 })
 
+describe('deriveAuthLists - credential fields ship read-denied (ADR-0036, issue #981)', () => {
+  it('denies read on Session.token, Verification.value, and the Account credential fields', async () => {
+    const { lists } = deriveAuthLists(defaultModels)
+
+    const denied: Array<[string, string]> = [
+      ['Session', 'token'],
+      ['Verification', 'value'],
+      ['Account', 'password'],
+      ['Account', 'accessToken'],
+      ['Account', 'refreshToken'],
+      ['Account', 'idToken'],
+    ]
+
+    for (const [listKey, fieldKey] of denied) {
+      const field = lists[listKey].fields[fieldKey]
+      expect(field.access?.read).toBeTypeOf('function')
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal read-access call fixture
+      expect(await field.access!.read!({} as any)).toBe(false)
+    }
+  })
+
+  it('also curates read-denied credential fields out of the admin default columns (issue #1018)', async () => {
+    const { lists } = deriveAuthLists(defaultModels)
+
+    const denied: Array<[string, string]> = [
+      ['Session', 'token'],
+      ['Verification', 'value'],
+      ['Account', 'password'],
+      ['Account', 'accessToken'],
+      ['Account', 'refreshToken'],
+      ['Account', 'idToken'],
+    ]
+
+    for (const [listKey, fieldKey] of denied) {
+      const field = lists[listKey].fields[fieldKey]
+      expect(field.ui?.listView?.defaultColumn).toBe(false)
+    }
+
+    // A non-credential field is left with no ui.listView declaration at all.
+    expect(lists.Session.fields.ipAddress.ui?.listView).toBeUndefined()
+  })
+
+  it('leaves identifying fields open — session/account metadata and every User field', () => {
+    const { lists } = deriveAuthLists(defaultModels)
+
+    const open: Array<[string, string]> = [
+      ['Session', 'ipAddress'],
+      ['Session', 'userAgent'],
+      ['Session', 'expiresAt'],
+      ['Account', 'providerId'],
+      ['Account', 'accountId'],
+      ['Account', 'scope'],
+      ['Verification', 'identifier'],
+      ['Verification', 'expiresAt'],
+      ['User', 'name'],
+      ['User', 'email'],
+    ]
+
+    for (const [listKey, fieldKey] of open) {
+      expect(lists[listKey].fields[fieldKey].access).toBeUndefined()
+    }
+  })
+
+  it('keys the deny to the better-auth model/field, surviving a modelName + column remap', () => {
+    const models: NormalizedAuthModels = {
+      user: { modelName: 'AuthUser', fields: {} },
+      session: { modelName: 'AuthSession', fields: { token: 'session_token' } },
+      account: { modelName: 'AuthAccount', fields: { password: 'password_hash' } },
+      verification: { modelName: 'AuthVerification', fields: { value: 'verification_value' } },
+    }
+
+    const { lists } = deriveAuthLists(models)
+
+    expect(lists.AuthSession.fields.token.access?.read).toBeTypeOf('function')
+    expect(lists.AuthSession.fields.token.db?.map).toBe('session_token')
+    expect(lists.AuthAccount.fields.password.access?.read).toBeTypeOf('function')
+    expect(lists.AuthAccount.fields.password.db?.map).toBe('password_hash')
+    expect(lists.AuthVerification.fields.value.access?.read).toBeTypeOf('function')
+    expect(lists.AuthVerification.fields.value.db?.map).toBe('verification_value')
+  })
+
+  it('does not add access to fields that already have none, beyond the credential set', () => {
+    const { lists } = deriveAuthLists(defaultModels)
+
+    // Every other scalar/relationship field across the four base lists stays access-less.
+    const nonCredentialFields = [
+      ...Object.entries(lists.Session.fields).filter(([k]) => k !== 'token'),
+      ...Object.entries(lists.Account.fields).filter(
+        ([k]) => !['password', 'accessToken', 'refreshToken', 'idToken'].includes(k),
+      ),
+      ...Object.entries(lists.Verification.fields).filter(([k]) => k !== 'value'),
+    ]
+    for (const [, field] of nonCredentialFields) {
+      expect(field.access).toBeUndefined()
+    }
+  })
+})
+
+describe('deriveAuthLists - credential fields on plugin tables (issue #1014)', () => {
+  const mcpPlugin = mcp({
+    loginPage: '/sign-in',
+    consentPage: '/consent',
+    resource: 'https://example.com/mcp',
+  })
+
+  it('denies read on the mcp/oauth-provider credential fields', async () => {
+    const { lists } = deriveAuthLists(defaultModels, {}, {}, [mcpPlugin])
+
+    const denied: Array<[string, string]> = [
+      ['OauthClient', 'clientSecret'],
+      ['OauthAccessToken', 'token'],
+      ['OauthRefreshToken', 'token'],
+    ]
+
+    for (const [listKey, fieldKey] of denied) {
+      const field = lists[listKey].fields[fieldKey]
+      expect(field.access?.read).toBeTypeOf('function')
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal read-access call fixture
+      expect(await field.access!.read!({} as any)).toBe(false)
+      expect(field.ui?.listView?.defaultColumn).toBe(false)
+    }
+  })
+
+  it('leaves identifying oauth-provider fields open', () => {
+    const { lists } = deriveAuthLists(defaultModels, {}, {}, [mcpPlugin])
+
+    expect(lists.OauthClient.fields.name.access).toBeUndefined()
+    expect(lists.OauthClient.fields.uri.access).toBeUndefined()
+    expect(lists.OauthClient.fields.clientId.access).toBeUndefined()
+    expect(lists.OauthAccessToken.fields.scopes.access).toBeUndefined()
+    expect(lists.OauthAccessToken.fields.expiresAt.access).toBeUndefined()
+  })
+
+  it('denies read on twoFactor.secret and twoFactor.backupCodes', async () => {
+    const { lists } = deriveAuthLists(defaultModels, {}, {}, [twoFactor()])
+
+    for (const fieldKey of ['secret', 'backupCodes']) {
+      const field = lists.TwoFactor.fields[fieldKey]
+      expect(field.access?.read).toBeTypeOf('function')
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal read-access call fixture
+      expect(await field.access!.read!({} as any)).toBe(false)
+      expect(field.ui?.listView?.defaultColumn).toBe(false)
+    }
+  })
+
+  it('leaves twoFactor.verified open, and twoFactor.userId open despite carrying returned: false upstream', () => {
+    const { lists } = deriveAuthLists(defaultModels, {}, {}, [twoFactor()])
+
+    expect(lists.TwoFactor.fields.verified.access).toBeUndefined()
+    // userId is a relationship field (references user.id), not a scalar —
+    // it's never routed through the credential-deny path at all.
+    expect(lists.TwoFactor.fields.user.access).toBeUndefined()
+  })
+
+  it('survives a plugin-table modelName + column remap', () => {
+    const plugin = {
+      id: 'test-remap',
+      schema: {
+        widget: {
+          modelName: 'Gadget',
+          fields: {
+            apiKey: { type: 'string' as const, required: true, fieldName: 'api_key' },
+          },
+        },
+      },
+    }
+
+    const { lists } = deriveAuthLists(defaultModels, {}, {}, [plugin], {
+      widget: ['apiKey'],
+    })
+
+    expect(lists.Gadget.fields.apiKey.access?.read).toBeTypeOf('function')
+    expect(lists.Gadget.fields.apiKey.db?.map).toBe('api_key')
+  })
+
+  it('authPlugin({ credentialFields }) marks an additional field on a synthetic plugin table', async () => {
+    const plugin = {
+      id: 'test-passkey',
+      schema: {
+        passkey: {
+          fields: {
+            publicKey: { type: 'string' as const, required: true },
+            deviceType: { type: 'string' as const, required: true },
+          },
+        },
+      },
+    }
+
+    const { lists } = deriveAuthLists(defaultModels, {}, {}, [plugin], {
+      passkey: ['publicKey'],
+    })
+
+    expect(await lists.Passkey.fields.publicKey.access!.read!({} as never)).toBe(false)
+    expect(lists.Passkey.fields.deviceType.access).toBeUndefined()
+  })
+
+  it('cannot unmark a stack-seeded credential field', async () => {
+    // An empty (or omitted) field list for a seeded model must not remove its
+    // seeded deny — credentialFields is additive-only.
+    const { lists } = deriveAuthLists(defaultModels, {}, {}, [], { session: [] })
+
+    expect(await lists.Session.fields.token.access!.read!({} as never)).toBe(false)
+  })
+
+  it('throws, naming the model and field, when credentialFields names a field missing from a derived model', () => {
+    const plugin = {
+      id: 'test-typo',
+      schema: {
+        widget: { fields: { apiKey: { type: 'string' as const } } },
+      },
+    }
+
+    expect(() => deriveAuthLists(defaultModels, {}, {}, [plugin], { widget: ['apiKye'] })).toThrow(
+      /widget\.apiKye.*no field "apiKye"/,
+    )
+  })
+
+  it('is a silent no-op when credentialFields names a model that is not derived at all', () => {
+    // No plugin registers `passkey` here, so `tables` never contains it.
+    expect(() =>
+      deriveAuthLists(defaultModels, {}, {}, [], { passkey: ['publicKey'] }),
+    ).not.toThrow()
+  })
+
+  it('throws, naming the model and field, when credentialFields names an id-referencing relationship field', () => {
+    // An id-referencing field (references.field === 'id') derives to a
+    // relationship(), never a scalar — withCredentialAccess only ever runs on
+    // the scalar-field path, so a deny registered against one would silently
+    // never apply. Reject the config instead of accepting a no-op.
+    const plugin = {
+      id: 'test-fk-credential',
+      schema: {
+        widget: {
+          fields: {
+            ownerId: { type: 'string' as const, references: { model: 'user', field: 'id' } },
+          },
+        },
+      },
+    }
+
+    expect(() => deriveAuthLists(defaultModels, {}, {}, [plugin], { widget: ['ownerId'] })).toThrow(
+      /widget\.ownerId.*relationship field.*"user\.id"/,
+    )
+  })
+})
+
 describe('deriveAuthLists - extendUserList', () => {
   it('adds custom fields to the derived user list', () => {
     const { lists } = deriveAuthLists(