@opensaas/stack-core 0.33.0 → 0.35.0

package/src/context/write-pipeline.ts

@@ -297,9 +297,10 @@ export async function runWritePipeline<TPrisma extends PrismaClientLike>(
  * construction, so the request-time `context.db` is bound to the ORIGINAL
  * client. We rebuild the delegates against `tx` via {@link buildDbDelegate},
  * reusing the request context's `session`, `storage`, `plugins`, `_isSudo`, and
- * the shared `_resolveOutputCounter` reference (so resolveOutput depth tracking
- * is preserved). Plugin runtimes are NOT re-executed; the existing
- * `plugins` object is reused as-is.
+ * the current `_resolveOutputChain` value (carried through unchanged, so a
+ * write issued from inside a `resolveOutput` hook keeps that hook's chain).
+ * Plugin runtimes are NOT re-executed; the existing `plugins` object is
+ * reused as-is.
  */
 function bindContextToTransaction<TPrisma extends PrismaClientLike>(
   args: WritePipelineArgs<TPrisma>,
@@ -313,7 +314,7 @@ function bindContextToTransaction<TPrisma extends PrismaClientLike>(
     storage: context.storage,
     plugins: context.plugins,
     _isSudo: context._isSudo,
-    _resolveOutputCounter: context._resolveOutputCounter,
+    _resolveOutputChain: context._resolveOutputChain,
   }
   // Rebuild the db delegate against `tx`, pointing back at `txContext` so hooks
   // reached through it also see the transactional context.

package/src/index.ts

@@ -68,6 +68,11 @@ export { ValidationError } from './hooks/index.js'
 // a user-input validation failure.
 export { AccessScopeDepthExceededError } from './access/index.js'
 
+// Thrown by a `resolveOutput` hook whose own read cycles back into a
+// `(list, field)` pair already on its resolve chain (see ADR-0023). Distinct
+// from `ValidationError` for the same reason as `AccessScopeDepthExceededError`.
+export { ResolveOutputCycleError } from './access/index.js'
+
 // Field self-containment validation — checks each field implements the
 // generation contract (getPrismaType / getTypeScriptType / getZodSchema, or
 // getPrismaRelation for relationships) so a misimplemented field fails early

package/tests/access-relationships.test.ts

@@ -23,7 +23,7 @@ describe('Relationship Access Control', () => {
     },
     plugins: {},
     _isSudo: false,
-    _resolveOutputCounter: { depth: 0 },
+    _resolveOutputChain: [],
   }
 
   describe('getRelatedListConfig', () => {

package/tests/bare-read-scalars.test.ts

@@ -0,0 +1,147 @@
+import { describe, it, expect, vi } from 'vitest'
+import { getContext } from '../src/context/index.js'
+import { config, list } from '../src/config/index.js'
+import { text, relationship, virtual } from '../src/fields/index.js'
+
+/**
+ * Regression coverage for issue #848 / ADR-0024: a `context.db` read with no
+ * `include` (and no fragment `query`) used to auto-include every readable
+ * relationship of the list, recursing to `READ_INCLUDE_MAX_DEPTH` and
+ * evaluating every related list's operation-level `query` access along the
+ * way. It now returns the row's own columns plus its virtual fields — nothing
+ * more — matching Prisma's own semantics for a bare read. Relations are
+ * fetched only when a caller names them via `include` (covered, unmodified,
+ * by the #566/#830 regression suites in `context.test.ts`).
+ */
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+function createMockPrisma(): any {
+  return {
+    author: {
+      findFirst: vi.fn(),
+      findMany: vi.fn(),
+      create: vi.fn(),
+      update: vi.fn(),
+      delete: vi.fn(),
+      count: vi.fn(),
+    },
+    post: {
+      findFirst: vi.fn(),
+      findMany: vi.fn(),
+      create: vi.fn(),
+      update: vi.fn(),
+      delete: vi.fn(),
+      count: vi.fn(),
+    },
+  }
+}
+
+function buildTestConfig(authorQuerySpy: ReturnType<typeof vi.fn>) {
+  return config({
+    db: { provider: 'postgresql', url: 'postgresql://localhost:5432/test' },
+    lists: {
+      Author: list({
+        fields: {
+          name: text(),
+        },
+        access: { operation: { query: authorQuerySpy } },
+      }),
+      Post: list({
+        fields: {
+          title: text(),
+          // List-only ref keeps the schema minimal — the relation still owns
+          // an `authorId` foreign-key column, which is what matters here.
+          author: relationship({ ref: 'Author' }),
+          shout: virtual({
+            type: 'string',
+            hooks: {
+              resolveOutput: ({ item }) => `${(item as { title?: string }).title}!`,
+            },
+          }),
+        },
+        access: { operation: { query: () => true } },
+      }),
+    },
+  })
+}
+
+describe('a bare read fetches scalars, not relations (#848, ADR-0024)', () => {
+  it('findUnique with no include sends no include to the ORM and evaluates no related query access', async () => {
+    const authorQuerySpy = vi.fn(() => true)
+    const testConfig = await buildTestConfig(authorQuerySpy)
+    const mockPrisma = createMockPrisma()
+    mockPrisma.post.findFirst.mockResolvedValue({ id: '1', title: 'Hello', authorId: 'a1' })
+
+    const context = getContext(testConfig, mockPrisma, null)
+    const result = await context.db.post.findUnique({ where: { id: '1' } })
+
+    expect(mockPrisma.post.findFirst).toHaveBeenCalledWith({
+      where: { id: '1' },
+      include: undefined,
+    })
+    // Related list's operation-level `query` access is never invoked — a bare
+    // read never even considers whether the relation is fetchable.
+    expect(authorQuerySpy).not.toHaveBeenCalled()
+
+    // Own columns (including the FK column) and the computed virtual field
+    // are present; the relation key is absent entirely.
+    expect(result).toEqual({ id: '1', title: 'Hello', authorId: 'a1', shout: 'Hello!' })
+    expect(result).not.toHaveProperty('author')
+  })
+
+  it('findMany with no include sends no include to the ORM and evaluates no related query access', async () => {
+    const authorQuerySpy = vi.fn(() => true)
+    const testConfig = await buildTestConfig(authorQuerySpy)
+    const mockPrisma = createMockPrisma()
+    mockPrisma.post.findMany.mockResolvedValue([{ id: '1', title: 'Hello', authorId: 'a1' }])
+
+    const context = getContext(testConfig, mockPrisma, null)
+    const result = await context.db.post.findMany({})
+
+    expect(mockPrisma.post.findMany).toHaveBeenCalledWith(
+      expect.objectContaining({ include: undefined }),
+    )
+    expect(authorQuerySpy).not.toHaveBeenCalled()
+
+    expect(result).toEqual([{ id: '1', title: 'Hello', authorId: 'a1', shout: 'Hello!' }])
+    expect(result[0]).not.toHaveProperty('author')
+  })
+
+  it('a caller-supplied include still evaluates the related query access (unchanged)', async () => {
+    const authorQuerySpy = vi.fn(() => true)
+    const testConfig = await buildTestConfig(authorQuerySpy)
+    const mockPrisma = createMockPrisma()
+    mockPrisma.post.findFirst.mockResolvedValue({
+      id: '1',
+      title: 'Hello',
+      authorId: 'a1',
+      author: { id: 'a1', name: 'Ann' },
+    })
+
+    const context = getContext(testConfig, mockPrisma, null)
+    const result = await context.db.post.findUnique({
+      where: { id: '1' },
+      include: { author: true },
+    })
+
+    expect(authorQuerySpy).toHaveBeenCalled()
+    expect(result?.author).toEqual({ id: 'a1', name: 'Ann' })
+  })
+
+  it('sudo bare read also sends no include (behaviour already matched Prisma; unaffected by this change)', async () => {
+    const authorQuerySpy = vi.fn(() => true)
+    const testConfig = await buildTestConfig(authorQuerySpy)
+    const mockPrisma = createMockPrisma()
+    mockPrisma.post.findFirst.mockResolvedValue({ id: '1', title: 'Hello', authorId: 'a1' })
+
+    const context = getContext(testConfig, mockPrisma, null).sudo()
+    const result = await context.db.post.findUnique({ where: { id: '1' } })
+
+    expect(mockPrisma.post.findFirst).toHaveBeenCalledWith({
+      where: { id: '1' },
+      include: undefined,
+    })
+    expect(authorQuerySpy).not.toHaveBeenCalled()
+    expect(result).toEqual({ id: '1', title: 'Hello', authorId: 'a1', shout: 'Hello!' })
+  })
+})

package/tests/context.test.ts

@@ -1430,7 +1430,7 @@ describe('getContext', () => {
       // Regression for issue #830: a read issued from inside a `resolveOutput`
       // hook used to lose relation row scoping ENTIRELY — `buildIncludeWithAccessControl`
       // returned a whole-object `undefined` for the inner read (any
-      // `_resolveOutputCounter.depth > 0`), which `mergeIncludeWithAccessControl`
+      // `_resolveOutputChain.length > 0`), which `mergeIncludeWithAccessControl`
       // treated as "nothing to merge against" and passed the caller's include
       // through completely unscoped. The fix scopes each immediate relation with
       // its own access `where` while still not auto-EXPANDING into that
@@ -1439,7 +1439,7 @@ describe('getContext', () => {
       describe('scopes (without expanding) a caller include used inside a resolveOutput hook (#830)', () => {
         // Build an Author config with a virtual field whose resolveOutput issues a
         // read WITH an explicit include. While that hook runs,
-        // _resolveOutputCounter.depth > 0.
+        // _resolveOutputChain.length > 0.
         function configWithResolveOutputProbe(
           callerInclude: Record<string, unknown>,
           capture: (include: unknown) => void,

package/tests/default-value-create.test.ts

@@ -33,7 +33,7 @@ function makeContext(): AccessContext {
     storage: {} as any,
     plugins: {},
     _isSudo: false,
-    _resolveOutputCounter: { depth: 0 },
+    _resolveOutputChain: [],
   }
 }
 

package/tests/hook-pipeline.test.ts

@@ -37,7 +37,7 @@ function makeContext(): AccessContext {
     storage: {} as any,
     plugins: {},
     _isSudo: false,
-    _resolveOutputCounter: { depth: 0 },
+    _resolveOutputChain: [],
   }
 }
 

package/tests/nav-count.test.ts

@@ -43,7 +43,7 @@ function makeContext(counts: Record<string, number>): {
     storage: {},
     plugins: {},
     _isSudo: false,
-    _resolveOutputCounter: { depth: 0 },
+    _resolveOutputChain: [],
   } as unknown as AccessContext
   return { context, spies }
 }
@@ -168,7 +168,7 @@ describe('resolveNavCounts', () => {
       storage: {},
       plugins: {},
       _isSudo: false,
-      _resolveOutputCounter: { depth: 0 },
+      _resolveOutputChain: [],
     } as unknown as AccessContext
 
     const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {})

package/tests/nested-access-and-hooks.test.ts

@@ -397,8 +397,12 @@ describe('Nested Operations - Access Control and Hooks', () => {
 
       const context = getContext(await testConfig, mockPrisma, null)
 
+      // A caller-supplied `include` is required to fetch `posts` at all — a
+      // bare read returns scalars only (ADR-0024) — so name it explicitly to
+      // exercise the per-relation access `where` merge.
       await context.db.user.findUnique({
         where: { id: '1' },
+        include: { posts: true },
       })
 
       // Verify findFirst was called with access filter
@@ -469,8 +473,11 @@ describe('Nested Operations - Access Control and Hooks', () => {
 
       const context = getContext(await testConfig, mockPrisma, null)
 
+      // `author` must be named explicitly — a bare read returns scalars only
+      // (ADR-0024).
       const result = await context.db.post.findUnique({
         where: { id: '1' },
+        include: { author: true },
       })
 
       // Email should be filtered out
@@ -522,8 +529,11 @@ describe('Nested Operations - Access Control and Hooks', () => {
 
       const context = getContext(await testConfig, mockPrisma, null)
 
+      // `author` must be named explicitly to exercise the access-denied drop —
+      // a bare read never requests it at all (ADR-0024).
       await context.db.post.findUnique({
         where: { id: '1' },
+        include: { author: true },
       })
 
       // Verify include does NOT include author (access denied)