@opensaas/stack-core 0.32.0 → 0.34.0

package/tests/access-relationships.test.ts

@@ -23,7 +23,7 @@ describe('Relationship Access Control', () => {
     },
     plugins: {},
     _isSudo: false,
-    _resolveOutputCounter: { depth: 0 },
+    _resolveOutputChain: [],
   }
 
   describe('getRelatedListConfig', () => {
@@ -319,9 +319,10 @@ describe('Relationship Access Control', () => {
         }
 
         // Test that buildIncludeWithAccessControl creates the right where clause
-        const { buildIncludeWithAccessControl } = await import('../src/access/index.js')
+        const { buildIncludeWithAccessControl, toPrismaInclude } =
+          await import('../src/access/index.js')
 
-        const include = await buildIncludeWithAccessControl(
+        const result = await buildIncludeWithAccessControl(
           config.lists.User.fields,
           {
             session: null,
@@ -329,6 +330,7 @@ describe('Relationship Access Control', () => {
           },
           config,
         )
+        const include = toPrismaInclude(result)
 
         // Should include posts with a where filter
         expect(include).toBeDefined()
@@ -486,9 +488,10 @@ describe('Relationship Access Control', () => {
         }
 
         // Test that buildIncludeWithAccessControl creates session-based where clause
-        const { buildIncludeWithAccessControl } = await import('../src/access/index.js')
+        const { buildIncludeWithAccessControl, toPrismaInclude } =
+          await import('../src/access/index.js')
 
-        const include = await buildIncludeWithAccessControl(
+        const result = await buildIncludeWithAccessControl(
           config.lists.User.fields,
           {
             session: { userId: '1' },
@@ -496,6 +499,7 @@ describe('Relationship Access Control', () => {
           },
           config,
         )
+        const include = toPrismaInclude(result)
 
         // Should include posts with session-based where filter
         expect(include).toBeDefined()
@@ -505,75 +509,85 @@ describe('Relationship Access Control', () => {
       })
     })
 
-    describe('depth limiting', () => {
-      it('should prevent infinite recursion with depth limit', async () => {
-        const config: OpenSaasConfig = {
-          db: {
-            provider: 'postgresql',
-            url: 'postgresql://localhost:5432/test',
-          },
-          lists: {
-            User: {
-              fields: {
-                name: { type: 'text' },
-                posts: {
-                  type: 'relationship',
-                  ref: 'Post.author',
-                  many: true,
-                },
-              },
-              access: {
-                operation: {
-                  query: () => true,
-                },
-              },
+    describe('no depth cap on an acyclic chain (issue #830)', () => {
+      /**
+       * `filterReadableFields` used to stop recursing into relationships past
+       * `MAX_DEPTH` (5), so a nested row past that depth was returned with its
+       * field-level `read` access never evaluated and its `resolveOutput` hooks
+       * never run — even though the row-scoping half of the pipeline
+       * (`buildIncludeWithAccessControl`) may have correctly scoped it. The fix
+       * removes this cap: by the time a result reaches this function it is
+       * already a finite, ACYCLIC tree bounded by whatever the (now fail-closed)
+       * pre-query phase permitted, so there is no infinite-recursion risk left
+       * to guard against. This test builds an 8-level-deep chain — deeper than
+       * the old cap — with a read-denied field and a resolveOutput hook on the
+       * deepest list, and asserts both are applied at every level.
+       */
+      it('applies field-level read access and resolveOutput at depth 6+', async () => {
+        const allowQuery = () => true
+        const chainLength = 8
+        const lists: OpenSaasConfig['lists'] = {}
+        for (let i = 0; i < chainLength; i++) {
+          const isLast = i === chainLength - 1
+          lists[`L${i}`] = {
+            fields: {
+              name: { type: 'text' },
+              ...(isLast
+                ? {
+                    secret: {
+                      type: 'text',
+                      access: { read: () => false },
+                    },
+                    label: {
+                      type: 'text',
+                      hooks: {
+                        resolveOutput: ({ value }: { value: unknown }) => `resolved:${value}`,
+                      },
+                    },
+                  }
+                : {}),
+              ...(i < chainLength - 1
+                ? { next: { type: 'relationship', ref: `L${i + 1}.prev` } }
+                : {}),
+              ...(i > 0 ? { prev: { type: 'relationship', ref: `L${i - 1}.next` } } : {}),
             },
-            Post: {
-              fields: {
-                title: { type: 'text' },
-                author: {
-                  type: 'relationship',
-                  ref: 'User.posts',
-                },
-              },
-              access: {
-                operation: {
-                  query: () => true,
-                },
-              },
-            },
-          },
+            access: { operation: { query: allowQuery } },
+          }
         }
-
-        // Create circular reference structure
-        const user = {
-          id: '1',
-          name: 'John Doe',
-          // eslint-disable-next-line @typescript-eslint/no-explicit-any
-          posts: [] as any[],
+        const config: OpenSaasConfig = {
+          db: { provider: 'postgresql', url: 'postgresql://localhost:5432/test' },
+          lists,
         }
 
-        const post = {
-          id: '1',
-          title: 'Test Post',
-          author: user,
+        // Build a genuinely acyclic, materialized nested object — exactly what
+        // Prisma would return for this include shape (a fresh object per level,
+        // no shared/back references).
+        let deepest: Record<string, unknown> = {
+          id: `${chainLength - 1}`,
+          name: `L${chainLength - 1}`,
+          secret: 'TOP-SECRET',
+          label: 'raw-value',
+        }
+        for (let i = chainLength - 2; i >= 0; i--) {
+          deepest = { id: `${i}`, name: `L${i}`, next: deepest }
         }
-
-        user.posts = [post]
 
         const result = await filterReadableFields(
-          user,
-          config.lists.User.fields,
-          {
-            session: null,
-            context: mockContext,
-          },
+          deepest,
+          config.lists.L0.fields,
+          { session: null, context: mockContext },
           config,
         )
 
-        // Should not throw stack overflow error
-        expect(result).toBeDefined()
-        expect(result.posts).toBeDefined()
+        // Walk down to the deepest level in the filtered result.
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        let current: any = result
+        for (let i = 0; i < chainLength - 1; i++) {
+          current = current.next
+        }
+
+        expect(current.secret).toBeUndefined() // read-denied field stripped
+        expect(current.label).toBe('resolved:raw-value') // resolveOutput ran
       })
     })
 

package/tests/context.test.ts

@@ -2,6 +2,8 @@ import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
 import { getContext } from '../src/context/index.js'
 import { defineFragment } from '../src/query/index.js'
 import { virtual } from '../src/fields/index.js'
+import { AccessScopeDepthExceededError } from '../src/access/index.js'
+import { READ_INCLUDE_MAX_DEPTH } from '../src/access/depth-limits.js'
 import type { OpenSaasConfig } from '../src/config/types.js'
 
 describe('getContext', () => {
@@ -1425,20 +1427,19 @@ describe('getContext', () => {
         expect(call.include).toEqual({ posts: true })
       })
 
-      // Regression: when buildIncludeWithAccessControl returns `undefined` (a
-      // NON-denial outcome), the caller include must PASS THROUGH unchanged
-      // rather than every declared relation being silently dropped. The original
-      // #566 merge treated `undefined` as "all relations denied" (fail-closed
-      // data loss). `undefined` is returned in three non-denial cases:
-      //   1. inside a resolveOutput hook / virtual-field context,
-      //   2. at MAX_DEPTH,
-      //   3. when a list has no relationships.
-      describe('passes caller include through when no access include is computed', () => {
+      // Regression for issue #830: a read issued from inside a `resolveOutput`
+      // hook used to lose relation row scoping ENTIRELY — `buildIncludeWithAccessControl`
+      // returned a whole-object `undefined` for the inner read (any
+      // `_resolveOutputChain.length > 0`), which `mergeIncludeWithAccessControl`
+      // treated as "nothing to merge against" and passed the caller's include
+      // through completely unscoped. The fix scopes each immediate relation with
+      // its own access `where` while still not auto-EXPANDING into that
+      // relation's own nested relations (preserving the original loop-prevention
+      // — see the self-referential coverage in `access-filter.test.ts`).
+      describe('scopes (without expanding) a caller include used inside a resolveOutput hook (#830)', () => {
         // Build an Author config with a virtual field whose resolveOutput issues a
         // read WITH an explicit include. While that hook runs,
-        // _resolveOutputCounter.depth > 0, so buildIncludeWithAccessControl
-        // returns undefined for the inner read — exercising the
-        // `accessControlledInclude === undefined` passthrough path.
+        // _resolveOutputChain.length > 0.
         function configWithResolveOutputProbe(
           callerInclude: Record<string, unknown>,
           capture: (include: unknown) => void,
@@ -1467,7 +1468,7 @@ describe('getContext', () => {
           }
         }
 
-        it('findUnique inside a resolveOutput hook keeps the caller include (not dropped)', async () => {
+        it('findUnique inside a resolveOutput hook row-scopes the relation instead of dropping the where', async () => {
           let innerIncludeSeen: unknown
           const hookConfig = configWithResolveOutputProbe({ post: true }, (include) => {
             innerIncludeSeen = include
@@ -1479,12 +1480,12 @@ describe('getContext', () => {
           const context = await getContext(hookConfig, relPrisma, null)
           await context.db.author.findUnique({ where: { id: 'a1' } })
 
-          // The caller include `{ post: true }` survives: the declared `post`
-          // relation is NOT dropped despite the access include being undefined here.
-          expect(innerIncludeSeen).toEqual({ post: true })
+          // `post` is still fetched (not dropped) but now carries Post's own
+          // query-access `where` — it is no longer a bare, unscoped `true`.
+          expect(innerIncludeSeen).toEqual({ post: { where: { status: { equals: 'published' } } } })
         })
 
-        it('findMany inside a resolveOutput hook passes a NESTED caller include through whole', async () => {
+        it('findMany inside a resolveOutput hook scopes the relation but does not auto-expand its nested include', async () => {
           let innerIncludeSeen: unknown
           const hookConfig = configWithResolveOutputProbe(
             { post: { include: { author: true } } },
@@ -1499,15 +1500,96 @@ describe('getContext', () => {
           const context = await getContext(hookConfig, relPrisma, null)
           await context.db.author.findMany()
 
-          // The whole nested caller include passes through untouched (no access
-          // include exists to merge against in resolveOutput context).
-          expect(innerIncludeSeen).toEqual({ post: { include: { author: true } } })
+          // The caller's own nested selection (`post.include.author`) is honoured
+          // as-is (access control does not auto-descend further here), while
+          // `post` itself picks up its access `where`.
+          expect(innerIncludeSeen).toEqual({
+            post: { where: { status: { equals: 'published' } }, include: { author: true } },
+          })
         })
+      })
+
+      // Regression for issue #830: a caller `include` nested deeper than the
+      // Access Filter can scope used to be returned unscoped rather than
+      // denied. This exercises the fix end-to-end through `context.db`,
+      // matching the reproduction in the issue: a chain of lists deep enough
+      // to cross `READ_INCLUDE_MAX_DEPTH`, read as a non-privileged session.
+      describe('fail-closed at the read-include depth cap through context.db (#830)', () => {
+        function chainListConfig(count: number): OpenSaasConfig['lists'] {
+          const lists: OpenSaasConfig['lists'] = {}
+          for (let i = 0; i < count; i++) {
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+            const fields: Record<string, any> = { name: { type: 'text' } }
+            if (i < count - 1) fields.next = { type: 'relationship', ref: `C${i + 1}.prev` }
+            if (i > 0) fields.prev = { type: 'relationship', ref: `C${i - 1}.next` }
+            lists[`C${i}`] = {
+              fields,
+              access: {
+                operation: { query: () => (i === 0 ? true : { ownerId: { equals: `C${i}` } }) },
+              },
+            }
+          }
+          return lists
+        }
+
+        // A caller include selecting `next` `hops` more times, ending bare.
+        function nestedCallerInclude(hops: number): Record<string, unknown> {
+          if (hops <= 0) return true as unknown as Record<string, unknown>
+          return { include: { next: nestedCallerInclude(hops - 1) } }
+        }
+
+        it('throws AccessScopeDepthExceededError for a caller include one hop past the cap', async () => {
+          const chainLength = READ_INCLUDE_MAX_DEPTH + 2
+          const chainConfig: OpenSaasConfig = {
+            db: { provider: 'postgresql', url: 'postgresql://localhost:5432/test' },
+            lists: chainListConfig(chainLength),
+          }
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+          const chainPrisma: any = {}
+          for (let i = 0; i < chainLength; i++) {
+            chainPrisma[`c${i}`] = { findMany: vi.fn(), findFirst: vi.fn(), findUnique: vi.fn() }
+          }
+
+          const context = await getContext(chainConfig, chainPrisma, null)
 
-        // The MAX_DEPTH and no-relationships cases also make
-        // buildIncludeWithAccessControl return undefined; they flow through the
-        // identical `accessControlledInclude === undefined` branch verified above,
-        // so the resolveOutput probe covers all three non-denial cases.
+          await expect(
+            context.db.c0.findMany({
+              include: { next: nestedCallerInclude(READ_INCLUDE_MAX_DEPTH) },
+            }),
+          ).rejects.toThrow(AccessScopeDepthExceededError)
+
+          // The database is never even queried — the denial happens before the
+          // Prisma call, not as a post-hoc filter on returned data.
+          expect(chainPrisma.c0.findMany).not.toHaveBeenCalled()
+        })
+
+        it('still returns correctly row-scoped data for the same include one hop shallower', async () => {
+          const chainLength = READ_INCLUDE_MAX_DEPTH + 1
+          const chainConfig: OpenSaasConfig = {
+            db: { provider: 'postgresql', url: 'postgresql://localhost:5432/test' },
+            lists: chainListConfig(chainLength),
+          }
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+          const chainPrisma: any = {}
+          for (let i = 0; i < chainLength; i++) {
+            chainPrisma[`c${i}`] = { findMany: vi.fn(), findFirst: vi.fn(), findUnique: vi.fn() }
+          }
+          chainPrisma.c0.findMany.mockResolvedValue([])
+
+          const context = await getContext(chainConfig, chainPrisma, null)
+
+          await context.db.c0.findMany({
+            include: { next: nestedCallerInclude(READ_INCLUDE_MAX_DEPTH - 1) },
+          })
+
+          // Walk the built include down to the last list — it must carry that
+          // list's own access `where`, proving row scoping, not just "no throw".
+          let entry = chainPrisma.c0.findMany.mock.calls[0][0].include.next
+          for (let i = 1; i < READ_INCLUDE_MAX_DEPTH; i++) {
+            entry = entry.include.next
+          }
+          expect(entry.where).toEqual({ ownerId: { equals: `C${READ_INCLUDE_MAX_DEPTH}` } })
+        })
       })
 
       // Regression for #628: a virtual field named in `include` used to be

package/tests/default-value-create.test.ts

@@ -33,7 +33,7 @@ function makeContext(): AccessContext {
     storage: {} as any,
     plugins: {},
     _isSudo: false,
-    _resolveOutputCounter: { depth: 0 },
+    _resolveOutputChain: [],
   }
 }
 

package/tests/hook-pipeline.test.ts

@@ -37,7 +37,7 @@ function makeContext(): AccessContext {
     storage: {} as any,
     plugins: {},
     _isSudo: false,
-    _resolveOutputCounter: { depth: 0 },
+    _resolveOutputChain: [],
   }
 }
 

package/tests/nav-count.test.ts

@@ -43,7 +43,7 @@ function makeContext(counts: Record<string, number>): {
     storage: {},
     plugins: {},
     _isSudo: false,
-    _resolveOutputCounter: { depth: 0 },
+    _resolveOutputChain: [],
   } as unknown as AccessContext
   return { context, spies }
 }
@@ -168,7 +168,7 @@ describe('resolveNavCounts', () => {
       storage: {},
       plugins: {},
       _isSudo: false,
-      _resolveOutputCounter: { depth: 0 },
+      _resolveOutputChain: [],
     } as unknown as AccessContext
 
     const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {})