@opensaas/stack-core 0.39.2 → 0.40.0

package/tests/prisma-errors.test.ts

@@ -0,0 +1,141 @@
+import { describe, it, expect } from 'vitest'
+import { uniqueConstraintOf } from '../src/lib/prisma-errors.js'
+
+// Fixtures below are the verified output captured during triage of issue #979
+// (PGlite behind a Postgres wire-protocol socket, @prisma/adapter-pg@7.8.0,
+// @prisma/client@7.8.0) — not a hand-invented shape.
+const compositeDriverAdapterError = {
+  code: 'P2002',
+  meta: {
+    modelName: 'Thing',
+    driverAdapterError: {
+      name: 'DriverAdapterError',
+      cause: {
+        originalCode: '23505',
+        originalMessage: 'duplicate key value violates unique constraint "thing_tenant_slug_key"',
+        kind: 'UniqueConstraintViolation',
+        constraint: { fields: ['"tenantId"', 'slug'] },
+      },
+    },
+  },
+}
+
+const singleColumnDriverAdapterError = {
+  code: 'P2002',
+  meta: {
+    modelName: 'Thing',
+    driverAdapterError: {
+      name: 'DriverAdapterError',
+      cause: {
+        originalCode: '23505',
+        originalMessage: 'duplicate key value violates unique constraint "thing_extRef_key"',
+        kind: 'UniqueConstraintViolation',
+        constraint: { fields: ['"extRef"'] },
+      },
+    },
+  },
+}
+
+// This shape is read directly out of @prisma/adapter-better-sqlite3's own
+// error-mapping source (its SQLITE_CONSTRAINT_UNIQUE branch), not hand-invented:
+// `constraint.fields` comes unquoted (SQLite has no Postgres-style identifier
+// quoting), and `originalMessage` ("UNIQUE constraint failed: Post.slug") has no
+// quoted constraint name for the regex to recover.
+const sqliteDriverAdapterError = {
+  code: 'P2002',
+  meta: {
+    modelName: 'Post',
+    driverAdapterError: {
+      name: 'DriverAdapterError',
+      cause: {
+        originalCode: 'SQLITE_CONSTRAINT_UNIQUE',
+        originalMessage: 'UNIQUE constraint failed: Post.slug',
+        kind: 'UniqueConstraintViolation',
+        constraint: { fields: ['slug'] },
+      },
+    },
+  },
+}
+
+describe('uniqueConstraintOf', () => {
+  it('resolves fields and constraint name from a composite driver-adapter P2002', () => {
+    expect(uniqueConstraintOf(compositeDriverAdapterError)).toEqual({
+      fields: ['tenantId', 'slug'],
+      constraintName: 'thing_tenant_slug_key',
+    })
+  })
+
+  it('resolves fields (no constraint name) from a SQLite driver-adapter P2002', () => {
+    // SQLite's error text carries no quoted constraint name, so this must
+    // degrade to fields-only rather than leaving an empty/garbage name.
+    expect(uniqueConstraintOf(sqliteDriverAdapterError)).toEqual({ fields: ['slug'] })
+  })
+
+  it('resolves a single-column driver-adapter P2002', () => {
+    expect(uniqueConstraintOf(singleColumnDriverAdapterError)).toEqual({
+      fields: ['extRef'],
+      constraintName: 'thing_extRef_key',
+    })
+  })
+
+  it('strips quotes only from identifiers Postgres quoted (camelCase), leaving plain names as-is', () => {
+    const info = uniqueConstraintOf(compositeDriverAdapterError)
+    // `tenantId` is camelCase and arrives quoted; `slug` is lowercase and does not.
+    expect(info?.fields).toEqual(['tenantId', 'slug'])
+  })
+
+  it('prefers an already-populated meta.target and does not consult driverAdapterError', () => {
+    const error = {
+      code: 'P2002',
+      meta: {
+        target: ['email'],
+        // Present but must be ignored — meta.target already wins.
+        driverAdapterError: {
+          cause: {
+            originalMessage: 'duplicate key value violates unique constraint "other_key"',
+            constraint: { fields: ['other'] },
+          },
+        },
+      },
+    }
+
+    expect(uniqueConstraintOf(error)).toEqual({ fields: ['email'] })
+  })
+
+  it('returns undefined for a P2002 with no recoverable constraint information', () => {
+    expect(uniqueConstraintOf({ code: 'P2002', meta: {} })).toBeUndefined()
+    expect(uniqueConstraintOf({ code: 'P2002' })).toBeUndefined()
+  })
+
+  it('returns undefined for a non-P2002 error', () => {
+    expect(uniqueConstraintOf({ code: 'P2025', meta: { target: ['email'] } })).toBeUndefined()
+  })
+
+  it('returns undefined for non-error values without throwing', () => {
+    expect(uniqueConstraintOf(null)).toBeUndefined()
+    expect(uniqueConstraintOf(undefined)).toBeUndefined()
+    expect(uniqueConstraintOf('boom')).toBeUndefined()
+    expect(uniqueConstraintOf({})).toBeUndefined()
+  })
+
+  it('never throws when the adapter error shape is malformed at any level', () => {
+    expect(() =>
+      uniqueConstraintOf({ code: 'P2002', meta: { driverAdapterError: null } }),
+    ).not.toThrow()
+    expect(() =>
+      uniqueConstraintOf({ code: 'P2002', meta: { driverAdapterError: { cause: null } } }),
+    ).not.toThrow()
+    expect(() =>
+      uniqueConstraintOf({
+        code: 'P2002',
+        meta: { driverAdapterError: { cause: { constraint: { fields: [1, null, 'ok'] } } } },
+      }),
+    ).not.toThrow()
+    expect(
+      uniqueConstraintOf({
+        code: 'P2002',
+        meta: { driverAdapterError: { cause: { constraint: { fields: [1, null, 'ok'] } } } },
+      }),
+    ).toEqual({ fields: ['ok'] })
+  })
+})

package/tests/singleton.test.ts

@@ -278,12 +278,20 @@ describe('Singleton Lists', () => {
         featuredAuthorId: 'a1',
         featuredAuthor: { id: 'a1', name: 'Ann' },
       })
+      // `featuredAuthor` is to-one, so Prisma cannot scope it with a nested
+      // `where` (#974) — it's fetched unscoped, then this batched existence
+      // check decides whether it survives.
+      relPrisma.author.findMany.mockResolvedValue([{ id: 'a1' }])
 
       const context = getContext(relConfig, relPrisma, null)
       const result = await context.db.homePage.get({ include: { featuredAuthor: true } })
 
       const call = relPrisma.homePage.findFirst.mock.calls[0][0]
-      expect(call.include.featuredAuthor).toEqual({ where: { published: { equals: true } } })
+      expect(call.include.featuredAuthor).toBe(true)
+      expect(relPrisma.author.findMany).toHaveBeenCalledWith({
+        where: { AND: [{ published: { equals: true } }, { id: { in: ['a1'] } }] },
+        select: { id: true },
+      })
       expect(result?.featuredAuthor).toEqual({ id: 'a1', name: 'Ann' })
     })
   })

package/tests/to-one-include-access-filter.test.ts

@@ -0,0 +1,172 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { getContext } from '../src/context/index.js'
+import type { OpenSaasConfig } from '../src/config/types.js'
+
+/**
+ * End-to-end regression coverage for issue #974: `include`-ing a to-one
+ * relation whose related list's `query` access resolves to a filter used to
+ * throw `PrismaClientValidationError` — the access-scoped include builder
+ * attached that filter as a nested `where`, which Prisma only accepts on a
+ * to-many include. These tests exercise the fix through `context.db`, the
+ * same surface the issue's reproduction used, with a membership-derived
+ * filter (an `OR` reaching through a relation) matching the reporter's real
+ * case — proving the filter is handed to Prisma unmodified rather than
+ * hand-evaluated.
+ */
+describe('include on a to-one relationship with a filtered related list (#974)', () => {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  let mockPrisma: any
+  let config: OpenSaasConfig
+  const membershipFilter = {
+    OR: [
+      { id: { equals: 'self-id' } },
+      { memberships: { some: { studio: { admins: { some: { id: { equals: 'self-id' } } } } } } },
+    ],
+  }
+
+  beforeEach(() => {
+    mockPrisma = {
+      child: { findFirst: vi.fn(), findMany: vi.fn() },
+      user: { findFirst: vi.fn(), findMany: vi.fn() },
+    }
+
+    config = {
+      db: { provider: 'postgresql', url: 'postgresql://localhost:5432/test' },
+      lists: {
+        Child: {
+          fields: {
+            name: { type: 'text' },
+            owner: { type: 'relationship', ref: 'User' },
+          },
+          access: { operation: { query: () => true } },
+        },
+        User: {
+          fields: { name: { type: 'text' } },
+          access: { operation: { query: () => membershipFilter } },
+        },
+      },
+    }
+  })
+
+  it('findMany succeeds instead of throwing, admits a visible owner, and nulls an excluded one', async () => {
+    mockPrisma.child.findMany.mockResolvedValue([
+      { id: 'c1', name: 'A', owner: { id: 'u1', name: 'Visible' } },
+      { id: 'c2', name: 'B', owner: { id: 'u2', name: 'Hidden' } },
+      { id: 'c3', name: 'C', owner: null },
+    ])
+    // Only u1 satisfies the access filter.
+    mockPrisma.user.findMany.mockResolvedValue([{ id: 'u1' }])
+
+    const context = getContext(config, mockPrisma, { userId: 'self-id' })
+    const result = await context.db.child.findMany({ include: { owner: true } })
+
+    // The Prisma call itself carries no `where` on `owner` — this is exactly
+    // the shape Prisma rejected before the fix.
+    expect(mockPrisma.child.findMany).toHaveBeenCalledWith(
+      expect.objectContaining({ include: { owner: true } }),
+    )
+
+    // One batched existence check, evaluating the EXACT filter `checkAccess`
+    // produced — never a hand-rolled interpretation of it.
+    expect(mockPrisma.user.findMany).toHaveBeenCalledTimes(1)
+    expect(mockPrisma.user.findMany).toHaveBeenCalledWith({
+      where: { AND: [membershipFilter, { id: { in: ['u1', 'u2'] } }] },
+      select: { id: true },
+    })
+
+    expect(result).toHaveLength(3)
+    expect(result[0].owner).toEqual({ id: 'u1', name: 'Visible' })
+    expect(result[1].owner).toBeNull()
+    expect(result[2].owner).toBeNull()
+  })
+
+  it('findUnique and findFirst apply the same nulling for a single row', async () => {
+    const deniedRow = { id: 'c2', name: 'B', owner: { id: 'u2', name: 'Hidden' } }
+    // findUnique reads through the model's own `findFirst`; findFirst is
+    // sugar over `findMany` (see `createFindFirst` in context/index.ts) — both
+    // need mocking here.
+    mockPrisma.child.findFirst.mockResolvedValue(deniedRow)
+    mockPrisma.child.findMany.mockResolvedValue([deniedRow])
+    mockPrisma.user.findMany.mockResolvedValue([])
+
+    const context = getContext(config, mockPrisma, { userId: 'self-id' })
+    const viaFindUnique = await context.db.child.findUnique({
+      where: { id: 'c2' },
+      include: { owner: true },
+    })
+    const viaFindFirst = await context.db.child.findFirst({ include: { owner: true } })
+
+    expect(viaFindUnique?.owner).toBeNull()
+    expect(viaFindFirst?.owner).toBeNull()
+  })
+
+  it('nulls every parent row when the related list denies query access outright, without issuing an existence check', async () => {
+    config.lists.User.access = { operation: { query: () => false } }
+    mockPrisma.child.findMany.mockResolvedValue([
+      { id: 'c1', name: 'A' }, // never fetched at all — access-filter drops the key from `include`
+    ])
+
+    const context = getContext(config, mockPrisma, { userId: 'self-id' })
+    const result = await context.db.child.findMany({ include: { owner: true } })
+
+    expect(mockPrisma.child.findMany).toHaveBeenCalledWith(expect.objectContaining({ include: {} }))
+    expect(mockPrisma.user.findMany).not.toHaveBeenCalled()
+    expect(result[0].owner).toBeNull()
+  })
+
+  it('leaves the relation unchanged and issues no extra query when the related list is fully open', async () => {
+    config.lists.User.access = { operation: { query: () => true } }
+    mockPrisma.child.findMany.mockResolvedValue([
+      { id: 'c1', name: 'A', owner: { id: 'u1', name: 'Ann' } },
+    ])
+
+    const context = getContext(config, mockPrisma, { userId: 'self-id' })
+    const result = await context.db.child.findMany({ include: { owner: true } })
+
+    expect(mockPrisma.child.findMany).toHaveBeenCalledWith(
+      expect.objectContaining({ include: { owner: true } }),
+    )
+    expect(mockPrisma.user.findMany).not.toHaveBeenCalled()
+    expect(result[0].owner).toEqual({ id: 'u1', name: 'Ann' })
+  })
+
+  it('scopes a filtered to-one relation nested inside a to-many include, at every row', async () => {
+    config.lists.Child.fields.notes = { type: 'relationship', ref: 'Note.child', many: true }
+    config.lists.Note = {
+      fields: {
+        body: { type: 'text' },
+        child: { type: 'relationship', ref: 'Child.notes' },
+        author: { type: 'relationship', ref: 'User' },
+      },
+      access: { operation: { query: () => true } },
+    }
+    mockPrisma.child.findMany.mockResolvedValue([
+      {
+        id: 'c1',
+        name: 'A',
+        notes: [
+          { id: 'n1', body: 'ok', author: { id: 'u1', name: 'Visible' } },
+          { id: 'n2', body: 'no', author: { id: 'u2', name: 'Hidden' } },
+        ],
+      },
+    ])
+    mockPrisma.user.findMany.mockResolvedValue([{ id: 'u1' }])
+
+    const context = getContext(config, mockPrisma, { userId: 'self-id' })
+    const result = await context.db.child.findMany({
+      include: { notes: { include: { author: true } } },
+    })
+
+    // The to-many `notes` relation still carries no `where` here (Note's
+    // query access is fully open); the nested to-one `author` inside it is
+    // resolved via ONE batched existence check across both notes.
+    expect(mockPrisma.user.findMany).toHaveBeenCalledTimes(1)
+    expect(mockPrisma.user.findMany).toHaveBeenCalledWith({
+      where: { AND: [membershipFilter, { id: { in: ['u1', 'u2'] } }] },
+      select: { id: true },
+    })
+
+    expect(result[0].notes[0].author).toEqual({ id: 'u1', name: 'Visible' })
+    expect(result[0].notes[1].author).toBeNull()
+  })
+})

package/tests/with-session.test.ts

@@ -0,0 +1,243 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { getContext } from '../src/context/index.js'
+import { config, list } from '../src/config/index.js'
+import { text } from '../src/fields/index.js'
+import type { PrismaClient } from '@prisma/client'
+
+/**
+ * #980: `context.withSession(session)` — the sibling to `sudo()` on the
+ * other axis. It substitutes the session a derived context carries while
+ * reusing the receiver's already-resolved config and client (including a
+ * transaction client) and running access control/hooks exactly as normal.
+ */
+
+describe('withSession', () => {
+  const mockPrisma = {
+    post: {
+      findFirst: vi.fn(),
+      findMany: vi.fn(),
+      findUnique: vi.fn(),
+      create: vi.fn(),
+      update: vi.fn(),
+      delete: vi.fn(),
+      count: vi.fn(),
+    },
+  } as unknown as PrismaClient
+
+  const seenSessions: (Record<string, unknown> | null | undefined)[] = []
+
+  const testConfig = config({
+    db: { provider: 'sqlite' },
+    lists: {
+      Post: list({
+        fields: {
+          title: text({ validation: { isRequired: true } }),
+        },
+        access: {
+          operation: {
+            query: async () => true,
+            create: async ({ session }) => session?.role === 'admin',
+            update: async ({ session }) => session?.role === 'admin',
+          },
+        },
+        hooks: {
+          validate: async ({ context }) => {
+            seenSessions.push(context.session as Record<string, unknown> | null | undefined)
+          },
+        },
+      }),
+    },
+  })
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    seenSessions.length = 0
+  })
+
+  it('returns a context whose session is the substituted one, leaving the original unmutated', () => {
+    const original = getContext(testConfig, mockPrisma, { userId: '1', role: 'user' })
+    const derived = original.withSession({ userId: '2', role: 'admin' })
+
+    expect(derived.session).toEqual({ userId: '2', role: 'admin' })
+    expect(original.session).toEqual({ userId: '1', role: 'user' })
+  })
+
+  it('a list validate hook sees the substituted session, not the original', async () => {
+    const original = getContext(testConfig, mockPrisma, { userId: '1', role: 'user' })
+    const derived = original.withSession({ userId: '2', role: 'admin' })
+
+    mockPrisma.post.create.mockResolvedValue({ id: '1', title: 'Hi' })
+
+    await derived.db.post.create({ data: { title: 'Hi' } })
+
+    expect(seenSessions).toEqual([{ userId: '2', role: 'admin' }])
+  })
+
+  it('access rules evaluate against the substituted session — a derived context can do neither more nor less than one built directly with it', async () => {
+    const adminSession = { userId: '2', role: 'admin' }
+    const derived = getContext(testConfig, mockPrisma, { userId: '1', role: 'user' }).withSession(
+      adminSession,
+    )
+    const direct = getContext(testConfig, mockPrisma, adminSession)
+
+    mockPrisma.post.create.mockResolvedValue({ id: '1', title: 'Hi' })
+
+    const derivedResult = await derived.db.post.create({ data: { title: 'Hi' } })
+    const directResult = await direct.db.post.create({ data: { title: 'Hi' } })
+
+    expect(derivedResult).toMatchObject({ title: 'Hi' })
+    expect(directResult).toMatchObject({ title: 'Hi' })
+
+    // Neither more: a non-admin substituted session is denied exactly like a
+    // context built with that session directly.
+    const userSession = { userId: '3', role: 'user' }
+    const derivedDenied = getContext(testConfig, mockPrisma, adminSession).withSession(userSession)
+    const directDenied = getContext(testConfig, mockPrisma, userSession)
+
+    expect(await derivedDenied.db.post.create({ data: { title: 'Nope' } })).toBeNull()
+    expect(await directDenied.db.post.create({ data: { title: 'Nope' } })).toBeNull()
+  })
+
+  it('withSession(null) yields an anonymous context and access rules treat it as such', async () => {
+    const derived = getContext(testConfig, mockPrisma, { userId: '1', role: 'admin' }).withSession(
+      null,
+    )
+
+    expect(derived.session).toBeNull()
+
+    const result = await derived.db.post.create({ data: { title: 'Nope' } })
+    expect(result).toBeNull()
+  })
+
+  it('context.withSession(s).sudo() and context.sudo().withSession(s) are equivalent', () => {
+    const base = getContext(testConfig, mockPrisma, { userId: '1', role: 'user' })
+    const admin = { userId: '2', role: 'admin' }
+
+    const a = base.withSession(admin).sudo()
+    const b = base.sudo().withSession(admin)
+
+    expect(a._isSudo).toBe(true)
+    expect(b._isSudo).toBe(true)
+    expect(a.session).toEqual(admin)
+    expect(b.session).toEqual(admin)
+  })
+
+  it('preserves sudo state: withSession on a sudo context stays sudo, on a non-sudo context stays non-sudo', () => {
+    const base = getContext(testConfig, mockPrisma, { userId: '1', role: 'user' })
+    const admin = { userId: '2', role: 'admin' }
+
+    expect(base.sudo().withSession(admin)._isSudo).toBe(true)
+    expect(base.withSession(admin)._isSudo).toBe(false)
+  })
+
+  it('reuses the receiver client — no second connection is opened', () => {
+    const original = getContext(testConfig, mockPrisma, { userId: '1', role: 'user' })
+    const derived = original.withSession({ userId: '2', role: 'admin' })
+
+    expect(derived.prisma).toBe(original.prisma)
+  })
+
+  it('reuses the receiver storage', () => {
+    const original = getContext(testConfig, mockPrisma, { userId: '1', role: 'user' })
+    const derived = original.withSession({ userId: '2', role: 'admin' })
+
+    expect(derived.storage).toBe(original.storage)
+  })
+
+  it('hooks fire on the derived context exactly as on any other', async () => {
+    const original = getContext(testConfig, mockPrisma, { userId: '1', role: 'admin' })
+    const derived = original.withSession({ userId: '2', role: 'admin' })
+
+    mockPrisma.post.create.mockResolvedValue({ id: '1', title: 'Hi' })
+
+    await derived.db.post.create({ data: { title: 'Hi' } })
+
+    expect(seenSessions).toHaveLength(1)
+  })
+})
+
+describe('withSession inside context.transaction (#614/#980)', () => {
+  function createTxPrisma() {
+    const tables: Record<string, Map<string, Record<string, unknown>>> = { post: new Map() }
+    let idCounter = 0
+    const nextId = () => `id-${++idCounter}`
+
+    function makeModel(table: string) {
+      return {
+        findUnique: vi.fn(
+          async ({ where }: { where: { id: string } }) => tables[table].get(where.id) ?? null,
+        ),
+        findFirst: vi.fn(async () => tables[table].values().next().value ?? null),
+        findMany: vi.fn(async () => Array.from(tables[table].values())),
+        count: vi.fn(async () => tables[table].size),
+        create: vi.fn(async ({ data }: { data: Record<string, unknown> }) => {
+          const id = (data.id as string) ?? nextId()
+          const record = { ...data, id }
+          tables[table].set(id, record)
+          return record
+        }),
+      }
+    }
+
+    const client: Record<string, unknown> = { post: makeModel('post') }
+
+    client.$transaction = async (fn: (tx: unknown) => Promise<unknown>) => {
+      const snapshot: Record<string, Map<string, Record<string, unknown>>> = {}
+      for (const [name, map] of Object.entries(tables)) snapshot[name] = new Map(map)
+      const { $transaction: _omit, ...models } = client
+      void _omit
+      try {
+        return await fn(models)
+      } catch (err) {
+        for (const [name, map] of Object.entries(snapshot)) tables[name] = map
+        throw err
+      }
+    }
+
+    return { client, tables }
+  }
+
+  const txConfig = config({
+    db: { provider: 'postgresql', url: 'postgresql://localhost:5432/test' },
+    lists: {
+      Post: list({
+        fields: { title: text() },
+        access: { operation: { query: () => true, create: () => true } },
+      }),
+    },
+  })
+
+  it('tx.withSession(s) writes participate in the same transaction and roll back with it', async () => {
+    const mock = createTxPrisma()
+    const context = getContext(txConfig, mock.client, { userId: '1' })
+
+    // Commits: the substituted-session write is inside the callback's transaction.
+    const created = await context.transaction((tx) =>
+      tx.withSession({ userId: '2' }).db.post.create({ data: { title: 'committed' } }),
+    )
+    expect(created).toMatchObject({ title: 'committed' })
+    expect(mock.tables.post.size).toBe(1)
+
+    // Rolls back: a throw after the substituted-session write undoes it too,
+    // proving the write joined the same transaction rather than a separate one.
+    await expect(
+      context.transaction(async (tx) => {
+        await tx.withSession({ userId: '3' }).db.post.create({ data: { title: 'rollback-me' } })
+        throw new Error('boom')
+      }),
+    ).rejects.toThrow('boom')
+    expect(mock.tables.post.size).toBe(1)
+  })
+
+  it('tx.withSession(s) carries the substituted session', async () => {
+    const mock = createTxPrisma()
+    const context = getContext(txConfig, mock.client, { userId: '1' })
+
+    const seen = await context.transaction(async (tx) => {
+      const withOther = tx.withSession({ userId: 'other' })
+      return withOther.session
+    })
+
+    expect(seen).toEqual({ userId: 'other' })
+  })
+})

package/tests/write-pipeline.test.ts

@@ -6,6 +6,7 @@ import {
   deleteWriteStrategy,
 } from '../src/context/write-pipeline.js'
 import { ValidationError } from '../src/hooks/index.js'
+import { InvalidCreateAccessResultError } from '../src/access/errors.js'
 import { text } from '../src/fields/index.js'
 import type { OpenSaasConfig, ListConfig } from '../src/config/types.js'
 import type { AccessContext, PrismaClientLike } from '../src/access/types.js'
@@ -289,6 +290,34 @@ describe('Write Pipeline — short-circuit to null (silent failure)', () => {
     expect(events).not.toContain('list:resolveInput')
   })
 
+  // #1009: a `create` rule returning a filter reads as though it scopes the
+  // create, but create has no existing row to re-check that filter against
+  // (unlike update/delete, which do). Before this fix the only test was
+  // `=== false`, so a filter fell through and was silently treated as allow.
+  it('create: access control returning a filter throws InvalidCreateAccessResultError, before DB and before beforeOperation', async () => {
+    const { prisma, post } = makeFakePrisma()
+    const listConfig = makeListConfig({
+      operationAccess: { create: () => ({ authorId: 'someone' }) },
+    })
+    const context = makeContext()
+
+    await expect(
+      runWritePipeline({
+        listName: 'Post',
+        listConfig,
+        prisma,
+        context,
+        config: makeConfig(listConfig),
+        inputData: { title: 'hi' },
+        strategy: createWriteStrategy('Post', listConfig, context),
+      }),
+    ).rejects.toThrow(InvalidCreateAccessResultError)
+
+    expect(post.create).not.toHaveBeenCalled()
+    expect(events).not.toContain('list:beforeOperation')
+    expect(events).not.toContain('list:resolveInput')
+  })
+
   it('update: missing target short-circuits to null before access, hooks, and DB', async () => {
     const { prisma, post } = makeFakePrisma({ existing: null })
     const listConfig = makeListConfig()