@opensaas/stack-core 0.38.0 → 0.39.1

package/src/access/field-visibility.ts

@@ -30,18 +30,14 @@ import { buildDbDelegate } from '../context/index.js'
  * level this way; a bare or `include`-based read, and any relation reached
  * purely to satisfy a `needs` declaration, still compute every field, as
  * before. A field the read is not going to return does no work at all —
- * neither its read-access evaluation nor its hook.
+ * neither its read-access evaluation nor its hook. The projection-aware skip
+ * below shows this rule at each of the two places it applies.
  *
  * Phase 1 (pre-query row/relation scoping) lives in `access-filter.ts`. See
  * `docs/adr/0001-access-control-is-a-two-phase-read.md` and the access-control
  * glossary in `CONTEXT.md`.
  */
 
-/**
- * Runtime type for resolveOutput hooks
- * Used when we need to call hooks generically without knowing the specific field type
- * Supports both sync and async implementations
- */
 type ResolveOutputHookRuntime = (args: {
   operation: 'query'
   value: unknown
@@ -123,7 +119,6 @@ async function resolveReadableFieldValue(params: {
 }): Promise<{ readable: false } | { readable: true; value: unknown }> {
   const { fieldConfig, fieldName, value, accessItem, hookItem, listKey, args, config } = params
 
-  // Check field access (checkFieldAccess already handles sudo mode)
   const canRead = await checkFieldAccess(fieldConfig?.access, 'read', {
     ...args,
     item: accessItem,
@@ -133,10 +128,9 @@ async function resolveReadableFieldValue(params: {
     return { readable: false }
   }
 
-  // Apply resolveOutput hook if present
   if (fieldConfig?.hooks?.resolveOutput && listKey) {
-    // Cast to runtime type for generic execution
-    // At runtime, the hook will receive the correct value type for the field
+    // The hook is erased to this runtime shape here; at the actual call it
+    // receives the value typed for its own field.
     const hook = fieldConfig.hooks.resolveOutput as unknown as ResolveOutputHookRuntime
     const link = { listKey, fieldKey: fieldName }
     const chain = args.context._resolveOutputChain
@@ -164,7 +158,6 @@ async function resolveReadableFieldValue(params: {
       return { readable: false }
     }
 
-    // Use Promise.resolve() to handle both sync and async hooks
     const resolved = await Promise.resolve(
       hook({
         value,
@@ -181,10 +174,6 @@ async function resolveReadableFieldValue(params: {
   return { readable: true, value }
 }
 
-/**
- * Filter fields from an object based on read access
- * Recursively applies access control to nested relationships
- */
 export async function filterReadableFields<T extends Record<string, unknown>>(
   item: T,
   fieldConfigs: Record<string, FieldConfig>,
@@ -201,12 +190,8 @@ export async function filterReadableFields<T extends Record<string, unknown>>(
   // returned — after resolveOutput has had a chance to read them — so a
   // declared dependency never widens what the caller receives.
   declaredOnly: DeclaredOnlyTree = emptyDeclaredOnlyTree(),
-  // The fragment scope this level was reached under (ADR-0027), and the same
-  // tree one level down for each nested relation. `undefined` — the default,
-  // and what a bare/`include`-based read passes at every level — means
-  // unrestricted: every field on the list is computed, unchanged from
-  // before ADR-0027. Only a `query` fragment's own field selection ever
-  // restricts a level.
+  // The fragment scope this level was reached under (ADR-0027, see module doc
+  // above), and the same tree one level down for each nested relation.
   selection?: FieldSelectionScope,
 ): Promise<Partial<T>> {
   const filtered: Record<string, unknown> = {}
@@ -246,26 +231,22 @@ export async function filterReadableFields<T extends Record<string, unknown>>(
   for (const [fieldName, value] of Object.entries(workingItem)) {
     const fieldConfig = fieldConfigs[fieldName]
 
-    // Always include id, createdAt, updatedAt
     if (['id', 'createdAt', 'updatedAt'].includes(fieldName)) {
       filtered[fieldName] = value
       continue
     }
 
-    // Projection-aware skip (ADR-0027): a fragment read that does not select
-    // this field does no work for it at all — no field-level read-access
-    // check, no resolveOutput, no recursion into a relation — because the
-    // read is never going to return it. `selection` is only ever restricted
-    // by a fragment's own field selection; a bare/`include`-based read, and a
-    // relation reached only to satisfy another field's `needs`, pass no
-    // selection at all and compute every field here, unchanged.
+    // Projection-aware skip (ADR-0027, see module doc above): a field this
+    // level's fragment did not select gets no read-access check, no
+    // resolveOutput, and no recursion into a relation — none of that work
+    // happens for a value the read isn't going to return.
     if (selection?.fields && !selection.fields.has(fieldName)) {
       continue
     }
 
-    // Handle relationship fields - recursively filter fields within related items
-    // Note: Access control filtering is now done at database level via buildAccessScopedInclude
-    // This only handles field-level access (hiding sensitive fields)
+    // Row/relation-level access is already scoped at the DB level via
+    // buildAccessScopedInclude; this only handles field-level access (hiding
+    // sensitive fields).
     //
     // Deliberately uncapped: the row/relation scoping in access-filter.ts bounds
     // what gets FETCHED (a caller include past its depth cap is now a denial,
@@ -283,7 +264,6 @@ export async function filterReadableFields<T extends Record<string, unknown>>(
       value !== null &&
       value !== undefined
     ) {
-      // Gate the relationship on read access before recursing.
       const canRead = await checkFieldAccess(fieldConfig?.access, 'read', {
         ...args,
         item: workingItem,
@@ -308,8 +288,6 @@ export async function filterReadableFields<T extends Record<string, unknown>>(
       const nestedSelection = selection?.nested[fieldName]
 
       if (relatedConfig) {
-        // For many relationships (arrays) - recursively filter fields in each item
-        // The recursive call already handles applying resolveOutput hooks
         if (Array.isArray(value)) {
           filtered[fieldName] = await Promise.all(
             value.map((relatedItem) =>
@@ -325,10 +303,7 @@ export async function filterReadableFields<T extends Record<string, unknown>>(
               ),
             ),
           )
-        }
-        // For single relationships (objects) - recursively filter fields
-        // The recursive call already handles applying resolveOutput hooks
-        else if (typeof value === 'object') {
+        } else if (typeof value === 'object') {
           filtered[fieldName] = await filterReadableFields(
             value as Record<string, unknown>,
             relatedConfig.listConfig.fields,
@@ -341,14 +316,13 @@ export async function filterReadableFields<T extends Record<string, unknown>>(
           )
         }
       } else {
-        // Related config not found, include the value as-is
         filtered[fieldName] = value
       }
       continue
     }
 
-    // Non-relationship field (or relationship without an includable value):
-    // check read access and apply resolveOutput via the shared helper.
+    // Non-relationship field, or a relationship field whose value is not
+    // includable (null/undefined) — falls through to the shared helper.
     const result = await resolveReadableFieldValue({
       fieldConfig,
       fieldName,
@@ -394,15 +368,11 @@ export async function filterReadableFields<T extends Record<string, unknown>>(
     delete computedFieldItem[key]
   }
 
-  // Process virtual fields - compute values from other fields
-  // Virtual fields don't exist in the database result, so we need to compute them separately
   for (const [fieldName, fieldConfig] of Object.entries(fieldConfigs)) {
-    // Skip if already processed (from database result)
     if (fieldName in filtered) {
       continue
     }
 
-    // Only process virtual fields
     if (!fieldConfig.virtual) {
       continue
     }
@@ -423,7 +393,6 @@ export async function filterReadableFields<T extends Record<string, unknown>>(
       continue
     }
 
-    // Check read access and compute the value via the shared helper.
     const result = await resolveReadableFieldValue({
       fieldConfig,
       fieldName,

package/src/access/index.ts

@@ -20,9 +20,23 @@ export {
   getRelatedListConfig,
 } from './engine.js'
 // Canonical field-level access evaluation (shared by read and write paths).
-export { checkFieldAccess, filterWritableFields } from './field-access.js'
+export {
+  checkFieldAccess,
+  filterWritableFields,
+  isFieldReadableForPredicate,
+} from './field-access.js'
+// Read-path key validation — the `findMany`/`count` counterpart to the write
+// path's #564 undeclared-key reject.
+export { validateQueryKeys } from './query-validation.js'
+// Read-path field-level access on `where`/`orderBy` keys — a field the
+// session cannot read cannot be named in a predicate either (#915).
+export { validateQueryFieldReadAccess } from './query-validation.js'
 // Phase 1 — Access Filter (pre-query row/relation scoping).
-export { buildAccessScopedInclude, stripVirtualFieldsFromInclude } from './access-filter.js'
+export {
+  buildAccessScopedInclude,
+  buildAccessScopedWhere,
+  stripVirtualFieldsFromInclude,
+} from './access-filter.js'
 // Phase 2 — Field Visibility (post-query field stripping + resolveOutput).
 export { filterReadableFields } from './field-visibility.js'
 // Declared Dependencies — folding `needs` into an include without widening
@@ -37,3 +51,7 @@ export type { DeclaredOnlyTree } from './declared-dependencies.js'
 export { AccessScopeDepthExceededError } from './errors.js'
 // Thrown when a resolveOutput hook's own resolve chain cycles back into itself.
 export { ResolveOutputCycleError } from './errors.js'
+// Thrown when a field-level access control function returns a non-boolean result.
+export { InvalidFieldAccessResultError } from './errors.js'
+// Thrown when a relation filter's related list denies query access outright (#916).
+export { RelationFilterAccessDeniedError } from './errors.js'

package/src/access/query-validation.ts

@@ -0,0 +1,359 @@
+import type { ListConfig, OpenSaasConfig } from '../config/types.js'
+import type { Session, AccessContext } from './types.js'
+import { getRelatedListConfig } from './engine.js'
+import { isFieldReadableForPredicate } from './field-access.js'
+import { ValidationError } from '../hooks/index.js'
+
+/**
+ * #912 — read-path key validation.
+ *
+ * The write path settled #564: an undeclared key in `data` throws, because the
+ * generated Prisma model has strictly more fields than the config declares (most
+ * notably back-relations — Prisma emits one for every inbound foreign key, whether
+ * or not the list config declares the reverse relationship). Reads had no
+ * equivalent — a caller's `where`/`orderBy` reached Prisma unchanged, so an
+ * anonymous caller could filter or order by a relation the config never exposed.
+ *
+ * This module is the read-path counterpart: every key named in a caller's `where`
+ * or `orderBy` is resolved against the list config before the query runs. A key
+ * with no entry in the config throws, naming the list and the key. `sudo` is the
+ * single trusted bypass, mirroring the write path.
+ *
+ * Deliberately NOT walked: the access filter produced by the list's own `query`
+ * access control. That filter is trusted config authored by the same person who
+ * declares the fields — walking it would make this an access-control decision
+ * (that's #915/#916), not the key-existence seam this ticket establishes.
+ *
+ * `validateQueryFieldReadAccess` below is that access-control decision for
+ * #915: it re-walks `where`/`orderBy` (reusing `resolveQueryField`) and checks
+ * each resolved field's `read` access via the canonical evaluator, so a field
+ * the session cannot read cannot be named in a predicate either. It runs
+ * strictly after this module's key-existence check — an undeclared key is
+ * #912's rejection, not a field-access decision — and stays scoped to the
+ * CURRENT list, deliberately not recursing into a related list's fields
+ * nested inside a relation filter itself (that recursion is #916's job, not
+ * this module's — see below).
+ *
+ * #916 — the relation-filter counterpart — scopes a relation filter itself
+ * (`some`/`every`/`none`/`is`/`isNot`) by the RELATED list's own `query`
+ * access, folding it into the nested clause exactly like
+ * `buildAccessScopedInclude` folds it into `include` (`access-filter.ts`).
+ * It reuses this module's shape-recognition (`resolveQueryField`,
+ * `LOGICAL_OPERATORS`, `RELATION_QUANTIFIERS`, exported below) and calls
+ * `walkWhereReadAccess` once per hop — against the RELATED list's own
+ * config — for the field-read half of the same job this module's
+ * `validateQueryFieldReadAccess` already does for the CURRENT list. There is
+ * deliberately no second copy of either the shape-recognition or the
+ * field-read check: `access-filter.ts` supplies the RELATED list at each
+ * hop and calls back into the same primitives this module already owns.
+ */
+
+// Prisma's logical combinators for a WHERE clause — never field names.
+export const LOGICAL_OPERATORS = new Set(['AND', 'OR', 'NOT'])
+
+// Prisma's relation quantifiers. The value nested under one of these is itself a
+// WHERE clause for the RELATED list, and is walked against that list's fields.
+export const RELATION_QUANTIFIERS = new Set(['some', 'every', 'none', 'is', 'isNot'])
+
+// Always present, never declared in a list's `fields` — the write path
+// (`filterWritableFields`) excludes the same three names from `fieldConfigs`.
+const SYSTEM_FIELDS = new Set(['id', 'createdAt', 'updatedAt'])
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any -- field configs are heterogeneous across field types
+type FieldConfigMap = Record<string, any>
+
+export interface ResolvedQueryField {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- field configs are heterogeneous across field types
+  fieldConfig: any
+  isRelationship: boolean
+}
+
+/**
+ * Resolve a `where`/`orderBy` key against a list's declared fields.
+ *
+ * A key is valid when it is:
+ * - a system field (`id`, `createdAt`, `updatedAt`) — always present, and never
+ *   declared in `fields` (the write path excludes them from `fieldConfigs` the
+ *   same way), or
+ * - a field declared directly in the list config, or
+ * - the foreign-key scalar a to-one `relationship` field implies (e.g. `authorId`
+ *   for `author: relationship(...)`) — the config never names this column
+ *   directly, but Prisma always generates it, and the write path
+ *   (`filterWritableFields`) grants it the same pass, or
+ * - a raw per-part column a multi-column field's `splitColumns` contributes (e.g.
+ *   storage `image()`/`file()` in Keystone-parity mode) — undeclared by design,
+ *   mirroring the write path's `splitColumnOwners` allowance (#568/#789).
+ *
+ * Anything else — most importantly a Prisma-generated back-relation the config
+ * never declares — resolves to `undefined` and is rejected by the caller.
+ */
+export function resolveQueryField(
+  key: string,
+  fields: FieldConfigMap,
+): ResolvedQueryField | undefined {
+  if (SYSTEM_FIELDS.has(key)) {
+    return { fieldConfig: undefined, isRelationship: false }
+  }
+
+  const fieldConfig = fields[key]
+  if (fieldConfig) {
+    return { fieldConfig, isRelationship: fieldConfig.type === 'relationship' }
+  }
+
+  if (key.endsWith('Id')) {
+    const baseField = fields[key.slice(0, -2)]
+    if (baseField && baseField.type === 'relationship' && !baseField.many) {
+      return { fieldConfig: baseField, isRelationship: false }
+    }
+  }
+
+  for (const [ownerName, owner] of Object.entries(fields)) {
+    if (owner && typeof owner.getColumnNames === 'function') {
+      const columns: string[] = owner.getColumnNames(ownerName)
+      if (columns.includes(key)) {
+        return { fieldConfig: owner, isRelationship: false }
+      }
+    }
+  }
+
+  return undefined
+}
+
+function rejectUndeclaredKey(listName: string, key: string, kind: 'where' | 'orderBy'): never {
+  throw new ValidationError([
+    `Cannot query "${listName}" — "${key}" is not a field of this list. ` +
+      `Undeclared ${kind} keys are rejected (use sudo to bypass).`,
+  ])
+}
+
+function walkWhere(
+  where: unknown,
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+  listConfig: ListConfig<any>,
+  listName: string,
+  config: OpenSaasConfig,
+  isSudo: boolean,
+): void {
+  if (where === null || typeof where !== 'object') return
+
+  if (Array.isArray(where)) {
+    for (const entry of where) walkWhere(entry, listConfig, listName, config, isSudo)
+    return
+  }
+
+  for (const [key, value] of Object.entries(where as Record<string, unknown>)) {
+    if (LOGICAL_OPERATORS.has(key)) {
+      walkWhere(value, listConfig, listName, config, isSudo)
+      continue
+    }
+
+    const resolved = resolveQueryField(key, listConfig.fields)
+    if (!resolved) {
+      if (isSudo) continue
+      rejectUndeclaredKey(listName, key, 'where')
+    }
+
+    // Scalar field filters use Prisma's own operator vocabulary (`equals`,
+    // `contains`, `in`, …) and never nest another field name — trusted as-is,
+    // no further walk needed. Only a relationship field's filter nests a
+    // WHERE clause for another list.
+    if (
+      resolved.isRelationship &&
+      value !== null &&
+      typeof value === 'object' &&
+      !Array.isArray(value)
+    ) {
+      const related = getRelatedListConfig(resolved.fieldConfig.ref, config)
+      if (!related) continue
+
+      const relationEntries = Object.entries(value as Record<string, unknown>)
+      const hasQuantifier = relationEntries.some(([k]) => RELATION_QUANTIFIERS.has(k))
+
+      if (hasQuantifier) {
+        // Wrapped form: `{ author: { is: {...} } }` / `{ posts: { some: {...} } }`.
+        // Only the quantifier's own value is a nested WHERE clause for the
+        // related list.
+        for (const [quantifier, quantifierValue] of relationEntries) {
+          if (RELATION_QUANTIFIERS.has(quantifier)) {
+            walkWhere(quantifierValue, related.listConfig, related.listName, config, isSudo)
+          }
+        }
+      } else {
+        // Direct-nesting form: Prisma's documented default for a to-one
+        // relation filter nests the related list's own fields with no `is`
+        // wrapper at all (`{ author: { email: { contains: '...' } } }`). The
+        // whole value object IS the nested WHERE clause here — walk it
+        // directly, or an undeclared key reached exactly this way (one hop
+        // through a to-one relation) would pass through unchecked.
+        walkWhere(value, related.listConfig, related.listName, config, isSudo)
+      }
+    }
+  }
+}
+
+function walkOrderBy(
+  orderBy: unknown,
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+  listConfig: ListConfig<any>,
+  listName: string,
+  config: OpenSaasConfig,
+  isSudo: boolean,
+): void {
+  if (orderBy === null || typeof orderBy !== 'object') return
+
+  if (Array.isArray(orderBy)) {
+    for (const entry of orderBy) walkOrderBy(entry, listConfig, listName, config, isSudo)
+    return
+  }
+
+  for (const [key, value] of Object.entries(orderBy as Record<string, unknown>)) {
+    const resolved = resolveQueryField(key, listConfig.fields)
+    if (!resolved) {
+      if (isSudo) continue
+      rejectUndeclaredKey(listName, key, 'orderBy')
+    }
+
+    if (resolved.isRelationship && value !== null && typeof value === 'object') {
+      // `{ relation: { _count: 'asc' } }` orders by an aggregate — no nested
+      // field name to resolve. `{ relation: { name: 'asc' } }` orders by a
+      // field on a to-one related list — walk it against that list's fields.
+      if ('_count' in (value as Record<string, unknown>)) continue
+
+      const related = getRelatedListConfig(resolved.fieldConfig.ref, config)
+      if (related) walkOrderBy(value, related.listConfig, related.listName, config, isSudo)
+    }
+  }
+}
+
+/**
+ * Validate a caller-supplied `where`/`orderBy` against the list config,
+ * recursing into logical operators (`AND`/`OR`/`NOT`) and relation filters.
+ * Throws a `ValidationError` naming the list and the offending key on the
+ * first undeclared key found. `isSudo` bypasses the check entirely, matching
+ * the write path's `sudo` escape hatch.
+ */
+export function validateQueryKeys(args: {
+  where?: unknown
+  orderBy?: unknown
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+  listConfig: ListConfig<any>
+  listName: string
+  config: OpenSaasConfig
+  isSudo: boolean
+}): void {
+  const { where, orderBy, listConfig, listName, config, isSudo } = args
+  if (where !== undefined) walkWhere(where, listConfig, listName, config, isSudo)
+  if (orderBy !== undefined) walkOrderBy(orderBy, listConfig, listName, config, isSudo)
+}
+
+/**
+ * #915 — the predicate-time counterpart to `checkFieldAccess`'s post-query
+ * check: reject a `where`/`orderBy` key that names a field the session cannot
+ * read, BEFORE the query runs. See this module's top doc comment for how this
+ * relates to `validateQueryKeys` (#912) and `isFieldReadableForPredicate`'s
+ * doc (in `field-access.ts`) for how a row-dependent `read` rule is handled.
+ *
+ * A key `resolveQueryField` cannot resolve is skipped here — #912 has already
+ * rejected it (or, under `sudo`, deliberately let it through) by the time
+ * this runs. A system field (`id`/`createdAt`/`updatedAt`) resolves with no
+ * `fieldConfig` and carries no field-level access control, so it is always
+ * readable and skipped too.
+ */
+async function checkKeyReadableOrThrow(
+  key: string,
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+  listConfig: ListConfig<any>,
+  listName: string,
+  args: { session: Session | null; context: AccessContext & { _isSudo?: boolean } },
+  kind: 'where' | 'orderBy',
+): Promise<void> {
+  const resolved = resolveQueryField(key, listConfig.fields)
+  if (!resolved || resolved.fieldConfig === undefined) return
+
+  const readable = await isFieldReadableForPredicate(resolved.fieldConfig.access, args)
+  if (!readable) {
+    throw new ValidationError([
+      `Cannot query "${listName}" — "${key}" is denied by field-level read access. ` +
+        `A field the session cannot read cannot be named in a ${kind} (use sudo to bypass).`,
+    ])
+  }
+}
+
+/**
+ * Check field-level `read` access for every key at ONE level of a `where`
+ * clause, recursing only into logical operators (`AND`/`OR`/`NOT`) — never
+ * into a relationship field's own nested value. Exported for `access-filter.ts`'s
+ * #916 reuse (see module doc comment above) — called once per hop against the
+ * RELATED list's own config.
+ */
+export async function walkWhereReadAccess(
+  where: unknown,
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+  listConfig: ListConfig<any>,
+  listName: string,
+  args: { session: Session | null; context: AccessContext & { _isSudo?: boolean } },
+): Promise<void> {
+  if (where === null || typeof where !== 'object') return
+
+  if (Array.isArray(where)) {
+    for (const entry of where) await walkWhereReadAccess(entry, listConfig, listName, args)
+    return
+  }
+
+  for (const [key, value] of Object.entries(where as Record<string, unknown>)) {
+    if (LOGICAL_OPERATORS.has(key)) {
+      await walkWhereReadAccess(value, listConfig, listName, args)
+      continue
+    }
+    // Deliberately does not recurse into a relationship field's own nested
+    // value: it checks whether THIS list's relationship field may be named
+    // (its own `read` access) — a field on the RELATED list nested inside it
+    // is checked by the CALLER re-invoking this function against the related
+    // list's config (see #916 in the module doc comment above).
+    await checkKeyReadableOrThrow(key, listConfig, listName, args, 'where')
+  }
+}
+
+async function walkOrderByReadAccess(
+  orderBy: unknown,
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+  listConfig: ListConfig<any>,
+  listName: string,
+  args: { session: Session | null; context: AccessContext & { _isSudo?: boolean } },
+): Promise<void> {
+  if (orderBy === null || typeof orderBy !== 'object') return
+
+  if (Array.isArray(orderBy)) {
+    for (const entry of orderBy) await walkOrderByReadAccess(entry, listConfig, listName, args)
+    return
+  }
+
+  for (const key of Object.keys(orderBy as Record<string, unknown>)) {
+    await checkKeyReadableOrThrow(key, listConfig, listName, args, 'orderBy')
+  }
+}
+
+/**
+ * Validate a caller-supplied `where`/`orderBy` against field-level `read`
+ * access, recursing into logical operators (`AND`/`OR`/`NOT`) the same way
+ * `validateQueryKeys` does. Throws a `ValidationError` naming the list and
+ * the offending key on the first read-denied field found. `isSudo` bypasses
+ * the check entirely, matching `validateQueryKeys` and the write path's
+ * `sudo` escape hatch.
+ */
+export async function validateQueryFieldReadAccess(args: {
+  where?: unknown
+  orderBy?: unknown
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+  listConfig: ListConfig<any>
+  listName: string
+  session: Session | null
+  context: AccessContext & { _isSudo?: boolean }
+  isSudo: boolean
+}): Promise<void> {
+  const { where, orderBy, listConfig, listName, session, context, isSudo } = args
+  if (isSudo) return
+  const evalArgs = { session, context }
+  if (where !== undefined) await walkWhereReadAccess(where, listConfig, listName, evalArgs)
+  if (orderBy !== undefined) await walkOrderByReadAccess(orderBy, listConfig, listName, evalArgs)
+}

package/src/access/relationship-count.ts

@@ -99,7 +99,6 @@ export async function buildRelationshipCountSelect(
   return Object.keys(select).length > 0 ? select : undefined
 }
 
-/** Read a to-many relationship's count off a fetched row's `_count` payload. */
 function readRelationshipCount(row: Record<string, unknown>, fieldName: string): number {
   const counts = row._count
   if (counts && typeof counts === 'object') {
@@ -109,7 +108,6 @@ function readRelationshipCount(row: Record<string, unknown>, fieldName: string):
   return 0
 }
 
-/** Whether a count satisfies a Filter operator/value comparison. */
 function matchesCount(count: number, operator: FilterOperator, value: number): boolean {
   switch (operator) {
     case 'eq':
@@ -140,7 +138,6 @@ function asCountDelegate(value: unknown): CountFindManyDelegate | null {
   return null
 }
 
-/** Extract the `RelationshipCountFilterMarker` from a condition value, if present. */
 function readCountMarker(value: unknown): RelationshipCountFilterMarker | null {
   if (!value || typeof value !== 'object') return null
   const marker = (value as Record<string, unknown>)[RELATIONSHIP_COUNT_FILTER_KEY]
@@ -291,13 +288,8 @@ export async function resolveRelationshipCountFilters(
       args,
       config,
     )
-    // Preserve any sibling conditions co-present on this member rather than
-    // replacing it wholesale with the resolved `{ id: { in } }`. The filter engine
-    // currently guarantees each AND-member (and the no-AND single object) carries
-    // exactly one field condition, so `siblings` is empty today and this equals the
-    // previous wholesale replacement — but if a future engine change ever merged
-    // multiple conditions into one member, spreading keeps the marker's siblings
-    // from being silently dropped.
+    // Preserve any sibling conditions rather than replacing the member
+    // wholesale — see `mergeResolvedMember` above for why.
     const siblings: Record<string, unknown> = { ...member }
     delete siblings[found.field]
     resolvedMembers.push(mergeResolvedMember(siblings, resolved))