@opensaas/stack-core 0.39.2 → 0.41.0

package/src/access/access-filter.test.ts

@@ -1,7 +1,13 @@
 import { describe, it, expect, vi } from 'vitest'
-import { buildAccessScopedInclude } from './access-filter.js'
-import { AccessScopeDepthExceededError } from './errors.js'
+import { buildAccessScopedInclude, resolveToOneAccessVisibility } from './access-filter.js'
+import {
+  AccessScopeDepthExceededError,
+  RelationFilterAccessDeniedError,
+  UndeclaredCountKeyError,
+  UndeclaredIncludeKeyError,
+} from './errors.js'
 import { READ_INCLUDE_MAX_DEPTH } from './depth-limits.js'
+import { ValidationError } from '../hooks/index.js'
 import type { OpenSaasConfig, FieldConfig } from '../config/types.js'
 import type { AccessContext } from './types.js'
 
@@ -22,6 +28,14 @@ import type { AccessContext } from './types.js'
  * relation the request doesn't name never has its list's `query` access
  * invoked, and naming a relation fetches its own columns and stops (the "One
  * hop" rule) at every level, not just the root.
+ *
+ * The scenarios in this file build every chain relation as to-MANY
+ * (`rel(ref, true)`), so `where`-in-`include` keeps meaning what it always
+ * has here — the walk-depth/caller-directed logic under test is arity-
+ * agnostic. The to-one-specific behavior this function grew for issue #974
+ * (a `where` on a to-one include is not something Prisma accepts, so it's
+ * recorded in `toOneAccessFilters` instead and resolved post-query by
+ * `resolveToOneAccessVisibility`) has its own dedicated describe blocks below.
  */
 
 // A relationship field pointing at another list.
@@ -71,10 +85,10 @@ function chainConfig(count: number): {
     const listName = `L${i}`
     const fields: Record<string, FieldConfig> = { name: { type: 'text' } as FieldConfig }
     if (i < count - 1) {
-      fields.next = rel(`L${i + 1}.prev`)
+      fields.next = rel(`L${i + 1}.prev`, true)
     }
     if (i > 0) {
-      fields.prev = rel(`L${i - 1}.next`)
+      fields.prev = rel(`L${i - 1}.next`, true)
     }
     const filter = { ownerId: { equals: listName } }
     const queryFn = vi.fn(i === 0 ? () => true : () => filter)
@@ -139,7 +153,7 @@ describe('buildAccessScopedInclude — caller-directed walk (ADR-0026)', () => {
       // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
     } as any as OpenSaasConfig
 
-    const include = await buildAccessScopedInclude(
+    const { include } = await buildAccessScopedInclude(
       { b: true },
       config.lists.A.fields,
       { session: null, context: makeContext() },
@@ -155,7 +169,7 @@ describe('buildAccessScopedInclude — caller-directed walk (ADR-0026)', () => {
   it("fetches a named relation's own columns and stops — does not auto-expand its subtree (One hop)", async () => {
     const { config, queryFns } = chainConfig(4) // L0 → L1 → L2 → L3
 
-    const include = await buildAccessScopedInclude(
+    const { include } = await buildAccessScopedInclude(
       { next: true },
       config.lists.L0.fields,
       { session: null, context: makeContext() },
@@ -175,7 +189,7 @@ describe('buildAccessScopedInclude — caller-directed walk (ADR-0026)', () => {
   it('scopes a nested path at every level the request names it', async () => {
     const { config, queryFns } = chainConfig(4) // L0 → L1 → L2 → L3
 
-    const include = await buildAccessScopedInclude(
+    const { include } = await buildAccessScopedInclude(
       { next: { include: { next: { include: { next: true } } } } },
       config.lists.L0.fields,
       { session: null, context: makeContext() },
@@ -215,7 +229,7 @@ describe('buildAccessScopedInclude — caller-directed walk (ADR-0026)', () => {
       // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
     } as any as OpenSaasConfig
 
-    const include = await buildAccessScopedInclude(
+    const { include } = await buildAccessScopedInclude(
       { b: { include: { c: { include: { a: true } } } } },
       config.lists.A.fields,
       { session: null, context: makeContext() },
@@ -253,7 +267,7 @@ describe('buildAccessScopedInclude — caller take on a to-many relation (issue
   it('preserves the take and AND-combines it with the access where', async () => {
     const config = scopedConfig()
 
-    const include = await buildAccessScopedInclude(
+    const { include } = await buildAccessScopedInclude(
       { posts: { take: 10 } },
       config.lists.User.fields,
       { session: null, context: makeContext() },
@@ -276,7 +290,7 @@ describe('buildAccessScopedInclude — caller take on a to-many relation (issue
     const config = scopedConfig()
     config.lists.Post.access = { operation: { query: () => false } }
 
-    const include = await buildAccessScopedInclude(
+    const { include } = await buildAccessScopedInclude(
       { posts: { take: 10 } },
       config.lists.User.fields,
       { session: null, context: makeContext() },
@@ -342,7 +356,7 @@ describe('buildAccessScopedInclude — fail-closed at the read-include depth cap
     // Outer `next` (hop 1) + nestedInclude(HOPS_AT_CAP - 1) = HOPS_AT_CAP hops total — right at the boundary.
     const requested = { next: nestedInclude(HOPS_AT_CAP - 1) }
 
-    const include = await buildAccessScopedInclude(
+    const { include } = await buildAccessScopedInclude(
       requested,
       config.lists.L0.fields,
       { session: null, context: makeContext() },
@@ -373,7 +387,7 @@ describe('buildAccessScopedInclude — fail-closed at the read-include depth cap
     const chainLength = HOPS_AT_CAP + 3
     const { config } = chainConfig(chainLength)
 
-    const include = await buildAccessScopedInclude(
+    const { include } = await buildAccessScopedInclude(
       {},
       config.lists.L0.fields,
       { session: null, context: makeContext() },
@@ -383,7 +397,55 @@ describe('buildAccessScopedInclude — fail-closed at the read-include depth cap
     expect(include).toEqual({})
   })
 
-  it('a list with no relationships passes an unrelated requested key through unchanged', async () => {
+  it('a declared non-relationship key on a list with no relationships passes through unchanged', async () => {
+    const config = {
+      db: { provider: 'sqlite' },
+      lists: {
+        Leaf: {
+          fields: { name: { type: 'text' } as FieldConfig },
+          access: { operation: { query: () => true } },
+        },
+      },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+    } as any as OpenSaasConfig
+
+    // A declared field that isn't a relationship — access control does not
+    // govern it (e.g. a virtual field named in `include`, stripped later by
+    // `stripVirtualFieldsFromInclude`).
+    const { include } = await buildAccessScopedInclude(
+      { name: true },
+      config.lists.Leaf.fields,
+      { session: null, context: makeContext() },
+      config,
+      'Leaf',
+    )
+    expect(include).toEqual({ name: true })
+  })
+
+  it('rejects a key that is neither declared nor a synthetic back-relation (#1082)', async () => {
+    const config = {
+      db: { provider: 'sqlite' },
+      lists: {
+        Leaf: {
+          fields: { name: { type: 'text' } as FieldConfig },
+          access: { operation: { query: () => true } },
+        },
+      },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+    } as any as OpenSaasConfig
+
+    await expect(
+      buildAccessScopedInclude(
+        { someUnrelatedKey: true },
+        config.lists.Leaf.fields,
+        { session: null, context: makeContext() },
+        config,
+        'Leaf',
+      ),
+    ).rejects.toThrow(UndeclaredIncludeKeyError)
+  })
+
+  it('a bare `_count: true` on a list with no to-many relations yields no `_count` key at all (#1087)', async () => {
     const config = {
       db: { provider: 'sqlite' },
       lists: {
@@ -395,15 +457,1463 @@ describe('buildAccessScopedInclude — fail-closed at the read-include depth cap
       // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
     } as any as OpenSaasConfig
 
-    // An arbitrary (non-declared-relationship) key passed through unchanged —
-    // access control does not govern keys it doesn't recognize as relationships.
-    const include = await buildAccessScopedInclude(
-      { someUnrelatedKey: true },
+    const { include } = await buildAccessScopedInclude(
+      { _count: true },
       config.lists.Leaf.fields,
       { session: null, context: makeContext() },
       config,
       'Leaf',
     )
-    expect(include).toEqual({ someUnrelatedKey: true })
+    expect(include).toEqual({})
+  })
+})
+
+/**
+ * Regression coverage for issue #1087: a caller-supplied `_count` in
+ * `include` used to reach Prisma unscoped (#1082's "Out of scope" — the one
+ * key `buildAccessScopedInclude`'s own denial rule allowlisted through rather
+ * than rejecting or scoping). These tests pin the fix: each named relation's
+ * `_count.select` entry is scoped by that relation's own `query` access,
+ * exactly like the rest of this module scopes `include`, and a denied
+ * relation is recorded in `countDenials` for `filterReadableFields` to inject
+ * `0` for post-query (Prisma cannot be asked for a guaranteed `0`).
+ */
+describe('buildAccessScopedInclude — `_count` is scoped like any other relation (issue #1087)', () => {
+  function countConfig(postQuery: unknown): OpenSaasConfig {
+    return {
+      db: { provider: 'sqlite' },
+      lists: {
+        User: {
+          fields: {
+            name: { type: 'text' } as FieldConfig,
+            posts: rel('Post.author', true),
+            secrets: rel('Secret.owner', true),
+          },
+          access: { operation: { query: () => true } },
+        },
+        Post: {
+          fields: { title: { type: 'text' } as FieldConfig, author: rel('User.posts') },
+          access: { operation: { query: postQuery } },
+        },
+        Secret: {
+          fields: { body: { type: 'text' } as FieldConfig, owner: rel('User.secrets') },
+          access: { operation: { query: () => false } },
+        },
+      },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+    } as any
+  }
+
+  it('a fully-readable relation counts unchanged', async () => {
+    const config = countConfig(() => true)
+
+    const { include, countDenials } = await buildAccessScopedInclude(
+      { _count: { select: { posts: true } } },
+      config.lists.User.fields,
+      { session: null, context: makeContext() },
+      config,
+      'User',
+    )
+
+    expect(include).toEqual({ _count: { select: { posts: true } } })
+    expect(countDenials.keys.size).toBe(0)
+  })
+
+  it('folds the related list row filter into the count select', async () => {
+    const config = countConfig(() => ({ published: { equals: true } }))
+
+    const { include } = await buildAccessScopedInclude(
+      { _count: { select: { posts: true } } },
+      config.lists.User.fields,
+      { session: null, context: makeContext() },
+      config,
+      'User',
+    )
+
+    expect(include).toEqual({
+      _count: { select: { posts: { where: { published: { equals: true } } } } },
+    })
+  })
+
+  it('AND-combines a caller-supplied nested `where` with the access filter, never replacing it', async () => {
+    const config = countConfig(() => ({ published: { equals: true } }))
+
+    const { include } = await buildAccessScopedInclude(
+      { _count: { select: { posts: { where: { title: { contains: 'foo' } } } } } },
+      config.lists.User.fields,
+      { session: null, context: makeContext() },
+      config,
+      'User',
+    )
+
+    expect(include).toEqual({
+      _count: {
+        select: {
+          posts: {
+            where: {
+              AND: [{ published: { equals: true } }, { title: { contains: 'foo' } }],
+            },
+          },
+        },
+      },
+    })
+  })
+
+  it('omits a fully-denied relation from the select and records it in `countDenials`', async () => {
+    const config = countConfig(() => true)
+
+    const { include, countDenials } = await buildAccessScopedInclude(
+      { _count: { select: { posts: true, secrets: true } } },
+      config.lists.User.fields,
+      { session: null, context: makeContext() },
+      config,
+      'User',
+    )
+
+    expect(include).toEqual({ _count: { select: { posts: true } } })
+    expect(countDenials.keys).toEqual(new Set(['secrets']))
+  })
+
+  it('a wholly-denied `_count.select` omits the `_count` key entirely, still recording the denial', async () => {
+    const config = countConfig(() => true)
+
+    const { include, countDenials } = await buildAccessScopedInclude(
+      { _count: { select: { secrets: true } } },
+      config.lists.User.fields,
+      { session: null, context: makeContext() },
+      config,
+      'User',
+    )
+
+    expect(include).toEqual({})
+    expect(countDenials.keys).toEqual(new Set(['secrets']))
+  })
+
+  it('a denied relation resolves to 0 without validating its caller `where` — no field-name/read-access oracle', async () => {
+    // A caller who cannot read a single `Secret` row supplies a nonsense
+    // `where` naming a field that doesn't exist. If denial were checked
+    // AFTER `where` validation, this would throw a `ValidationError` naming
+    // "Secret"'s fields — letting a caller probe a fully denied list's
+    // schema. Denial must win first: the count is 0 regardless of `where`.
+    const config = countConfig(() => true)
+
+    const { include, countDenials } = await buildAccessScopedInclude(
+      { _count: { select: { secrets: { where: { bogusField: { equals: 1 } } } } } },
+      config.lists.User.fields,
+      { session: null, context: makeContext() },
+      config,
+      'User',
+    )
+
+    expect(include).toEqual({})
+    expect(countDenials.keys).toEqual(new Set(['secrets']))
+  })
+
+  it('rejects a `_count.select` key that is not a countable to-many (undeclared)', async () => {
+    const config = countConfig(() => true)
+
+    await expect(
+      buildAccessScopedInclude(
+        { _count: { select: { nonsense: true } } },
+        config.lists.User.fields,
+        { session: null, context: makeContext() },
+        config,
+        'User',
+      ),
+    ).rejects.toThrow(UndeclaredCountKeyError)
+  })
+
+  it('rejects a `_count.select` key naming a scalar field', async () => {
+    const config = countConfig(() => true)
+
+    await expect(
+      buildAccessScopedInclude(
+        { _count: { select: { name: true } } },
+        config.lists.User.fields,
+        { session: null, context: makeContext() },
+        config,
+        'User',
+      ),
+    ).rejects.toThrow(UndeclaredCountKeyError)
+  })
+
+  it('rejects a `_count.select` key naming a to-one relationship', async () => {
+    const config = countConfig(() => true)
+
+    await expect(
+      buildAccessScopedInclude(
+        { _count: { select: { author: true } } },
+        config.lists.Post.fields,
+        { session: null, context: makeContext() },
+        config,
+        'Post',
+      ),
+    ).rejects.toThrow(UndeclaredCountKeyError)
+  })
+
+  // Issue #1111: a relationship hidden via field-level `read` access must not
+  // leak its true count through `_count`, even though the related list's rows
+  // are otherwise fully readable — the same denial an ordinary `include` of
+  // that field already gets from `filterReadableFields`'s `checkFieldAccess`
+  // call.
+  it('omits a relation whose field-level `read` access denies it, even though the related list is fully readable', async () => {
+    const config: OpenSaasConfig = {
+      db: { provider: 'sqlite' },
+      lists: {
+        User: {
+          fields: {
+            name: { type: 'text' } as FieldConfig,
+            posts: {
+              type: 'relationship',
+              ref: 'Post.author',
+              many: true,
+              access: { read: () => false },
+            } as FieldConfig,
+          },
+          access: { operation: { query: () => true } },
+        },
+        Post: {
+          fields: { title: { type: 'text' } as FieldConfig, author: rel('User.posts') },
+          access: { operation: { query: () => true } },
+        },
+      },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+    } as any
+
+    const { include, countDenials } = await buildAccessScopedInclude(
+      { _count: { select: { posts: true } } },
+      config.lists.User.fields,
+      { session: null, context: makeContext() },
+      config,
+      'User',
+    )
+
+    expect(include).toEqual({})
+    expect(countDenials.keys).toEqual(new Set(['posts']))
+  })
+
+  it('does not reject a `_count.select` key naming a synthetic back-relation (#1082)', async () => {
+    const config = {
+      db: { provider: 'sqlite' },
+      lists: {
+        Category: {
+          fields: { name: { type: 'text' } as FieldConfig },
+          access: { operation: { query: () => true } },
+        },
+        Post: {
+          fields: {
+            title: { type: 'text' } as FieldConfig,
+            // A list-only ref: no `Category` field names it back, so schema
+            // generation synthesizes `from_Post_category` on Category.
+            category: rel('Category'),
+          },
+          access: { operation: { query: () => true } },
+        },
+      },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+    } as any as OpenSaasConfig
+
+    const { include } = await buildAccessScopedInclude(
+      { _count: { select: { from_Post_category: true } } },
+      config.lists.Category.fields,
+      { session: null, context: makeContext() },
+      config,
+      'Category',
+    )
+
+    expect(include).toEqual({ _count: { select: { from_Post_category: true } } })
+  })
+
+  it('`_count: true` also expands to a synthetic back-relation, scoped (#1082/#1087)', async () => {
+    const config = {
+      db: { provider: 'sqlite' },
+      lists: {
+        Category: {
+          fields: { name: { type: 'text' } as FieldConfig },
+          access: { operation: { query: () => true } },
+        },
+        Post: {
+          fields: {
+            title: { type: 'text' } as FieldConfig,
+            category: rel('Category'),
+          },
+          // A row filter — proves the synthetic relation's count is scoped
+          // exactly like an explicitly-named one, not merely included.
+          access: { operation: { query: () => ({ published: { equals: true } }) } },
+        },
+      },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+    } as any as OpenSaasConfig
+
+    const { include } = await buildAccessScopedInclude(
+      { _count: true },
+      config.lists.Category.fields,
+      { session: null, context: makeContext() },
+      config,
+      'Category',
+    )
+
+    expect(include).toEqual({
+      _count: { select: { from_Post_category: { where: { published: { equals: true } } } } },
+    })
+  })
+
+  it('scopes a relation filter nested inside a caller-supplied count `where` (e.g. `_count.select.posts.where.comments.some`)', async () => {
+    const config = {
+      db: { provider: 'sqlite' },
+      lists: {
+        User: {
+          fields: { name: { type: 'text' } as FieldConfig, posts: rel('Post.author', true) },
+          access: { operation: { query: () => true } },
+        },
+        Post: {
+          fields: {
+            title: { type: 'text' } as FieldConfig,
+            author: rel('User.posts'),
+            comments: rel('Comment.post', true),
+          },
+          access: { operation: { query: () => true } },
+        },
+        Comment: {
+          fields: { body: { type: 'text' } as FieldConfig, post: rel('Post.comments') },
+          // A row filter one hop past the counted relation — must still be
+          // folded in, or the resulting post count would reveal whether
+          // inaccessible comments matching the caller's filter exist.
+          access: { operation: { query: () => ({ approved: { equals: true } }) } },
+        },
+      },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+    } as any as OpenSaasConfig
+
+    const { include } = await buildAccessScopedInclude(
+      {
+        _count: {
+          select: {
+            posts: { where: { comments: { some: { body: { contains: 'hi' } } } } },
+          },
+        },
+      },
+      config.lists.User.fields,
+      { session: null, context: makeContext() },
+      config,
+      'User',
+    )
+
+    expect(include).toEqual({
+      _count: {
+        select: {
+          posts: {
+            where: {
+              comments: {
+                some: {
+                  AND: [{ approved: { equals: true } }, { body: { contains: 'hi' } }],
+                },
+              },
+            },
+          },
+        },
+      },
+    })
+  })
+
+  it('resolves a synthetic back-relation named inside a caller-supplied count `where` (#1082/#1092)', async () => {
+    const config = {
+      db: { provider: 'sqlite' },
+      lists: {
+        User: {
+          fields: { name: { type: 'text' } as FieldConfig, posts: rel('Post.author', true) },
+          access: { operation: { query: () => true } },
+        },
+        Post: {
+          fields: {
+            title: { type: 'text' } as FieldConfig,
+            author: rel('User.posts'),
+            // A list-only ref: no `Post` field names it back, so schema
+            // generation synthesizes `from_Category_posts` on Post.
+            category: rel('Category'),
+          },
+          access: { operation: { query: () => true } },
+        },
+        Category: {
+          fields: {
+            name: { type: 'text' } as FieldConfig,
+            posts: rel('Post', true),
+          },
+          // A row filter one hop past the counted relation, reached only
+          // through the synthetic back-relation — must still be folded in.
+          access: { operation: { query: () => ({ published: { equals: true } }) } },
+        },
+      },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+    } as any as OpenSaasConfig
+
+    const { include } = await buildAccessScopedInclude(
+      {
+        _count: {
+          select: {
+            posts: { where: { from_Category_posts: { some: { name: { contains: 'news' } } } } },
+          },
+        },
+      },
+      config.lists.User.fields,
+      { session: null, context: makeContext() },
+      config,
+      'User',
+    )
+
+    expect(include).toEqual({
+      _count: {
+        select: {
+          posts: {
+            where: {
+              from_Category_posts: {
+                some: {
+                  AND: [{ published: { equals: true } }, { name: { contains: 'news' } }],
+                },
+              },
+            },
+          },
+        },
+      },
+    })
+  })
+
+  it('`_count: true` expands to every declared to-many relation, scoped', async () => {
+    const config = countConfig(() => true)
+
+    const { include, countDenials } = await buildAccessScopedInclude(
+      { _count: true },
+      config.lists.User.fields,
+      { session: null, context: makeContext() },
+      config,
+      'User',
+    )
+
+    expect(include).toEqual({ _count: { select: { posts: true } } })
+    expect(countDenials.keys).toEqual(new Set(['secrets']))
+  })
+
+  it('scopes `_count` nested inside an ordinary relation include, at that level', async () => {
+    const config = {
+      db: { provider: 'sqlite' },
+      lists: {
+        Org: {
+          fields: { name: { type: 'text' } as FieldConfig, users: rel('User.org', true) },
+          access: { operation: { query: () => true } },
+        },
+        User: {
+          fields: {
+            name: { type: 'text' } as FieldConfig,
+            org: rel('Org.users'),
+            posts: rel('Post.author', true),
+          },
+          access: { operation: { query: () => true } },
+        },
+        Post: {
+          fields: { title: { type: 'text' } as FieldConfig, author: rel('User.posts') },
+          access: { operation: { query: () => ({ published: { equals: true } }) } },
+        },
+      },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+    } as any as OpenSaasConfig
+
+    const { include } = await buildAccessScopedInclude(
+      { users: { include: { _count: { select: { posts: true } } } } },
+      config.lists.Org.fields,
+      { session: null, context: makeContext() },
+      config,
+      'Org',
+    )
+
+    expect(include).toEqual({
+      users: {
+        include: { _count: { select: { posts: { where: { published: { equals: true } } } } } },
+      },
+    })
+  })
+})
+
+/**
+ * Regression coverage for issue #974: Prisma accepts a nested `where` on an
+ * `include` entry only for a to-many relation — the same shape on a to-one
+ * relation raises `PrismaClientValidationError`. `buildAccessScopedInclude`
+ * must never attach one for a to-one relation, whatever its related list's
+ * `query` access resolves to; the scoping information goes into
+ * `toOneAccessFilters` instead.
+ */
+describe('buildAccessScopedInclude — to-one relations record a post-query filter, not `where` (issue #974)', () => {
+  function ownerConfig(queryAccess: unknown): OpenSaasConfig {
+    return {
+      db: { provider: 'sqlite' },
+      lists: {
+        Child: {
+          fields: { name: { type: 'text' } as FieldConfig, owner: rel('Owner') },
+          access: { operation: { query: () => true } },
+        },
+        Owner: {
+          fields: { name: { type: 'text' } as FieldConfig },
+          access: { operation: { query: queryAccess } },
+        },
+      },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+    } as any
+  }
+
+  it('records the access filter instead of attaching `where` when the related list scopes by a filter', async () => {
+    const config = ownerConfig(() => ({ id: { equals: 'u1' } }))
+
+    const { include, toOneAccessFilters } = await buildAccessScopedInclude(
+      { owner: true },
+      config.lists.Child.fields,
+      { session: null, context: makeContext() },
+      config,
+      'Child',
+    )
+
+    // The Prisma-bound include never carries a `where` on this to-one key —
+    // Prisma would reject it.
+    expect(include).toEqual({ owner: true })
+    expect(toOneAccessFilters).toEqual({
+      filters: {
+        owner: { kind: 'scoped', relatedListName: 'Owner', accessWhere: { id: { equals: 'u1' } } },
+      },
+      nested: {},
+    })
+  })
+
+  it('leaves a to-one relation whose related list is fully open untouched — no filter recorded, no extra query later', async () => {
+    const config = ownerConfig(() => true)
+
+    const { include, toOneAccessFilters } = await buildAccessScopedInclude(
+      { owner: true },
+      config.lists.Child.fields,
+      { session: null, context: makeContext() },
+      config,
+      'Child',
+    )
+
+    expect(include).toEqual({ owner: true })
+    expect(toOneAccessFilters).toEqual({ filters: {}, nested: {} })
+  })
+
+  it('drops a to-one relation whose related list denies query access outright, and records the denial', async () => {
+    const config = ownerConfig(() => false)
+
+    const { include, toOneAccessFilters } = await buildAccessScopedInclude(
+      { owner: true },
+      config.lists.Child.fields,
+      { session: null, context: makeContext() },
+      config,
+      'Child',
+    )
+
+    // Never asked of Prisma at all — same as before this fix.
+    expect(include).toEqual({})
+    expect(toOneAccessFilters).toEqual({ filters: { owner: { kind: 'denied' } }, nested: {} })
+  })
+
+  it('records a to-one filter nested inside another relation the caller explicitly included', async () => {
+    const config: OpenSaasConfig = {
+      db: { provider: 'sqlite' },
+      lists: {
+        GrandChild: {
+          fields: { name: { type: 'text' } as FieldConfig, child: rel('Child') },
+          access: { operation: { query: () => true } },
+        },
+        Child: {
+          fields: { name: { type: 'text' } as FieldConfig, owner: rel('Owner') },
+          access: { operation: { query: () => true } },
+        },
+        Owner: {
+          fields: { name: { type: 'text' } as FieldConfig },
+          access: { operation: { query: () => ({ id: { equals: 'u1' } }) } },
+        },
+      },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+    } as any
+
+    const { include, toOneAccessFilters } = await buildAccessScopedInclude(
+      { child: { include: { owner: true } } },
+      config.lists.GrandChild.fields,
+      { session: null, context: makeContext() },
+      config,
+      'GrandChild',
+    )
+
+    expect(include).toEqual({ child: { include: { owner: true } } })
+    expect(toOneAccessFilters).toEqual({
+      filters: {},
+      nested: {
+        child: {
+          filters: {
+            owner: {
+              kind: 'scoped',
+              relatedListName: 'Owner',
+              accessWhere: { id: { equals: 'u1' } },
+            },
+          },
+          nested: {},
+        },
+      },
+    })
+  })
+})
+
+/**
+ * Regression coverage for issue #1103: a denied to-MANY relation used to be
+ * dropped from `include` with nothing recorded, unlike its to-one sibling
+ * (issue #974, covered above). `filterReadableFields`'s main loop only ever
+ * visits keys present in the raw row, so an unrecorded denial left the key
+ * silently absent from the result — `undefined`, not `[]` — breaking the
+ * fragment API's typed contract (`ResultOf` types a to-many relation as an
+ * array). These tests pin that a to-many denial is now recorded exactly like
+ * a to-one one, sharing the same `toOneAccessFilters` tree and `kind:
+ * 'denied'` entry.
+ */
+describe('buildAccessScopedInclude — to-many relations record a denial too, like to-one (issue #1103)', () => {
+  function secretsConfig(): OpenSaasConfig {
+    return {
+      db: { provider: 'sqlite' },
+      lists: {
+        Author: {
+          fields: { name: { type: 'text' } as FieldConfig, secrets: rel('Secret.author', true) },
+          access: { operation: { query: () => true } },
+        },
+        Secret: {
+          fields: { value: { type: 'text' } as FieldConfig },
+          access: { operation: { query: () => false } },
+        },
+      },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+    } as any
+  }
+
+  it('drops a to-many relation whose related list denies query access outright, and records the denial', async () => {
+    const config = secretsConfig()
+
+    const { include, toOneAccessFilters } = await buildAccessScopedInclude(
+      { secrets: true },
+      config.lists.Author.fields,
+      { session: null, context: makeContext() },
+      config,
+      'Author',
+    )
+
+    // Never asked of Prisma at all — same treatment as a denied to-one.
+    expect(include).toEqual({})
+    expect(toOneAccessFilters).toEqual({ filters: { secrets: { kind: 'denied' } }, nested: {} })
+  })
+
+  it('records the denial even when the caller also asked for a `take`/`where` — a denied relation has no shape to preserve', async () => {
+    const config = secretsConfig()
+
+    const { include, toOneAccessFilters } = await buildAccessScopedInclude(
+      { secrets: { take: 5, where: { value: { equals: 'x' } } } },
+      config.lists.Author.fields,
+      { session: null, context: makeContext() },
+      config,
+      'Author',
+    )
+
+    expect(include).toEqual({})
+    expect(toOneAccessFilters).toEqual({ filters: { secrets: { kind: 'denied' } }, nested: {} })
+  })
+
+  // Code-review finding on #1103's own PR: a caller's `Include` type allows a
+  // bare `boolean` for a relation, so `{ secrets: false }` (or a conditional
+  // `{ secrets: cond ? true : undefined }` that resolved to `undefined`)
+  // explicitly opts the relation OUT — no different from the key being
+  // absent altogether. Before this guard, the loop evaluated (and, once
+  // denied, recorded) the key regardless of its value, so a denied relation
+  // the caller explicitly disabled still ended up forced to `[]` downstream
+  // by `field-visibility.ts` — surfacing a value for a key nobody asked for.
+  it('treats an explicit `false` include value as not requested, even when the related list denies query access', async () => {
+    const config = secretsConfig()
+
+    const { include, toOneAccessFilters } = await buildAccessScopedInclude(
+      { secrets: false },
+      config.lists.Author.fields,
+      { session: null, context: makeContext() },
+      config,
+      'Author',
+    )
+
+    expect(include).toEqual({})
+    expect(toOneAccessFilters).toEqual({ filters: {}, nested: {} })
+  })
+
+  it('treats an explicit `undefined` include value as not requested, even when the related list denies query access', async () => {
+    const config = secretsConfig()
+
+    const { include, toOneAccessFilters } = await buildAccessScopedInclude(
+      { secrets: undefined },
+      config.lists.Author.fields,
+      { session: null, context: makeContext() },
+      config,
+      'Author',
+    )
+
+    expect(include).toEqual({})
+    expect(toOneAccessFilters).toEqual({ filters: {}, nested: {} })
+  })
+
+  it('treats an explicit `false` include value as not requested even when the related list is fully open — never flips it to `true`', async () => {
+    const config = secretsConfig()
+    config.lists.Secret.access = { operation: { query: () => true } }
+
+    const { include, toOneAccessFilters } = await buildAccessScopedInclude(
+      { secrets: false },
+      config.lists.Author.fields,
+      { session: null, context: makeContext() },
+      config,
+      'Author',
+    )
+
+    expect(include).toEqual({})
+    expect(toOneAccessFilters).toEqual({ filters: {}, nested: {} })
+  })
+})
+
+describe('resolveToOneAccessVisibility (issue #974)', () => {
+  function makeVisibilityContext(findMany: ReturnType<typeof vi.fn>): AccessContext {
+    return {
+      session: null,
+      _isSudo: false,
+      _resolveOutputChain: [],
+      prisma: { owner: { findMany } },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal context for unit test
+    } as any
+  }
+
+  it('passes a denied filter straight through with no query', async () => {
+    const findMany = vi.fn()
+    const context = makeVisibilityContext(findMany)
+
+    const resolved = await resolveToOneAccessVisibility(
+      [{ id: 'c1' }],
+      { filters: { owner: { kind: 'denied' } }, nested: {} },
+      { session: null, context },
+    )
+
+    expect(resolved).toEqual({ filters: { owner: { kind: 'denied' } }, nested: {} })
+    expect(findMany).not.toHaveBeenCalled()
+  })
+
+  it('skips the query when no row carries a value at the scoped key', async () => {
+    const findMany = vi.fn()
+    const context = makeVisibilityContext(findMany)
+    const tree = {
+      filters: {
+        owner: {
+          kind: 'scoped' as const,
+          relatedListName: 'Owner',
+          accessWhere: { id: { equals: 'u1' } },
+        },
+      },
+      nested: {},
+    }
+
+    const resolved = await resolveToOneAccessVisibility([{ id: 'c1', owner: null }], tree, {
+      session: null,
+      context,
+    })
+
+    expect(resolved).toEqual({
+      filters: { owner: { kind: 'visible', ids: new Set() } },
+      nested: {},
+    })
+    expect(findMany).not.toHaveBeenCalled()
+  })
+
+  it('batches every row into ONE existence check, through the raw Prisma client, using the exact access filter', async () => {
+    const findMany = vi.fn().mockResolvedValue([{ id: 'u1' }, { id: 'u2' }])
+    const context = makeVisibilityContext(findMany)
+    const tree = {
+      filters: {
+        owner: {
+          kind: 'scoped' as const,
+          relatedListName: 'Owner',
+          accessWhere: { studioId: { equals: 's1' } },
+        },
+      },
+      nested: {},
+    }
+    const items = [
+      { id: 'c1', owner: { id: 'u1' } },
+      { id: 'c2', owner: { id: 'u2' } },
+      { id: 'c3', owner: { id: 'u3' } }, // excluded by the mocked response below
+      { id: 'c4', owner: null }, // contributes no id
+    ]
+
+    const resolved = await resolveToOneAccessVisibility(items, tree, { session: null, context })
+
+    // One call, not one per row.
+    expect(findMany).toHaveBeenCalledTimes(1)
+    expect(findMany).toHaveBeenCalledWith({
+      where: { AND: [{ studioId: { equals: 's1' } }, { id: { in: ['u1', 'u2', 'u3'] } }] },
+      select: { id: true },
+    })
+    expect(resolved.filters.owner).toEqual({ kind: 'visible', ids: new Set(['u1', 'u2']) })
+  })
+
+  it('recurses into nested trees, flattening rows reached through a to-many hop into one batch', async () => {
+    const ownerFindMany = vi.fn().mockResolvedValue([{ id: 'u1' }])
+    const context: AccessContext = {
+      session: null,
+      _isSudo: false,
+      _resolveOutputChain: [],
+      prisma: { owner: { findMany: ownerFindMany } },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal context for unit test
+    } as any
+    const tree = {
+      filters: {},
+      nested: {
+        children: {
+          filters: {
+            owner: {
+              kind: 'scoped' as const,
+              relatedListName: 'Owner',
+              accessWhere: { id: { equals: 'u1' } },
+            },
+          },
+          nested: {},
+        },
+      },
+    }
+    const items = [
+      {
+        id: 'p1',
+        children: [
+          { id: 'c1', owner: { id: 'u1' } },
+          { id: 'c2', owner: { id: 'u9' } },
+        ],
+      },
+      { id: 'p2', children: [{ id: 'c3', owner: { id: 'u1' } }] },
+    ]
+
+    const resolved = await resolveToOneAccessVisibility(items, tree, { session: null, context })
+
+    // Every child across BOTH parents resolved in one batched call.
+    expect(ownerFindMany).toHaveBeenCalledTimes(1)
+    expect(ownerFindMany).toHaveBeenCalledWith({
+      where: { AND: [{ id: { equals: 'u1' } }, { id: { in: ['u1', 'u9'] } }] },
+      select: { id: true },
+    })
+    expect(resolved.nested.children.filters.owner).toEqual({
+      kind: 'visible',
+      ids: new Set(['u1']),
+    })
+  })
+})
+
+/**
+ * Regression coverage for issue #1082: a list-only `ref` (`ref: 'Term'`, no
+ * target field) makes schema generation synthesize a back-relation on `Term`
+ * (`from_Bill_term`) that no list config declares. Before this fix,
+ * `buildAccessScopedInclude` treated any key it couldn't resolve to a
+ * DECLARED relationship as "not governed by access control" and passed it
+ * through unchanged — so a caller naming `from_Bill_term` in `include`
+ * bypassed `Bill`'s own `query` access entirely. These tests pin the fix: a
+ * synthetic key is scoped exactly like the declared relationship field it
+ * stands for.
+ */
+describe('buildAccessScopedInclude — synthetic back-relation (#1082)', () => {
+  // Term ← Bill.term (list-only ref) ← Bill.lineItems (declared, to-many).
+  // `from_Bill_term` is the back-relation schema generation synthesizes on
+  // Term; nothing in `Term.fields` declares it.
+  function syntheticConfig(billQuery: () => boolean | Record<string, unknown>) {
+    const config = {
+      db: { provider: 'sqlite' },
+      lists: {
+        Term: {
+          fields: { name: { type: 'text' } as FieldConfig },
+          access: { operation: { query: () => true } },
+        },
+        Bill: {
+          fields: {
+            amount: { type: 'integer' } as FieldConfig,
+            term: rel('Term'), // list-only ref — synthesizes `from_Bill_term` on Term
+            lineItems: rel('LineItem.bill', true),
+          },
+          access: { operation: { query: billQuery } },
+        },
+        LineItem: {
+          fields: { sku: { type: 'text' } as FieldConfig, bill: rel('Bill.lineItems') },
+          access: { operation: { query: () => true } },
+        },
+      },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+    } as any as OpenSaasConfig
+    return config
+  }
+
+  it('drops the relation entirely when the owning list denies query access', async () => {
+    const config = syntheticConfig(() => false)
+
+    const { include } = await buildAccessScopedInclude(
+      { from_Bill_term: true },
+      config.lists.Term.fields,
+      { session: null, context: makeContext() },
+      config,
+      'Term',
+    )
+
+    expect(include).toEqual({})
+  })
+
+  it('AND-folds the owning list access filter with the caller-supplied where', async () => {
+    const config = syntheticConfig(() => ({ paid: { equals: true } }))
+
+    const { include } = await buildAccessScopedInclude(
+      { from_Bill_term: { where: { amount: { gt: 10 } } } },
+      config.lists.Term.fields,
+      { session: null, context: makeContext() },
+      config,
+      'Term',
+    )
+
+    expect(include).toEqual({
+      from_Bill_term: {
+        where: { AND: [{ paid: { equals: true } }, { amount: { gt: 10 } }] },
+      },
+    })
+  })
+
+  it('scopes a nested include against the OWNING list fields and consumes depth', async () => {
+    const config = syntheticConfig(() => true)
+    const lineItemQuery = vi.fn(() => true)
+    config.lists.LineItem.access = { operation: { query: lineItemQuery } }
+
+    const { include } = await buildAccessScopedInclude(
+      { from_Bill_term: { include: { lineItems: true } } },
+      config.lists.Term.fields,
+      { session: null, context: makeContext() },
+      config,
+      'Term',
+    )
+
+    // The nested `lineItems` key was resolved against Bill's own fields (not
+    // Term's, which has no `lineItems` field at all) — proof the recursion
+    // used the owning list, not the synthetic key's declaring list.
+    expect(lineItemQuery).toHaveBeenCalledTimes(1)
+    expect(include).toEqual({ from_Bill_term: { include: { lineItems: true } } })
+  })
+
+  it('a synthetic hop counts toward the read-include depth cap the same as a declared one', async () => {
+    // A chain like `chainConfig` builds (L0 ↔ L1 ↔ … via declared `next`/`prev`),
+    // except the FIRST hop is synthetic: L1's `prev` is a list-only ref, so L0
+    // never declares `next` at all — it only gets `from_L1_prev` synthesized
+    // onto it. Every hop past that first one is declared, exactly matching the
+    // mixed synthetic-then-declared case the depth cap must bound identically.
+    const chainLength = READ_INCLUDE_MAX_DEPTH + 2
+    const { config } = chainConfig(chainLength)
+    delete (config.lists.L0.fields as Record<string, unknown>).next
+    ;(config.lists.L1.fields as Record<string, FieldConfig>).prev = rel('L0')
+
+    // Outer `from_L1_prev` (hop 1) + nestedInclude(HOPS_AT_CAP) (HOPS_AT_CAP
+    // more, via the declared `next` chain from L1 onward) = HOPS_AT_CAP + 1.
+    const requested = { from_L1_prev: nestedInclude(READ_INCLUDE_MAX_DEPTH) }
+
+    await expect(
+      buildAccessScopedInclude(
+        requested,
+        config.lists.L0.fields,
+        { session: null, context: makeContext() },
+        config,
+        'L0',
+      ),
+    ).rejects.toThrow(AccessScopeDepthExceededError)
+  })
+
+  it('still resolves a synthetic hop one level shallower than the cap', async () => {
+    const chainLength = READ_INCLUDE_MAX_DEPTH + 1
+    const { config } = chainConfig(chainLength)
+    delete (config.lists.L0.fields as Record<string, unknown>).next
+    ;(config.lists.L1.fields as Record<string, FieldConfig>).prev = rel('L0')
+
+    const requested = { from_L1_prev: nestedInclude(READ_INCLUDE_MAX_DEPTH - 1) }
+
+    const { include } = await buildAccessScopedInclude(
+      requested,
+      config.lists.L0.fields,
+      { session: null, context: makeContext() },
+      config,
+      'L0',
+    )
+
+    expect(includeDepth(include)).toBe(READ_INCLUDE_MAX_DEPTH)
+  })
+
+  it('rejects a key that resolves to neither a declared relationship nor a synthetic one', async () => {
+    const config = syntheticConfig(() => true)
+
+    await expect(
+      buildAccessScopedInclude(
+        { from_Nonexistent_field: true },
+        config.lists.Term.fields,
+        { session: null, context: makeContext() },
+        config,
+        'Term',
+      ),
+    ).rejects.toThrow(UndeclaredIncludeKeyError)
+  })
+})
+
+/**
+ * Regression coverage for issue #1092: a `where`/`orderBy` a caller nests
+ * inside an `include` entry reached Prisma with neither #912's key-existence
+ * check nor #915's field-read check — a probing oracle over exactly the
+ * fields those two tickets close one level up. `secret`/`secretNote` below
+ * deny field-level `read` outright; every other field is a normal declared
+ * field, so a throw in these tests can only come from the new validation.
+ */
+describe('buildAccessScopedInclude — nested where/orderBy validation (#1092)', () => {
+  function blogConfig(): OpenSaasConfig {
+    return {
+      db: { provider: 'sqlite' },
+      lists: {
+        Author: {
+          fields: {
+            name: { type: 'text' } as FieldConfig,
+            posts: rel('Post.author', true),
+          },
+          access: { operation: { query: () => true } },
+        },
+        Post: {
+          fields: {
+            title: { type: 'text' } as FieldConfig,
+            secret: { type: 'text', access: { read: () => false } } as unknown as FieldConfig,
+            author: rel('Author.posts'),
+            comments: rel('Comment.post', true),
+          },
+          access: { operation: { query: () => true } },
+        },
+        Comment: {
+          fields: {
+            body: { type: 'text' } as FieldConfig,
+            secretNote: { type: 'text', access: { read: () => false } } as unknown as FieldConfig,
+            post: rel('Post.comments'),
+          },
+          access: { operation: { query: () => true } },
+        },
+      },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+    } as any as OpenSaasConfig
+  }
+
+  it('throws when a nested `where` names a field the session cannot read', async () => {
+    const config = blogConfig()
+
+    await expect(
+      buildAccessScopedInclude(
+        { posts: { where: { secret: { equals: 'x' } } } },
+        config.lists.Author.fields,
+        { session: null, context: makeContext() },
+        config,
+        'Author',
+      ),
+    ).rejects.toThrow(ValidationError)
+    await expect(
+      buildAccessScopedInclude(
+        { posts: { where: { secret: { equals: 'x' } } } },
+        config.lists.Author.fields,
+        { session: null, context: makeContext() },
+        config,
+        'Author',
+      ),
+    ).rejects.toThrow(/"secret" is denied by field-level read access/)
+  })
+
+  it('throws when a nested `where` names a key the related list does not declare, naming the related list and key', async () => {
+    const config = blogConfig()
+
+    await expect(
+      buildAccessScopedInclude(
+        { posts: { where: { bogusField: { equals: 'x' } } } },
+        config.lists.Author.fields,
+        { session: null, context: makeContext() },
+        config,
+        'Author',
+      ),
+    ).rejects.toThrow(/Cannot query "Post" — "bogusField" is not a field of this list/)
+  })
+
+  it('applies the same two checks to a nested `orderBy`', async () => {
+    const config = blogConfig()
+
+    await expect(
+      buildAccessScopedInclude(
+        { posts: { orderBy: { secret: 'asc' } } },
+        config.lists.Author.fields,
+        { session: null, context: makeContext() },
+        config,
+        'Author',
+      ),
+    ).rejects.toThrow(ValidationError)
+
+    await expect(
+      buildAccessScopedInclude(
+        { posts: { orderBy: { bogusField: 'asc' } } },
+        config.lists.Author.fields,
+        { session: null, context: makeContext() },
+        config,
+        'Author',
+      ),
+    ).rejects.toThrow(/Cannot query "Post"/)
+  })
+
+  it('resolves against the RELATED list, not the current one — a key valid on the parent but not the related list is rejected', async () => {
+    const config = blogConfig()
+
+    // `name` is declared on Author, not on Post — validating against the
+    // wrong list would let this through.
+    await expect(
+      buildAccessScopedInclude(
+        { posts: { where: { name: { equals: 'x' } } } },
+        config.lists.Author.fields,
+        { session: null, context: makeContext() },
+        config,
+        'Author',
+      ),
+    ).rejects.toThrow(/Cannot query "Post" — "name"/)
+  })
+
+  it('recurses through AND/OR/NOT', async () => {
+    const config = blogConfig()
+
+    await expect(
+      buildAccessScopedInclude(
+        {
+          posts: {
+            where: { AND: [{ title: { contains: 'x' } }, { OR: [{ secret: { equals: 'x' } }] }] },
+          },
+        },
+        config.lists.Author.fields,
+        { session: null, context: makeContext() },
+        config,
+        'Author',
+      ),
+    ).rejects.toThrow(ValidationError)
+  })
+
+  it("the key-existence check recurses through a relation quantifier nested inside the entry's own where", async () => {
+    // #912's existence check (`validateQueryKeys`) is the reused #912/#915
+    // top-level walker, which already recurses through a relation quantifier
+    // regardless of caller position — an undeclared key nested that deep
+    // still rejects, naming the list it actually resolved against (Comment,
+    // not Post).
+    const config = blogConfig()
+
+    await expect(
+      buildAccessScopedInclude(
+        { posts: { where: { comments: { some: { bogusField: { equals: 'x' } } } } } },
+        config.lists.Author.fields,
+        { session: null, context: makeContext() },
+        config,
+        'Author',
+      ),
+    ).rejects.toThrow(/Cannot query "Comment" — "bogusField"/)
+  })
+
+  it("scopes a relation quantifier nested inside the entry's own where against the DEEPER related list — a read-denied field one hop further out still throws (#916)", async () => {
+    // Without this, #1092's fix would only move the oracle one hop further
+    // out instead of closing it: `posts: { where: { comments: { some: {...} } } }`
+    // names Comment, a list the entry's own #912/#915 checks never reach —
+    // only `buildAccessScopedWhere` (#916), reused here, does.
+    const config = blogConfig()
+
+    await expect(
+      buildAccessScopedInclude(
+        { posts: { where: { comments: { some: { secretNote: { equals: 'x' } } } } } },
+        config.lists.Author.fields,
+        { session: null, context: makeContext() },
+        config,
+        'Author',
+      ),
+    ).rejects.toThrow(/Cannot query "Comment" — "secretNote"/)
+  })
+
+  it("folds the deeper related list's own query access into a relation quantifier nested inside the entry's own where", async () => {
+    const config = blogConfig()
+    config.lists.Comment.access = {
+      operation: { query: () => ({ approved: { equals: true } }) },
+    }
+
+    const { include } = await buildAccessScopedInclude(
+      { posts: { where: { comments: { some: { body: { contains: 'hi' } } } } } },
+      config.lists.Author.fields,
+      { session: null, context: makeContext() },
+      config,
+      'Author',
+    )
+
+    expect(include).toEqual({
+      posts: {
+        where: {
+          comments: {
+            some: { AND: [{ approved: { equals: true } }, { body: { contains: 'hi' } }] },
+          },
+        },
+      },
+    })
+  })
+
+  it("throws when the deeper related list denies query access outright, matching #916's loud failure", async () => {
+    const config = blogConfig()
+    config.lists.Comment.access = { operation: { query: () => false } }
+
+    await expect(
+      buildAccessScopedInclude(
+        { posts: { where: { comments: { some: { body: { contains: 'hi' } } } } } },
+        config.lists.Author.fields,
+        { session: null, context: makeContext() },
+        config,
+        'Author',
+      ),
+    ).rejects.toThrow(RelationFilterAccessDeniedError)
+  })
+
+  it('recurses through a further nested include, at every level the walk reaches', async () => {
+    const config = blogConfig()
+
+    await expect(
+      buildAccessScopedInclude(
+        { posts: { include: { comments: { where: { secretNote: { equals: 'x' } } } } } },
+        config.lists.Author.fields,
+        { session: null, context: makeContext() },
+        config,
+        'Author',
+      ),
+    ).rejects.toThrow(/Cannot query "Comment" — "secretNote"/)
+  })
+
+  it('accepts a foreign-key scalar a to-one relationship implies, matching the top-level resolver', async () => {
+    const config = blogConfig()
+
+    await expect(
+      buildAccessScopedInclude(
+        { posts: { where: { authorId: { equals: 'a1' } } } },
+        config.lists.Author.fields,
+        { session: null, context: makeContext() },
+        config,
+        'Author',
+      ),
+    ).resolves.not.toThrow()
+  })
+
+  it('leaves a legitimate nested where over readable, declared fields unchanged, still AND-combined with the access filter', async () => {
+    const config = blogConfig()
+    config.lists.Post.access = { operation: { query: () => ({ published: { equals: true } }) } }
+
+    const { include } = await buildAccessScopedInclude(
+      { posts: { where: { title: { contains: 'hello' } } } },
+      config.lists.Author.fields,
+      { session: null, context: makeContext() },
+      config,
+      'Author',
+    )
+
+    expect(include).toEqual({
+      posts: {
+        where: { AND: [{ published: { equals: true } }, { title: { contains: 'hello' } }] },
+      },
+    })
+  })
+
+  it('equivalence: the same read-denied predicate throws whether it names the current list, a relation quantifier, or an include-nested where', async () => {
+    // Mirrors the triage comment's three-position table for #1092 — the
+    // include-nested position (the one gap) now matches the other two.
+    const config = blogConfig()
+
+    await expect(
+      buildAccessScopedInclude(
+        { posts: { where: { secret: { equals: 'x' } } } },
+        config.lists.Author.fields,
+        { session: null, context: makeContext() },
+        config,
+        'Author',
+      ),
+    ).rejects.toThrow(ValidationError)
+  })
+
+  describe('synthetic back-relation nested in a where (#1082 interaction)', () => {
+    function syntheticNestedConfig(): OpenSaasConfig {
+      const config = {
+        db: { provider: 'sqlite' },
+        lists: {
+          Company: {
+            fields: {
+              name: { type: 'text' } as FieldConfig,
+              terms: rel('Term', true),
+            },
+            access: { operation: { query: () => true } },
+          },
+          Term: {
+            fields: { name: { type: 'text' } as FieldConfig },
+            access: { operation: { query: () => true } },
+          },
+          Bill: {
+            fields: {
+              amount: { type: 'integer' } as FieldConfig,
+              term: rel('Term'), // list-only ref — synthesizes `from_Bill_term` on Term
+            },
+            access: { operation: { query: () => true } },
+          },
+        },
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+      } as any as OpenSaasConfig
+      return config
+    }
+
+    it('does not throw for a nested predicate naming a synthetic back-relation', async () => {
+      const config = syntheticNestedConfig()
+
+      await expect(
+        buildAccessScopedInclude(
+          { terms: { where: { from_Bill_term: { some: { amount: { gt: 5 } } } } } },
+          config.lists.Company.fields,
+          { session: null, context: makeContext() },
+          config,
+          'Company',
+        ),
+      ).resolves.not.toThrow()
+    })
+
+    it("recurses into the synthetic's own SOURCE list — an invalid key nested under it still throws, naming that list", async () => {
+      const config = syntheticNestedConfig()
+
+      await expect(
+        buildAccessScopedInclude(
+          { terms: { where: { from_Bill_term: { some: { bogusField: { equals: 'x' } } } } } },
+          config.lists.Company.fields,
+          { session: null, context: makeContext() },
+          config,
+          'Company',
+        ),
+      ).rejects.toThrow(/Cannot query "Bill" — "bogusField"/)
+    })
+
+    it("folds the synthetic's own SOURCE list's query access into the nested quantifier clause", async () => {
+      // Regression coverage for a Codex review finding on #1108: the deeper
+      // #916-style scoping originally only recognised a DECLARED
+      // relationship — a synthetic key's nested quantifier passed through
+      // with neither the source list's `query` access folded in nor its
+      // fields' read access checked, even though the shallow #912/#915
+      // checks (validateQueryKeys/validateQueryFieldReadAccess) already
+      // correctly tolerated and resolved the synthetic key itself.
+      const config = syntheticNestedConfig()
+      config.lists.Bill.access = { operation: { query: () => ({ paid: { equals: true } }) } }
+
+      const { include } = await buildAccessScopedInclude(
+        { terms: { where: { from_Bill_term: { some: { amount: { gt: 5 } } } } } },
+        config.lists.Company.fields,
+        { session: null, context: makeContext() },
+        config,
+        'Company',
+      )
+
+      expect(include).toEqual({
+        terms: {
+          where: {
+            from_Bill_term: {
+              some: { AND: [{ paid: { equals: true } }, { amount: { gt: 5 } }] },
+            },
+          },
+        },
+      })
+    })
+
+    it('throws when a field nested under a synthetic quantifier is denied by field-level read access', async () => {
+      const config = syntheticNestedConfig()
+      ;(config.lists.Bill.fields as Record<string, FieldConfig>).secretAmount = {
+        type: 'integer',
+        access: { read: () => false },
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal field config for unit test
+      } as any as FieldConfig
+
+      await expect(
+        buildAccessScopedInclude(
+          { terms: { where: { from_Bill_term: { some: { secretAmount: { gt: 5 } } } } } },
+          config.lists.Company.fields,
+          { session: null, context: makeContext() },
+          config,
+          'Company',
+        ),
+      ).rejects.toThrow(/"secretAmount" is denied by field-level read access/)
+    })
+
+    it("throws when the synthetic's own SOURCE list denies query access outright, matching #916's loud failure", async () => {
+      const config = syntheticNestedConfig()
+      config.lists.Bill.access = { operation: { query: () => false } }
+
+      await expect(
+        buildAccessScopedInclude(
+          { terms: { where: { from_Bill_term: { some: { amount: { gt: 5 } } } } } },
+          config.lists.Company.fields,
+          { session: null, context: makeContext() },
+          config,
+          'Company',
+        ),
+      ).rejects.toThrow(RelationFilterAccessDeniedError)
+    })
+  })
+
+  describe("a to-one relation's `is: null`/`isNot: null` inside a nested quantifier (Codex review finding on #1108)", () => {
+    // Root -> Parent (to-many, unscoped) -> Owner (to-one, query-scoped by a
+    // filter). Parent's own access is `true` (no filter), so the outer
+    // AND-fold is a no-op and cannot mask what this test is isolating: the
+    // fold that happens INSIDE the quantifier's own value.
+    function nullQuantifierConfig(): OpenSaasConfig {
+      return {
+        db: { provider: 'sqlite' },
+        lists: {
+          Root: {
+            fields: { name: { type: 'text' } as FieldConfig, parent: rel('Parent', true) },
+            access: { operation: { query: () => true } },
+          },
+          Parent: {
+            fields: { name: { type: 'text' } as FieldConfig, owner: rel('Owner') },
+            access: { operation: { query: () => true } },
+          },
+          Owner: {
+            fields: { name: { type: 'text' } as FieldConfig },
+            access: { operation: { query: () => ({ secret: { equals: true } }) } },
+          },
+        },
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+      } as any as OpenSaasConfig
+    }
+
+    it('preserves `is: null` rather than inverting it into an access-filter match', async () => {
+      // Before this fix, folding the access filter into a quantifier's
+      // value unconditionally turned `is: null` ("has no related row") into
+      // `is: <accessWhere>` ("has a related row matching the filter") —
+      // the opposite of the caller's own predicate.
+      const config = nullQuantifierConfig()
+
+      const { include } = await buildAccessScopedInclude(
+        { parent: { where: { owner: { is: null } } } },
+        config.lists.Root.fields,
+        { session: null, context: makeContext() },
+        config,
+        'Root',
+      )
+
+      expect(include).toEqual({ parent: { where: { owner: { is: null } } } })
+    })
+
+    it('preserves `isNot: null` the same way', async () => {
+      const config = nullQuantifierConfig()
+
+      const { include } = await buildAccessScopedInclude(
+        { parent: { where: { owner: { isNot: null } } } },
+        config.lists.Root.fields,
+        { session: null, context: makeContext() },
+        config,
+        'Root',
+      )
+
+      expect(include).toEqual({ parent: { where: { owner: { isNot: null } } } })
+    })
   })
 })