@opensaas/stack-core 0.29.0 → 0.31.0

package/src/access/multi-column-read-write.test.ts

@@ -1,6 +1,6 @@
 import { describe, it, expect } from 'vitest'
 import { filterReadableFields } from './field-visibility.js'
-import { executeFieldResolveInputHooks } from '../hooks/index.js'
+import { executeFieldResolveInputHooks, splitMultiColumnFields } from '../hooks/index.js'
 import type { FieldConfig } from '../config/types.js'
 import type { AccessContext, FieldAccess } from './types.js'
 
@@ -10,6 +10,13 @@ import type { AccessContext, FieldAccess } from './types.js'
  * field-agnostic: they assert that ANY field implementing
  * getColumnNames/assembleColumns/splitColumns is assembled on read (raw columns
  * stripped) and split on write.
+ *
+ * The write side is split across two phases (#789): `executeFieldResolveInputHooks`
+ * (Phase 1.5) resolves the field's value under its LOGICAL key only — no split —
+ * so that validation (Phase 2-3, not exercised by these field-agnostic unit
+ * tests; see the Hook Pipeline / Write Pipeline test suites) runs against the
+ * logical value first. `splitMultiColumnFields` (Phase 4) then replaces the
+ * logical key with its physical per-part columns, AFTER validation has passed.
  */
 
 // A minimal multi-column field: two physical columns `m_url` and `m_size`
@@ -113,10 +120,10 @@ describe('multi-column read assembly (filterReadableFields)', () => {
   })
 })
 
-describe('multi-column write split (executeFieldResolveInputHooks)', () => {
+describe('multi-column resolveInput (executeFieldResolveInputHooks) does NOT split (#789)', () => {
   const fields = { media: multiColumnField() }
 
-  it('splits the logical value into per-part columns and removes the logical key', async () => {
+  it('resolves the field under its LOGICAL key and leaves it unsplit', async () => {
     const inputData = { media: { url: 'https://x/y.jpg', size: 99 } }
     const result = await executeFieldResolveInputHooks(
       inputData,
@@ -126,33 +133,81 @@ describe('multi-column write split (executeFieldResolveInputHooks)', () => {
       makeContext(),
       'Post',
     )
+    // Still under the logical key — no split, no per-part columns yet.
+    expect(result).toEqual({ media: { url: 'https://x/y.jpg', size: 99 } })
+    expect('m_url' in result).toBe(false)
+    expect('m_size' in result).toBe(false)
+  })
+
+  it('passes an unrecognised value through unsplit, under the logical key', async () => {
+    // The field's own resolveInput fallback (see fixture: "unknown → return as
+    // is and let validation catch it") must be able to hand this value to
+    // validation BEFORE any split happens.
+    const inputData = { media: 'not-a-valid-shape' }
+    const result = await executeFieldResolveInputHooks(
+      inputData,
+      { ...inputData },
+      fields,
+      'update',
+      makeContext(),
+      'Post',
+    )
+    expect(result).toEqual({ media: 'not-a-valid-shape' })
+  })
+
+  it('does not touch the field when it is absent from the write', async () => {
+    const inputData = { title: 'no media in payload' }
+    const result = await executeFieldResolveInputHooks(
+      inputData,
+      { ...inputData },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- inline field configs
+      { ...fields, title: { type: 'text' } as any },
+      'update',
+      makeContext(),
+      'Post',
+    )
+    expect(result).toEqual({ title: 'no media in payload' })
+    expect('media' in result).toBe(false)
+  })
+})
+
+describe('multi-column write split (splitMultiColumnFields, AFTER validation — #789)', () => {
+  const fields = { media: multiColumnField() }
+
+  it('splits the logical value into per-part columns and removes the logical key', async () => {
+    const inputData = { media: { url: 'https://x/y.jpg', size: 99 } }
+    const result = await splitMultiColumnFields(
+      inputData,
+      { ...inputData },
+      fields,
+      'create',
+      makeContext(),
+    )
     expect(result).toEqual({ m_url: 'https://x/y.jpg', m_size: 99 })
     expect('media' in result).toBe(false)
   })
 
   it('splitting null clears all per-part columns', async () => {
     const inputData = { media: null }
-    const result = await executeFieldResolveInputHooks(
+    const result = await splitMultiColumnFields(
       inputData,
       { ...inputData },
       fields,
       'update',
       makeContext(),
-      'Post',
     )
     expect(result).toEqual({ m_url: null, m_size: null })
   })
 
   it('does not touch the columns when the logical field is absent from the write', async () => {
     const inputData = { title: 'no media in payload' }
-    const result = await executeFieldResolveInputHooks(
+    const result = await splitMultiColumnFields(
       inputData,
       { ...inputData },
       // eslint-disable-next-line @typescript-eslint/no-explicit-any -- inline field configs
       { ...fields, title: { type: 'text' } as any },
       'update',
       makeContext(),
-      'Post',
     )
     expect(result).toEqual({ title: 'no media in payload' })
     expect('m_url' in result).toBe(false)
@@ -163,13 +218,12 @@ describe('multi-column write split respects field-level write access', () => {
   it('does NOT write any per-part columns when update access is denied', async () => {
     const fields = { media: multiColumnField({ update: () => false }) }
     const inputData = { media: { url: 'https://x/y.jpg', size: 99 } }
-    const result = await executeFieldResolveInputHooks(
+    const result = await splitMultiColumnFields(
       inputData,
       { ...inputData },
       fields,
       'update',
       makeContext(),
-      'Post',
     )
     // The logical key is dropped (it is not a real column) AND none of its
     // per-part columns are written — identical to how filterWritableFields
@@ -183,13 +237,12 @@ describe('multi-column write split respects field-level write access', () => {
   it('does NOT write any per-part columns when create access is denied', async () => {
     const fields = { media: multiColumnField({ create: () => false }) }
     const inputData = { media: { url: 'https://x/y.jpg', size: 99 } }
-    const result = await executeFieldResolveInputHooks(
+    const result = await splitMultiColumnFields(
       inputData,
       { ...inputData },
       fields,
       'create',
       makeContext(),
-      'Post',
     )
     expect(result).toEqual({})
     expect('m_url' in result).toBe(false)
@@ -198,13 +251,12 @@ describe('multi-column write split respects field-level write access', () => {
   it('still splits/writes the columns when write access is granted', async () => {
     const fields = { media: multiColumnField({ update: () => true, create: () => true }) }
     const inputData = { media: { url: 'https://x/y.jpg', size: 99 } }
-    const result = await executeFieldResolveInputHooks(
+    const result = await splitMultiColumnFields(
       inputData,
       { ...inputData },
       fields,
       'update',
       makeContext(),
-      'Post',
     )
     expect(result).toEqual({ m_url: 'https://x/y.jpg', m_size: 99 })
     expect('media' in result).toBe(false)
@@ -214,13 +266,12 @@ describe('multi-column write split respects field-level write access', () => {
     // A field that denies `update` must still be writable on `create`.
     const fields = { media: multiColumnField({ update: () => false }) }
     const inputData = { media: { url: 'https://x/y.jpg', size: 99 } }
-    const result = await executeFieldResolveInputHooks(
+    const result = await splitMultiColumnFields(
       inputData,
       { ...inputData },
       fields,
       'create',
       makeContext(),
-      'Post',
     )
     expect(result).toEqual({ m_url: 'https://x/y.jpg', m_size: 99 })
   })
@@ -228,13 +279,12 @@ describe('multi-column write split respects field-level write access', () => {
   it('sudo bypasses the field-access gate and still splits', async () => {
     const fields = { media: multiColumnField({ update: () => false }) }
     const inputData = { media: { url: 'https://x/y.jpg', size: 99 } }
-    const result = await executeFieldResolveInputHooks(
+    const result = await splitMultiColumnFields(
       inputData,
       { ...inputData },
       fields,
       'update',
       makeContext({ isSudo: true }),
-      'Post',
     )
     expect(result).toEqual({ m_url: 'https://x/y.jpg', m_size: 99 })
   })
@@ -242,13 +292,12 @@ describe('multi-column write split respects field-level write access', () => {
   it('a multi-column field WITHOUT field-level access splits exactly as before', async () => {
     const fields = { media: multiColumnField() }
     const inputData = { media: { url: 'https://x/y.jpg', size: 99 } }
-    const result = await executeFieldResolveInputHooks(
+    const result = await splitMultiColumnFields(
       inputData,
       { ...inputData },
       fields,
       'update',
       makeContext(),
-      'Post',
     )
     expect(result).toEqual({ m_url: 'https://x/y.jpg', m_size: 99 })
   })

package/src/access/relationship-count.test.ts

@@ -0,0 +1,269 @@
+import { describe, it, expect, vi } from 'vitest'
+import { list } from '../config/index.js'
+import { text, relationship, integer } from '../fields/index.js'
+import type { OpenSaasConfig } from '../config/types.js'
+import type { AccessContext } from './types.js'
+import {
+  buildRelationshipCountSelect,
+  resolveRelationshipCountFilters,
+  isToManyRelationshipField,
+} from './relationship-count.js'
+import { RELATIONSHIP_COUNT_FILTER_KEY } from '../filter/types.js'
+
+/**
+ * Access-scoped to-many relationship counts (issue #732). Verifies:
+ *  • the filtered `_count` select folds in the related list's query access,
+ *  • a denied related list is omitted (its count renders as 0, never a leak),
+ *  • count-filter markers resolve to access-scoped `{ id: { in } }` via a single
+ *    secured read (never a per-row query), including the fully-denied case.
+ */
+
+// User (published-only for anon via a filter), plus a Widget list that is fully
+// closed by default (no query access) to prove the denied path.
+function makeConfig(): OpenSaasConfig {
+  return {
+    db: { provider: 'sqlite', prismaClientConstructor: () => null as never },
+    lists: {
+      User: list({
+        fields: {
+          name: text(),
+          posts: relationship({ ref: 'Post.author', many: true }),
+          widgets: relationship({ ref: 'Widget', many: true }),
+          manager: relationship({ ref: 'User' }), // to-one — never counted
+        },
+        access: { operation: { query: () => true } },
+      }),
+      Post: list({
+        fields: { title: text(), views: integer(), author: relationship({ ref: 'User.posts' }) },
+        // Only published posts are visible → the count must be access-scoped.
+        access: { operation: { query: () => ({ status: { equals: 'published' } }) } },
+      }),
+      // Widget ships closed (no access block) → query denied by default.
+      Widget: list({ fields: { name: text() } }),
+    },
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+  } as any
+}
+
+function makeContext(
+  findMany?: (args: unknown) => Promise<Array<Record<string, unknown>>>,
+): AccessContext {
+  return {
+    session: null,
+    _isSudo: false,
+    _resolveOutputCounter: { depth: 0 },
+    db: findMany ? { user: { findMany } } : {},
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal context for unit test
+  } as any
+}
+
+describe('isToManyRelationshipField', () => {
+  const config = makeConfig()
+  const userFields = config.lists.User.fields
+  it('is true only for a to-many relationship', () => {
+    expect(isToManyRelationshipField(userFields.posts)).toBe(true)
+    expect(isToManyRelationshipField(userFields.widgets)).toBe(true)
+    expect(isToManyRelationshipField(userFields.manager)).toBe(false)
+    expect(isToManyRelationshipField(userFields.name)).toBe(false)
+  })
+})
+
+describe('buildRelationshipCountSelect', () => {
+  it("folds the related list's query filter into each to-many count and omits denied/to-one", async () => {
+    const config = makeConfig()
+    const select = await buildRelationshipCountSelect(
+      config.lists.User,
+      { session: null, context: makeContext() },
+      config,
+    )
+    // `posts` → access-scoped where; `widgets` → denied (omitted); `manager` →
+    // to-one (never counted).
+    expect(select).toEqual({ posts: { where: { status: { equals: 'published' } } } })
+  })
+
+  it('uses a bare `true` when the related list is fully readable', async () => {
+    const config: OpenSaasConfig = {
+      db: { provider: 'sqlite', prismaClientConstructor: () => null as never },
+      lists: {
+        Tag: list({ fields: { name: text() }, access: { operation: { query: () => true } } }),
+        Post: list({ fields: { title: text(), tags: relationship({ ref: 'Tag', many: true }) } }),
+      },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+    } as any
+    const select = await buildRelationshipCountSelect(
+      config.lists.Post,
+      { session: null, context: makeContext() },
+      config,
+    )
+    expect(select).toEqual({ tags: true })
+  })
+
+  it('returns undefined when there are no countable to-many relationships', async () => {
+    const config: OpenSaasConfig = {
+      db: { provider: 'sqlite', prismaClientConstructor: () => null as never },
+      lists: { Post: list({ fields: { title: text() } }) },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+    } as any
+    const select = await buildRelationshipCountSelect(
+      config.lists.Post,
+      { session: null, context: makeContext() },
+      config,
+    )
+    expect(select).toBeUndefined()
+  })
+})
+
+describe('resolveRelationshipCountFilters', () => {
+  const marker = (operator: string, value: number) => ({
+    posts: { [RELATIONSHIP_COUNT_FILTER_KEY]: { operator, value } },
+  })
+
+  it('returns the where unchanged when there are no count markers', async () => {
+    const config = makeConfig()
+    const where = { name: { contains: 'ada' } }
+    const resolved = await resolveRelationshipCountFilters(
+      where,
+      config.lists.User,
+      'User',
+      { session: null, context: makeContext() },
+      config,
+    )
+    expect(resolved).toBe(where)
+  })
+
+  it('resolves a count marker to an access-scoped { id: { in } } via a single secured read', async () => {
+    const config = makeConfig()
+    // Two users; the secured read returns each with its access-scoped `_count`.
+    const findMany = vi.fn(async () => [
+      { id: 'u1', _count: { posts: 3 } },
+      { id: 'u2', _count: { posts: 7 } },
+    ])
+    const resolved = await resolveRelationshipCountFilters(
+      marker('gt', 5),
+      config.lists.User,
+      'User',
+      { session: null, context: makeContext(findMany) },
+      config,
+    )
+    // Only u2 (7 > 5) matches; the read was access-scoped (published-only count).
+    expect(resolved).toEqual({ id: { in: ['u2'] } })
+    expect(findMany).toHaveBeenCalledTimes(1)
+    expect(findMany).toHaveBeenCalledWith({
+      include: { _count: { select: { posts: { where: { status: { equals: 'published' } } } } } },
+    })
+  })
+
+  it('includes zero-count rows for comparisons that admit zero (no complement bug)', async () => {
+    const config = makeConfig()
+    const findMany = vi.fn(async () => [
+      { id: 'u1', _count: { posts: 0 } },
+      { id: 'u2', _count: { posts: 4 } },
+    ])
+    const resolved = await resolveRelationshipCountFilters(
+      marker('lt', 1), // count < 1 → only the zero-count user
+      config.lists.User,
+      'User',
+      { session: null, context: makeContext(findMany) },
+      config,
+    )
+    expect(resolved).toEqual({ id: { in: ['u1'] } })
+  })
+
+  it('resolves a denied related list without any query: count is always 0', async () => {
+    const config = makeConfig()
+    const findMany = vi.fn(async () => [])
+    // `widgets`' related list (Widget) is fully denied → every count is 0.
+    const where = { widgets: { [RELATIONSHIP_COUNT_FILTER_KEY]: { operator: 'gt', value: 5 } } }
+    const resolved = await resolveRelationshipCountFilters(
+      where,
+      config.lists.User,
+      'User',
+      { session: null, context: makeContext(findMany) },
+      config,
+    )
+    // 0 is not > 5 → nothing matches, and no read was issued.
+    expect(resolved).toEqual({ id: { in: [] } })
+    expect(findMany).not.toHaveBeenCalled()
+  })
+
+  it('preserves sibling conditions, ANDing the resolved id constraint', async () => {
+    const config = makeConfig()
+    const findMany = vi.fn(async () => [{ id: 'u2', _count: { posts: 7 } }])
+    const where = { AND: [{ name: { contains: 'ada' } }, marker('gte', 1)] }
+    const resolved = await resolveRelationshipCountFilters(
+      where,
+      config.lists.User,
+      'User',
+      { session: null, context: makeContext(findMany) },
+      config,
+    )
+    expect(resolved).toEqual({ AND: [{ name: { contains: 'ada' } }, { id: { in: ['u2'] } }] })
+  })
+
+  it('reads with only the filtered `_count` include — no over-fetching `select` projection', async () => {
+    const config = makeConfig()
+    const findMany = vi.fn((_args: unknown) =>
+      Promise.resolve([{ id: 'u2', _count: { posts: 7 } }]),
+    )
+    await resolveRelationshipCountFilters(
+      marker('gt', 5),
+      config.lists.User,
+      'User',
+      { session: null, context: makeContext(findMany) },
+      config,
+    )
+    // The secured read is issued with the access-scoped `_count` include and NO
+    // `select` — the secured findMany does not honour `select`, so forcing one
+    // would be an ignored no-op. Access-scoping lives entirely in `_count.where`.
+    expect(findMany).toHaveBeenCalledTimes(1)
+    const callArg = findMany.mock.calls[0][0]
+    expect(callArg).not.toHaveProperty('select')
+    expect(callArg).toEqual({
+      include: { _count: { select: { posts: { where: { status: { equals: 'published' } } } } } },
+    })
+  })
+
+  it('preserves a sibling condition co-present in the same member as the marker', async () => {
+    const config = makeConfig()
+    const findMany = vi.fn(async () => [{ id: 'u2', _count: { posts: 7 } }])
+    // A single AND-member carrying BOTH a scalar condition and the count marker.
+    // The marker resolution must keep the co-present sibling, not replace the
+    // member wholesale (guards against a future filter-engine change that merges
+    // conditions into one member).
+    const where = {
+      AND: [
+        {
+          name: { contains: 'ada' },
+          posts: { [RELATIONSHIP_COUNT_FILTER_KEY]: { operator: 'gt', value: 5 } },
+        },
+      ],
+    }
+    const resolved = await resolveRelationshipCountFilters(
+      where,
+      config.lists.User,
+      'User',
+      { session: null, context: makeContext(findMany) },
+      config,
+    )
+    expect(resolved).toEqual({ name: { contains: 'ada' }, id: { in: ['u2'] } })
+  })
+
+  it('ANDs the resolved id constraint with a co-present sibling id condition (no silent drop)', async () => {
+    const config = makeConfig()
+    const findMany = vi.fn(async () => [{ id: 'u2', _count: { posts: 7 } }])
+    // Contrived: a member carrying its own `id` condition alongside the marker.
+    // Spreading would let one `id` overwrite the other; instead both are ANDed.
+    const where = {
+      id: { in: ['u1', 'u2'] },
+      posts: { [RELATIONSHIP_COUNT_FILTER_KEY]: { operator: 'gt', value: 5 } },
+    }
+    const resolved = await resolveRelationshipCountFilters(
+      where,
+      config.lists.User,
+      'User',
+      { session: null, context: makeContext(findMany) },
+      config,
+    )
+    expect(resolved).toEqual({ AND: [{ id: { in: ['u1', 'u2'] } }, { id: { in: ['u2'] } }] })
+  })
+})