@opensaas/stack-core 0.38.0 → 0.39.0

package/src/access/field-access.test.ts

@@ -1,6 +1,12 @@
-import { describe, it, expect } from 'vitest'
-import { filterWritableFields } from './field-access.js'
+import { describe, it, expect, expectTypeOf } from 'vitest'
+import {
+  checkFieldAccess,
+  filterWritableFields,
+  isFieldReadableForPredicate,
+} from './field-access.js'
+import { InvalidFieldAccessResultError } from './errors.js'
 import { ValidationError } from '../hooks/index.js'
+import type { FieldAccess, FieldAccessControl } from './types.js'
 
 // A non-sudo access context. The cast is localized to test setup (mirrors the
 // existing sudo-context casts in this file): the runtime AccessContext carries
@@ -21,6 +27,283 @@ function sudoContext() {
   } as any
 }
 
+// ── #914: `FieldAccess['read']`'s `item` must type as present, matching what
+// Field Visibility (field-visibility.ts) actually passes ──
+
+describe("FieldAccess['read'] item typing (issue #914)", () => {
+  type Item = { ownerId: string }
+
+  it('types item as present for a read rule that reads a property off it — no cast, no `any`', () => {
+    const fieldAccess: FieldAccess<Item> = {
+      read: ({ session, item }) => item.ownerId === session?.userId,
+    }
+    expect(typeof fieldAccess.read).toBe('function')
+  })
+
+  it('still compiles a read rule that ignores item entirely', () => {
+    const fieldAccess: FieldAccess<Item> = {
+      read: () => true,
+    }
+    expect(typeof fieldAccess.read).toBe('function')
+  })
+
+  it('leaves the create branch unchanged — item is still absent, there genuinely is no row yet', () => {
+    // Pinned against `FieldAccessControl`'s discriminated union directly
+    // (rather than `FieldAccess['create']`'s destructured callback), because
+    // `create`/`update` — unlike `read` — are untouched by this fix and keep
+    // accepting the full `FieldAccessControl` union in `FieldAccess`.
+    type CreateArgs = Extract<Parameters<FieldAccessControl<Item>>[0], { operation: 'create' }>
+    expectTypeOf<CreateArgs['item']>().toEqualTypeOf<undefined>()
+  })
+
+  // Type-level pin: `resolveReadableFieldValue` (field-visibility.ts) is the
+  // sole caller of `checkFieldAccess` for `operation: 'read'`, and always
+  // supplies `item: accessItem` — a full row, never `undefined`. This
+  // assertion has no runtime effect (`expectTypeOf` is a no-op outside
+  // `vitest --typecheck`); its value is that `pnpm build`/`tsc` fails on this
+  // file the moment `FieldAccess['read']`'s `item` type drifts back to
+  // optional/absent, so the declared type and the call site cannot silently
+  // diverge again.
+  it("pins FieldAccess['read']'s item type against the field-visibility.ts call site", () => {
+    type ReadArgs = Parameters<NonNullable<FieldAccess<Item>['read']>>[0]
+    expectTypeOf<ReadArgs['item']>().toEqualTypeOf<Item>()
+    expectTypeOf<ReadArgs['operation']>().toEqualTypeOf<'read'>()
+  })
+})
+
+// ── #913: a field rule returning a filter must not be granted blanket access ──
+
+describe('checkFieldAccess', () => {
+  it('allows when the rule returns true', async () => {
+    const allowed = await checkFieldAccess({ read: () => true }, 'read', {
+      session: null,
+      item: { ownerId: 'someone-else' },
+      context: nonSudoContext(),
+    })
+    expect(allowed).toBe(true)
+  })
+
+  it('denies when the rule returns false', async () => {
+    const allowed = await checkFieldAccess({ read: () => false }, 'read', {
+      session: null,
+      item: { ownerId: 'someone-else' },
+      context: nonSudoContext(),
+    })
+    expect(allowed).toBe(false)
+  })
+
+  it('allows when no field access is configured', async () => {
+    const allowed = await checkFieldAccess(undefined, 'read', {
+      session: null,
+      context: nonSudoContext(),
+    })
+    expect(allowed).toBe(true)
+  })
+
+  it('allows when no rule is configured for the operation', async () => {
+    const allowed = await checkFieldAccess({ update: () => false }, 'read', {
+      session: null,
+      context: nonSudoContext(),
+    })
+    expect(allowed).toBe(true)
+  })
+
+  it('throws InvalidFieldAccessResultError, not allow, when a read rule returns a filter', async () => {
+    // The exact reproduction from the issue: a rule written to scope a field
+    // by row, which the previous fail-open default granted full access to.
+    const fieldAccess = {
+      read: () => ({ ownerId: { equals: 'someone-else' } }),
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    } as any
+
+    await expect(
+      checkFieldAccess(fieldAccess, 'read', {
+        session: null,
+        item: { ownerId: 'the-owner' },
+        context: nonSudoContext(),
+      }),
+    ).rejects.toThrow(InvalidFieldAccessResultError)
+  })
+
+  it('throws for a filter-returning rule on create, where there is no item to test it against', async () => {
+    const fieldAccess = {
+      create: () => ({ ownerId: { equals: 'someone-else' } }),
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    } as any
+
+    await expect(
+      checkFieldAccess(fieldAccess, 'create', {
+        session: null,
+        context: nonSudoContext(),
+        inputData: { ownerId: 'the-owner' },
+      }),
+    ).rejects.toThrow(InvalidFieldAccessResultError)
+  })
+
+  it('throws for a filter-returning rule on update', async () => {
+    const fieldAccess = {
+      update: () => ({ ownerId: { equals: 'someone-else' } }),
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    } as any
+
+    await expect(
+      checkFieldAccess(fieldAccess, 'update', {
+        session: null,
+        item: { ownerId: 'the-owner' },
+        context: nonSudoContext(),
+        inputData: { ownerId: 'someone-else' },
+      }),
+    ).rejects.toThrow(InvalidFieldAccessResultError)
+  })
+
+  it('throws for a non-boolean, non-filter result too (e.g. undefined)', async () => {
+    const fieldAccess = {
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      read: () => undefined as any,
+    }
+
+    await expect(
+      checkFieldAccess(fieldAccess, 'read', {
+        session: null,
+        item: {},
+        context: nonSudoContext(),
+      }),
+    ).rejects.toThrow(InvalidFieldAccessResultError)
+  })
+
+  it('throws with a descriptive message for null, and for other primitive results', async () => {
+    const nullAccess = {
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      read: () => null as any,
+    }
+    await expect(
+      checkFieldAccess(nullAccess, 'read', {
+        session: null,
+        item: {},
+        context: nonSudoContext(),
+      }),
+    ).rejects.toThrow(/returned null, not a boolean/)
+
+    const numberAccess = {
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      read: () => 42 as any,
+    }
+    await expect(
+      checkFieldAccess(numberAccess, 'read', {
+        session: null,
+        item: {},
+        context: nonSudoContext(),
+      }),
+    ).rejects.toThrow(/returned a number, not a boolean/)
+  })
+
+  it('sudo bypasses the rule entirely, so a filter-returning rule never reaches the throw', async () => {
+    const fieldAccess = {
+      read: () => ({ ownerId: { equals: 'someone-else' } }),
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    } as any
+
+    const allowed = await checkFieldAccess(fieldAccess, 'read', {
+      session: null,
+      item: { ownerId: 'the-owner' },
+      context: sudoContext(),
+    })
+    expect(allowed).toBe(true)
+  })
+})
+
+describe('isFieldReadableForPredicate (#915)', () => {
+  it('allows when there is no field access configured', async () => {
+    const readable = await isFieldReadableForPredicate(undefined, {
+      session: null,
+      context: nonSudoContext(),
+    })
+    expect(readable).toBe(true)
+  })
+
+  it('allows when the rule only inspects session (never touches item)', async () => {
+    const readable = await isFieldReadableForPredicate(
+      { read: ({ session }) => session?.userId === 'admin' },
+      { session: { userId: 'admin' }, context: nonSudoContext() },
+    )
+    expect(readable).toBe(true)
+  })
+
+  it('denies when the rule returns false', async () => {
+    const readable = await isFieldReadableForPredicate(
+      { read: () => false },
+      { session: null, context: nonSudoContext() },
+    )
+    expect(readable).toBe(false)
+  })
+
+  it('denies a row-dependent rule that dereferences `item` directly', async () => {
+    const readable = await isFieldReadableForPredicate(
+      { read: ({ item, session }) => item.ownerId === session?.userId },
+      { session: { userId: 'user-1' }, context: nonSudoContext() },
+    )
+    expect(readable).toBe(false)
+  })
+
+  it('denies a row-dependent rule even when it reads `item` via optional chaining', async () => {
+    // This is the exact idiom `InvalidFieldAccessResultError`'s own message
+    // recommends (`item?.ownerId === session?.userId`) — it must still deny,
+    // not silently misevaluate `undefined === session?.userId` against a
+    // poisoned `item`.
+    const readable = await isFieldReadableForPredicate(
+      { read: ({ item, session }) => item?.ownerId === session?.userId },
+      { session: null, context: nonSudoContext() },
+    )
+    expect(readable).toBe(false)
+  })
+
+  it('denies a row-dependent rule that only enumerates `item`s keys', async () => {
+    const readable = await isFieldReadableForPredicate(
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      { read: ({ item }) => Object.keys(item as any).length > 0 },
+      { session: null, context: nonSudoContext() },
+    )
+    expect(readable).toBe(false)
+  })
+
+  it('propagates InvalidFieldAccessResultError instead of folding it into a denial', async () => {
+    const fieldAccess = {
+      read: () => ({ ownerId: { equals: 'someone-else' } }),
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    } as any
+
+    await expect(
+      isFieldReadableForPredicate(fieldAccess, { session: null, context: nonSudoContext() }),
+    ).rejects.toThrow(InvalidFieldAccessResultError)
+  })
+
+  it('propagates a genuine error the rule throws for its own reasons, not just non-boolean results', async () => {
+    // The rule never touches `item` — it throws for a reason of its own.
+    // This must NOT be folded into an ordinary `false` denial (that would
+    // mask a real bug in the rule as "field not readable"), matching how the
+    // post-query path (`filterReadableFields`) already lets such a throw
+    // propagate unchanged.
+    const fieldAccess: FieldAccess = {
+      read: ({ session }) => {
+        if (session === null) throw new Error('unexpected anonymous access')
+        return true
+      },
+    }
+
+    await expect(
+      isFieldReadableForPredicate(fieldAccess, { session: null, context: nonSudoContext() }),
+    ).rejects.toThrow('unexpected anonymous access')
+  })
+
+  it('sudo bypasses the rule entirely, so a row-dependent rule never denies', async () => {
+    const readable = await isFieldReadableForPredicate(
+      { read: ({ item, session }) => item.ownerId === session?.userId },
+      { session: null, context: sudoContext() },
+    )
+    expect(readable).toBe(true)
+  })
+})
+
 describe('filterWritableFields', () => {
   it('should filter out foreign key fields when their corresponding relationship field exists', async () => {
     // Setup: Define field configs with a relationship field
@@ -361,6 +644,33 @@ describe('filterWritableFields', () => {
     ).rejects.toThrow(/status/)
   })
 
+  // ── #913: a field rule returning a filter must not grant blanket write access ──
+
+  it('throws InvalidFieldAccessResultError, not a blanket write, when field access returns a filter (non-sudo)', async () => {
+    const fieldConfigs = {
+      title: { type: 'text' },
+      status: {
+        type: 'text',
+        access: {
+          // Written as a row-scoping rule; field access does not honour filters.
+          update: () => ({ status: { equals: 'draft' } }),
+          create: () => ({ status: { equals: 'draft' } }),
+        },
+      },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    } as any
+    const data = { title: 'Test', status: 'published' }
+
+    await expect(
+      filterWritableFields(data, fieldConfigs, 'update', {
+        session: null,
+        item: { id: 'post-1', status: 'draft' },
+        context: nonSudoContext(),
+        inputData: data,
+      }),
+    ).rejects.toThrow(InvalidFieldAccessResultError)
+  })
+
   it('does NOT throw on a would-be-denied field under sudo', async () => {
     const fieldConfigs = {
       title: { type: 'text' },

package/src/access/field-access.ts

@@ -1,9 +1,48 @@
 import type { Session, AccessContext } from './types.js'
-import type { FieldAccess } from './types.js'
+import type { FieldAccess, FieldAccessControl } from './types.js'
 // `ValidationError` is referenced only inside function bodies (call-time), never
 // at module-evaluation time, so the field-access ⇄ hooks import cycle is safe
 // under ESM live bindings.
 import { ValidationError } from '../hooks/index.js'
+import { InvalidFieldAccessResultError } from './errors.js'
+
+/**
+ * Marks a throw caused by touching {@link createPoisonedItem}'s `item`, as
+ * opposed to some other error a field rule legitimately raises. Not exported
+ * — callers only ever see its effect (a `false` from
+ * `isFieldReadableForPredicate`), never the class itself.
+ */
+class PredicateTimeItemAccessError extends Error {}
+
+/**
+ * An `item` that throws {@link PredicateTimeItemAccessError} on ANY attempt to
+ * read a property off it — including via optional chaining (`item?.x`),
+ * since the Proxy itself is a truthy object and optional chaining still
+ * performs the property read once its base is non-nullish. Used by
+ * `isFieldReadableForPredicate` to detect a read rule that depends on the
+ * fetched row: there is no row yet at predicate-evaluation time (see that
+ * function's doc), so any rule that reaches into `item` at all cannot be
+ * answered here.
+ */
+function createPoisonedItem(): Record<string, unknown> {
+  return new Proxy(
+    {},
+    {
+      get(_target, prop) {
+        throw new PredicateTimeItemAccessError(String(prop))
+      },
+      has(_target, prop) {
+        throw new PredicateTimeItemAccessError(String(prop))
+      },
+      ownKeys() {
+        throw new PredicateTimeItemAccessError('ownKeys')
+      },
+      getOwnPropertyDescriptor(_target, prop) {
+        throw new PredicateTimeItemAccessError(String(prop))
+      },
+    },
+  ) as Record<string, unknown>
+}
 
 /**
  * Shared field-level access evaluation.
@@ -24,6 +63,10 @@ import { ValidationError } from '../hooks/index.js'
  * (read/update/delete), and on the `inputData` being written (create/update),
  * so all of those are accepted. Do not introduce a parallel evaluator with a
  * narrower signature.
+ *
+ * Returns a strict boolean, never a filter: a rule that returns anything else
+ * throws `InvalidFieldAccessResultError` rather than defaulting to allow (see
+ * that error's doc, ADR-0001, and ADR-0030).
  */
 export async function checkFieldAccess(
   fieldAccess: FieldAccess | undefined,
@@ -35,18 +78,25 @@ export async function checkFieldAccess(
     inputData?: Record<string, unknown>
   },
 ): Promise<boolean> {
-  // Skip access check in sudo mode
   if (args.context._isSudo) {
     return true
   }
 
   if (!fieldAccess) {
-    return true // No field access means allow
+    return true
   }
 
-  const accessControl = fieldAccess[operation]
+  // `FieldAccess['read']` is narrower than `FieldAccess['create'/'update']` (it
+  // only accepts the single `operation: 'read'` call shape, see `types.ts`),
+  // so indexing by a not-yet-narrowed `operation` union produces a callable
+  // whose effective parameter type collapses to an intersection TypeScript
+  // can't satisfy generically here. Widen back to the general
+  // `FieldAccessControl` — the same shape this function has always built and
+  // passed below — since by construction the args object always matches
+  // whichever operation is actually requested.
+  const accessControl = fieldAccess[operation] as FieldAccessControl | undefined
   if (!accessControl) {
-    return true // No specific access control means allow
+    return true
   }
 
   const result = await accessControl({
@@ -57,51 +107,79 @@ export async function checkFieldAccess(
     operation,
   } as Parameters<typeof accessControl>[0])
 
-  // If result is false, deny access
   if (result === false) {
     return false
   }
 
-  // If result is true, allow access
   if (result === true) {
     return true
   }
 
-  // Default to allowing access if we can't determine
-  return true
+  // `FieldAccessControl` is typed to return `boolean` only — field access is a
+  // per-field visibility decision, not a row filter (ADR-0001, ADR-0030). A
+  // well-typed rule can never reach this line; getting here means a caller
+  // bypassed the type (most notably by returning a Prisma filter, the shape
+  // operation-level `AccessControl` accepts but this does not). Fail loudly
+  // and closed — this operation applies identically whether or not `item` is
+  // available, so `create` (which has no `item` to evaluate a filter against)
+  // needs no separate answer: neither operation ever honours a non-boolean.
+  throw new InvalidFieldAccessResultError(operation, result)
 }
 
 /**
- * Simple filter matching for field-level access
- * Checks if an item matches a Prisma-like filter object
+ * Whether a field's `read` access allows it to be NAMED in a `where`/`orderBy`
+ * predicate, evaluated BEFORE the query runs (#915).
+ *
+ * Field-level `read` access has always been a post-query check (Field
+ * Visibility, `field-visibility.ts`): it strips a denied key from a row that
+ * has already been fetched. That leaves the predicate itself unconstrained —
+ * a caller can still filter or sort by a field whose value they could never
+ * read, and recover it (or its relative order) by probing. This function is
+ * the pre-query counterpart, called from `query-validation.ts`'s `where`/
+ * `orderBy` walk for every key that resolves to a declared field.
+ *
+ * It delegates to the same evaluator Field Visibility uses (`checkFieldAccess`),
+ * per this module's canonical-evaluator rule above. The one difference is the
+ * `item` it hands the rule: there is no fetched row
+ * yet, so a rule that depends on one (the shape `FieldAccess['read']`
+ * documents as the norm, e.g. `item?.ownerId === session?.userId`) cannot be
+ * answered here. Rather than skip the check for such a rule — which would
+ * reopen exactly the hole this closes for the fields most likely to be
+ * sensitive — it is handed a poisoned `item` that throws on any property
+ * read, and that throw is caught and resolved to `false`: a row-dependent
+ * `read` rule always denies at predicate time, documented and deliberate
+ * (see docs/adr/0031). A rule that never touches `item` (checking only
+ * `session`, the common case for a field meant to be filterable/sortable at
+ * all) evaluates normally and returns its real answer.
+ *
+ * A rule that returns a non-boolean is a distinct, louder failure (#913,
+ * ADR-0030) — `InvalidFieldAccessResultError` — and is deliberately NOT
+ * folded into the `false` here; it propagates so the config bug it signals is
+ * never mistaken for an ordinary field-level denial.
  */
-function matchesFilter(item: Record<string, unknown>, filter: Record<string, unknown>): boolean {
-  for (const [key, condition] of Object.entries(filter)) {
-    if (typeof condition === 'object' && condition !== null) {
-      // Handle nested conditions like { equals: value }
-      if ('equals' in condition) {
-        if (item[key] !== condition.equals) {
-          return false
-        }
-      } else if ('not' in condition) {
-        if (item[key] === condition.not) {
-          return false
-        }
-      }
-      // Add more condition types as needed
-    } else {
-      // Direct equality check
-      if (item[key] !== condition) {
-        return false
-      }
-    }
+export async function isFieldReadableForPredicate(
+  fieldAccess: FieldAccess | undefined,
+  args: {
+    session: Session | null
+    context: AccessContext & { _isSudo?: boolean }
+  },
+): Promise<boolean> {
+  try {
+    return await checkFieldAccess(fieldAccess, 'read', {
+      session: args.session,
+      context: args.context,
+      item: createPoisonedItem(),
+    })
+  } catch (err) {
+    // Only the poisoned-item signal means "row-dependent, deny". Anything
+    // else — including `InvalidFieldAccessResultError` and a genuine bug in
+    // the rule itself — propagates unchanged rather than being silently
+    // folded into an ordinary denial (found in review of #925).
+    if (err instanceof PredicateTimeItemAccessError) return false
+    throw err
   }
-  return true
 }
 
-/**
- * Filter fields from input data based on write access (create/update)
- */
 export async function filterWritableFields<T extends Record<string, unknown>>(
   data: T,
   fieldConfigs: Record<
@@ -122,8 +200,7 @@ export async function filterWritableFields<T extends Record<string, unknown>>(
 ): Promise<Partial<T>> {
   const filtered: Record<string, unknown> = {}
 
-  // Build a set of foreign key field names to exclude
-  // Foreign keys should not be in the data when using Prisma's relation syntax
+  // Foreign keys must not appear in `data` when using Prisma's relation syntax.
   const foreignKeyFields = new Set<string>()
   // Map each raw per-part column name contributed by a multi-column field
   // (e.g. storage image()/file() in Keystone-parity mode) back to its OWNING
@@ -162,19 +239,18 @@ export async function filterWritableFields<T extends Record<string, unknown>>(
   for (const [fieldName, value] of Object.entries(data)) {
     const fieldConfig = fieldConfigs[fieldName]
 
-    // Skip system fields
     if (['id', 'createdAt', 'updatedAt'].includes(fieldName)) {
       continue
     }
 
-    // Skip virtual fields - they don't store in database
-    // Virtual fields with resolveInput hooks handle side effects separately
+    // Virtual fields don't store in the database — skipped here, but their
+    // resolveInput hooks still run as a separate side-effect step.
     if (fieldConfig && 'virtual' in fieldConfig && fieldConfig.virtual) {
       continue
     }
 
-    // Skip foreign key fields (e.g., authorId) when their corresponding relationship field exists
-    // This prevents conflicts when using Prisma's relation syntax (e.g., author: { connect: { id } })
+    // Prevents conflicts with Prisma's relation syntax (e.g.,
+    // `author: { connect: { id } }`).
     if (foreignKeyFields.has(fieldName)) {
       continue
     }

package/src/access/field-transforms.ts

@@ -1,29 +1,20 @@
 import type { OpenSaasConfig, FieldConfig } from '../config/types.js'
 import type { HashedPassword } from '../utils/password.js'
 
-/**
- * Extract the return type of a field's afterOperation hook
- * If the field has an afterOperation hook, infer its return type
- * Otherwise, use the original type
- */
 export type InferFieldReadType<TField extends FieldConfig, TOriginal> = TField extends {
-  // Generic `any` is required here for TypeScript's conditional type inference to work correctly
-  // This allows us to infer the exact return type `R` from hooks of any signature
+  // Uses `any` here so TypeScript's conditional type inference can pick up the
+  // exact return type `R` from a hook of any signature.
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   hooks?: { afterOperation?: (...args: any[]) => infer R }
 }
   ? R extends never
-    ? TOriginal // No hook defined
-    : R // Hook return type
-  : TOriginal // No hooks at all
+    ? TOriginal
+    : R
+  : TOriginal
 
-/**
- * Transform a Prisma model's field types based on OpenSaas field configs
- * This applies afterOperation hook transformations to field types
- */
 export type TransformModelFields<
-  // Generic constraint requires `any` to allow indexing by string keys from Prisma models
-  // This is necessary for mapped types to work with Prisma's generated model types
+  // Uses `any` so this constraint accepts Prisma's generated model types, which are
+  // indexed by string keys.
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   TModel extends Record<string, any>,
   TFields extends Record<string, FieldConfig>,
@@ -33,34 +24,22 @@ export type TransformModelFields<
     : TModel[K]
 }
 
-/**
- * Get the field configs for a specific list from the OpenSaas config
- */
 export type GetListFields<
   TConfig extends OpenSaasConfig,
   TListKey extends keyof TConfig['lists'],
 > = TConfig['lists'][TListKey]['fields']
 
-/**
- * Transform a Prisma model result based on OpenSaas config
- * Applies field hooks transformations
- */
 export type TransformResult<
   TConfig extends OpenSaasConfig,
   TListKey extends keyof TConfig['lists'],
   TResult,
 > =
-  // Generic constraint requires `any` to check if TResult is an object type that can be transformed
-  // This pattern is standard in TypeScript for conditional types on object shapes
+  // Uses `any` to check whether TResult is an object type that can be transformed.
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   TResult extends Record<string, any>
     ? TransformModelFields<TResult, GetListFields<TConfig, TListKey>>
     : TResult
 
-/**
- * Transform a Prisma operation's return type
- * Handles single results, arrays, and null cases
- */
 export type TransformOperationResult<
   TConfig extends OpenSaasConfig,
   TListKey extends keyof TConfig['lists'],
@@ -76,20 +55,10 @@ export type TransformOperationResult<
       >
     : never
 
-/**
- * Known field type mappings for afterOperation hooks
- * These provide concrete type hints for common field transformations
- */
 export interface FieldTypeTransforms {
   password: HashedPassword
-  // Future field types can be added here
-  // richText: TiptapContent
-  // json: JSONValue
 }
 
-/**
- * Helper to infer field type based on field config type
- */
 export type InferFieldTypeTransform<TField extends FieldConfig> = TField extends {
   type: infer TType
 }