@opensaas/stack-core 0.39.2 → 0.41.0

package/src/access/field-visibility.ts

@@ -1,12 +1,18 @@
 import type { Session, AccessContext } from './types.js'
-import type { OpenSaasConfig, FieldConfig } from '../config/types.js'
-import { getRelatedListConfig } from './engine.js'
+import type { OpenSaasConfig, FieldConfig, ListConfig } from '../config/types.js'
+import { getRelatedListConfig, resolveSyntheticReverseRelation } from './engine.js'
 import { checkFieldAccess } from './field-access.js'
 import { RESOLVE_CHAIN_MAX_LENGTH } from './depth-limits.js'
 import { ResolveOutputCycleError } from './errors.js'
 import type { DeclaredOnlyTree } from './declared-dependencies.js'
 import { emptyDeclaredOnlyTree } from './declared-dependencies.js'
 import type { FieldSelectionScope } from '../query/index.js'
+import type { ToOneAccessVisibilityTree, CountAccessDenialTree } from './access-filter.js'
+import {
+  emptyToOneAccessVisibilityTree,
+  isToOneRelationship,
+  emptyCountAccessDenialTree,
+} from './access-filter.js'
 // NOTE: `context/index.ts` imports `filterReadableFields` from this module
 // (via the `access/index.ts` barrel) — this is an intentional cyclic
 // dependency, the same shape and for the same reason as the one documented in
@@ -36,6 +42,42 @@ import { buildDbDelegate } from '../context/index.js'
  * Phase 1 (pre-query row/relation scoping) lives in `access-filter.ts`. See
  * `docs/adr/0001-access-control-is-a-two-phase-read.md` and the access-control
  * glossary in `CONTEXT.md`.
+ *
+ * **To-one relation nulling (issue #974).** A to-one relation whose related
+ * list's `query` access resolves to a filter cannot be scoped by Prisma's own
+ * `where` (it only accepts one on a to-many include — see the "To-one
+ * relations" section of `access-filter.ts`'s module doc), so
+ * `buildAccessScopedInclude` fetches it unscoped and hands this module a
+ * `ToOneAccessVisibilityTree` — already resolved, via one batched existence
+ * check per relation across the whole read, by
+ * `resolveToOneAccessVisibility`. This module is where that resolution
+ * actually becomes the caller-visible `null`: a `kind: 'denied'` key is
+ * forced to `null` even though it was never fetched at all (the key is
+ * absent from `workingItem`), and a `kind: 'visible'` key's fetched row is
+ * nulled out unless its id survived the existence check — in both branches,
+ * before any field-level access check or `resolveOutput` hook runs, so the
+ * rest of the pipeline sees exactly what a denied to-one read has always
+ * meant elsewhere: `null`, never a thrown error.
+ *
+ * **A denied to-many relation is forced to `[]`, the same way (issue
+ * #1103).** `buildAccessScopedInclude` drops a to-many relation from
+ * `include` on the same outright `query` denial as a to-one one, and records
+ * the same `kind: 'denied'` entry for it. The key is therefore just as absent
+ * from `workingItem` as a denied to-one key, and the fix is the same fixup
+ * loop — it now forces the key present using the field's own declared
+ * arity: `null` for a to-one relation (unchanged), `[]` for a to-many one,
+ * rather than leaving a to-many key silently missing where the fragment
+ * API's `ResultOf` type (`query/index.ts`) promises an array.
+ *
+ * **`_count` denial injection (issue #1087).** A caller-supplied `_count.select`
+ * key whose related list denies `query` access outright is omitted from the
+ * select `buildAccessScopedInclude` sends to Prisma — there is no way to ask
+ * Prisma for a guaranteed `0`, and no query is needed to know one (unlike the
+ * to-one existence check above). This module is where that becomes the
+ * caller-visible `0`: every key in a `CountAccessDenialTree` at this level is
+ * written into `filtered._count` as `0`, whether or not `_count` came back
+ * from the database at all — a count is a session-relative value, and `0` is
+ * what "no visible rows" means for it, never an absent key.
  */
 
 type ResolveOutputHookRuntime = (args: {
@@ -193,6 +235,15 @@ export async function filterReadableFields<T extends Record<string, unknown>>(
   // The fragment scope this level was reached under (ADR-0027, see module doc
   // above), and the same tree one level down for each nested relation.
   selection?: FieldSelectionScope,
+  // Resolved to-one existence checks at THIS level (issue #974, see module
+  // doc above), and the same tree one level down for each nested relation —
+  // regardless of that relation's own arity, since a filtered to-one can sit
+  // beneath a to-many hop.
+  toOneVisibility: ToOneAccessVisibilityTree = emptyToOneAccessVisibilityTree(),
+  // `_count.select` keys denied outright at THIS level (issue #1087, see
+  // module doc above), and the same tree one level down for each nested
+  // relation whose own nested include named a further `_count`.
+  countDenials: CountAccessDenialTree = emptyCountAccessDenialTree(),
 ): Promise<Partial<T>> {
   const filtered: Record<string, unknown> = {}
 
@@ -256,25 +307,49 @@ export async function filterReadableFields<T extends Record<string, unknown>>(
     // cap used to let a relation be scoped correctly at the DB level while
     // still returning with unfiltered fields past this function's own,
     // separately-tracked limit (issue #830).
+    const isDeclaredRelationshipField =
+      fieldConfig?.type === 'relationship' && 'ref' in fieldConfig && !!fieldConfig.ref
+    // A synthetic back-relation (#1082) — no declared field of its own on
+    // this list, so resolved by name against the owning list's relationship
+    // field instead. `undefined` (not `fieldConfig`) is the signal it's
+    // worth trying: a declared-but-non-relationship field (e.g. a scalar or
+    // virtual) must fall through to the generic path below, unchanged.
+    const synthetic =
+      !isDeclaredRelationshipField && fieldConfig === undefined && config && listKey
+        ? resolveSyntheticReverseRelation(fieldName, listKey, config)
+        : null
+
     if (
       config &&
-      fieldConfig?.type === 'relationship' &&
-      'ref' in fieldConfig &&
-      fieldConfig.ref &&
+      (isDeclaredRelationshipField || synthetic) &&
       value !== null &&
       value !== undefined
     ) {
-      const canRead = await checkFieldAccess(fieldConfig?.access, 'read', {
-        ...args,
-        item: workingItem,
-      })
-
-      if (!canRead) {
-        accessDeniedKeys.add(fieldName)
-        continue
-      }
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+      let relatedConfig: { listName: string; listConfig: ListConfig<any> } | null = null
+
+      if (isDeclaredRelationshipField) {
+        const canRead = await checkFieldAccess(fieldConfig?.access, 'read', {
+          ...args,
+          item: workingItem,
+        })
+
+        if (!canRead) {
+          accessDeniedKeys.add(fieldName)
+          continue
+        }
 
-      const relatedConfig = getRelatedListConfig(fieldConfig.ref as string, config)
+        relatedConfig = getRelatedListConfig(fieldConfig.ref as string, config)
+      } else if (synthetic) {
+        // No declared field means no field-level `read` gate of its own to
+        // check here — the owning list's OWN field-level access is enforced
+        // by the recursive `filterReadableFields` call below, exactly as it
+        // would be for a declared relationship's related rows.
+        relatedConfig = {
+          listName: synthetic.sourceListName,
+          listConfig: synthetic.sourceListConfig,
+        }
+      }
       // The declared-only tree for whatever THIS relation's own list computes,
       // e.g. a field on the related list that declares its own `needs`. Falls
       // back to an empty tree when this relation isn't declaration-related at
@@ -286,6 +361,20 @@ export async function filterReadableFields<T extends Record<string, unknown>>(
       // unrestricted — matching what naming a relation without narrowing it
       // further has always meant.
       const nestedSelection = selection?.nested[fieldName]
+      // This relation's own resolved to-one visibility, if
+      // `buildAccessScopedInclude` flagged anything beneath it (issue #974).
+      // Falls back to empty — the common case for a relation with no
+      // filtered to-one anywhere in its own nested include.
+      const nestedToOneVisibility =
+        toOneVisibility.nested[fieldName] ?? emptyToOneAccessVisibilityTree()
+      // This key's OWN to-one existence check, if `fieldName` itself is a
+      // filtered to-one relation (as opposed to one further down its tree).
+      const toOneEntry = toOneVisibility.filters[fieldName]
+      // This relation's own denied `_count` keys, if `buildAccessScopedInclude`
+      // flagged any beneath it (issue #1087). Falls back to empty — the
+      // common case for a relation with no denied `_count` anywhere in its
+      // own nested include.
+      const nestedCountDenials = countDenials.nested[fieldName] ?? emptyCountAccessDenialTree()
 
       if (relatedConfig) {
         if (Array.isArray(value)) {
@@ -300,20 +389,30 @@ export async function filterReadableFields<T extends Record<string, unknown>>(
                 relatedConfig.listName,
                 nestedDeclaredOnly,
                 nestedSelection,
+                nestedToOneVisibility,
+                nestedCountDenials,
               ),
             ),
           )
         } else if (typeof value === 'object') {
-          filtered[fieldName] = await filterReadableFields(
-            value as Record<string, unknown>,
-            relatedConfig.listConfig.fields,
-            args,
-            config,
-            depth + 1,
-            relatedConfig.listName,
-            nestedDeclaredOnly,
-            nestedSelection,
-          )
+          const relatedId = (value as Record<string, unknown>).id
+          const isVisible =
+            !toOneEntry || toOneEntry.kind !== 'visible' || toOneEntry.ids.has(String(relatedId))
+
+          filtered[fieldName] = isVisible
+            ? await filterReadableFields(
+                value as Record<string, unknown>,
+                relatedConfig.listConfig.fields,
+                args,
+                config,
+                depth + 1,
+                relatedConfig.listName,
+                nestedDeclaredOnly,
+                nestedSelection,
+                nestedToOneVisibility,
+                nestedCountDenials,
+              )
+            : null
         }
       } else {
         filtered[fieldName] = value
@@ -341,6 +440,53 @@ export async function filterReadableFields<T extends Record<string, unknown>>(
     }
   }
 
+  // Relations `buildAccessScopedInclude` denied outright (to-one: issue #974,
+  // to-many: issue #1103) were never asked of Prisma at all, so `fieldName`
+  // has no entry in `workingItem` and the loop above never visits it. Force
+  // it present here — matching what a denied read means everywhere else in
+  // the context — rather than leaving the key silently absent: `null` for a
+  // to-one relation, `[]` for a to-many one. A synthetic back-relation
+  // (`fieldConfig` undefined — #1082) is always to-many, the same arity
+  // `buildAccessScopedInclude` assumes for it.
+  for (const [fieldName, entry] of Object.entries(toOneVisibility.filters)) {
+    if (entry.kind !== 'denied') continue
+    if (fieldName in filtered || fieldName in workingItem) continue
+    if (selection?.fields && !selection.fields.has(fieldName)) continue
+
+    const fieldConfig = fieldConfigs[fieldName]
+    const canRead = await checkFieldAccess(fieldConfig?.access, 'read', {
+      ...args,
+      item: workingItem,
+    })
+
+    if (!canRead) {
+      accessDeniedKeys.add(fieldName)
+      continue
+    }
+
+    const isToMany = !fieldConfig || !isToOneRelationship(fieldConfig)
+    filtered[fieldName] = isToMany ? [] : null
+  }
+
+  // `_count.select` keys `buildAccessScopedInclude` denied outright (issue
+  // #1087) were omitted from the select sent to Prisma, so `_count` may be
+  // absent from `workingItem` entirely, or present but missing exactly these
+  // keys. Write each denied key in as `0` — matching what a denied count has
+  // always meant for the admin list view's own scoped counts — unless a
+  // fragment's own selection excluded `_count` altogether, in which case
+  // there is nothing to inject it into.
+  if (countDenials.keys.size > 0 && !(selection?.fields && !selection.fields.has('_count'))) {
+    const existingCount =
+      filtered._count && typeof filtered._count === 'object'
+        ? (filtered._count as Record<string, unknown>)
+        : {}
+    const mergedCount = { ...existingCount }
+    for (const key of countDenials.keys) {
+      mergedCount[key] = 0
+    }
+    filtered._count = mergedCount
+  }
+
   // The item a virtual field's hook sees: stored columns and fetched
   // relations (from `workingItem`, never a resolved value — no hook's output
   // is ever written back into `workingItem`). A key is visible here if it

package/src/access/index.ts

@@ -14,11 +14,15 @@ export type {
 // Operation-level access primitives and shared ref-parsing helper.
 export {
   checkAccess,
+  checkCreateAccess,
   mergeFilters,
   isBoolean,
   isPrismaFilter,
   getRelatedListConfig,
+  resolveSyntheticReverseRelation,
+  listSyntheticReverseRelationNames,
 } from './engine.js'
+export type { SyntheticReverseRelation } from './engine.js'
 // Canonical field-level access evaluation (shared by read and write paths).
 export {
   checkFieldAccess,
@@ -36,7 +40,22 @@ export {
   buildAccessScopedInclude,
   buildAccessScopedWhere,
   stripVirtualFieldsFromInclude,
+  resolveToOneAccessVisibility,
+  emptyToOneAccessFilterTree,
+  emptyToOneAccessVisibilityTree,
+  emptyCountAccessDenialTree,
 } from './access-filter.js'
+export type {
+  ToOneAccessFilterTree,
+  ToOneAccessFilterEntry,
+  ToOneAccessVisibilityTree,
+  ToOneVisibility,
+  CountAccessDenialTree,
+} from './access-filter.js'
+// Access-scoped to-many relationship counts (admin list view, issue #732)
+// and the shared per-relation resolver `_count` scoping (issue #1087) reuses.
+export { isToManyRelationshipField, resolveCountAccessEntryForList } from './relationship-count.js'
+export type { CountAccessEntry } from './relationship-count.js'
 // Phase 2 — Field Visibility (post-query field stripping + resolveOutput).
 export { filterReadableFields } from './field-visibility.js'
 // Declared Dependencies — folding `needs` into an include without widening
@@ -53,5 +72,11 @@ export { AccessScopeDepthExceededError } from './errors.js'
 export { ResolveOutputCycleError } from './errors.js'
 // Thrown when a field-level access control function returns a non-boolean result.
 export { InvalidFieldAccessResultError } from './errors.js'
+// Thrown when operation-level `create` access control returns a non-boolean result (#1009).
+export { InvalidCreateAccessResultError } from './errors.js'
 // Thrown when a relation filter's related list denies query access outright (#916).
 export { RelationFilterAccessDeniedError } from './errors.js'
+// Thrown when a caller `include` names a key that is neither declared, synthetic, nor `_count` (#1082).
+export { UndeclaredIncludeKeyError } from './errors.js'
+// Thrown when a caller `_count.select` names a key that is not a countable to-many relation (#1087).
+export { UndeclaredCountKeyError } from './errors.js'

package/src/access/multi-column-read-write.test.ts

@@ -2,7 +2,8 @@ import { describe, it, expect } from 'vitest'
 import { filterReadableFields } from './field-visibility.js'
 import { executeFieldResolveInputHooks, splitMultiColumnFields } from '../hooks/index.js'
 import type { FieldConfig } from '../config/types.js'
-import type { AccessContext, FieldAccess } from './types.js'
+import type { FieldAccess } from './types.js'
+import type { StackContext } from '../context/index.js'
 
 /**
  * Generic core wiring for multi-column fields (the contract storage
@@ -48,7 +49,7 @@ function multiColumnField(access?: FieldAccess): FieldConfig {
   } as unknown as FieldConfig
 }
 
-function makeContext(overrides: { isSudo?: boolean } = {}): AccessContext {
+function makeContext(overrides: { isSudo?: boolean } = {}): StackContext {
   return {
     session: null,
     _isSudo: overrides.isSudo ?? false,

package/src/access/query-validation.ts

@@ -46,6 +46,20 @@ import { ValidationError } from '../hooks/index.js'
  * deliberately no second copy of either the shape-recognition or the
  * field-read check: `access-filter.ts` supplies the RELATED list at each
  * hop and calls back into the same primitives this module already owns.
+ *
+ * #1092 — `validateQueryKeys` is also the include-nested counterpart: a
+ * `where`/`orderBy` a caller nests inside an `include` entry gets the same
+ * #912 check, called by `buildAccessScopedInclude` against the RELATED list
+ * instead of the current one — no second key-existence walker for that
+ * position. `validateQueryFieldReadAccess` needs no equivalent call there:
+ * `checkKeyReadableOrThrow` already treats a key `resolveQueryField` cannot
+ * resolve as "already handled elsewhere" and skips it, which is exactly the
+ * synthetic-back-relation tolerance below needs — nothing to change. The one
+ * thing this position needs that the top-level `where`/`orderBy` never did:
+ * a key neither call resolves is tried against the optional
+ * `resolveSyntheticRelation` hook before being rejected, because a synthetic
+ * back-relation (#1082) is nameable in a nested predicate too. Every
+ * existing caller omits the hook, so top-level behavior is unchanged.
  */
 
 // Prisma's logical combinators for a WHERE clause — never field names.
@@ -68,6 +82,23 @@ export interface ResolvedQueryField {
   isRelationship: boolean
 }
 
+/**
+ * Where an unresolved key's nested predicate should recurse when it turns out
+ * to name a synthetic back-relation (#1082) rather than a declared field —
+ * the source list the back-relation stands for, NOT `getRelatedListConfig`'s
+ * target (a synthetic field carries no `ref` of its own to follow).
+ */
+export interface SyntheticRelationTarget {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+  listConfig: ListConfig<any>
+  listName: string
+}
+
+export type ResolveSyntheticRelation = (
+  key: string,
+  listName: string,
+) => SyntheticRelationTarget | null
+
 /**
  * Resolve a `where`/`orderBy` key against a list's declared fields.
  *
@@ -133,22 +164,61 @@ function walkWhere(
   listName: string,
   config: OpenSaasConfig,
   isSudo: boolean,
+  resolveSyntheticRelation?: ResolveSyntheticRelation,
 ): void {
   if (where === null || typeof where !== 'object') return
 
   if (Array.isArray(where)) {
-    for (const entry of where) walkWhere(entry, listConfig, listName, config, isSudo)
+    for (const entry of where) {
+      walkWhere(entry, listConfig, listName, config, isSudo, resolveSyntheticRelation)
+    }
     return
   }
 
   for (const [key, value] of Object.entries(where as Record<string, unknown>)) {
     if (LOGICAL_OPERATORS.has(key)) {
-      walkWhere(value, listConfig, listName, config, isSudo)
+      walkWhere(value, listConfig, listName, config, isSudo, resolveSyntheticRelation)
       continue
     }
 
     const resolved = resolveQueryField(key, listConfig.fields)
     if (!resolved) {
+      const synthetic = resolveSyntheticRelation?.(key, listName)
+      if (synthetic) {
+        // A synthetic back-relation is always to-many (#1082's own
+        // construction site has no arity branch), so its nested value takes
+        // the same two shapes a declared to-many relationship's filter does
+        // — walk it exactly like the resolved-relationship branch below,
+        // against the synthetic's source list instead of `getRelatedListConfig`.
+        if (value !== null && typeof value === 'object' && !Array.isArray(value)) {
+          const syntheticEntries = Object.entries(value as Record<string, unknown>)
+          const syntheticHasQuantifier = syntheticEntries.some(([k]) => RELATION_QUANTIFIERS.has(k))
+          if (syntheticHasQuantifier) {
+            for (const [quantifier, quantifierValue] of syntheticEntries) {
+              if (RELATION_QUANTIFIERS.has(quantifier)) {
+                walkWhere(
+                  quantifierValue,
+                  synthetic.listConfig,
+                  synthetic.listName,
+                  config,
+                  isSudo,
+                  resolveSyntheticRelation,
+                )
+              }
+            }
+          } else {
+            walkWhere(
+              value,
+              synthetic.listConfig,
+              synthetic.listName,
+              config,
+              isSudo,
+              resolveSyntheticRelation,
+            )
+          }
+        }
+        continue
+      }
       if (isSudo) continue
       rejectUndeclaredKey(listName, key, 'where')
     }
@@ -175,7 +245,14 @@ function walkWhere(
         // related list.
         for (const [quantifier, quantifierValue] of relationEntries) {
           if (RELATION_QUANTIFIERS.has(quantifier)) {
-            walkWhere(quantifierValue, related.listConfig, related.listName, config, isSudo)
+            walkWhere(
+              quantifierValue,
+              related.listConfig,
+              related.listName,
+              config,
+              isSudo,
+              resolveSyntheticRelation,
+            )
           }
         }
       } else {
@@ -185,7 +262,14 @@ function walkWhere(
         // whole value object IS the nested WHERE clause here — walk it
         // directly, or an undeclared key reached exactly this way (one hop
         // through a to-one relation) would pass through unchecked.
-        walkWhere(value, related.listConfig, related.listName, config, isSudo)
+        walkWhere(
+          value,
+          related.listConfig,
+          related.listName,
+          config,
+          isSudo,
+          resolveSyntheticRelation,
+        )
       }
     }
   }
@@ -198,17 +282,41 @@ function walkOrderBy(
   listName: string,
   config: OpenSaasConfig,
   isSudo: boolean,
+  resolveSyntheticRelation?: ResolveSyntheticRelation,
 ): void {
   if (orderBy === null || typeof orderBy !== 'object') return
 
   if (Array.isArray(orderBy)) {
-    for (const entry of orderBy) walkOrderBy(entry, listConfig, listName, config, isSudo)
+    for (const entry of orderBy) {
+      walkOrderBy(entry, listConfig, listName, config, isSudo, resolveSyntheticRelation)
+    }
     return
   }
 
   for (const [key, value] of Object.entries(orderBy as Record<string, unknown>)) {
     const resolved = resolveQueryField(key, listConfig.fields)
     if (!resolved) {
+      const synthetic = resolveSyntheticRelation?.(key, listName)
+      if (synthetic) {
+        // `{ relation: { _count: 'asc' } }` orders by an aggregate — no
+        // nested field name to resolve, matching the declared-relationship
+        // branch below.
+        if (
+          value !== null &&
+          typeof value === 'object' &&
+          !('_count' in (value as Record<string, unknown>))
+        ) {
+          walkOrderBy(
+            value,
+            synthetic.listConfig,
+            synthetic.listName,
+            config,
+            isSudo,
+            resolveSyntheticRelation,
+          )
+        }
+        continue
+      }
       if (isSudo) continue
       rejectUndeclaredKey(listName, key, 'orderBy')
     }
@@ -220,7 +328,16 @@ function walkOrderBy(
       if ('_count' in (value as Record<string, unknown>)) continue
 
       const related = getRelatedListConfig(resolved.fieldConfig.ref, config)
-      if (related) walkOrderBy(value, related.listConfig, related.listName, config, isSudo)
+      if (related) {
+        walkOrderBy(
+          value,
+          related.listConfig,
+          related.listName,
+          config,
+          isSudo,
+          resolveSyntheticRelation,
+        )
+      }
     }
   }
 }
@@ -231,6 +348,11 @@ function walkOrderBy(
  * Throws a `ValidationError` naming the list and the offending key on the
  * first undeclared key found. `isSudo` bypasses the check entirely, matching
  * the write path's `sudo` escape hatch.
+ *
+ * `resolveSyntheticRelation` is the include-nested position's own addition
+ * (#1092, see module doc comment) — omit it (every top-level `where`/`orderBy`
+ * caller does) and a key `resolveQueryField` can't resolve rejects exactly as
+ * before.
  */
 export function validateQueryKeys(args: {
   where?: unknown
@@ -240,10 +362,15 @@ export function validateQueryKeys(args: {
   listName: string
   config: OpenSaasConfig
   isSudo: boolean
+  resolveSyntheticRelation?: ResolveSyntheticRelation
 }): void {
-  const { where, orderBy, listConfig, listName, config, isSudo } = args
-  if (where !== undefined) walkWhere(where, listConfig, listName, config, isSudo)
-  if (orderBy !== undefined) walkOrderBy(orderBy, listConfig, listName, config, isSudo)
+  const { where, orderBy, listConfig, listName, config, isSudo, resolveSyntheticRelation } = args
+  if (where !== undefined) {
+    walkWhere(where, listConfig, listName, config, isSudo, resolveSyntheticRelation)
+  }
+  if (orderBy !== undefined) {
+    walkOrderBy(orderBy, listConfig, listName, config, isSudo, resolveSyntheticRelation)
+  }
 }
 
 /**

package/src/access/relationship-count.test.ts

@@ -111,6 +111,41 @@ describe('buildRelationshipCountSelect', () => {
     )
     expect(select).toBeUndefined()
   })
+
+  // Issue #1111: a relationship hidden via field-level `read` access must not
+  // leak its true count, even when the related list's rows are otherwise
+  // fully readable — the same denial an ordinary `include` of that field
+  // already gets from `filterReadableFields`'s `checkFieldAccess` call.
+  it('omits a relation whose field-level `read` access denies it, even though the related list is fully readable', async () => {
+    const config: OpenSaasConfig = {
+      db: { provider: 'sqlite', prismaClientConstructor: () => null as never },
+      lists: {
+        User: list({
+          fields: {
+            name: text(),
+            posts: relationship({
+              ref: 'Post.author',
+              many: true,
+              access: { read: () => false },
+            }),
+          },
+          access: { operation: { query: () => true } },
+        }),
+        Post: list({
+          fields: { title: text(), author: relationship({ ref: 'User.posts' }) },
+          access: { operation: { query: () => true } },
+        }),
+      },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+    } as any
+
+    const select = await buildRelationshipCountSelect(
+      config.lists.User,
+      { session: null, context: makeContext() },
+      config,
+    )
+    expect(select).toBeUndefined()
+  })
 })
 
 describe('resolveRelationshipCountFilters', () => {
@@ -186,6 +221,46 @@ describe('resolveRelationshipCountFilters', () => {
     expect(findMany).not.toHaveBeenCalled()
   })
 
+  // Issue #1111: a relationship denied at the FIELD level (as opposed to the
+  // related list's operation-level `query` access, covered above) must also
+  // resolve to "always 0, no query needed" — the related list here (Post) is
+  // otherwise fully readable, so only the field-level check on `posts` itself
+  // can be what's denying it.
+  it('resolves a field-level-denied relationship without any query: count is always 0', async () => {
+    const config: OpenSaasConfig = {
+      db: { provider: 'sqlite', prismaClientConstructor: () => null as never },
+      lists: {
+        User: list({
+          fields: {
+            name: text(),
+            posts: relationship({
+              ref: 'Post.author',
+              many: true,
+              access: { read: () => false },
+            }),
+          },
+          access: { operation: { query: () => true } },
+        }),
+        Post: list({
+          fields: { title: text(), author: relationship({ ref: 'User.posts' }) },
+          access: { operation: { query: () => true } },
+        }),
+      },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+    } as any
+    const findMany = vi.fn(async () => [])
+    const where = { posts: { [RELATIONSHIP_COUNT_FILTER_KEY]: { operator: 'gt', value: 0 } } }
+    const resolved = await resolveRelationshipCountFilters(
+      where,
+      config.lists.User,
+      'User',
+      { session: null, context: makeContext(findMany) },
+      config,
+    )
+    expect(resolved).toEqual({ id: { in: [] } })
+    expect(findMany).not.toHaveBeenCalled()
+  })
+
   it('preserves sibling conditions, ANDing the resolved id constraint', async () => {
     const config = makeConfig()
     const findMany = vi.fn(async () => [{ id: 'u2', _count: { posts: 7 } }])