@opensaas/stack-core 0.32.0 → 0.33.0

package/src/access/errors.ts

@@ -0,0 +1,32 @@
+import { READ_INCLUDE_MAX_DEPTH } from './depth-limits.js'
+
+/**
+ * Thrown when a caller-supplied `include` names a relation nested deeper than
+ * the Access Filter can scope (see `READ_INCLUDE_MAX_DEPTH`). Deliberately
+ * distinct from `ValidationError`: this is not bad user input, it is the
+ * engine refusing to return data it cannot prove is row/field scoped. Code
+ * that catches `ValidationError` to report form errors must not silently
+ * swallow this.
+ *
+ * Only an explicit caller selection past the depth cap triggers this — the
+ * auto-include silently stopping at the cap (no caller `include` involved)
+ * never throws. See ADR-0022 and issue #830.
+ */
+export class AccessScopeDepthExceededError extends Error {
+  public listKey: string
+  public fieldKey: string
+  public depth: number
+
+  constructor(listKey: string, fieldKey: string, depth: number) {
+    super(
+      `Cannot compute an access scope for "${listKey}.${fieldKey}" at include depth ${depth}: ` +
+        `this exceeds the Access Filter's maximum read-include depth (${READ_INCLUDE_MAX_DEPTH}). ` +
+        `A caller-supplied include this deep cannot be row- and field-scoped, so the read is denied ` +
+        `rather than returned unscoped. Restructure the query to fetch this relation separately.`,
+    )
+    this.name = 'AccessScopeDepthExceededError'
+    this.listKey = listKey
+    this.fieldKey = fieldKey
+    this.depth = depth
+  }
+}

package/src/access/field-visibility.ts

@@ -116,7 +116,6 @@ export async function filterReadableFields<T extends Record<string, unknown>>(
   listKey?: string,
 ): Promise<Partial<T>> {
   const filtered: Record<string, unknown> = {}
-  const MAX_DEPTH = 5 // Prevent infinite recursion
 
   // Multi-column fields (e.g. storage image()/file() in Keystone-parity mode)
   // back several physical columns rather than one. Before the per-field pass,
@@ -153,14 +152,22 @@ export async function filterReadableFields<T extends Record<string, unknown>>(
     // Handle relationship fields - recursively filter fields within related items
     // Note: Access control filtering is now done at database level via buildIncludeWithAccessControl
     // This only handles field-level access (hiding sensitive fields)
+    //
+    // Deliberately uncapped: the row/relation scoping in access-filter.ts bounds
+    // what gets FETCHED (a caller include past its depth cap is now a denial,
+    // not a passthrough — see ADR-0022), so by the time a result reaches this
+    // function it is already a finite, acyclic tree whose depth was decided at
+    // the pre-query phase. Capping recursion again here independently of that
+    // cap used to let a relation be scoped correctly at the DB level while
+    // still returning with unfiltered fields past this function's own,
+    // separately-tracked limit (issue #830).
     if (
       config &&
       fieldConfig?.type === 'relationship' &&
       'ref' in fieldConfig &&
       fieldConfig.ref &&
       value !== null &&
-      value !== undefined &&
-      depth < MAX_DEPTH
+      value !== undefined
     ) {
       // Gate the relationship on read access before recursing.
       const canRead = await checkFieldAccess(fieldConfig?.access, 'read', {

package/src/access/index.ts

@@ -26,6 +26,10 @@ export {
   buildIncludeWithAccessControl,
   mergeIncludeWithAccessControl,
   stripVirtualFieldsFromInclude,
+  toPrismaInclude,
 } from './access-filter.js'
+export type { AccessIncludeResult } from './access-filter.js'
 // Phase 2 — Field Visibility (post-query field stripping + resolveOutput).
 export { filterReadableFields } from './field-visibility.js'
+// Thrown when a caller include reaches past the depth the Access Filter can scope.
+export { AccessScopeDepthExceededError } from './errors.js'

package/src/context/index.ts

@@ -7,6 +7,7 @@ import {
   buildIncludeWithAccessControl,
   mergeIncludeWithAccessControl,
   stripVirtualFieldsFromInclude,
+  toPrismaInclude,
 } from '../access/index.js'
 import { ValidationError, DatabaseError } from '../hooks/index.js'
 import { getDbKey } from '../lib/case-utils.js'
@@ -994,15 +995,19 @@ function createFindUnique<TPrisma extends PrismaClientLike>(
       // MERGE (not replace) a caller-supplied include with the access-controlled
       // include: the caller selects WHICH relations to fetch, access control
       // decides WHETHER and WITH WHAT filter (#566). A bare auto-include (no
-      // caller include) still uses the access-controlled include directly.
+      // caller include) still uses the access-controlled include directly. A
+      // caller include naming a relation past the depth the engine can scope
+      // throws `AccessScopeDepthExceededError` (issue #830) rather than being
+      // returned unscoped.
       include = args.include
         ? mergeIncludeWithAccessControl(
             args.include,
             accessControlledInclude,
             listConfig.fields,
             config,
+            listName,
           )
-        : accessControlledInclude
+        : toPrismaInclude(accessControlledInclude)
     }
 
     // Virtual fields have no database column. Whichever path produced
@@ -1128,15 +1133,19 @@ function createFindMany<TPrisma extends PrismaClientLike>(
       // MERGE (not replace) a caller-supplied include with the access-controlled
       // include: the caller selects WHICH relations to fetch, access control
       // decides WHETHER and WITH WHAT filter (#566). A bare auto-include (no
-      // caller include) still uses the access-controlled include directly.
+      // caller include) still uses the access-controlled include directly. A
+      // caller include naming a relation past the depth the engine can scope
+      // throws `AccessScopeDepthExceededError` (issue #830) rather than being
+      // returned unscoped.
       include = args?.include
         ? mergeIncludeWithAccessControl(
             args.include,
             accessControlledInclude,
             listConfig.fields,
             config,
+            listName,
           )
-        : accessControlledInclude
+        : toPrismaInclude(accessControlledInclude)
     }
 
     // Virtual fields have no database column. Whichever path produced
@@ -1445,7 +1454,7 @@ function createGet<TPrisma extends PrismaClientLike>(
     // Try to find the record
     const item = await model.findFirst({
       where,
-      include: accessControlledInclude,
+      include: toPrismaInclude(accessControlledInclude),
     })
 
     // If record exists, return it

package/src/context/nested-operations.ts

@@ -1312,17 +1312,10 @@ export async function processNestedOperations(
   // finding) so item-/inputData-dependent field-access rules cannot diverge between
   // Phase 5 and the connect site. `undefined` is tolerated (defaults to `{}`).
   parentInputData: Record<string, unknown> | undefined = undefined,
-  depth: number = 0,
 ): Promise<NestedOpsResult> {
-  const MAX_DEPTH = 5
-
   const afterTasks: AfterTask[] = []
   const includeFields = new Set<string>()
 
-  if (depth >= MAX_DEPTH) {
-    return { data, afterTasks, includeFields }
-  }
-
   const processed: Record<string, unknown> = {}
 
   for (const [fieldName, value] of Object.entries(data)) {

package/src/context/transaction-boundary.ts

@@ -55,9 +55,6 @@ export interface InvolvedList {
   originalItem: Record<string, unknown> | undefined
 }
 
-/** Max nesting depth walked when enumerating involved lists (matches nested-operations). */
-const MAX_DEPTH = 5
-
 /** Nested-op kinds whose payloads imply an involved list + operation. */
 const NESTED_OP_OPERATIONS: ReadonlyArray<{ kind: string; operation: WriteOperation }> = [
   { kind: 'create', operation: 'create' },
@@ -67,10 +64,49 @@ const NESTED_OP_OPERATIONS: ReadonlyArray<{ kind: string; operation: WriteOperat
   { kind: 'connectOrCreate', operation: 'create' },
 ]
 
+/** Distinct dedupe-key operations `NESTED_OP_OPERATIONS` can produce (create/update/delete). */
+const DISTINCT_OPERATION_COUNT = new Set(NESTED_OP_OPERATIONS.map((o) => o.operation)).size
+
 function isRelationshipField(fieldConfig: FieldConfig | undefined): boolean {
   return fieldConfig?.type === 'relationship'
 }
 
+/**
+ * The number of distinct (listKey, operation) involvement pairs the walk
+ * could ever record starting from `startListName` — computed from the
+ * CONFIG's relationship graph (not the payload), so it bounds the walk by
+ * what the schema can reach rather than by an arbitrary depth.
+ *
+ * Used as the saturation bound: once `walkNested` has recorded this many
+ * pairs, no further pair can be new, so it stops descending. This replaces
+ * the old depth cap as the cost bound (#835) — a payload nesting the config's
+ * lists more deeply than any previous cap no longer loses their
+ * transaction-boundary hooks, while a payload that repeats the same few
+ * lists still terminates promptly instead of walking every entry.
+ */
+function countReachableInvolvementPairs(
+  startListName: string,
+  startListConfig: ListConfig<any>, // eslint-disable-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+  config: OpenSaasConfig,
+): number {
+  const visited = new Set<string>([startListName])
+  const queue: Array<ListConfig<any>> = [startListConfig] // eslint-disable-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+
+  while (queue.length > 0) {
+    const current = queue.shift()!
+    for (const fieldConfig of Object.values(current.fields)) {
+      if (!isRelationshipField(fieldConfig)) continue
+      const relationshipField = fieldConfig as { type: 'relationship'; ref: string }
+      const related = getRelatedListConfig(relationshipField.ref, config)
+      if (!related || visited.has(related.listName)) continue
+      visited.add(related.listName)
+      queue.push(related.listConfig)
+    }
+  }
+
+  return visited.size * DISTINCT_OPERATION_COUNT
+}
+
 function asRecordArray(value: unknown): Array<Record<string, unknown>> {
   if (value == null) return []
   if (Array.isArray(value)) return value.filter((v) => v && typeof v === 'object')
@@ -117,9 +153,11 @@ function walkNested(
   config: OpenSaasConfig,
   out: InvolvedList[],
   seen: Set<string>,
-  depth: number,
+  maxPairs: number,
 ): void {
-  if (!data || depth >= MAX_DEPTH) return
+  // Every reachable pair is already recorded — no further recursion can add
+  // anything new, so stop instead of re-walking the rest of the payload.
+  if (!data || seen.size >= maxPairs) return
 
   for (const [fieldName, value] of Object.entries(data)) {
     const fieldConfig = fieldConfigs[fieldName]
@@ -150,10 +188,12 @@ function walkNested(
         })
       }
 
+      if (seen.size >= maxPairs) return
+
       // Recurse into each nested entry's own relationship payload.
       for (const entry of entries) {
         const childData = nestedInputData(kind, entry)
-        walkNested(childData, relatedListConfig.fields, config, out, seen, depth + 1)
+        walkNested(childData, relatedListConfig.fields, config, out, seen, maxPairs)
       }
     }
   }
@@ -187,9 +227,10 @@ export function enumerateInvolvedLists(args: {
     },
   ]
   const seen = new Set<string>([`${listName}:${operation}`])
+  const maxPairs = countReachableInvolvementPairs(listName, listConfig, config)
 
   // Delete has no nested payload to walk (inputData is undefined).
-  walkNested(inputData, listConfig.fields, config, out, seen, 0)
+  walkNested(inputData, listConfig.fields, config, out, seen, maxPairs)
 
   return out
 }

package/src/index.ts

@@ -62,6 +62,12 @@ export { resolveNavCounts, isListQueryStaticallyDenied } from './config/nav-coun
 // Validation error surfaced by write operations
 export { ValidationError } from './hooks/index.js'
 
+// Thrown by a read when a caller-supplied `include` names a relation nested
+// deeper than the Access Filter can scope (see ADR-0022). Distinct from
+// `ValidationError` — this is the engine refusing to return unscoped data, not
+// a user-input validation failure.
+export { AccessScopeDepthExceededError } from './access/index.js'
+
 // Field self-containment validation — checks each field implements the
 // generation contract (getPrismaType / getTypeScriptType / getZodSchema, or
 // getPrismaRelation for relationships) so a misimplemented field fails early

package/tests/access-relationships.test.ts

@@ -319,9 +319,10 @@ describe('Relationship Access Control', () => {
         }
 
         // Test that buildIncludeWithAccessControl creates the right where clause
-        const { buildIncludeWithAccessControl } = await import('../src/access/index.js')
+        const { buildIncludeWithAccessControl, toPrismaInclude } =
+          await import('../src/access/index.js')
 
-        const include = await buildIncludeWithAccessControl(
+        const result = await buildIncludeWithAccessControl(
           config.lists.User.fields,
           {
             session: null,
@@ -329,6 +330,7 @@ describe('Relationship Access Control', () => {
           },
           config,
         )
+        const include = toPrismaInclude(result)
 
         // Should include posts with a where filter
         expect(include).toBeDefined()
@@ -486,9 +488,10 @@ describe('Relationship Access Control', () => {
         }
 
         // Test that buildIncludeWithAccessControl creates session-based where clause
-        const { buildIncludeWithAccessControl } = await import('../src/access/index.js')
+        const { buildIncludeWithAccessControl, toPrismaInclude } =
+          await import('../src/access/index.js')
 
-        const include = await buildIncludeWithAccessControl(
+        const result = await buildIncludeWithAccessControl(
           config.lists.User.fields,
           {
             session: { userId: '1' },
@@ -496,6 +499,7 @@ describe('Relationship Access Control', () => {
           },
           config,
         )
+        const include = toPrismaInclude(result)
 
         // Should include posts with session-based where filter
         expect(include).toBeDefined()
@@ -505,75 +509,85 @@ describe('Relationship Access Control', () => {
       })
     })
 
-    describe('depth limiting', () => {
-      it('should prevent infinite recursion with depth limit', async () => {
-        const config: OpenSaasConfig = {
-          db: {
-            provider: 'postgresql',
-            url: 'postgresql://localhost:5432/test',
-          },
-          lists: {
-            User: {
-              fields: {
-                name: { type: 'text' },
-                posts: {
-                  type: 'relationship',
-                  ref: 'Post.author',
-                  many: true,
-                },
-              },
-              access: {
-                operation: {
-                  query: () => true,
-                },
-              },
+    describe('no depth cap on an acyclic chain (issue #830)', () => {
+      /**
+       * `filterReadableFields` used to stop recursing into relationships past
+       * `MAX_DEPTH` (5), so a nested row past that depth was returned with its
+       * field-level `read` access never evaluated and its `resolveOutput` hooks
+       * never run — even though the row-scoping half of the pipeline
+       * (`buildIncludeWithAccessControl`) may have correctly scoped it. The fix
+       * removes this cap: by the time a result reaches this function it is
+       * already a finite, ACYCLIC tree bounded by whatever the (now fail-closed)
+       * pre-query phase permitted, so there is no infinite-recursion risk left
+       * to guard against. This test builds an 8-level-deep chain — deeper than
+       * the old cap — with a read-denied field and a resolveOutput hook on the
+       * deepest list, and asserts both are applied at every level.
+       */
+      it('applies field-level read access and resolveOutput at depth 6+', async () => {
+        const allowQuery = () => true
+        const chainLength = 8
+        const lists: OpenSaasConfig['lists'] = {}
+        for (let i = 0; i < chainLength; i++) {
+          const isLast = i === chainLength - 1
+          lists[`L${i}`] = {
+            fields: {
+              name: { type: 'text' },
+              ...(isLast
+                ? {
+                    secret: {
+                      type: 'text',
+                      access: { read: () => false },
+                    },
+                    label: {
+                      type: 'text',
+                      hooks: {
+                        resolveOutput: ({ value }: { value: unknown }) => `resolved:${value}`,
+                      },
+                    },
+                  }
+                : {}),
+              ...(i < chainLength - 1
+                ? { next: { type: 'relationship', ref: `L${i + 1}.prev` } }
+                : {}),
+              ...(i > 0 ? { prev: { type: 'relationship', ref: `L${i - 1}.next` } } : {}),
             },
-            Post: {
-              fields: {
-                title: { type: 'text' },
-                author: {
-                  type: 'relationship',
-                  ref: 'User.posts',
-                },
-              },
-              access: {
-                operation: {
-                  query: () => true,
-                },
-              },
-            },
-          },
+            access: { operation: { query: allowQuery } },
+          }
         }
-
-        // Create circular reference structure
-        const user = {
-          id: '1',
-          name: 'John Doe',
-          // eslint-disable-next-line @typescript-eslint/no-explicit-any
-          posts: [] as any[],
+        const config: OpenSaasConfig = {
+          db: { provider: 'postgresql', url: 'postgresql://localhost:5432/test' },
+          lists,
         }
 
-        const post = {
-          id: '1',
-          title: 'Test Post',
-          author: user,
+        // Build a genuinely acyclic, materialized nested object — exactly what
+        // Prisma would return for this include shape (a fresh object per level,
+        // no shared/back references).
+        let deepest: Record<string, unknown> = {
+          id: `${chainLength - 1}`,
+          name: `L${chainLength - 1}`,
+          secret: 'TOP-SECRET',
+          label: 'raw-value',
+        }
+        for (let i = chainLength - 2; i >= 0; i--) {
+          deepest = { id: `${i}`, name: `L${i}`, next: deepest }
         }
-
-        user.posts = [post]
 
         const result = await filterReadableFields(
-          user,
-          config.lists.User.fields,
-          {
-            session: null,
-            context: mockContext,
-          },
+          deepest,
+          config.lists.L0.fields,
+          { session: null, context: mockContext },
           config,
         )
 
-        // Should not throw stack overflow error
-        expect(result).toBeDefined()
-        expect(result.posts).toBeDefined()
+        // Walk down to the deepest level in the filtered result.
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        let current: any = result
+        for (let i = 0; i < chainLength - 1; i++) {
+          current = current.next
+        }
+
+        expect(current.secret).toBeUndefined() // read-denied field stripped
+        expect(current.label).toBe('resolved:raw-value') // resolveOutput ran
       })
     })
 

package/tests/context.test.ts

@@ -2,6 +2,8 @@ import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { getContext } from '../src/context/index.js'
 import { defineFragment } from '../src/query/index.js'
 import { virtual } from '../src/fields/index.js'
+import { AccessScopeDepthExceededError } from '../src/access/index.js'
+import { READ_INCLUDE_MAX_DEPTH } from '../src/access/depth-limits.js'
 import type { OpenSaasConfig } from '../src/config/types.js'
 
 describe('getContext', () => {
@@ -1425,20 +1427,19 @@ describe('getContext', () => {
         expect(call.include).toEqual({ posts: true })
       })
 
-      // Regression: when buildIncludeWithAccessControl returns `undefined` (a
-      // NON-denial outcome), the caller include must PASS THROUGH unchanged
-      // rather than every declared relation being silently dropped. The original
-      // #566 merge treated `undefined` as "all relations denied" (fail-closed
-      // data loss). `undefined` is returned in three non-denial cases:
-      //   1. inside a resolveOutput hook / virtual-field context,
-      //   2. at MAX_DEPTH,
-      //   3. when a list has no relationships.
-      describe('passes caller include through when no access include is computed', () => {
+      // Regression for issue #830: a read issued from inside a `resolveOutput`
+      // hook used to lose relation row scoping ENTIRELY — `buildIncludeWithAccessControl`
+      // returned a whole-object `undefined` for the inner read (any
+      // `_resolveOutputCounter.depth > 0`), which `mergeIncludeWithAccessControl`
+      // treated as "nothing to merge against" and passed the caller's include
+      // through completely unscoped. The fix scopes each immediate relation with
+      // its own access `where` while still not auto-EXPANDING into that
+      // relation's own nested relations (preserving the original loop-prevention
+      // — see the self-referential coverage in `access-filter.test.ts`).
+      describe('scopes (without expanding) a caller include used inside a resolveOutput hook (#830)', () => {
         // Build an Author config with a virtual field whose resolveOutput issues a
         // read WITH an explicit include. While that hook runs,
-        // _resolveOutputCounter.depth > 0, so buildIncludeWithAccessControl
-        // returns undefined for the inner read — exercising the
-        // `accessControlledInclude === undefined` passthrough path.
+        // _resolveOutputCounter.depth > 0.
         function configWithResolveOutputProbe(
           callerInclude: Record<string, unknown>,
           capture: (include: unknown) => void,
@@ -1467,7 +1468,7 @@ describe('getContext', () => {
           }
         }
 
-        it('findUnique inside a resolveOutput hook keeps the caller include (not dropped)', async () => {
+        it('findUnique inside a resolveOutput hook row-scopes the relation instead of dropping the where', async () => {
           let innerIncludeSeen: unknown
           const hookConfig = configWithResolveOutputProbe({ post: true }, (include) => {
             innerIncludeSeen = include
@@ -1479,12 +1480,12 @@ describe('getContext', () => {
           const context = await getContext(hookConfig, relPrisma, null)
           await context.db.author.findUnique({ where: { id: 'a1' } })
 
-          // The caller include `{ post: true }` survives: the declared `post`
-          // relation is NOT dropped despite the access include being undefined here.
-          expect(innerIncludeSeen).toEqual({ post: true })
+          // `post` is still fetched (not dropped) but now carries Post's own
+          // query-access `where` — it is no longer a bare, unscoped `true`.
+          expect(innerIncludeSeen).toEqual({ post: { where: { status: { equals: 'published' } } } })
         })
 
-        it('findMany inside a resolveOutput hook passes a NESTED caller include through whole', async () => {
+        it('findMany inside a resolveOutput hook scopes the relation but does not auto-expand its nested include', async () => {
           let innerIncludeSeen: unknown
           const hookConfig = configWithResolveOutputProbe(
             { post: { include: { author: true } } },
@@ -1499,15 +1500,96 @@ describe('getContext', () => {
           const context = await getContext(hookConfig, relPrisma, null)
           await context.db.author.findMany()
 
-          // The whole nested caller include passes through untouched (no access
-          // include exists to merge against in resolveOutput context).
-          expect(innerIncludeSeen).toEqual({ post: { include: { author: true } } })
+          // The caller's own nested selection (`post.include.author`) is honoured
+          // as-is (access control does not auto-descend further here), while
+          // `post` itself picks up its access `where`.
+          expect(innerIncludeSeen).toEqual({
+            post: { where: { status: { equals: 'published' } }, include: { author: true } },
+          })
         })
+      })
+
+      // Regression for issue #830: a caller `include` nested deeper than the
+      // Access Filter can scope used to be returned unscoped rather than
+      // denied. This exercises the fix end-to-end through `context.db`,
+      // matching the reproduction in the issue: a chain of lists deep enough
+      // to cross `READ_INCLUDE_MAX_DEPTH`, read as a non-privileged session.
+      describe('fail-closed at the read-include depth cap through context.db (#830)', () => {
+        function chainListConfig(count: number): OpenSaasConfig['lists'] {
+          const lists: OpenSaasConfig['lists'] = {}
+          for (let i = 0; i < count; i++) {
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+            const fields: Record<string, any> = { name: { type: 'text' } }
+            if (i < count - 1) fields.next = { type: 'relationship', ref: `C${i + 1}.prev` }
+            if (i > 0) fields.prev = { type: 'relationship', ref: `C${i - 1}.next` }
+            lists[`C${i}`] = {
+              fields,
+              access: {
+                operation: { query: () => (i === 0 ? true : { ownerId: { equals: `C${i}` } }) },
+              },
+            }
+          }
+          return lists
+        }
+
+        // A caller include selecting `next` `hops` more times, ending bare.
+        function nestedCallerInclude(hops: number): Record<string, unknown> {
+          if (hops <= 0) return true as unknown as Record<string, unknown>
+          return { include: { next: nestedCallerInclude(hops - 1) } }
+        }
+
+        it('throws AccessScopeDepthExceededError for a caller include one hop past the cap', async () => {
+          const chainLength = READ_INCLUDE_MAX_DEPTH + 2
+          const chainConfig: OpenSaasConfig = {
+            db: { provider: 'postgresql', url: 'postgresql://localhost:5432/test' },
+            lists: chainListConfig(chainLength),
+          }
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+          const chainPrisma: any = {}
+          for (let i = 0; i < chainLength; i++) {
+            chainPrisma[`c${i}`] = { findMany: vi.fn(), findFirst: vi.fn(), findUnique: vi.fn() }
+          }
+
+          const context = await getContext(chainConfig, chainPrisma, null)
 
-        // The MAX_DEPTH and no-relationships cases also make
-        // buildIncludeWithAccessControl return undefined; they flow through the
-        // identical `accessControlledInclude === undefined` branch verified above,
-        // so the resolveOutput probe covers all three non-denial cases.
+          await expect(
+            context.db.c0.findMany({
+              include: { next: nestedCallerInclude(READ_INCLUDE_MAX_DEPTH) },
+            }),
+          ).rejects.toThrow(AccessScopeDepthExceededError)
+
+          // The database is never even queried — the denial happens before the
+          // Prisma call, not as a post-hoc filter on returned data.
+          expect(chainPrisma.c0.findMany).not.toHaveBeenCalled()
+        })
+
+        it('still returns correctly row-scoped data for the same include one hop shallower', async () => {
+          const chainLength = READ_INCLUDE_MAX_DEPTH + 1
+          const chainConfig: OpenSaasConfig = {
+            db: { provider: 'postgresql', url: 'postgresql://localhost:5432/test' },
+            lists: chainListConfig(chainLength),
+          }
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+          const chainPrisma: any = {}
+          for (let i = 0; i < chainLength; i++) {
+            chainPrisma[`c${i}`] = { findMany: vi.fn(), findFirst: vi.fn(), findUnique: vi.fn() }
+          }
+          chainPrisma.c0.findMany.mockResolvedValue([])
+
+          const context = await getContext(chainConfig, chainPrisma, null)
+
+          await context.db.c0.findMany({
+            include: { next: nestedCallerInclude(READ_INCLUDE_MAX_DEPTH - 1) },
+          })
+
+          // Walk the built include down to the last list — it must carry that
+          // list's own access `where`, proving row scoping, not just "no throw".
+          let entry = chainPrisma.c0.findMany.mock.calls[0][0].include.next
+          for (let i = 1; i < READ_INCLUDE_MAX_DEPTH; i++) {
+            entry = entry.include.next
+          }
+          expect(entry.where).toEqual({ ownerId: { equals: `C${READ_INCLUDE_MAX_DEPTH}` } })
+        })
       })
 
       // Regression for #628: a virtual field named in `include` used to be