@opensaas/stack-core 0.30.0 → 0.31.0

package/dist/access/relationship-count.test.js

@@ -0,0 +1,185 @@
+import { describe, it, expect, vi } from 'vitest';
+import { list } from '../config/index.js';
+import { text, relationship, integer } from '../fields/index.js';
+import { buildRelationshipCountSelect, resolveRelationshipCountFilters, isToManyRelationshipField, } from './relationship-count.js';
+import { RELATIONSHIP_COUNT_FILTER_KEY } from '../filter/types.js';
+/**
+ * Access-scoped to-many relationship counts (issue #732). Verifies:
+ *  • the filtered `_count` select folds in the related list's query access,
+ *  • a denied related list is omitted (its count renders as 0, never a leak),
+ *  • count-filter markers resolve to access-scoped `{ id: { in } }` via a single
+ *    secured read (never a per-row query), including the fully-denied case.
+ */
+// User (published-only for anon via a filter), plus a Widget list that is fully
+// closed by default (no query access) to prove the denied path.
+function makeConfig() {
+    return {
+        db: { provider: 'sqlite', prismaClientConstructor: () => null },
+        lists: {
+            User: list({
+                fields: {
+                    name: text(),
+                    posts: relationship({ ref: 'Post.author', many: true }),
+                    widgets: relationship({ ref: 'Widget', many: true }),
+                    manager: relationship({ ref: 'User' }), // to-one — never counted
+                },
+                access: { operation: { query: () => true } },
+            }),
+            Post: list({
+                fields: { title: text(), views: integer(), author: relationship({ ref: 'User.posts' }) },
+                // Only published posts are visible → the count must be access-scoped.
+                access: { operation: { query: () => ({ status: { equals: 'published' } }) } },
+            }),
+            // Widget ships closed (no access block) → query denied by default.
+            Widget: list({ fields: { name: text() } }),
+        },
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+    };
+}
+function makeContext(findMany) {
+    return {
+        session: null,
+        _isSudo: false,
+        _resolveOutputCounter: { depth: 0 },
+        db: findMany ? { user: { findMany } } : {},
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal context for unit test
+    };
+}
+describe('isToManyRelationshipField', () => {
+    const config = makeConfig();
+    const userFields = config.lists.User.fields;
+    it('is true only for a to-many relationship', () => {
+        expect(isToManyRelationshipField(userFields.posts)).toBe(true);
+        expect(isToManyRelationshipField(userFields.widgets)).toBe(true);
+        expect(isToManyRelationshipField(userFields.manager)).toBe(false);
+        expect(isToManyRelationshipField(userFields.name)).toBe(false);
+    });
+});
+describe('buildRelationshipCountSelect', () => {
+    it("folds the related list's query filter into each to-many count and omits denied/to-one", async () => {
+        const config = makeConfig();
+        const select = await buildRelationshipCountSelect(config.lists.User, { session: null, context: makeContext() }, config);
+        // `posts` → access-scoped where; `widgets` → denied (omitted); `manager` →
+        // to-one (never counted).
+        expect(select).toEqual({ posts: { where: { status: { equals: 'published' } } } });
+    });
+    it('uses a bare `true` when the related list is fully readable', async () => {
+        const config = {
+            db: { provider: 'sqlite', prismaClientConstructor: () => null },
+            lists: {
+                Tag: list({ fields: { name: text() }, access: { operation: { query: () => true } } }),
+                Post: list({ fields: { title: text(), tags: relationship({ ref: 'Tag', many: true }) } }),
+            },
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+        };
+        const select = await buildRelationshipCountSelect(config.lists.Post, { session: null, context: makeContext() }, config);
+        expect(select).toEqual({ tags: true });
+    });
+    it('returns undefined when there are no countable to-many relationships', async () => {
+        const config = {
+            db: { provider: 'sqlite', prismaClientConstructor: () => null },
+            lists: { Post: list({ fields: { title: text() } }) },
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+        };
+        const select = await buildRelationshipCountSelect(config.lists.Post, { session: null, context: makeContext() }, config);
+        expect(select).toBeUndefined();
+    });
+});
+describe('resolveRelationshipCountFilters', () => {
+    const marker = (operator, value) => ({
+        posts: { [RELATIONSHIP_COUNT_FILTER_KEY]: { operator, value } },
+    });
+    it('returns the where unchanged when there are no count markers', async () => {
+        const config = makeConfig();
+        const where = { name: { contains: 'ada' } };
+        const resolved = await resolveRelationshipCountFilters(where, config.lists.User, 'User', { session: null, context: makeContext() }, config);
+        expect(resolved).toBe(where);
+    });
+    it('resolves a count marker to an access-scoped { id: { in } } via a single secured read', async () => {
+        const config = makeConfig();
+        // Two users; the secured read returns each with its access-scoped `_count`.
+        const findMany = vi.fn(async () => [
+            { id: 'u1', _count: { posts: 3 } },
+            { id: 'u2', _count: { posts: 7 } },
+        ]);
+        const resolved = await resolveRelationshipCountFilters(marker('gt', 5), config.lists.User, 'User', { session: null, context: makeContext(findMany) }, config);
+        // Only u2 (7 > 5) matches; the read was access-scoped (published-only count).
+        expect(resolved).toEqual({ id: { in: ['u2'] } });
+        expect(findMany).toHaveBeenCalledTimes(1);
+        expect(findMany).toHaveBeenCalledWith({
+            include: { _count: { select: { posts: { where: { status: { equals: 'published' } } } } } },
+        });
+    });
+    it('includes zero-count rows for comparisons that admit zero (no complement bug)', async () => {
+        const config = makeConfig();
+        const findMany = vi.fn(async () => [
+            { id: 'u1', _count: { posts: 0 } },
+            { id: 'u2', _count: { posts: 4 } },
+        ]);
+        const resolved = await resolveRelationshipCountFilters(marker('lt', 1), // count < 1 → only the zero-count user
+        config.lists.User, 'User', { session: null, context: makeContext(findMany) }, config);
+        expect(resolved).toEqual({ id: { in: ['u1'] } });
+    });
+    it('resolves a denied related list without any query: count is always 0', async () => {
+        const config = makeConfig();
+        const findMany = vi.fn(async () => []);
+        // `widgets`' related list (Widget) is fully denied → every count is 0.
+        const where = { widgets: { [RELATIONSHIP_COUNT_FILTER_KEY]: { operator: 'gt', value: 5 } } };
+        const resolved = await resolveRelationshipCountFilters(where, config.lists.User, 'User', { session: null, context: makeContext(findMany) }, config);
+        // 0 is not > 5 → nothing matches, and no read was issued.
+        expect(resolved).toEqual({ id: { in: [] } });
+        expect(findMany).not.toHaveBeenCalled();
+    });
+    it('preserves sibling conditions, ANDing the resolved id constraint', async () => {
+        const config = makeConfig();
+        const findMany = vi.fn(async () => [{ id: 'u2', _count: { posts: 7 } }]);
+        const where = { AND: [{ name: { contains: 'ada' } }, marker('gte', 1)] };
+        const resolved = await resolveRelationshipCountFilters(where, config.lists.User, 'User', { session: null, context: makeContext(findMany) }, config);
+        expect(resolved).toEqual({ AND: [{ name: { contains: 'ada' } }, { id: { in: ['u2'] } }] });
+    });
+    it('reads with only the filtered `_count` include — no over-fetching `select` projection', async () => {
+        const config = makeConfig();
+        const findMany = vi.fn((_args) => Promise.resolve([{ id: 'u2', _count: { posts: 7 } }]));
+        await resolveRelationshipCountFilters(marker('gt', 5), config.lists.User, 'User', { session: null, context: makeContext(findMany) }, config);
+        // The secured read is issued with the access-scoped `_count` include and NO
+        // `select` — the secured findMany does not honour `select`, so forcing one
+        // would be an ignored no-op. Access-scoping lives entirely in `_count.where`.
+        expect(findMany).toHaveBeenCalledTimes(1);
+        const callArg = findMany.mock.calls[0][0];
+        expect(callArg).not.toHaveProperty('select');
+        expect(callArg).toEqual({
+            include: { _count: { select: { posts: { where: { status: { equals: 'published' } } } } } },
+        });
+    });
+    it('preserves a sibling condition co-present in the same member as the marker', async () => {
+        const config = makeConfig();
+        const findMany = vi.fn(async () => [{ id: 'u2', _count: { posts: 7 } }]);
+        // A single AND-member carrying BOTH a scalar condition and the count marker.
+        // The marker resolution must keep the co-present sibling, not replace the
+        // member wholesale (guards against a future filter-engine change that merges
+        // conditions into one member).
+        const where = {
+            AND: [
+                {
+                    name: { contains: 'ada' },
+                    posts: { [RELATIONSHIP_COUNT_FILTER_KEY]: { operator: 'gt', value: 5 } },
+                },
+            ],
+        };
+        const resolved = await resolveRelationshipCountFilters(where, config.lists.User, 'User', { session: null, context: makeContext(findMany) }, config);
+        expect(resolved).toEqual({ name: { contains: 'ada' }, id: { in: ['u2'] } });
+    });
+    it('ANDs the resolved id constraint with a co-present sibling id condition (no silent drop)', async () => {
+        const config = makeConfig();
+        const findMany = vi.fn(async () => [{ id: 'u2', _count: { posts: 7 } }]);
+        // Contrived: a member carrying its own `id` condition alongside the marker.
+        // Spreading would let one `id` overwrite the other; instead both are ANDed.
+        const where = {
+            id: { in: ['u1', 'u2'] },
+            posts: { [RELATIONSHIP_COUNT_FILTER_KEY]: { operator: 'gt', value: 5 } },
+        };
+        const resolved = await resolveRelationshipCountFilters(where, config.lists.User, 'User', { session: null, context: makeContext(findMany) }, config);
+        expect(resolved).toEqual({ AND: [{ id: { in: ['u1', 'u2'] } }, { id: { in: ['u2'] } }] });
+    });
+});
+//# sourceMappingURL=relationship-count.test.js.map

package/dist/access/relationship-count.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relationship-count.test.js","sourceRoot":"","sources":["../../src/access/relationship-count.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AACjD,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AACzC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAGhE,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,EAC/B,yBAAyB,GAC1B,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAA;AAElE;;;;;;GAMG;AAEH,gFAAgF;AAChF,gEAAgE;AAChE,SAAS,UAAU;IACjB,OAAO;QACL,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,uBAAuB,EAAE,GAAG,EAAE,CAAC,IAAa,EAAE;QACxE,KAAK,EAAE;YACL,IAAI,EAAE,IAAI,CAAC;gBACT,MAAM,EAAE;oBACN,IAAI,EAAE,IAAI,EAAE;oBACZ,KAAK,EAAE,YAAY,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;oBACvD,OAAO,EAAE,YAAY,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;oBACpD,OAAO,EAAE,YAAY,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,yBAAyB;iBAClE;gBACD,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;aAC7C,CAAC;YACF,IAAI,EAAE,IAAI,CAAC;gBACT,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,EAAE;gBACxF,sEAAsE;gBACtE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE;aAC9E,CAAC;YACF,mEAAmE;YACnE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;SAC3C;QACD,8FAA8F;KACxF,CAAA;AACV,CAAC;AAED,SAAS,WAAW,CAClB,QAAqE;IAErE,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,KAAK;QACd,qBAAqB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;QACnC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;QAC1C,+FAA+F;KACzF,CAAA;AACV,CAAC;AAED,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;IAC3B,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAA;IAC3C,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,yBAAyB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9D,MAAM,CAAC,yBAAyB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChE,MAAM,CAAC,yBAAyB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACjE,MAAM,CAAC,yBAAyB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;QACrG,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAC3B,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAC/C,MAAM,CAAC,KAAK,CAAC,IAAI,EACjB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EACzC,MAAM,CACP,CAAA;QACD,2EAA2E;QAC3E,0BAA0B;QAC1B,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;IACnF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,MAAM,GAAmB;YAC7B,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,uBAAuB,EAAE,GAAG,EAAE,CAAC,IAAa,EAAE;YACxE,KAAK,EAAE;gBACL,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;gBACrF,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;aAC1F;YACD,8FAA8F;SACxF,CAAA;QACR,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAC/C,MAAM,CAAC,KAAK,CAAC,IAAI,EACjB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EACzC,MAAM,CACP,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,MAAM,GAAmB;YAC7B,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,uBAAuB,EAAE,GAAG,EAAE,CAAC,IAAa,EAAE;YACxE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE;YACpD,8FAA8F;SACxF,CAAA;QACR,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAC/C,MAAM,CAAC,KAAK,CAAC,IAAI,EACjB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EACzC,MAAM,CACP,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAA;IAChC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,MAAM,MAAM,GAAG,CAAC,QAAgB,EAAE,KAAa,EAAE,EAAE,CAAC,CAAC;QACnD,KAAK,EAAE,EAAE,CAAC,6BAA6B,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;KAChE,CAAC,CAAA;IAEF,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAC3B,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAA;QAC3C,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CACpD,KAAK,EACL,MAAM,CAAC,KAAK,CAAC,IAAI,EACjB,MAAM,EACN,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EACzC,MAAM,CACP,CAAA;QACD,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;QACpG,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAC3B,4EAA4E;QAC5E,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;YACjC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAClC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;SACnC,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CACpD,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,EACf,MAAM,CAAC,KAAK,CAAC,IAAI,EACjB,MAAM,EACN,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,EACjD,MAAM,CACP,CAAA;QACD,8EAA8E;QAC9E,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;QAChD,MAAM,CAAC,QAAQ,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;QACzC,MAAM,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CAAC;YACpC,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;SAC3F,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAC3B,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;YACjC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAClC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;SACnC,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CACpD,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,uCAAuC;QACxD,MAAM,CAAC,KAAK,CAAC,IAAI,EACjB,MAAM,EACN,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,EACjD,MAAM,CACP,CAAA;QACD,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAC3B,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;QACtC,uEAAuE;QACvE,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,6BAA6B,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAA;QAC5F,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CACpD,KAAK,EACL,MAAM,CAAC,KAAK,CAAC,IAAI,EACjB,MAAM,EACN,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,EACjD,MAAM,CACP,CAAA;QACD,0DAA0D;QAC1D,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QAC5C,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;IACzC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAC3B,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;QACxE,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QACxE,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CACpD,KAAK,EACL,MAAM,CAAC,KAAK,CAAC,IAAI,EACjB,MAAM,EACN,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,EACjD,MAAM,CACP,CAAA;QACD,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;IAC5F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;QACpG,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAC3B,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,KAAc,EAAE,EAAE,CACxC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CACtD,CAAA;QACD,MAAM,+BAA+B,CACnC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,EACf,MAAM,CAAC,KAAK,CAAC,IAAI,EACjB,MAAM,EACN,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,EACjD,MAAM,CACP,CAAA;QACD,4EAA4E;QAC5E,2EAA2E;QAC3E,8EAA8E;QAC9E,MAAM,CAAC,QAAQ,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;QACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACzC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAA;QAC5C,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;YACtB,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;SAC3F,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAC3B,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;QACxE,6EAA6E;QAC7E,0EAA0E;QAC1E,6EAA6E;QAC7E,+BAA+B;QAC/B,MAAM,KAAK,GAAG;YACZ,GAAG,EAAE;gBACH;oBACE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;oBACzB,KAAK,EAAE,EAAE,CAAC,6BAA6B,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;iBACzE;aACF;SACF,CAAA;QACD,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CACpD,KAAK,EACL,MAAM,CAAC,KAAK,CAAC,IAAI,EACjB,MAAM,EACN,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,EACjD,MAAM,CACP,CAAA;QACD,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;QACvG,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAC3B,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;QACxE,4EAA4E;QAC5E,4EAA4E;QAC5E,MAAM,KAAK,GAAG;YACZ,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE;YACxB,KAAK,EAAE,EAAE,CAAC,6BAA6B,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;SACzE,CAAA;QACD,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CACpD,KAAK,EACL,MAAM,CAAC,KAAK,CAAC,IAAI,EACjB,MAAM,EACN,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,EACjD,MAAM,CACP,CAAA;QACD,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;IAC3F,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/access/relationship-label-filter.d.ts

@@ -0,0 +1,45 @@
+import type { Session, AccessContext } from './types.js';
+import type { OpenSaasConfig, ListConfig, FieldConfig } from '../config/types.js';
+/**
+ * Access-scoped to-one relationship label filters for the admin list view
+ * (issue #749).
+ *
+ * A to-one relationship's Filter spec (`author:Ada` → `{ author: { is: { name:
+ * { contains: 'Ada' } } } }`) is a pure mapper (see `relationship()` in
+ * `fields/index.ts`) — it has no way to consult the related list's access
+ * control, so the nested `is` clause it emits runs as an unscoped Prisma
+ * sub-filter against the related table. The parent list's own access filter
+ * still scopes which parent rows are visible, but the nested condition itself
+ * is evaluated with no reference to the related list's `query` access — a
+ * session could distinguish parent rows by a related field it is not itself
+ * allowed to read (e.g. binary-searching `author:A`, `author:Ad`, `author:Ada`
+ * against a `User` list it cannot query).
+ *
+ * This module is the single place the related list's operation-level `query`
+ * access is folded into that nested `is` clause, mirroring how
+ * `relationship-count.ts` folds it into `_count` selects and count-filter
+ * markers. A fully denied related list makes the member never match — the
+ * token cannot be used to confirm or rule out a value on a field the session
+ * cannot read (narrowing-only, matching the count resolver's denied path).
+ */
+type LabelFilterArgs = {
+    session: Session | null;
+    context: AccessContext;
+};
+/**
+ * Whether a field is a to-one relationship — the only field kind whose Filter
+ * spec emits a nested `{ is: {...} } }` condition against the related list's
+ * label field.
+ */
+export declare function isToOneRelationshipField(field: FieldConfig | undefined): boolean;
+/**
+ * Replace any to-one relationship label-filter members in a filter `where`
+ * with access-scoped equivalents. Label-filter members only ever appear as
+ * top-level AND members (the relationship Filter spec does not declare
+ * `freeText`, so it never participates in the free-text OR), so this walks
+ * only the top level. Returns the `where` unchanged when it contains no such
+ * members, so lists without to-one relationship filters pay nothing.
+ */
+export declare function resolveRelationshipLabelFilters(where: Record<string, unknown> | undefined, listConfig: ListConfig<any>, args: LabelFilterArgs, config: OpenSaasConfig): Promise<Record<string, unknown> | undefined>;
+export {};
+//# sourceMappingURL=relationship-label-filter.d.ts.map

package/dist/access/relationship-label-filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relationship-label-filter.d.ts","sourceRoot":"","sources":["../../src/access/relationship-label-filter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAIjF;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,KAAK,eAAe,GAAG;IACrB,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IACvB,OAAO,EAAE,aAAa,CAAA;CACvB,CAAA;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,GAAG,OAAO,CAQhF;AAsCD;;;;;;;GAOG;AACH,wBAAsB,+BAA+B,CACnD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAE1C,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,EAC3B,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,CAyC9C"}

package/dist/access/relationship-label-filter.js

@@ -0,0 +1,93 @@
+import { checkAccess, getRelatedListConfig } from './engine.js';
+import { mergeResolvedMember } from './relationship-count.js';
+/**
+ * Whether a field is a to-one relationship — the only field kind whose Filter
+ * spec emits a nested `{ is: {...} } }` condition against the related list's
+ * label field.
+ */
+export function isToOneRelationshipField(field) {
+    return (field?.type === 'relationship' &&
+        !('many' in field && field.many === true) &&
+        'ref' in field &&
+        typeof field.ref === 'string' &&
+        field.ref.length > 0);
+}
+/** Narrow a filter member's field value to a `{ is: {...} } }` clause, if it is one. */
+function readIsClause(value) {
+    if (!value || typeof value !== 'object')
+        return null;
+    const isValue = value.is;
+    if (!isValue || typeof isValue !== 'object')
+        return null;
+    return isValue;
+}
+/**
+ * Resolve one to-one relationship label-filter member into an access-scoped
+ * condition by ANDing the related list's `query` access filter into the nested
+ * `is` clause. Returns `{ id: { in: [] } }` (never matches) when the related
+ * list is fully denied, the original member unchanged when it is fully
+ * readable, and the `is` clause ANDed with the access filter otherwise.
+ */
+async function resolveOneLabelFilter(field, fieldName, isClause, args, config) {
+    if (!('ref' in field) || typeof field.ref !== 'string') {
+        return { [fieldName]: { is: isClause } };
+    }
+    const related = getRelatedListConfig(field.ref, config);
+    if (!related)
+        return { [fieldName]: { is: isClause } };
+    const queryAccess = related.listConfig.access?.operation?.query;
+    const result = await checkAccess(queryAccess, { session: args.session, context: args.context });
+    if (result === false)
+        return { id: { in: [] } };
+    if (result === true)
+        return { [fieldName]: { is: isClause } };
+    return { [fieldName]: { is: { AND: [result, isClause] } } };
+}
+/**
+ * Replace any to-one relationship label-filter members in a filter `where`
+ * with access-scoped equivalents. Label-filter members only ever appear as
+ * top-level AND members (the relationship Filter spec does not declare
+ * `freeText`, so it never participates in the free-text OR), so this walks
+ * only the top level. Returns the `where` unchanged when it contains no such
+ * members, so lists without to-one relationship filters pay nothing.
+ */
+export async function resolveRelationshipLabelFilters(where, 
+// eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+listConfig, args, config) {
+    if (!where)
+        return where;
+    const andValue = where.AND;
+    const members = Array.isArray(andValue)
+        ? andValue
+        : [where];
+    const findLabelFilter = (member) => {
+        for (const key of Object.keys(member)) {
+            const field = listConfig.fields[key];
+            if (!isToOneRelationshipField(field))
+                continue;
+            const isClause = readIsClause(member[key]);
+            if (!isClause)
+                continue;
+            return { field: key, isClause };
+        }
+        return null;
+    };
+    if (!members.some((member) => findLabelFilter(member) !== null)) {
+        return where;
+    }
+    const resolvedMembers = [];
+    for (const member of members) {
+        const found = findLabelFilter(member);
+        if (!found) {
+            resolvedMembers.push(member);
+            continue;
+        }
+        const field = listConfig.fields[found.field];
+        const resolved = await resolveOneLabelFilter(field, found.field, found.isClause, args, config);
+        const siblings = { ...member };
+        delete siblings[found.field];
+        resolvedMembers.push(mergeResolvedMember(siblings, resolved));
+    }
+    return resolvedMembers.length === 1 ? resolvedMembers[0] : { AND: resolvedMembers };
+}
+//# sourceMappingURL=relationship-label-filter.js.map

package/dist/access/relationship-label-filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relationship-label-filter.js","sourceRoot":"","sources":["../../src/access/relationship-label-filter.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AA8B7D;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAA8B;IACrE,OAAO,CACL,KAAK,EAAE,IAAI,KAAK,cAAc;QAC9B,CAAC,CAAC,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QACzC,KAAK,IAAI,KAAK;QACd,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;QAC7B,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CACrB,CAAA;AACH,CAAC;AAED,wFAAwF;AACxF,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACpD,MAAM,OAAO,GAAI,KAAiC,CAAC,EAAE,CAAA;IACrD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACxD,OAAO,OAAkC,CAAA;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,qBAAqB,CAClC,KAAkB,EAClB,SAAiB,EACjB,QAAiC,EACjC,IAAqB,EACrB,MAAsB;IAEtB,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACvD,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAA;IAC1C,CAAC;IACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACvD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAA;IAEtD,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAA;IAC/D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IAE/F,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAA;IAC/C,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAA;IAC7D,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAA;AAC7D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAA0C;AAC1C,qGAAqG;AACrG,UAA2B,EAC3B,IAAqB,EACrB,MAAsB;IAEtB,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IAExB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAA;IAC1B,MAAM,OAAO,GAAmC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QACrE,CAAC,CAAE,QAA2C;QAC9C,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IAEX,MAAM,eAAe,GAAG,CACtB,MAA+B,EAC8B,EAAE;QAC/D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACpC,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC;gBAAE,SAAQ;YAC9C,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;YAC1C,IAAI,CAAC,QAAQ;gBAAE,SAAQ;YACvB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAA;QACjC,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QAChE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,eAAe,GAAmC,EAAE,CAAA;IAC1D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;QACrC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAC5B,SAAQ;QACV,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC5C,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;QAE9F,MAAM,QAAQ,GAA4B,EAAE,GAAG,MAAM,EAAE,CAAA;QACvD,OAAO,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC5B,eAAe,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAA;IAC/D,CAAC;IAED,OAAO,eAAe,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,CAAA;AACrF,CAAC"}

package/dist/access/relationship-label-filter.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=relationship-label-filter.test.d.ts.map

package/dist/access/relationship-label-filter.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relationship-label-filter.test.d.ts","sourceRoot":"","sources":["../../src/access/relationship-label-filter.test.ts"],"names":[],"mappings":""}

package/dist/access/relationship-label-filter.test.js

@@ -0,0 +1,126 @@
+import { describe, it, expect } from 'vitest';
+import { list } from '../config/index.js';
+import { text, relationship, integer } from '../fields/index.js';
+import { resolveRelationshipLabelFilters, isToOneRelationshipField, } from './relationship-label-filter.js';
+/**
+ * Access-scoped to-one relationship label filters (issue #749). Verifies that
+ * `author:Ada` → `{ author: { is: { name: { contains: 'Ada' } } } }` gets the
+ * related list's `query` access folded into the nested `is` clause, so a
+ * session can never distinguish parent rows by a related field it cannot
+ * itself read.
+ */
+// Post is fully open; User (the `author` relation target) is scoped so only
+// active users are queryable; Widget ships fully closed (no access block).
+function makeConfig() {
+    return {
+        db: { provider: 'sqlite', prismaClientConstructor: () => null },
+        lists: {
+            User: list({
+                fields: { name: text(), active: integer() },
+                access: { operation: { query: () => ({ active: { equals: 1 } }) } },
+            }),
+            Post: list({
+                fields: {
+                    title: text(),
+                    views: integer(),
+                    author: relationship({ ref: 'User.posts' }),
+                    widget: relationship({ ref: 'Widget' }),
+                },
+                access: { operation: { query: () => true } },
+            }),
+            // Widget ships closed (no access block) → query denied by default.
+            Widget: list({ fields: { name: text() } }),
+        },
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+    };
+}
+function makeContext() {
+    return {
+        session: null,
+        _isSudo: false,
+        _resolveOutputCounter: { depth: 0 },
+        db: {},
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal context for unit test
+    };
+}
+describe('isToOneRelationshipField', () => {
+    const config = makeConfig();
+    const postFields = config.lists.Post.fields;
+    it('is true only for a to-one relationship', () => {
+        expect(isToOneRelationshipField(postFields.author)).toBe(true);
+        expect(isToOneRelationshipField(postFields.widget)).toBe(true);
+        expect(isToOneRelationshipField(postFields.title)).toBe(false);
+    });
+});
+describe('resolveRelationshipLabelFilters', () => {
+    it('returns the where unchanged when there are no label-filter members', async () => {
+        const config = makeConfig();
+        const where = { title: { contains: 'hello' } };
+        const resolved = await resolveRelationshipLabelFilters(where, config.lists.Post, { session: null, context: makeContext() }, config);
+        expect(resolved).toBe(where);
+    });
+    it("ANDs the related list's access filter into the nested `is` clause", async () => {
+        const config = makeConfig();
+        const where = { author: { is: { name: { contains: 'Ada' } } } };
+        const resolved = await resolveRelationshipLabelFilters(where, config.lists.Post, { session: null, context: makeContext() }, config);
+        expect(resolved).toEqual({
+            author: { is: { AND: [{ active: { equals: 1 } }, { name: { contains: 'Ada' } }] } },
+        });
+    });
+    it('leaves the member unchanged when the related list is fully readable', async () => {
+        const config = {
+            db: { provider: 'sqlite', prismaClientConstructor: () => null },
+            lists: {
+                Tag: list({ fields: { name: text() }, access: { operation: { query: () => true } } }),
+                Post: list({ fields: { title: text(), tag: relationship({ ref: 'Tag' }) } }),
+            },
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+        };
+        const where = { tag: { is: { name: { contains: 'news' } } } };
+        const resolved = await resolveRelationshipLabelFilters(where, config.lists.Post, { session: null, context: makeContext() }, config);
+        expect(resolved).toEqual(where);
+    });
+    it('resolves a fully denied related list to a never-matching member (no leak)', async () => {
+        const config = makeConfig();
+        const where = { widget: { is: { name: { contains: 'Gadget' } } } };
+        const resolved = await resolveRelationshipLabelFilters(where, config.lists.Post, { session: null, context: makeContext() }, config);
+        expect(resolved).toEqual({ id: { in: [] } });
+    });
+    it('preserves sibling conditions, ANDing the resolved id constraint for a denied member', async () => {
+        const config = makeConfig();
+        const where = {
+            AND: [{ title: { contains: 'hello' } }, { widget: { is: { name: { contains: 'Gadget' } } } }],
+        };
+        const resolved = await resolveRelationshipLabelFilters(where, config.lists.Post, { session: null, context: makeContext() }, config);
+        expect(resolved).toEqual({
+            AND: [{ title: { contains: 'hello' } }, { id: { in: [] } }],
+        });
+    });
+    it('preserves sibling conditions alongside the access-scoped nested `is` clause', async () => {
+        const config = makeConfig();
+        const where = {
+            AND: [{ title: { contains: 'hello' } }, { author: { is: { name: { contains: 'Ada' } } } }],
+        };
+        const resolved = await resolveRelationshipLabelFilters(where, config.lists.Post, { session: null, context: makeContext() }, config);
+        expect(resolved).toEqual({
+            AND: [
+                { title: { contains: 'hello' } },
+                { author: { is: { AND: [{ active: { equals: 1 } }, { name: { contains: 'Ada' } }] } } },
+            ],
+        });
+    });
+    it('composes with a to-many count marker member left untouched by this resolver', async () => {
+        const config = makeConfig();
+        const where = {
+            AND: [{ author: { is: { name: { contains: 'Ada' } } } }, { views: { gt: 10 } }],
+        };
+        const resolved = await resolveRelationshipLabelFilters(where, config.lists.Post, { session: null, context: makeContext() }, config);
+        expect(resolved).toEqual({
+            AND: [
+                { author: { is: { AND: [{ active: { equals: 1 } }, { name: { contains: 'Ada' } }] } } },
+                { views: { gt: 10 } },
+            ],
+        });
+    });
+});
+//# sourceMappingURL=relationship-label-filter.test.js.map

package/dist/access/relationship-label-filter.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relationship-label-filter.test.js","sourceRoot":"","sources":["../../src/access/relationship-label-filter.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AACzC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAGhE,OAAO,EACL,+BAA+B,EAC/B,wBAAwB,GACzB,MAAM,gCAAgC,CAAA;AAEvC;;;;;;GAMG;AAEH,4EAA4E;AAC5E,2EAA2E;AAC3E,SAAS,UAAU;IACjB,OAAO;QACL,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,uBAAuB,EAAE,GAAG,EAAE,CAAC,IAAa,EAAE;QACxE,KAAK,EAAE;YACL,IAAI,EAAE,IAAI,CAAC;gBACT,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE;gBAC3C,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;aACpE,CAAC;YACF,IAAI,EAAE,IAAI,CAAC;gBACT,MAAM,EAAE;oBACN,KAAK,EAAE,IAAI,EAAE;oBACb,KAAK,EAAE,OAAO,EAAE;oBAChB,MAAM,EAAE,YAAY,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC;oBAC3C,MAAM,EAAE,YAAY,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;iBACxC;gBACD,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE;aAC7C,CAAC;YACF,mEAAmE;YACnE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;SAC3C;QACD,8FAA8F;KACxF,CAAA;AACV,CAAC;AAED,SAAS,WAAW;IAClB,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,KAAK;QACd,qBAAqB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;QACnC,EAAE,EAAE,EAAE;QACN,+FAA+F;KACzF,CAAA;AACV,CAAC;AAED,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;IAC3B,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAA;IAE3C,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,wBAAwB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9D,MAAM,CAAC,wBAAwB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9D,MAAM,CAAC,wBAAwB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAC3B,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAA;QAC9C,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CACpD,KAAK,EACL,MAAM,CAAC,KAAK,CAAC,IAAI,EACjB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EACzC,MAAM,CACP,CAAA;QACD,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAC3B,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAA;QAC/D,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CACpD,KAAK,EACL,MAAM,CAAC,KAAK,CAAC,IAAI,EACjB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EACzC,MAAM,CACP,CAAA;QACD,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;YACvB,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;SACpF,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,MAAM,GAAmB;YAC7B,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,uBAAuB,EAAE,GAAG,EAAE,CAAC,IAAa,EAAE;YACxE,KAAK,EAAE;gBACL,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;gBACrF,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,YAAY,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;aAC7E;YACD,8FAA8F;SACxF,CAAA;QACR,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAA;QAC7D,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CACpD,KAAK,EACL,MAAM,CAAC,KAAK,CAAC,IAAI,EACjB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EACzC,MAAM,CACP,CAAA;QACD,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IACjC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAC3B,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAA;QAClE,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CACpD,KAAK,EACL,MAAM,CAAC,KAAK,CAAC,IAAI,EACjB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EACzC,MAAM,CACP,CAAA;QACD,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;IAC9C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;QACnG,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAC3B,MAAM,KAAK,GAAG;YACZ,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC;SAC9F,CAAA;QACD,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CACpD,KAAK,EACL,MAAM,CAAC,KAAK,CAAC,IAAI,EACjB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EACzC,MAAM,CACP,CAAA;QACD,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;YACvB,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;SAC5D,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAC3B,MAAM,KAAK,GAAG;YACZ,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC;SAC3F,CAAA;QACD,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CACpD,KAAK,EACL,MAAM,CAAC,KAAK,CAAC,IAAI,EACjB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EACzC,MAAM,CACP,CAAA;QACD,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;YACvB,GAAG,EAAE;gBACH,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;gBAChC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;aACxF;SACF,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAC3B,MAAM,KAAK,GAAG;YACZ,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;SAChF,CAAA;QACD,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CACpD,KAAK,EACL,MAAM,CAAC,KAAK,CAAC,IAAI,EACjB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EACzC,MAAM,CACP,CAAA;QACD,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;YACvB,GAAG,EAAE;gBACH,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;gBACvF,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;aACtB;SACF,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/config/index.d.ts

@@ -62,5 +62,5 @@ export declare function config(userConfig: OpenSaasConfig): OpenSaasConfig | Pro
  * ```
  */
 export declare function list<TTypeInfo extends import('./types.js').TypeInfo>(config: ListConfigInput<TTypeInfo>): ListConfig<TTypeInfo>;
-export type { OpenSaasConfig, OutputConfig, ListConfig, ListConfigInput, ListAccessControl, FieldConfig, BaseFieldConfig, TextField, IntegerField, CheckboxField, TimestampField, PasswordField, SelectField, RelationshipField, PrismaRelationResult, MultiColumnPrismaResult, JsonField, VirtualField, TypeDescriptor, TypeInfo, OperationAccess, Hooks, FieldHooks, FieldsWithTypeInfo, DatabaseConfig, SessionConfig, UIConfig, ListUIConfig, ListViewUIConfig, ThemeConfig, ThemePreset, ThemeColors, ThemeFonts, ThemeShadows, McpConfig, McpToolsConfig, McpAuthConfig, ListMcpConfig, McpCustomTool, FileMetadata, ImageMetadata, ImageTransformationResult, Plugin, PluginContext, GeneratedFiles, ResolveInputHookArgs, ValidateHookArgs, BeforeOperationHookArgs, AfterOperationHookArgs, FieldResolveInputHookArgs, FieldValidateHookArgs, FieldBeforeOperationHookArgs, FieldAfterOperationHookArgs, FieldResolveOutputHookArgs, } from './types.js';
+export type { OpenSaasConfig, OutputConfig, ListConfig, ListConfigInput, ListAccessControl, FieldConfig, BaseFieldConfig, TextField, IntegerField, CheckboxField, TimestampField, PasswordField, SelectField, RelationshipField, PrismaRelationResult, MultiColumnPrismaResult, JsonField, VirtualField, TypeDescriptor, TypeInfo, OperationAccess, Hooks, FieldHooks, FieldsWithTypeInfo, DatabaseConfig, SessionConfig, UIConfig, ListUIConfig, ListViewUIConfig, BulkAction, BulkActionContext, BulkActionResult, BulkActionVariant, ItemViewUIConfig, RelationshipItemViewConfig, ThemeConfig, ThemePreset, ThemeColors, ThemeFonts, ThemeShadows, McpConfig, McpToolsConfig, McpAuthConfig, ListMcpConfig, McpCustomTool, FileMetadata, ImageMetadata, ImageTransformationResult, Plugin, PluginContext, GeneratedFiles, ResolveInputHookArgs, ValidateHookArgs, BeforeOperationHookArgs, AfterOperationHookArgs, FieldResolveInputHookArgs, FieldValidateHookArgs, FieldBeforeOperationHookArgs, FieldAfterOperationHookArgs, FieldResolveOutputHookArgs, } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/config/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,UAAU,EACV,eAAe,EAGhB,MAAM,YAAY,CAAA;AA8BnB;;;;;;GAMG;AACH,wBAAgB,MAAM,CAAC,UAAU,EAAE,cAAc,GAAG,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAQ3F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,wBAAgB,IAAI,CAAC,SAAS,SAAS,OAAO,YAAY,EAAE,QAAQ,EAClE,MAAM,EAAE,eAAe,CAAC,SAAS,CAAC,GACjC,UAAU,CAAC,SAAS,CAAC,CAUvB;AAGD,YAAY,EACV,cAAc,EACd,YAAY,EACZ,UAAU,EACV,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,eAAe,EACf,SAAS,EACT,YAAY,EACZ,aAAa,EACb,cAAc,EACd,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EACvB,SAAS,EACT,YAAY,EACZ,cAAc,EACd,QAAQ,EACR,eAAe,EACf,KAAK,EACL,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,WAAW,EACX,UAAU,EACV,YAAY,EACZ,SAAS,EACT,cAAc,EACd,aAAa,EACb,aAAa,EACb,aAAa,EACb,YAAY,EACZ,aAAa,EACb,yBAAyB,EAEzB,MAAM,EACN,aAAa,EACb,cAAc,EAEd,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,EAEtB,yBAAyB,EACzB,qBAAqB,EACrB,4BAA4B,EAC5B,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,UAAU,EACV,eAAe,EAGhB,MAAM,YAAY,CAAA;AA8BnB;;;;;;GAMG;AACH,wBAAgB,MAAM,CAAC,UAAU,EAAE,cAAc,GAAG,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAQ3F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,wBAAgB,IAAI,CAAC,SAAS,SAAS,OAAO,YAAY,EAAE,QAAQ,EAClE,MAAM,EAAE,eAAe,CAAC,SAAS,CAAC,GACjC,UAAU,CAAC,SAAS,CAAC,CAUvB;AAGD,YAAY,EACV,cAAc,EACd,YAAY,EACZ,UAAU,EACV,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,eAAe,EACf,SAAS,EACT,YAAY,EACZ,aAAa,EACb,cAAc,EACd,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EACvB,SAAS,EACT,YAAY,EACZ,cAAc,EACd,QAAQ,EACR,eAAe,EACf,KAAK,EACL,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,0BAA0B,EAC1B,WAAW,EACX,WAAW,EACX,WAAW,EACX,UAAU,EACV,YAAY,EACZ,SAAS,EACT,cAAc,EACd,aAAa,EACb,aAAa,EACb,aAAa,EACb,YAAY,EACZ,aAAa,EACb,yBAAyB,EAEzB,MAAM,EACN,aAAa,EACb,cAAc,EAEd,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,EAEtB,yBAAyB,EACzB,qBAAqB,EACrB,4BAA4B,EAC5B,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,YAAY,CAAA"}

package/dist/config/nav-count.d.ts

@@ -0,0 +1,34 @@
+import type { AccessContext } from '../access/types.js';
+import type { ListConfig, OpenSaasConfig } from './types.js';
+/**
+ * Whether a list's query access is **statically denied** — provably no session
+ * can read any row without evaluating a session-dependent function.
+ *
+ * Mirrors the list view's `canDeleteList` static check (issue #733): query
+ * access is statically denied when it is absent (deny-by-default, matching the
+ * access engine) or the literal boolean `false`. A function — or `true` —
+ * cannot be decided up front, so the count is fetched through the secured
+ * context, which re-applies the real rule per row.
+ *
+ * A statically-denied list must render no nav count at all: a `0` there would
+ * imply "this list is empty" when the truth is "you may see none of it".
+ */
+export declare function isListQueryStaticallyDenied(listConfig: ListConfig<any>): boolean;
+/**
+ * Resolve the access-scoped nav counts for the lists that opt in via
+ * `ui.navCount` (issue #735).
+ *
+ * The returned map is keyed by list key and contains an entry **only** for a
+ * list that:
+ *
+ * 1. opts in (`ui.navCount === true`) — no count query runs for any other list,
+ * 2. is not a singleton (a single-record list has no meaningful count), and
+ * 3. does not have statically-denied query access (see
+ *    {@link isListQueryStaticallyDenied}).
+ *
+ * Each count is read through the secured `context.db`, whose `count` applies the
+ * access filter, so the number reflects exactly what the current session may
+ * see (a denied row is not counted). Counts are fetched concurrently.
+ */
+export declare function resolveNavCounts(context: AccessContext, config: OpenSaasConfig): Promise<Record<string, number>>;
+//# sourceMappingURL=nav-count.d.ts.map

package/dist/config/nav-count.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nav-count.d.ts","sourceRoot":"","sources":["../../src/config/nav-count.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAEvD,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAY,MAAM,YAAY,CAAA;AAWtE;;;;;;;;;;;;GAYG;AACH,wBAAgB,2BAA2B,CAEzC,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,GAC1B,OAAO,CAKT;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA6BjC"}

package/dist/config/nav-count.js

@@ -0,0 +1,71 @@
+import { getDbKey } from '../lib/case-utils.js';
+/**
+ * Whether a list's query access is **statically denied** — provably no session
+ * can read any row without evaluating a session-dependent function.
+ *
+ * Mirrors the list view's `canDeleteList` static check (issue #733): query
+ * access is statically denied when it is absent (deny-by-default, matching the
+ * access engine) or the literal boolean `false`. A function — or `true` —
+ * cannot be decided up front, so the count is fetched through the secured
+ * context, which re-applies the real rule per row.
+ *
+ * A statically-denied list must render no nav count at all: a `0` there would
+ * imply "this list is empty" when the truth is "you may see none of it".
+ */
+export function isListQueryStaticallyDenied(
+// eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+listConfig) {
+    const queryAccess = listConfig.access?.operation?.query;
+    if (queryAccess === undefined)
+        return true;
+    if (typeof queryAccess === 'boolean')
+        return !queryAccess;
+    return false;
+}
+/**
+ * Resolve the access-scoped nav counts for the lists that opt in via
+ * `ui.navCount` (issue #735).
+ *
+ * The returned map is keyed by list key and contains an entry **only** for a
+ * list that:
+ *
+ * 1. opts in (`ui.navCount === true`) — no count query runs for any other list,
+ * 2. is not a singleton (a single-record list has no meaningful count), and
+ * 3. does not have statically-denied query access (see
+ *    {@link isListQueryStaticallyDenied}).
+ *
+ * Each count is read through the secured `context.db`, whose `count` applies the
+ * access filter, so the number reflects exactly what the current session may
+ * see (a denied row is not counted). Counts are fetched concurrently.
+ */
+export async function resolveNavCounts(context, config) {
+    const counts = {};
+    const lists = config.lists ?? {};
+    const optedIn = Object.keys(lists).filter((listKey) => {
+        const listConfig = lists[listKey];
+        if (!listConfig)
+            return false;
+        if (listConfig.ui?.navCount !== true)
+            return false;
+        if (listConfig.isSingleton)
+            return false;
+        return !isListQueryStaticallyDenied(listConfig);
+    });
+    await Promise.all(optedIn.map(async (listKey) => {
+        const delegate = context.db?.[getDbKey(listKey)];
+        if (!delegate?.count)
+            return;
+        // A single list's count failing (a DB hiccup, a throwing access filter or
+        // hook) must not blank the whole admin chrome — `AdminUI` awaits this
+        // before rendering the shell. Degrade like the sibling `ListView`: log and
+        // omit just that badge. Other lists' counts are unaffected.
+        try {
+            counts[listKey] = await delegate.count();
+        }
+        catch (error) {
+            console.error(`Failed to resolve nav count for ${listKey}:`, error);
+        }
+    }));
+    return counts;
+}
+//# sourceMappingURL=nav-count.js.map