@opensaas/stack-core 0.37.0 → 0.38.0

package/src/access/field-visibility.ts

@@ -6,6 +6,7 @@ import { RESOLVE_CHAIN_MAX_LENGTH } from './depth-limits.js'
 import { ResolveOutputCycleError } from './errors.js'
 import type { DeclaredOnlyTree } from './declared-dependencies.js'
 import { emptyDeclaredOnlyTree } from './declared-dependencies.js'
+import type { FieldSelectionScope } from '../query/index.js'
 // NOTE: `context/index.ts` imports `filterReadableFields` from this module
 // (via the `access/index.ts` barrel) — this is an intentional cyclic
 // dependency, the same shape and for the same reason as the one documented in
@@ -23,6 +24,14 @@ import { buildDbDelegate } from '../context/index.js'
  * virtual fields. None of this can move into phase 1: virtual fields are
  * computed in JavaScript and field access can depend on the fetched row.
  *
+ * A computed field — any field carrying a `resolveOutput` hook, virtual or
+ * not — is produced only where the read is going to return it (ADR-0027). A
+ * fragment `query`'s own field selection is the only thing that restricts a
+ * level this way; a bare or `include`-based read, and any relation reached
+ * purely to satisfy a `needs` declaration, still compute every field, as
+ * before. A field the read is not going to return does no work at all —
+ * neither its read-access evaluation nor its hook.
+ *
  * Phase 1 (pre-query row/relation scoping) lives in `access-filter.ts`. See
  * `docs/adr/0001-access-control-is-a-two-phase-read.md` and the access-control
  * glossary in `CONTEXT.md`.
@@ -96,8 +105,11 @@ function deriveResolveOutputContext(
  * from the result.
  *
  * `accessItem` is the row used to evaluate field access; `hookItem` is the
- * object passed to the hook as `item` (these differ for virtual fields, which
- * see the already-filtered output so they can read sibling fields).
+ * object passed to the hook as `item`. For a stored field, both are
+ * `workingItem` (the row's own stored/fetched columns). For a virtual field,
+ * `hookItem` is `computedFieldItem` instead — the same stored columns with
+ * every skipped-or-denied key removed — so it never sees another computed
+ * field's resolved value (ADR-0027).
  */
 async function resolveReadableFieldValue(params: {
   fieldConfig: FieldConfig | undefined
@@ -189,6 +201,13 @@ export async function filterReadableFields<T extends Record<string, unknown>>(
   // returned — after resolveOutput has had a chance to read them — so a
   // declared dependency never widens what the caller receives.
   declaredOnly: DeclaredOnlyTree = emptyDeclaredOnlyTree(),
+  // The fragment scope this level was reached under (ADR-0027), and the same
+  // tree one level down for each nested relation. `undefined` — the default,
+  // and what a bare/`include`-based read passes at every level — means
+  // unrestricted: every field on the list is computed, unchanged from
+  // before ADR-0027. Only a `query` fragment's own field selection ever
+  // restricts a level.
+  selection?: FieldSelectionScope,
 ): Promise<Partial<T>> {
   const filtered: Record<string, unknown> = {}
 
@@ -214,6 +233,15 @@ export async function filterReadableFields<T extends Record<string, unknown>>(
     workingItem[fieldName] = assembled
   }
 
+  // Keys denied by field-level read access during the pass below — as opposed
+  // to a key merely skipped by `selection` or held back only for
+  // `declaredOnly` stripping. Tracked separately because a denied key must
+  // stay invisible to a computed field's hook (below), while a declared-only
+  // key must stay VISIBLE to one — that is the entire point of declaring it
+  // (ADR-0025) — even though `selection` above skipped adding it to
+  // `filtered` because the caller's fragment never asked for it.
+  const accessDeniedKeys = new Set<string>()
+
   // Process existing fields from the database result
   for (const [fieldName, value] of Object.entries(workingItem)) {
     const fieldConfig = fieldConfigs[fieldName]
@@ -224,8 +252,19 @@ export async function filterReadableFields<T extends Record<string, unknown>>(
       continue
     }
 
+    // Projection-aware skip (ADR-0027): a fragment read that does not select
+    // this field does no work for it at all — no field-level read-access
+    // check, no resolveOutput, no recursion into a relation — because the
+    // read is never going to return it. `selection` is only ever restricted
+    // by a fragment's own field selection; a bare/`include`-based read, and a
+    // relation reached only to satisfy another field's `needs`, pass no
+    // selection at all and compute every field here, unchanged.
+    if (selection?.fields && !selection.fields.has(fieldName)) {
+      continue
+    }
+
     // Handle relationship fields - recursively filter fields within related items
-    // Note: Access control filtering is now done at database level via buildIncludeWithAccessControl
+    // Note: Access control filtering is now done at database level via buildAccessScopedInclude
     // This only handles field-level access (hiding sensitive fields)
     //
     // Deliberately uncapped: the row/relation scoping in access-filter.ts bounds
@@ -251,6 +290,7 @@ export async function filterReadableFields<T extends Record<string, unknown>>(
       })
 
       if (!canRead) {
+        accessDeniedKeys.add(fieldName)
         continue
       }
 
@@ -260,6 +300,12 @@ export async function filterReadableFields<T extends Record<string, unknown>>(
       // back to an empty tree when this relation isn't declaration-related at
       // all — the common case.
       const nestedDeclaredOnly = declaredOnly.nested[fieldName] ?? emptyDeclaredOnlyTree()
+      // This relation's own fragment scope, if the caller's fragment named it
+      // with a nested Fragment/RelationSelector. `undefined` (a bare `true`
+      // selector, or no `selection` at all) means the nested list computes
+      // unrestricted — matching what naming a relation without narrowing it
+      // further has always meant.
+      const nestedSelection = selection?.nested[fieldName]
 
       if (relatedConfig) {
         // For many relationships (arrays) - recursively filter fields in each item
@@ -275,6 +321,7 @@ export async function filterReadableFields<T extends Record<string, unknown>>(
                 depth + 1,
                 relatedConfig.listName,
                 nestedDeclaredOnly,
+                nestedSelection,
               ),
             ),
           )
@@ -290,6 +337,7 @@ export async function filterReadableFields<T extends Record<string, unknown>>(
             depth + 1,
             relatedConfig.listName,
             nestedDeclaredOnly,
+            nestedSelection,
           )
         }
       } else {
@@ -314,7 +362,36 @@ export async function filterReadableFields<T extends Record<string, unknown>>(
 
     if (result.readable) {
       filtered[fieldName] = result.value
+    } else {
+      accessDeniedKeys.add(fieldName)
+    }
+  }
+
+  // The item a virtual field's hook sees: stored columns and fetched
+  // relations (from `workingItem`, never a resolved value — no hook's output
+  // is ever written back into `workingItem`). A key is visible here if it
+  // either survived into `filtered` (selected and allowed) OR exists only to
+  // satisfy a `needs` declaration (`declaredOnly` — that IS the point of
+  // declaring it: fetched for a hook, never for the caller, ADR-0025).
+  // Everything else — field-level denied, or skipped by `selection` and
+  // declared by no one — is deleted. A computed field reaches for exactly its
+  // own declared dependencies and nothing another field's hook produced
+  // (ADR-0027): reaching for a sibling that was denied or skipped-and-
+  // undeclared finds nothing there, the same as reaching for one never
+  // declared at all, and reaching for a sibling that DID survive finds its
+  // raw stored form, never another hook's resolved value — a virtual field
+  // computed earlier in declaration order is exactly as invisible as one
+  // computed later.
+  const computedFieldItem: Record<string, unknown> = { ...workingItem }
+  for (const key of Object.keys(workingItem)) {
+    if (['id', 'createdAt', 'updatedAt'].includes(key)) continue
+    if (accessDeniedKeys.has(key)) {
+      delete computedFieldItem[key]
+      continue
     }
+    if (key in filtered) continue
+    if (declaredOnly.keys.has(key)) continue
+    delete computedFieldItem[key]
   }
 
   // Process virtual fields - compute values from other fields
@@ -330,22 +407,29 @@ export async function filterReadableFields<T extends Record<string, unknown>>(
       continue
     }
 
-    // Virtual fields must have a resolveOutput hook to compute their value;
-    // without one there is nothing to add to the result.
+    // Projection-aware skip (ADR-0027): same rule as the stored-field pass
+    // above — a fragment that does not select this virtual field does no
+    // work for it at all.
+    if (selection?.fields && !selection.fields.has(fieldName)) {
+      continue
+    }
+
+    // A virtual field with no resolveOutput hook can never produce a value
+    // on ANY read — there is nothing to compute, so there is nothing to do,
+    // including evaluating its read access (ADR-0027 reconciles the
+    // access-only evaluation this branch used to preserve: a field that
+    // never has output has no side effect worth preserving access for).
     if (!(fieldConfig.hooks?.resolveOutput && listKey)) {
-      // Still evaluate read access to preserve any access-fn side effects.
-      await checkFieldAccess(fieldConfig.access, 'read', { ...args, item: workingItem })
       continue
     }
 
-    // Check read access and compute the value via the shared helper. Virtual
-    // fields see the already-filtered item so they can read sibling fields.
+    // Check read access and compute the value via the shared helper.
     const result = await resolveReadableFieldValue({
       fieldConfig,
       fieldName,
       value: undefined, // Virtual fields don't have a database value
       accessItem: workingItem,
-      hookItem: filtered,
+      hookItem: computedFieldItem,
       listKey,
       args,
       config,
@@ -357,10 +441,11 @@ export async function filterReadableFields<T extends Record<string, unknown>>(
   }
 
   // Strip relations that were fetched ONLY to satisfy a `needs` declaration
-  // (ADR-0025), now that every resolveOutput hook at this level — including
-  // virtual fields, which read the assembled `filtered` object above — has
-  // had the chance to see them. A declared dependency is private plumbing,
-  // not an implicit `include`: it never widens what the caller receives.
+  // (ADR-0025), now that every resolveOutput hook at this level has had the
+  // chance to see them (via `computedFieldItem`, never `filtered` itself — a
+  // declared dependency is read from stored columns, not from another
+  // field's resolved output). A declared dependency is private plumbing, not
+  // an implicit `include`: it never widens what the caller receives.
   for (const key of declaredOnly.keys) {
     delete filtered[key]
   }

package/src/access/index.ts

@@ -22,13 +22,7 @@ export {
 // Canonical field-level access evaluation (shared by read and write paths).
 export { checkFieldAccess, filterWritableFields } from './field-access.js'
 // Phase 1 — Access Filter (pre-query row/relation scoping).
-export {
-  buildIncludeWithAccessControl,
-  mergeIncludeWithAccessControl,
-  stripVirtualFieldsFromInclude,
-  toPrismaInclude,
-} from './access-filter.js'
-export type { AccessIncludeResult } from './access-filter.js'
+export { buildAccessScopedInclude, stripVirtualFieldsFromInclude } from './access-filter.js'
 // Phase 2 — Field Visibility (post-query field stripping + resolveOutput).
 export { filterReadableFields } from './field-visibility.js'
 // Declared Dependencies — folding `needs` into an include without widening

package/src/access/relationship-count.ts

@@ -15,7 +15,7 @@ import { getDbKey } from '../lib/case-utils.js'
  * per-row query is issued and the count can never include rows the session
  * cannot read. This module is the single place the related list's
  * operation-level `query` access is folded into that `_count`, mirroring how
- * `buildIncludeWithAccessControl` folds it into relation includes.
+ * `buildAccessScopedInclude` folds it into relation includes.
  *
  * It also resolves the count Filter spec's markers: Prisma cannot compare a
  * relation count in a `where`, so a to-many relationship's Filter spec emits a

package/src/context/index.ts

@@ -4,8 +4,7 @@ import {
   checkAccess,
   mergeFilters,
   filterReadableFields,
-  buildIncludeWithAccessControl,
-  mergeIncludeWithAccessControl,
+  buildAccessScopedInclude,
   stripVirtualFieldsFromInclude,
   foldDeclaredDependencies,
 } from '../access/index.js'
@@ -13,8 +12,8 @@ import type { DeclaredOnlyTree } from '../access/index.js'
 import { ValidationError, DatabaseError } from '../hooks/index.js'
 import { getDbKey } from '../lib/case-utils.js'
 import type { PrismaClientLike } from '../access/types.js'
-import { buildInclude, pickFields, isFragment } from '../query/index.js'
-import type { FieldSelection } from '../query/index.js'
+import { buildInclude, pickFields, isFragment, buildFieldSelectionScope } from '../query/index.js'
+import type { FieldSelection, FieldSelectionScope } from '../query/index.js'
 import { getRelationshipOptions } from '../query/relationship-options.js'
 import {
   runWritePipeline,
@@ -921,11 +920,19 @@ export function buildDbDelegate<TPrisma extends PrismaClientLike>(
  *
  * A fragment's own `include` and a sudo caller's `include` are folded and
  * used as-is, matching their existing (unmerged) treatment. A non-sudo
- * caller include is folded and then merged through the same
- * access-scoping pipeline as before. A bare read stays on the exact
- * ADR-0024 path — `include: undefined`, no related `query` access
- * evaluated — unless folding actually added something, which only happens
- * when a field on this list declares `needs`.
+ * caller include is folded and then scoped by `buildAccessScopedInclude`
+ * (ADR-0026) — caller-directed, so a relation named nowhere in the folded
+ * tree never has its list's `query` access evaluated at all. A bare read
+ * stays on the exact ADR-0024 path — `include: undefined`, no related
+ * `query` access evaluated — unless folding actually added something, which
+ * only happens when a field on this list declares `needs`.
+ *
+ * Also returns the `FieldSelectionScope` a fragment's own field selection
+ * produces (ADR-0027), so the caller can pass it to `filterReadableFields`
+ * and make computation itself projection-aware, not only the fold above.
+ * `undefined` for every non-fragment path: a caller `include` (sudo or not)
+ * and a bare read both mean "compute every field," matching what they
+ * already fetch.
  */
 async function resolveReadInclude(
   callerInclude: Record<string, unknown> | undefined,
@@ -935,38 +942,43 @@ async function resolveReadInclude(
   listConfig: ListConfig<any>,
   context: AccessContext & { _isSudo?: boolean },
   config: OpenSaasConfig,
-): Promise<{ include: Record<string, unknown> | undefined; declaredOnly: DeclaredOnlyTree }> {
+): Promise<{
+  include: Record<string, unknown> | undefined
+  declaredOnly: DeclaredOnlyTree
+  selection: FieldSelectionScope | undefined
+}> {
   if (fragmentFields !== undefined) {
     const fragmentInclude = buildInclude(fragmentFields) ?? undefined
-    return foldDeclaredDependencies(fragmentInclude, listConfig.fields, config)
+    const selection = buildFieldSelectionScope(fragmentFields)
+    const folded = foldDeclaredDependencies(
+      fragmentInclude,
+      listConfig.fields,
+      config,
+      listName,
+      [listName],
+      selection,
+    )
+    return { ...folded, selection }
   }
 
   if (context._isSudo) {
-    return foldDeclaredDependencies(callerInclude, listConfig.fields, config)
+    const folded = foldDeclaredDependencies(callerInclude, listConfig.fields, config, listName)
+    return { ...folded, selection: undefined }
   }
 
-  const folded = foldDeclaredDependencies(callerInclude, listConfig.fields, config)
+  const folded = foldDeclaredDependencies(callerInclude, listConfig.fields, config, listName)
   if (!folded.include) {
-    return folded
+    return { ...folded, selection: undefined }
   }
 
-  const accessControlledInclude = await buildIncludeWithAccessControl(
-    listConfig.fields,
-    { session: context.session, context },
-    config,
-    0,
-    // Seed the cycle guard with the root list so a relationship cycle back
-    // to it (self-referential or longer) stops re-descending.
-    [listName],
-  )
-  const include = mergeIncludeWithAccessControl(
+  const include = await buildAccessScopedInclude(
     folded.include,
-    accessControlledInclude,
     listConfig.fields,
+    { session: context.session, context },
     config,
     listName,
   )
-  return { include, declaredOnly: folded.declaredOnly }
+  return { include, declaredOnly: folded.declaredOnly, selection: undefined }
 }
 
 /**
@@ -1032,7 +1044,7 @@ function createFindUnique<TPrisma extends PrismaClientLike>(
     // Resolve `include`, folding any declared dependencies (`needs`,
     // ADR-0025) in alongside whatever the fragment/caller/sudo/bare path
     // already produces — see `resolveReadInclude`'s doc comment.
-    let { include, declaredOnly } = await resolveReadInclude(
+    let { include, declaredOnly, selection } = await resolveReadInclude(
       args.include,
       fragment ? fragment._fields : undefined,
       listName,
@@ -1044,8 +1056,10 @@ function createFindUnique<TPrisma extends PrismaClientLike>(
     // Virtual fields have no database column. Whichever path produced
     // `include` (fragment, access-controlled merge, or sudo passthrough), a
     // virtual key must never reach Prisma — it would throw "Unknown field"
-    // (#628). The virtual value is still computed unconditionally below by
-    // `filterReadableFields`, independent of what was requested here.
+    // (#628). Below, `filterReadableFields` computes a virtual field's value
+    // exactly when `selection` says the read is going to return it (ADR-0027)
+    // — every one of them for a bare/`include`-based read (`selection` is
+    // `undefined`), only the ones a fragment named otherwise.
     include = stripVirtualFieldsFromInclude(include, listConfig.fields, config)
 
     // Execute query with optimized includes
@@ -1074,6 +1088,7 @@ function createFindUnique<TPrisma extends PrismaClientLike>(
       0,
       listName,
       declaredOnly,
+      selection,
     )
 
     // When a fragment is provided, pick only the requested fields from the result
@@ -1145,7 +1160,7 @@ function createFindMany<TPrisma extends PrismaClientLike>(
     // Resolve `include`, folding any declared dependencies (`needs`,
     // ADR-0025) in alongside whatever the fragment/caller/sudo/bare path
     // already produces — see `resolveReadInclude`'s doc comment.
-    let { include, declaredOnly } = await resolveReadInclude(
+    let { include, declaredOnly, selection } = await resolveReadInclude(
       args?.include,
       fragment ? fragment._fields : undefined,
       listName,
@@ -1157,8 +1172,10 @@ function createFindMany<TPrisma extends PrismaClientLike>(
     // Virtual fields have no database column. Whichever path produced
     // `include` (fragment, access-controlled merge, or sudo passthrough), a
     // virtual key must never reach Prisma — it would throw "Unknown field"
-    // (#628). The virtual value is still computed unconditionally below by
-    // `filterReadableFields`, independent of what was requested here.
+    // (#628). Below, `filterReadableFields` computes a virtual field's value
+    // exactly when `selection` says the read is going to return it (ADR-0027)
+    // — every one of them for a bare/`include`-based read (`selection` is
+    // `undefined`), only the ones a fragment named otherwise.
     include = stripVirtualFieldsFromInclude(include, listConfig.fields, config)
 
     // Execute query with optimized includes
@@ -1188,6 +1205,7 @@ function createFindMany<TPrisma extends PrismaClientLike>(
           0,
           listName,
           declaredOnly,
+          selection,
         ),
       ),
     )
@@ -1461,7 +1479,7 @@ function createGet<TPrisma extends PrismaClientLike>(
     // Resolve `include`, folding any declared dependencies (`needs`,
     // ADR-0025) in alongside whatever the fragment/caller/sudo/bare path
     // already produces — see `resolveReadInclude`'s doc comment.
-    let { include, declaredOnly } = await resolveReadInclude(
+    let { include, declaredOnly, selection } = await resolveReadInclude(
       args?.include,
       fragment ? fragment._fields : undefined,
       listName,
@@ -1493,6 +1511,7 @@ function createGet<TPrisma extends PrismaClientLike>(
         0,
         listName,
         declaredOnly,
+        selection,
       )
       // When a fragment is provided, pick only the requested fields from the result
       if (fragment) {

package/src/query/index.ts

@@ -345,6 +345,59 @@ export function buildInclude(fields: FieldSelection<unknown>): Record<string, un
   return hasIncludes ? include : undefined
 }
 
+/**
+ * A snapshot of which field names a fragment selects at one nesting level,
+ * plus the same tree one level down for every relation selected via a nested
+ * Fragment/RelationSelector. `fields: undefined` means "unrestricted" — every
+ * field at this level is going to be returned, which is what a bare or
+ * `include`-based read means for the whole tree (only a `query` fragment ever
+ * produces a restricted scope, and only as deep as it names).
+ *
+ * Used to make computed-field evaluation (`filterReadableFields`) and
+ * declared-dependency folding (`foldDeclaredDependencies`) projection-aware
+ * (ADR-0027): a field not named by the scope at its level is never computed
+ * and its `needs` are never folded, because the read is never going to
+ * return it.
+ * @internal
+ */
+export type FieldSelectionScope = {
+  readonly fields: ReadonlySet<string> | undefined
+  readonly nested: Readonly<Record<string, FieldSelectionScope>>
+}
+
+/**
+ * Build the `FieldSelectionScope` for one fragment's field selection,
+ * recursing into nested Fragment/RelationSelector entries the same way
+ * `buildInclude` does. A relation named with the bare `true` shorthand (no
+ * narrower nested Fragment) gets no entry in `nested`, so a level reached
+ * through it is treated as unrestricted — the caller asked for "everything"
+ * there and gave no narrower shape to restrict it with.
+ * @internal
+ */
+export function buildFieldSelectionScope(fields: FieldSelection<unknown>): FieldSelectionScope {
+  const fieldNames = new Set(Object.keys(fields as Record<string, unknown>))
+  const nested: Record<string, FieldSelectionScope> = {}
+
+  for (const [key, value] of Object.entries(fields as Record<string, unknown>)) {
+    if (value === null || value === true || typeof value !== 'object') continue
+    const val = value as Record<string, unknown>
+
+    if (isFragment(val)) {
+      nested[key] = buildFieldSelectionScope(val._fields as FieldSelection<unknown>)
+      continue
+    }
+
+    if ('query' in val && isFragment(val.query)) {
+      nested[key] = buildFieldSelectionScope(
+        (val.query as Fragment<unknown, FieldSelection<unknown>>)
+          ._fields as FieldSelection<unknown>,
+      )
+    }
+  }
+
+  return { fields: fieldNames, nested }
+}
+
 /**
  * Recursively pick only the fields requested by a fragment from a raw Prisma
  * result object. This ensures the runtime shape exactly matches the type

package/src/query/relationship-options.ts

@@ -23,7 +23,7 @@ export interface RelationshipOptionsArgs {
  * editor — the read primitive behind the `relationshipOptions` serverAction
  * op. Selects only `id` and the resolved label field (via
  * {@link getLabelFieldName}), so the fragment carries no relation keys and
- * `buildIncludeWithAccessControl`'s depth-5 auto-include never runs.
+ * `buildAccessScopedInclude` never has anything to scope.
  *
  * Operation-level `query` access on `relatedListKey` still applies — a denied
  * list resolves to `[]` (via the underlying access-controlled `findMany`).

package/tests/access-relationships.test.ts

@@ -123,7 +123,7 @@ describe('Relationship Access Control', () => {
         expect(result.author?.name).toBe('John Doe')
       })
 
-      it('should filter out single relationship when access denied (via buildIncludeWithAccessControl)', async () => {
+      it('should filter out single relationship when access denied (via buildAccessScopedInclude)', async () => {
         const config: OpenSaasConfig = {
           db: {
             provider: 'postgresql',
@@ -152,16 +152,18 @@ describe('Relationship Access Control', () => {
           },
         }
 
-        // Test that buildIncludeWithAccessControl excludes the denied relationship
-        const { buildIncludeWithAccessControl } = await import('../src/access/index.js')
+        // Test that buildAccessScopedInclude excludes the denied relationship
+        const { buildAccessScopedInclude } = await import('../src/access/index.js')
 
-        const include = await buildIncludeWithAccessControl(
+        const include = await buildAccessScopedInclude(
+          { author: true },
           config.lists.Post.fields,
           {
             session: null,
             context: mockContext,
           },
           config,
+          'Post',
         )
 
         // When access is denied, the relationship should not be included
@@ -286,7 +288,7 @@ describe('Relationship Access Control', () => {
         expect(result.posts?.[1].title).toBe('Post 2')
       })
 
-      it('should filter items in many relationships based on query access (via buildIncludeWithAccessControl)', async () => {
+      it('should filter items in many relationships based on query access (via buildAccessScopedInclude)', async () => {
         const config: OpenSaasConfig = {
           db: {
             provider: 'postgresql',
@@ -318,19 +320,19 @@ describe('Relationship Access Control', () => {
           },
         }
 
-        // Test that buildIncludeWithAccessControl creates the right where clause
-        const { buildIncludeWithAccessControl, toPrismaInclude } =
-          await import('../src/access/index.js')
+        // Test that buildAccessScopedInclude creates the right where clause
+        const { buildAccessScopedInclude } = await import('../src/access/index.js')
 
-        const result = await buildIncludeWithAccessControl(
+        const include = await buildAccessScopedInclude(
+          { posts: true },
           config.lists.User.fields,
           {
             session: null,
             context: mockContext,
           },
           config,
+          'User',
         )
-        const include = toPrismaInclude(result)
 
         // Should include posts with a where filter
         expect(include).toBeDefined()
@@ -452,7 +454,7 @@ describe('Relationship Access Control', () => {
     })
 
     describe('session-based access for relationships', () => {
-      it('should apply session-based access to relationships (via buildIncludeWithAccessControl)', async () => {
+      it('should apply session-based access to relationships (via buildAccessScopedInclude)', async () => {
         const config: OpenSaasConfig = {
           db: {
             provider: 'postgresql',
@@ -487,19 +489,19 @@ describe('Relationship Access Control', () => {
           },
         }
 
-        // Test that buildIncludeWithAccessControl creates session-based where clause
-        const { buildIncludeWithAccessControl, toPrismaInclude } =
-          await import('../src/access/index.js')
+        // Test that buildAccessScopedInclude creates session-based where clause
+        const { buildAccessScopedInclude } = await import('../src/access/index.js')
 
-        const result = await buildIncludeWithAccessControl(
+        const include = await buildAccessScopedInclude(
+          { posts: true },
           config.lists.User.fields,
           {
             session: { userId: '1' },
             context: mockContext,
           },
           config,
+          'User',
         )
-        const include = toPrismaInclude(result)
 
         // Should include posts with session-based where filter
         expect(include).toBeDefined()