@opensaas/stack-core 0.37.0 → 0.38.0

package/src/access/access-filter.test.ts

@@ -1,24 +1,27 @@
-import { describe, it, expect } from 'vitest'
-import {
-  buildIncludeWithAccessControl,
-  mergeIncludeWithAccessControl,
-  toPrismaInclude,
-} from './access-filter.js'
+import { describe, it, expect, vi } from 'vitest'
+import { buildAccessScopedInclude } from './access-filter.js'
 import { AccessScopeDepthExceededError } from './errors.js'
 import { READ_INCLUDE_MAX_DEPTH } from './depth-limits.js'
 import type { OpenSaasConfig, FieldConfig } from '../config/types.js'
 import type { AccessContext } from './types.js'
 
 /**
- * Regression coverage for the cyclic readable-relationship auto-include.
+ * Regression coverage for `buildAccessScopedInclude`, the caller-directed
+ * access-scoping walk introduced by ADR-0026. It replaces the old two-step
+ * "auto-walk every relationship of the list, then reconcile against whatever
+ * the caller asked for" pipeline (`buildIncludeWithAccessControl` +
+ * `mergeIncludeWithAccessControl`): the walk now recurses ONLY into the
+ * branches a request (`requestedInclude`) itself names, and never evaluates
+ * `query` access on a relation nobody asked for.
  *
- * On a relationship graph that contains a cycle (A → B → C → A) the depth-first
- * auto-include used to descend the cycle on every branch to `MAX_DEPTH`, and
- * `mergeIncludeWithAccessControl` re-expanded any bare-`true` leaf back into that
- * same auto-include. The resulting include tree was deep/large enough to
- * stack-overflow downstream processing (the RSC serializer). The fix seeds a
- * cycle guard with the root list and stops the walk at cycle back-edges, so a
- * relation that closes a cycle comes back FLAT (own columns only).
+ * The scenarios below carry forward the guarantees the old two-function
+ * pipeline encoded — #566 (caller include augments, never replaces, the
+ * access-controlled scope), #752 (a caller `take` survives the merge), #830
+ * (fail-closed past the read-include depth cap) — expressed against the new,
+ * single-function API. New coverage (the point of ADR-0026 itself): a
+ * relation the request doesn't name never has its list's `query` access
+ * invoked, and naming a relation fetches its own columns and stops (the "One
+ * hop" rule) at every level, not just the root.
  */
 
 // A relationship field pointing at another list.
@@ -26,38 +29,11 @@ function rel(ref: string, many = false): FieldConfig {
   return { type: 'relationship', ref, many } as unknown as FieldConfig
 }
 
-// A cyclic config: A → B → C → A (plus a scalar on each list).
-function cyclicConfig(): OpenSaasConfig {
-  const allowQuery = () => true
-  return {
-    db: { provider: 'sqlite', url: 'file:./dev.db' },
-    lists: {
-      A: {
-        fields: { name: { type: 'text' } as FieldConfig, b: rel('B.a') },
-        access: { operation: { query: allowQuery } },
-      },
-      B: {
-        fields: { name: { type: 'text' } as FieldConfig, c: rel('C.b') },
-        access: { operation: { query: allowQuery } },
-      },
-      C: {
-        fields: { name: { type: 'text' } as FieldConfig, a: rel('A.c') },
-        access: { operation: { query: allowQuery } },
-      },
-    },
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
-  } as any
-}
-
-function makeContext(resolveOutputDepth = 0): AccessContext {
-  const chain = Array.from({ length: resolveOutputDepth }, (_, i) => ({
-    listKey: 'TestHook',
-    fieldKey: `hook${i}`,
-  }))
+function makeContext(): AccessContext {
   return {
     session: null,
     _isSudo: false,
-    _resolveOutputChain: chain,
+    _resolveOutputChain: [],
     // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal context for unit test
   } as any
 }
@@ -81,10 +57,16 @@ function includeDepth(include: unknown): number {
 // A straight-line chain of `count` lists, each with a scalar field and a
 // single relationship to the next list: L0 → L1 → … → L(count-1). Every list
 // past the root is query-scoped with a filter unique to it, so a test can
-// assert the merged tree actually carries the right `where` at a given hop
-// (not just that it happens not to throw).
-function chainConfig(count: number): OpenSaasConfig {
+// assert the scoped tree actually carries the right `where` at a given hop
+// (not just that it happens not to throw). `access.operation.query` is a
+// `vi.fn()` on every list so tests can additionally assert which lists' access
+// functions were (or were not) invoked.
+function chainConfig(count: number): {
+  config: OpenSaasConfig
+  queryFns: Record<string, ReturnType<typeof vi.fn>>
+} {
   const lists: Record<string, { fields: Record<string, FieldConfig>; access: unknown }> = {}
+  const queryFns: Record<string, ReturnType<typeof vi.fn>> = {}
   for (let i = 0; i < count; i++) {
     const listName = `L${i}`
     const fields: Record<string, FieldConfig> = { name: { type: 'text' } as FieldConfig }
@@ -95,22 +77,24 @@ function chainConfig(count: number): OpenSaasConfig {
       fields.prev = rel(`L${i - 1}.next`)
     }
     const filter = { ownerId: { equals: listName } }
-    lists[listName] = {
-      fields,
-      access: { operation: { query: i === 0 ? () => true : () => filter } },
-    }
+    const queryFn = vi.fn(i === 0 ? () => true : () => filter)
+    queryFns[listName] = queryFn
+    lists[listName] = { fields, access: { operation: { query: queryFn } } }
   }
   return {
-    db: { provider: 'sqlite', url: 'file:./dev.db' },
-    lists,
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
-  } as any
+    config: {
+      db: { provider: 'sqlite', url: 'file:./dev.db' },
+      lists,
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+    } as any,
+    queryFns,
+  }
 }
 
-// A caller `include` value selecting `next` `hops` more times beyond the
+// A requested `include` value selecting `next` `hops` more times beyond the
 // point at which this value is attached, ending in a bare `true` leaf. E.g.
-// `nestedInclude(0) === true` (stop here); `{ next: nestedInclude(2) }` at the
-// top level names 3 hops total (the outer `next` plus 2 more).
+// `nestedInclude(0) === true` (stop here); `{ include: { next: nestedInclude(2) } }`
+// at the top level names 3 hops total (the outer `next` plus 2 more).
 function nestedInclude(hops: number): Record<string, unknown> {
   if (hops <= 0) return true as unknown as Record<string, unknown>
   return { include: { next: nestedInclude(hops - 1) } }
@@ -118,8 +102,8 @@ function nestedInclude(hops: number): Record<string, unknown> {
 
 // Read the `where` at the end of a chain of nested `next` includes (used to
 // assert row-scoping survived down to a specific hop).
-function whereAtHop(merged: Record<string, unknown>, hops: number): unknown {
-  let current: unknown = merged
+function whereAtHop(scoped: Record<string, unknown>, hops: number): unknown {
+  let current: unknown = scoped
   for (let i = 0; i < hops; i++) {
     const entry = (current as { next?: unknown })?.next
     if (i === hops - 1) return (entry as { where?: unknown })?.where
@@ -128,98 +112,127 @@ function whereAtHop(merged: Record<string, unknown>, hops: number): unknown {
   return undefined
 }
 
-describe('buildIncludeWithAccessControl — cyclic graph', () => {
-  it('stops re-descending a relationship cycle instead of walking to MAX_DEPTH', async () => {
-    const config = cyclicConfig()
-    const result = await buildIncludeWithAccessControl(
-      config.lists.A.fields,
-      { session: null, context: makeContext() },
-      config,
-      0,
-      ['A'],
-    )
-    const include = toPrismaInclude(result)
-
-    // A → B → C, then C.a closes the cycle back to A → flat (no further nesting).
-    expect(include).toEqual({
-      b: { include: { c: { include: { a: true } } } },
-    })
-    // Three distinct lists → depth 3, not the old MAX_DEPTH=5 (which on a cycle
-    // could recurse A→B→C→A→B).
-    expect(includeDepth(include)).toBe(3)
-  })
-
-  it('flattens a self-referential relationship to a single level', async () => {
-    const allowQuery = () => true
+describe('buildAccessScopedInclude — caller-directed walk (ADR-0026)', () => {
+  it('does not invoke query access on a relation the request never named', async () => {
+    // A → B, A → C (siblings). Requesting only `b` must never touch C's
+    // access function — the core guarantee #852 introduces: a request
+    // naming one relation no longer walks (and access-checks) every other
+    // relationship of the list.
+    const queryB = vi.fn(() => true)
+    const queryC = vi.fn(() => true)
     const config = {
       db: { provider: 'sqlite' },
       lists: {
-        Category: {
-          fields: {
-            name: { type: 'text' } as FieldConfig,
-            parent: rel('Category.children'),
-            children: rel('Category.parent', true),
-          },
-          access: { operation: { query: allowQuery } },
+        A: {
+          fields: { b: rel('B.a'), c: rel('C.a') },
+          access: { operation: { query: () => true } },
+        },
+        B: {
+          fields: { name: { type: 'text' } as FieldConfig },
+          access: { operation: { query: queryB } },
+        },
+        C: {
+          fields: { name: { type: 'text' } as FieldConfig },
+          access: { operation: { query: queryC } },
         },
       },
       // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
     } as any as OpenSaasConfig
 
-    const result = await buildIncludeWithAccessControl(
-      config.lists.Category.fields,
+    const include = await buildAccessScopedInclude(
+      { b: true },
+      config.lists.A.fields,
+      { session: null, context: makeContext() },
+      config,
+      'A',
+    )
+
+    expect(include).toEqual({ b: true })
+    expect(queryB).toHaveBeenCalledTimes(1)
+    expect(queryC).not.toHaveBeenCalled()
+  })
+
+  it("fetches a named relation's own columns and stops — does not auto-expand its subtree (One hop)", async () => {
+    const { config, queryFns } = chainConfig(4) // L0 → L1 → L2 → L3
+
+    const include = await buildAccessScopedInclude(
+      { next: true },
+      config.lists.L0.fields,
       { session: null, context: makeContext() },
       config,
-      0,
-      ['Category'],
+      'L0',
     )
-    const include = toPrismaInclude(result)
 
-    // Both self-references come back flat — no infinite parent/children descent.
-    expect(include).toEqual({ parent: true, children: true })
+    // L1 is fetched and where-scoped; L2/L3 are never reached because the
+    // request named `next` bare, with no nested `include` beneath it.
+    expect(include).toEqual({ next: { where: { ownerId: { equals: 'L1' } } } })
     expect(includeDepth(include)).toBe(1)
+    expect(queryFns.L1).toHaveBeenCalledTimes(1)
+    expect(queryFns.L2).not.toHaveBeenCalled()
+    expect(queryFns.L3).not.toHaveBeenCalled()
   })
-})
 
-describe('mergeIncludeWithAccessControl — bare-true leaf on a cyclic graph', () => {
-  it('does not re-expand a bare-true leaf beyond the cycle-bounded auto-include', async () => {
-    const config = cyclicConfig()
-    const accessControlledInclude = await buildIncludeWithAccessControl(
-      config.lists.A.fields,
+  it('scopes a nested path at every level the request names it', async () => {
+    const { config, queryFns } = chainConfig(4) // L0 → L1 → L2 → L3
+
+    const include = await buildAccessScopedInclude(
+      { next: { include: { next: { include: { next: true } } } } },
+      config.lists.L0.fields,
       { session: null, context: makeContext() },
       config,
-      0,
-      ['A'],
+      'L0',
     )
 
-    // Caller asks for A → b with a bare-`true` leaf. The merge must keep the
-    // access-controlled (cycle-bounded) nested include rather than re-expanding
-    // the leaf into an unbounded auto-include.
-    const merged = mergeIncludeWithAccessControl(
-      { b: true },
-      accessControlledInclude,
+    expect(include).toEqual({
+      next: {
+        where: { ownerId: { equals: 'L1' } },
+        include: {
+          next: {
+            where: { ownerId: { equals: 'L2' } },
+            include: { next: { where: { ownerId: { equals: 'L3' } } } },
+          },
+        },
+      },
+    })
+    expect(queryFns.L1).toHaveBeenCalledTimes(1)
+    expect(queryFns.L2).toHaveBeenCalledTimes(1)
+    expect(queryFns.L3).toHaveBeenCalledTimes(1)
+  })
+
+  it('scopes a full cyclic path exactly as requested, one hop stopping the cycle', async () => {
+    // A → B → C → A. The caller explicitly names the whole cyclic path; the
+    // walk simply follows the finite literal it was given (no cycle guard
+    // needed here — that only matters for the declared-dependency fold, see
+    // declared-dependencies.ts).
+    const allowQuery = () => true
+    const config = {
+      db: { provider: 'sqlite' },
+      lists: {
+        A: { fields: { b: rel('B.a') }, access: { operation: { query: allowQuery } } },
+        B: { fields: { c: rel('C.b') }, access: { operation: { query: allowQuery } } },
+        C: { fields: { a: rel('A.c') }, access: { operation: { query: allowQuery } } },
+      },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+    } as any as OpenSaasConfig
+
+    const include = await buildAccessScopedInclude(
+      { b: { include: { c: { include: { a: true } } } } },
       config.lists.A.fields,
+      { session: null, context: makeContext() },
       config,
       'A',
     )
 
-    expect(merged).toEqual({
-      b: { include: { c: { include: { a: true } } } },
-    })
-    // Still bounded to the acyclic path length.
-    expect(includeDepth(merged)).toBeLessThanOrEqual(3)
+    expect(include).toEqual({ b: { include: { c: { include: { a: true } } } } })
   })
 })
 
 /**
- * A caller-supplied `take` on a to-many relation include must survive the
- * access-controlled merge (issue #752). It only narrows the fetched rows and can
- * never widen past the access `where`, so the merge re-attaches it on top of the
- * per-relation access filter — powering the item view's bounded relationship
- * tables without dropping row-level access.
+ * A caller-supplied `take` on a to-many relation include must survive
+ * scoping (issue #752). It only narrows the fetched rows and can never widen
+ * past the access `where`, so it rides on top of the access filter unchanged.
  */
-describe('mergeIncludeWithAccessControl — caller take on a to-many relation (issue #752)', () => {
-  // A one-list config whose `posts` to-many is query-scoped by an access filter.
+describe('buildAccessScopedInclude — caller take on a to-many relation (issue #752)', () => {
   function scopedConfig(): OpenSaasConfig {
     return {
       db: { provider: 'sqlite' },
@@ -230,7 +243,6 @@ describe('mergeIncludeWithAccessControl — caller take on a to-many relation (i
         },
         Post: {
           fields: { title: { type: 'text' } as FieldConfig, author: rel('User.posts') },
-          // Scoped read access → the merge must fold this into the relation include.
           access: { operation: { query: () => ({ published: { equals: true } }) } },
         },
       },
@@ -240,28 +252,21 @@ describe('mergeIncludeWithAccessControl — caller take on a to-many relation (i
 
   it('preserves the take and AND-combines it with the access where', async () => {
     const config = scopedConfig()
-    const accessControlledInclude = await buildIncludeWithAccessControl(
-      config.lists.User.fields,
-      { session: null, context: makeContext() },
-      config,
-      0,
-      ['User'],
-    )
 
-    const merged = mergeIncludeWithAccessControl(
+    const include = await buildAccessScopedInclude(
       { posts: { take: 10 } },
-      accessControlledInclude,
       config.lists.User.fields,
+      { session: null, context: makeContext() },
       config,
       'User',
     )
 
     // The bound rides on top of the access filter — neither is dropped. The
-    // access-controlled include also auto-nests Post's `author` back-relation.
-    expect(merged).toEqual({
+    // Post→author back-relation is NOT auto-nested (One hop, ADR-0026) since
+    // the request didn't name it.
+    expect(include).toEqual({
       posts: {
         where: { published: { equals: true } },
-        include: { author: true },
         take: 10,
       },
     })
@@ -269,26 +274,18 @@ describe('mergeIncludeWithAccessControl — caller take on a to-many relation (i
 
   it('drops a take for a relation whose query access is denied', async () => {
     const config = scopedConfig()
-    // Deny Post reads entirely.
     config.lists.Post.access = { operation: { query: () => false } }
-    const accessControlledInclude = await buildIncludeWithAccessControl(
-      config.lists.User.fields,
-      { session: null, context: makeContext() },
-      config,
-      0,
-      ['User'],
-    )
 
-    const merged = mergeIncludeWithAccessControl(
+    const include = await buildAccessScopedInclude(
       { posts: { take: 10 } },
-      accessControlledInclude,
       config.lists.User.fields,
+      { session: null, context: makeContext() },
       config,
       'User',
     )
 
     // A denied relation is dropped wholesale — the take cannot resurrect it.
-    expect(merged).toEqual({})
+    expect(include).toEqual({})
   })
 })
 
@@ -296,96 +293,97 @@ describe('mergeIncludeWithAccessControl — caller take on a to-many relation (i
  * Regression coverage for issue #830: the read pipeline used to FAIL OPEN past
  * `READ_INCLUDE_MAX_DEPTH` — a caller-supplied `include` nested deeper than the
  * engine could scope was passed through unscoped rather than denied. These
- * tests pin the exact boundary the fix introduces (ADR-0022): a caller include
- * one level past the cap throws, the same include one level shallower still
- * works, and an unrequested auto-include past the cap stays silent.
+ * tests pin the exact boundary ADR-0022 introduced and ADR-0026 preserves: a
+ * request one level past the cap throws, the same request one level
+ * shallower still works, and a request that never reaches the cap is
+ * unaffected.
  */
-describe('mergeIncludeWithAccessControl — fail-closed at the read-include depth cap (#830)', () => {
-  // A relation `hops` hops from the root sits AT the cap boundary (correctly
-  // where-scoped, matching the triage report's "F" list); one hop further is
-  // the first one the engine cannot scope ("G"). With
-  // READ_INCLUDE_MAX_DEPTH = 5 that boundary is hop 5 / hop 6.
+describe('buildAccessScopedInclude — fail-closed at the read-include depth cap (#830)', () => {
   const HOPS_AT_CAP = READ_INCLUDE_MAX_DEPTH
 
-  it('throws AccessScopeDepthExceededError when the caller include reaches past the cap', async () => {
-    // L0 → L1 → … → L6 (one more list than HOPS_AT_CAP + 1) so a caller
-    // include can walk `next` one hop past the boundary.
+  it('throws AccessScopeDepthExceededError when the request reaches past the cap', async () => {
     const chainLength = HOPS_AT_CAP + 2
-    const config = chainConfig(chainLength)
-
-    const accessControlledInclude = await buildIncludeWithAccessControl(
-      config.lists.L0.fields,
-      { session: null, context: makeContext() },
-      config,
-      0,
-      ['L0'],
-    )
+    const { config } = chainConfig(chainLength)
 
     // Outer `next` (hop 1) + nestedInclude(HOPS_AT_CAP) (HOPS_AT_CAP more) = HOPS_AT_CAP + 1 hops.
-    const callerInclude = { next: nestedInclude(HOPS_AT_CAP) }
+    const requested = { next: nestedInclude(HOPS_AT_CAP) }
 
-    expect(() =>
-      mergeIncludeWithAccessControl(
-        callerInclude,
-        accessControlledInclude,
+    await expect(
+      buildAccessScopedInclude(
+        requested,
         config.lists.L0.fields,
+        { session: null, context: makeContext() },
         config,
         'L0',
       ),
-    ).toThrow(AccessScopeDepthExceededError)
+    ).rejects.toThrow(AccessScopeDepthExceededError)
   })
 
-  it('still row-scopes a caller include one level shallower than the cap', async () => {
-    const chainLength = HOPS_AT_CAP + 1
-    const config = chainConfig(chainLength)
+  it('describes a cost refusal, not an inability to scope', async () => {
+    const chainLength = HOPS_AT_CAP + 2
+    const { config } = chainConfig(chainLength)
+    const requested = { next: nestedInclude(HOPS_AT_CAP) }
 
-    const accessControlledInclude = await buildIncludeWithAccessControl(
-      config.lists.L0.fields,
-      { session: null, context: makeContext() },
-      config,
-      0,
-      ['L0'],
-    )
+    await expect(
+      buildAccessScopedInclude(
+        requested,
+        config.lists.L0.fields,
+        { session: null, context: makeContext() },
+        config,
+        'L0',
+      ),
+    ).rejects.toThrow(/cost limit/)
+  })
+
+  it('still row-scopes a request one level shallower than the cap', async () => {
+    const chainLength = HOPS_AT_CAP + 1
+    const { config } = chainConfig(chainLength)
 
     // Outer `next` (hop 1) + nestedInclude(HOPS_AT_CAP - 1) = HOPS_AT_CAP hops total — right at the boundary.
-    const callerInclude = { next: nestedInclude(HOPS_AT_CAP - 1) }
+    const requested = { next: nestedInclude(HOPS_AT_CAP - 1) }
 
-    // Must NOT throw — this depth is within what the engine can scope.
-    const merged = mergeIncludeWithAccessControl(
-      callerInclude,
-      accessControlledInclude,
+    const include = await buildAccessScopedInclude(
+      requested,
       config.lists.L0.fields,
+      { session: null, context: makeContext() },
       config,
       'L0',
     )
 
-    expect(includeDepth(merged)).toBe(HOPS_AT_CAP)
-    // The last list in the chain (at the boundary) is genuinely row-scoped —
-    // not just present without a throw.
-    expect(whereAtHop(merged, HOPS_AT_CAP)).toEqual({ ownerId: { equals: `L${HOPS_AT_CAP}` } })
+    expect(includeDepth(include)).toBe(HOPS_AT_CAP)
+    expect(whereAtHop(include, HOPS_AT_CAP)).toEqual({ ownerId: { equals: `L${HOPS_AT_CAP}` } })
   })
 
-  it('does not throw for an ordinary read with no caller include, even on a deep schema', async () => {
-    // No caller include at all — the auto-include just stops at the cap
-    // silently. This must never throw; only an EXPLICIT caller selection past
-    // the cap is a denial.
+  it('does not throw for a request that never reaches the cap', async () => {
     const chainLength = HOPS_AT_CAP + 3
-    const config = chainConfig(chainLength)
+    const { config } = chainConfig(chainLength)
 
-    const result = await buildIncludeWithAccessControl(
+    await expect(
+      buildAccessScopedInclude(
+        { next: true },
+        config.lists.L0.fields,
+        { session: null, context: makeContext() },
+        config,
+        'L0',
+      ),
+    ).resolves.not.toThrow()
+  })
+
+  it('an empty request never throws, even on a deep schema', async () => {
+    const chainLength = HOPS_AT_CAP + 3
+    const { config } = chainConfig(chainLength)
+
+    const include = await buildAccessScopedInclude(
+      {},
       config.lists.L0.fields,
       { session: null, context: makeContext() },
       config,
-      0,
-      ['L0'],
+      'L0',
     )
-
-    expect(() => toPrismaInclude(result)).not.toThrow()
-    const include = toPrismaInclude(result)
-    expect(includeDepth(include)).toBeLessThanOrEqual(HOPS_AT_CAP)
+    expect(include).toEqual({})
   })
 
-  it('a list with no relationships still passes the caller include through unchanged', async () => {
+  it('a list with no relationships passes an unrelated requested key through unchanged', async () => {
     const config = {
       db: { provider: 'sqlite' },
       lists: {
@@ -397,83 +395,15 @@ describe('mergeIncludeWithAccessControl — fail-closed at the read-include dept
       // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
     } as any as OpenSaasConfig
 
-    const accessControlledInclude = await buildIncludeWithAccessControl(
-      config.lists.Leaf.fields,
-      { session: null, context: makeContext() },
-      config,
-      0,
-      ['Leaf'],
-    )
-
-    expect(accessControlledInclude).toEqual({ kind: 'nothing-to-scope' })
-
     // An arbitrary (non-declared-relationship) key passed through unchanged —
     // access control does not govern keys it doesn't recognize as relationships.
-    const merged = mergeIncludeWithAccessControl(
+    const include = await buildAccessScopedInclude(
       { someUnrelatedKey: true },
-      accessControlledInclude,
       config.lists.Leaf.fields,
+      { session: null, context: makeContext() },
       config,
       'Leaf',
     )
-    expect(merged).toEqual({ someUnrelatedKey: true })
-  })
-})
-
-/**
- * Regression coverage for the resolveOutput/virtual-field trigger of #830: a
- * read issued from inside a resolveOutput hook used to lose relation row
- * scoping ENTIRELY (whole-object passthrough) rather than scoping the
- * immediate relation and simply not auto-expanding further. The loop guard
- * that motivated the original passthrough (hooks making DB queries that
- * include relationships back to the same entity) must still hold.
- */
-describe('buildIncludeWithAccessControl — inside a resolveOutput context', () => {
-  it('scopes the immediate relation with its access where but does not auto-expand nested relations', async () => {
-    const config = chainConfig(4) // L0 → L1 → L2 → L3
-    config.lists.L1.access = { operation: { query: () => ({ tenantId: { equals: 'mine' } }) } }
-
-    const result = await buildIncludeWithAccessControl(
-      config.lists.L0.fields,
-      { session: null, context: makeContext(1) }, // depth > 0 → inside resolveOutput
-      config,
-      0,
-      ['L0'],
-    )
-
-    expect(result.kind).toBe('scoped')
-    const include = toPrismaInclude(result)
-    // L1's own access `where` is applied...
-    expect(include).toEqual({ next: { where: { tenantId: { equals: 'mine' } } } })
-    // ...but L1's own nested relations (`next` → L2) are NOT auto-included.
-    expect(includeDepth(include)).toBe(1)
-  })
-
-  it('terminates on a self-referential relationship instead of looping', async () => {
-    const config = {
-      db: { provider: 'sqlite' },
-      lists: {
-        Category: {
-          fields: {
-            name: { type: 'text' } as FieldConfig,
-            parent: rel('Category.children'),
-            children: rel('Category.parent', true),
-          },
-          access: { operation: { query: () => true } },
-        },
-      },
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
-    } as any as OpenSaasConfig
-
-    const result = await buildIncludeWithAccessControl(
-      config.lists.Category.fields,
-      { session: null, context: makeContext(1) },
-      config,
-      0,
-      ['Category'],
-    )
-
-    const include = toPrismaInclude(result)
-    expect(include).toEqual({ parent: true, children: true })
+    expect(include).toEqual({ someUnrelatedKey: true })
   })
 })