@opensaas/stack-core 0.39.2 → 0.41.0

package/dist/access/access-filter.test.js

@@ -1,7 +1,8 @@
 import { describe, it, expect, vi } from 'vitest';
-import { buildAccessScopedInclude } from './access-filter.js';
-import { AccessScopeDepthExceededError } from './errors.js';
+import { buildAccessScopedInclude, resolveToOneAccessVisibility } from './access-filter.js';
+import { AccessScopeDepthExceededError, RelationFilterAccessDeniedError, UndeclaredCountKeyError, UndeclaredIncludeKeyError, } from './errors.js';
 import { READ_INCLUDE_MAX_DEPTH } from './depth-limits.js';
+import { ValidationError } from '../hooks/index.js';
 /**
  * Regression coverage for `buildAccessScopedInclude`, the caller-directed
  * access-scoping walk introduced by ADR-0026. It replaces the old two-step
@@ -19,6 +20,14 @@ import { READ_INCLUDE_MAX_DEPTH } from './depth-limits.js';
  * relation the request doesn't name never has its list's `query` access
  * invoked, and naming a relation fetches its own columns and stops (the "One
  * hop" rule) at every level, not just the root.
+ *
+ * The scenarios in this file build every chain relation as to-MANY
+ * (`rel(ref, true)`), so `where`-in-`include` keeps meaning what it always
+ * has here — the walk-depth/caller-directed logic under test is arity-
+ * agnostic. The to-one-specific behavior this function grew for issue #974
+ * (a `where` on a to-one include is not something Prisma accepts, so it's
+ * recorded in `toOneAccessFilters` instead and resolved post-query by
+ * `resolveToOneAccessVisibility`) has its own dedicated describe blocks below.
  */
 // A relationship field pointing at another list.
 function rel(ref, many = false) {
@@ -65,10 +74,10 @@ function chainConfig(count) {
         const listName = `L${i}`;
         const fields = { name: { type: 'text' } };
         if (i < count - 1) {
-            fields.next = rel(`L${i + 1}.prev`);
+            fields.next = rel(`L${i + 1}.prev`, true);
         }
         if (i > 0) {
-            fields.prev = rel(`L${i - 1}.next`);
+            fields.prev = rel(`L${i - 1}.next`, true);
         }
         const filter = { ownerId: { equals: listName } };
         const queryFn = vi.fn(i === 0 ? () => true : () => filter);
@@ -131,14 +140,14 @@ describe('buildAccessScopedInclude — caller-directed walk (ADR-0026)', () => {
             },
             // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
         };
-        const include = await buildAccessScopedInclude({ b: true }, config.lists.A.fields, { session: null, context: makeContext() }, config, 'A');
+        const { include } = await buildAccessScopedInclude({ b: true }, config.lists.A.fields, { session: null, context: makeContext() }, config, 'A');
         expect(include).toEqual({ b: true });
         expect(queryB).toHaveBeenCalledTimes(1);
         expect(queryC).not.toHaveBeenCalled();
     });
     it("fetches a named relation's own columns and stops — does not auto-expand its subtree (One hop)", async () => {
         const { config, queryFns } = chainConfig(4); // L0 → L1 → L2 → L3
-        const include = await buildAccessScopedInclude({ next: true }, config.lists.L0.fields, { session: null, context: makeContext() }, config, 'L0');
+        const { include } = await buildAccessScopedInclude({ next: true }, config.lists.L0.fields, { session: null, context: makeContext() }, config, 'L0');
         // L1 is fetched and where-scoped; L2/L3 are never reached because the
         // request named `next` bare, with no nested `include` beneath it.
         expect(include).toEqual({ next: { where: { ownerId: { equals: 'L1' } } } });
@@ -149,7 +158,7 @@ describe('buildAccessScopedInclude — caller-directed walk (ADR-0026)', () => {
     });
     it('scopes a nested path at every level the request names it', async () => {
         const { config, queryFns } = chainConfig(4); // L0 → L1 → L2 → L3
-        const include = await buildAccessScopedInclude({ next: { include: { next: { include: { next: true } } } } }, config.lists.L0.fields, { session: null, context: makeContext() }, config, 'L0');
+        const { include } = await buildAccessScopedInclude({ next: { include: { next: { include: { next: true } } } } }, config.lists.L0.fields, { session: null, context: makeContext() }, config, 'L0');
         expect(include).toEqual({
             next: {
                 where: { ownerId: { equals: 'L1' } },
@@ -180,7 +189,7 @@ describe('buildAccessScopedInclude — caller-directed walk (ADR-0026)', () => {
             },
             // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
         };
-        const include = await buildAccessScopedInclude({ b: { include: { c: { include: { a: true } } } } }, config.lists.A.fields, { session: null, context: makeContext() }, config, 'A');
+        const { include } = await buildAccessScopedInclude({ b: { include: { c: { include: { a: true } } } } }, config.lists.A.fields, { session: null, context: makeContext() }, config, 'A');
         expect(include).toEqual({ b: { include: { c: { include: { a: true } } } } });
     });
 });
@@ -208,7 +217,7 @@ describe('buildAccessScopedInclude — caller take on a to-many relation (issue
     }
     it('preserves the take and AND-combines it with the access where', async () => {
         const config = scopedConfig();
-        const include = await buildAccessScopedInclude({ posts: { take: 10 } }, config.lists.User.fields, { session: null, context: makeContext() }, config, 'User');
+        const { include } = await buildAccessScopedInclude({ posts: { take: 10 } }, config.lists.User.fields, { session: null, context: makeContext() }, config, 'User');
         // The bound rides on top of the access filter — neither is dropped. The
         // Post→author back-relation is NOT auto-nested (One hop, ADR-0026) since
         // the request didn't name it.
@@ -222,7 +231,7 @@ describe('buildAccessScopedInclude — caller take on a to-many relation (issue
     it('drops a take for a relation whose query access is denied', async () => {
         const config = scopedConfig();
         config.lists.Post.access = { operation: { query: () => false } };
-        const include = await buildAccessScopedInclude({ posts: { take: 10 } }, config.lists.User.fields, { session: null, context: makeContext() }, config, 'User');
+        const { include } = await buildAccessScopedInclude({ posts: { take: 10 } }, config.lists.User.fields, { session: null, context: makeContext() }, config, 'User');
         // A denied relation is dropped wholesale — the take cannot resurrect it.
         expect(include).toEqual({});
     });
@@ -256,7 +265,7 @@ describe('buildAccessScopedInclude — fail-closed at the read-include depth cap
         const { config } = chainConfig(chainLength);
         // Outer `next` (hop 1) + nestedInclude(HOPS_AT_CAP - 1) = HOPS_AT_CAP hops total — right at the boundary.
         const requested = { next: nestedInclude(HOPS_AT_CAP - 1) };
-        const include = await buildAccessScopedInclude(requested, config.lists.L0.fields, { session: null, context: makeContext() }, config, 'L0');
+        const { include } = await buildAccessScopedInclude(requested, config.lists.L0.fields, { session: null, context: makeContext() }, config, 'L0');
         expect(includeDepth(include)).toBe(HOPS_AT_CAP);
         expect(whereAtHop(include, HOPS_AT_CAP)).toEqual({ ownerId: { equals: `L${HOPS_AT_CAP}` } });
     });
@@ -268,10 +277,40 @@ describe('buildAccessScopedInclude — fail-closed at the read-include depth cap
     it('an empty request never throws, even on a deep schema', async () => {
         const chainLength = HOPS_AT_CAP + 3;
         const { config } = chainConfig(chainLength);
-        const include = await buildAccessScopedInclude({}, config.lists.L0.fields, { session: null, context: makeContext() }, config, 'L0');
+        const { include } = await buildAccessScopedInclude({}, config.lists.L0.fields, { session: null, context: makeContext() }, config, 'L0');
         expect(include).toEqual({});
     });
-    it('a list with no relationships passes an unrelated requested key through unchanged', async () => {
+    it('a declared non-relationship key on a list with no relationships passes through unchanged', async () => {
+        const config = {
+            db: { provider: 'sqlite' },
+            lists: {
+                Leaf: {
+                    fields: { name: { type: 'text' } },
+                    access: { operation: { query: () => true } },
+                },
+            },
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+        };
+        // A declared field that isn't a relationship — access control does not
+        // govern it (e.g. a virtual field named in `include`, stripped later by
+        // `stripVirtualFieldsFromInclude`).
+        const { include } = await buildAccessScopedInclude({ name: true }, config.lists.Leaf.fields, { session: null, context: makeContext() }, config, 'Leaf');
+        expect(include).toEqual({ name: true });
+    });
+    it('rejects a key that is neither declared nor a synthetic back-relation (#1082)', async () => {
+        const config = {
+            db: { provider: 'sqlite' },
+            lists: {
+                Leaf: {
+                    fields: { name: { type: 'text' } },
+                    access: { operation: { query: () => true } },
+                },
+            },
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+        };
+        await expect(buildAccessScopedInclude({ someUnrelatedKey: true }, config.lists.Leaf.fields, { session: null, context: makeContext() }, config, 'Leaf')).rejects.toThrow(UndeclaredIncludeKeyError);
+    });
+    it('a bare `_count: true` on a list with no to-many relations yields no `_count` key at all (#1087)', async () => {
         const config = {
             db: { provider: 'sqlite' },
             lists: {
@@ -282,10 +321,936 @@ describe('buildAccessScopedInclude — fail-closed at the read-include depth cap
             },
             // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
         };
-        // An arbitrary (non-declared-relationship) key passed through unchanged —
-        // access control does not govern keys it doesn't recognize as relationships.
-        const include = await buildAccessScopedInclude({ someUnrelatedKey: true }, config.lists.Leaf.fields, { session: null, context: makeContext() }, config, 'Leaf');
-        expect(include).toEqual({ someUnrelatedKey: true });
+        const { include } = await buildAccessScopedInclude({ _count: true }, config.lists.Leaf.fields, { session: null, context: makeContext() }, config, 'Leaf');
+        expect(include).toEqual({});
+    });
+});
+/**
+ * Regression coverage for issue #1087: a caller-supplied `_count` in
+ * `include` used to reach Prisma unscoped (#1082's "Out of scope" — the one
+ * key `buildAccessScopedInclude`'s own denial rule allowlisted through rather
+ * than rejecting or scoping). These tests pin the fix: each named relation's
+ * `_count.select` entry is scoped by that relation's own `query` access,
+ * exactly like the rest of this module scopes `include`, and a denied
+ * relation is recorded in `countDenials` for `filterReadableFields` to inject
+ * `0` for post-query (Prisma cannot be asked for a guaranteed `0`).
+ */
+describe('buildAccessScopedInclude — `_count` is scoped like any other relation (issue #1087)', () => {
+    function countConfig(postQuery) {
+        return {
+            db: { provider: 'sqlite' },
+            lists: {
+                User: {
+                    fields: {
+                        name: { type: 'text' },
+                        posts: rel('Post.author', true),
+                        secrets: rel('Secret.owner', true),
+                    },
+                    access: { operation: { query: () => true } },
+                },
+                Post: {
+                    fields: { title: { type: 'text' }, author: rel('User.posts') },
+                    access: { operation: { query: postQuery } },
+                },
+                Secret: {
+                    fields: { body: { type: 'text' }, owner: rel('User.secrets') },
+                    access: { operation: { query: () => false } },
+                },
+            },
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+        };
+    }
+    it('a fully-readable relation counts unchanged', async () => {
+        const config = countConfig(() => true);
+        const { include, countDenials } = await buildAccessScopedInclude({ _count: { select: { posts: true } } }, config.lists.User.fields, { session: null, context: makeContext() }, config, 'User');
+        expect(include).toEqual({ _count: { select: { posts: true } } });
+        expect(countDenials.keys.size).toBe(0);
+    });
+    it('folds the related list row filter into the count select', async () => {
+        const config = countConfig(() => ({ published: { equals: true } }));
+        const { include } = await buildAccessScopedInclude({ _count: { select: { posts: true } } }, config.lists.User.fields, { session: null, context: makeContext() }, config, 'User');
+        expect(include).toEqual({
+            _count: { select: { posts: { where: { published: { equals: true } } } } },
+        });
+    });
+    it('AND-combines a caller-supplied nested `where` with the access filter, never replacing it', async () => {
+        const config = countConfig(() => ({ published: { equals: true } }));
+        const { include } = await buildAccessScopedInclude({ _count: { select: { posts: { where: { title: { contains: 'foo' } } } } } }, config.lists.User.fields, { session: null, context: makeContext() }, config, 'User');
+        expect(include).toEqual({
+            _count: {
+                select: {
+                    posts: {
+                        where: {
+                            AND: [{ published: { equals: true } }, { title: { contains: 'foo' } }],
+                        },
+                    },
+                },
+            },
+        });
+    });
+    it('omits a fully-denied relation from the select and records it in `countDenials`', async () => {
+        const config = countConfig(() => true);
+        const { include, countDenials } = await buildAccessScopedInclude({ _count: { select: { posts: true, secrets: true } } }, config.lists.User.fields, { session: null, context: makeContext() }, config, 'User');
+        expect(include).toEqual({ _count: { select: { posts: true } } });
+        expect(countDenials.keys).toEqual(new Set(['secrets']));
+    });
+    it('a wholly-denied `_count.select` omits the `_count` key entirely, still recording the denial', async () => {
+        const config = countConfig(() => true);
+        const { include, countDenials } = await buildAccessScopedInclude({ _count: { select: { secrets: true } } }, config.lists.User.fields, { session: null, context: makeContext() }, config, 'User');
+        expect(include).toEqual({});
+        expect(countDenials.keys).toEqual(new Set(['secrets']));
+    });
+    it('a denied relation resolves to 0 without validating its caller `where` — no field-name/read-access oracle', async () => {
+        // A caller who cannot read a single `Secret` row supplies a nonsense
+        // `where` naming a field that doesn't exist. If denial were checked
+        // AFTER `where` validation, this would throw a `ValidationError` naming
+        // "Secret"'s fields — letting a caller probe a fully denied list's
+        // schema. Denial must win first: the count is 0 regardless of `where`.
+        const config = countConfig(() => true);
+        const { include, countDenials } = await buildAccessScopedInclude({ _count: { select: { secrets: { where: { bogusField: { equals: 1 } } } } } }, config.lists.User.fields, { session: null, context: makeContext() }, config, 'User');
+        expect(include).toEqual({});
+        expect(countDenials.keys).toEqual(new Set(['secrets']));
+    });
+    it('rejects a `_count.select` key that is not a countable to-many (undeclared)', async () => {
+        const config = countConfig(() => true);
+        await expect(buildAccessScopedInclude({ _count: { select: { nonsense: true } } }, config.lists.User.fields, { session: null, context: makeContext() }, config, 'User')).rejects.toThrow(UndeclaredCountKeyError);
+    });
+    it('rejects a `_count.select` key naming a scalar field', async () => {
+        const config = countConfig(() => true);
+        await expect(buildAccessScopedInclude({ _count: { select: { name: true } } }, config.lists.User.fields, { session: null, context: makeContext() }, config, 'User')).rejects.toThrow(UndeclaredCountKeyError);
+    });
+    it('rejects a `_count.select` key naming a to-one relationship', async () => {
+        const config = countConfig(() => true);
+        await expect(buildAccessScopedInclude({ _count: { select: { author: true } } }, config.lists.Post.fields, { session: null, context: makeContext() }, config, 'Post')).rejects.toThrow(UndeclaredCountKeyError);
+    });
+    // Issue #1111: a relationship hidden via field-level `read` access must not
+    // leak its true count through `_count`, even though the related list's rows
+    // are otherwise fully readable — the same denial an ordinary `include` of
+    // that field already gets from `filterReadableFields`'s `checkFieldAccess`
+    // call.
+    it('omits a relation whose field-level `read` access denies it, even though the related list is fully readable', async () => {
+        const config = {
+            db: { provider: 'sqlite' },
+            lists: {
+                User: {
+                    fields: {
+                        name: { type: 'text' },
+                        posts: {
+                            type: 'relationship',
+                            ref: 'Post.author',
+                            many: true,
+                            access: { read: () => false },
+                        },
+                    },
+                    access: { operation: { query: () => true } },
+                },
+                Post: {
+                    fields: { title: { type: 'text' }, author: rel('User.posts') },
+                    access: { operation: { query: () => true } },
+                },
+            },
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+        };
+        const { include, countDenials } = await buildAccessScopedInclude({ _count: { select: { posts: true } } }, config.lists.User.fields, { session: null, context: makeContext() }, config, 'User');
+        expect(include).toEqual({});
+        expect(countDenials.keys).toEqual(new Set(['posts']));
+    });
+    it('does not reject a `_count.select` key naming a synthetic back-relation (#1082)', async () => {
+        const config = {
+            db: { provider: 'sqlite' },
+            lists: {
+                Category: {
+                    fields: { name: { type: 'text' } },
+                    access: { operation: { query: () => true } },
+                },
+                Post: {
+                    fields: {
+                        title: { type: 'text' },
+                        // A list-only ref: no `Category` field names it back, so schema
+                        // generation synthesizes `from_Post_category` on Category.
+                        category: rel('Category'),
+                    },
+                    access: { operation: { query: () => true } },
+                },
+            },
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+        };
+        const { include } = await buildAccessScopedInclude({ _count: { select: { from_Post_category: true } } }, config.lists.Category.fields, { session: null, context: makeContext() }, config, 'Category');
+        expect(include).toEqual({ _count: { select: { from_Post_category: true } } });
+    });
+    it('`_count: true` also expands to a synthetic back-relation, scoped (#1082/#1087)', async () => {
+        const config = {
+            db: { provider: 'sqlite' },
+            lists: {
+                Category: {
+                    fields: { name: { type: 'text' } },
+                    access: { operation: { query: () => true } },
+                },
+                Post: {
+                    fields: {
+                        title: { type: 'text' },
+                        category: rel('Category'),
+                    },
+                    // A row filter — proves the synthetic relation's count is scoped
+                    // exactly like an explicitly-named one, not merely included.
+                    access: { operation: { query: () => ({ published: { equals: true } }) } },
+                },
+            },
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+        };
+        const { include } = await buildAccessScopedInclude({ _count: true }, config.lists.Category.fields, { session: null, context: makeContext() }, config, 'Category');
+        expect(include).toEqual({
+            _count: { select: { from_Post_category: { where: { published: { equals: true } } } } },
+        });
+    });
+    it('scopes a relation filter nested inside a caller-supplied count `where` (e.g. `_count.select.posts.where.comments.some`)', async () => {
+        const config = {
+            db: { provider: 'sqlite' },
+            lists: {
+                User: {
+                    fields: { name: { type: 'text' }, posts: rel('Post.author', true) },
+                    access: { operation: { query: () => true } },
+                },
+                Post: {
+                    fields: {
+                        title: { type: 'text' },
+                        author: rel('User.posts'),
+                        comments: rel('Comment.post', true),
+                    },
+                    access: { operation: { query: () => true } },
+                },
+                Comment: {
+                    fields: { body: { type: 'text' }, post: rel('Post.comments') },
+                    // A row filter one hop past the counted relation — must still be
+                    // folded in, or the resulting post count would reveal whether
+                    // inaccessible comments matching the caller's filter exist.
+                    access: { operation: { query: () => ({ approved: { equals: true } }) } },
+                },
+            },
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+        };
+        const { include } = await buildAccessScopedInclude({
+            _count: {
+                select: {
+                    posts: { where: { comments: { some: { body: { contains: 'hi' } } } } },
+                },
+            },
+        }, config.lists.User.fields, { session: null, context: makeContext() }, config, 'User');
+        expect(include).toEqual({
+            _count: {
+                select: {
+                    posts: {
+                        where: {
+                            comments: {
+                                some: {
+                                    AND: [{ approved: { equals: true } }, { body: { contains: 'hi' } }],
+                                },
+                            },
+                        },
+                    },
+                },
+            },
+        });
+    });
+    it('resolves a synthetic back-relation named inside a caller-supplied count `where` (#1082/#1092)', async () => {
+        const config = {
+            db: { provider: 'sqlite' },
+            lists: {
+                User: {
+                    fields: { name: { type: 'text' }, posts: rel('Post.author', true) },
+                    access: { operation: { query: () => true } },
+                },
+                Post: {
+                    fields: {
+                        title: { type: 'text' },
+                        author: rel('User.posts'),
+                        // A list-only ref: no `Post` field names it back, so schema
+                        // generation synthesizes `from_Category_posts` on Post.
+                        category: rel('Category'),
+                    },
+                    access: { operation: { query: () => true } },
+                },
+                Category: {
+                    fields: {
+                        name: { type: 'text' },
+                        posts: rel('Post', true),
+                    },
+                    // A row filter one hop past the counted relation, reached only
+                    // through the synthetic back-relation — must still be folded in.
+                    access: { operation: { query: () => ({ published: { equals: true } }) } },
+                },
+            },
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+        };
+        const { include } = await buildAccessScopedInclude({
+            _count: {
+                select: {
+                    posts: { where: { from_Category_posts: { some: { name: { contains: 'news' } } } } },
+                },
+            },
+        }, config.lists.User.fields, { session: null, context: makeContext() }, config, 'User');
+        expect(include).toEqual({
+            _count: {
+                select: {
+                    posts: {
+                        where: {
+                            from_Category_posts: {
+                                some: {
+                                    AND: [{ published: { equals: true } }, { name: { contains: 'news' } }],
+                                },
+                            },
+                        },
+                    },
+                },
+            },
+        });
+    });
+    it('`_count: true` expands to every declared to-many relation, scoped', async () => {
+        const config = countConfig(() => true);
+        const { include, countDenials } = await buildAccessScopedInclude({ _count: true }, config.lists.User.fields, { session: null, context: makeContext() }, config, 'User');
+        expect(include).toEqual({ _count: { select: { posts: true } } });
+        expect(countDenials.keys).toEqual(new Set(['secrets']));
+    });
+    it('scopes `_count` nested inside an ordinary relation include, at that level', async () => {
+        const config = {
+            db: { provider: 'sqlite' },
+            lists: {
+                Org: {
+                    fields: { name: { type: 'text' }, users: rel('User.org', true) },
+                    access: { operation: { query: () => true } },
+                },
+                User: {
+                    fields: {
+                        name: { type: 'text' },
+                        org: rel('Org.users'),
+                        posts: rel('Post.author', true),
+                    },
+                    access: { operation: { query: () => true } },
+                },
+                Post: {
+                    fields: { title: { type: 'text' }, author: rel('User.posts') },
+                    access: { operation: { query: () => ({ published: { equals: true } }) } },
+                },
+            },
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+        };
+        const { include } = await buildAccessScopedInclude({ users: { include: { _count: { select: { posts: true } } } } }, config.lists.Org.fields, { session: null, context: makeContext() }, config, 'Org');
+        expect(include).toEqual({
+            users: {
+                include: { _count: { select: { posts: { where: { published: { equals: true } } } } } },
+            },
+        });
+    });
+});
+/**
+ * Regression coverage for issue #974: Prisma accepts a nested `where` on an
+ * `include` entry only for a to-many relation — the same shape on a to-one
+ * relation raises `PrismaClientValidationError`. `buildAccessScopedInclude`
+ * must never attach one for a to-one relation, whatever its related list's
+ * `query` access resolves to; the scoping information goes into
+ * `toOneAccessFilters` instead.
+ */
+describe('buildAccessScopedInclude — to-one relations record a post-query filter, not `where` (issue #974)', () => {
+    function ownerConfig(queryAccess) {
+        return {
+            db: { provider: 'sqlite' },
+            lists: {
+                Child: {
+                    fields: { name: { type: 'text' }, owner: rel('Owner') },
+                    access: { operation: { query: () => true } },
+                },
+                Owner: {
+                    fields: { name: { type: 'text' } },
+                    access: { operation: { query: queryAccess } },
+                },
+            },
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+        };
+    }
+    it('records the access filter instead of attaching `where` when the related list scopes by a filter', async () => {
+        const config = ownerConfig(() => ({ id: { equals: 'u1' } }));
+        const { include, toOneAccessFilters } = await buildAccessScopedInclude({ owner: true }, config.lists.Child.fields, { session: null, context: makeContext() }, config, 'Child');
+        // The Prisma-bound include never carries a `where` on this to-one key —
+        // Prisma would reject it.
+        expect(include).toEqual({ owner: true });
+        expect(toOneAccessFilters).toEqual({
+            filters: {
+                owner: { kind: 'scoped', relatedListName: 'Owner', accessWhere: { id: { equals: 'u1' } } },
+            },
+            nested: {},
+        });
+    });
+    it('leaves a to-one relation whose related list is fully open untouched — no filter recorded, no extra query later', async () => {
+        const config = ownerConfig(() => true);
+        const { include, toOneAccessFilters } = await buildAccessScopedInclude({ owner: true }, config.lists.Child.fields, { session: null, context: makeContext() }, config, 'Child');
+        expect(include).toEqual({ owner: true });
+        expect(toOneAccessFilters).toEqual({ filters: {}, nested: {} });
+    });
+    it('drops a to-one relation whose related list denies query access outright, and records the denial', async () => {
+        const config = ownerConfig(() => false);
+        const { include, toOneAccessFilters } = await buildAccessScopedInclude({ owner: true }, config.lists.Child.fields, { session: null, context: makeContext() }, config, 'Child');
+        // Never asked of Prisma at all — same as before this fix.
+        expect(include).toEqual({});
+        expect(toOneAccessFilters).toEqual({ filters: { owner: { kind: 'denied' } }, nested: {} });
+    });
+    it('records a to-one filter nested inside another relation the caller explicitly included', async () => {
+        const config = {
+            db: { provider: 'sqlite' },
+            lists: {
+                GrandChild: {
+                    fields: { name: { type: 'text' }, child: rel('Child') },
+                    access: { operation: { query: () => true } },
+                },
+                Child: {
+                    fields: { name: { type: 'text' }, owner: rel('Owner') },
+                    access: { operation: { query: () => true } },
+                },
+                Owner: {
+                    fields: { name: { type: 'text' } },
+                    access: { operation: { query: () => ({ id: { equals: 'u1' } }) } },
+                },
+            },
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+        };
+        const { include, toOneAccessFilters } = await buildAccessScopedInclude({ child: { include: { owner: true } } }, config.lists.GrandChild.fields, { session: null, context: makeContext() }, config, 'GrandChild');
+        expect(include).toEqual({ child: { include: { owner: true } } });
+        expect(toOneAccessFilters).toEqual({
+            filters: {},
+            nested: {
+                child: {
+                    filters: {
+                        owner: {
+                            kind: 'scoped',
+                            relatedListName: 'Owner',
+                            accessWhere: { id: { equals: 'u1' } },
+                        },
+                    },
+                    nested: {},
+                },
+            },
+        });
+    });
+});
+/**
+ * Regression coverage for issue #1103: a denied to-MANY relation used to be
+ * dropped from `include` with nothing recorded, unlike its to-one sibling
+ * (issue #974, covered above). `filterReadableFields`'s main loop only ever
+ * visits keys present in the raw row, so an unrecorded denial left the key
+ * silently absent from the result — `undefined`, not `[]` — breaking the
+ * fragment API's typed contract (`ResultOf` types a to-many relation as an
+ * array). These tests pin that a to-many denial is now recorded exactly like
+ * a to-one one, sharing the same `toOneAccessFilters` tree and `kind:
+ * 'denied'` entry.
+ */
+describe('buildAccessScopedInclude — to-many relations record a denial too, like to-one (issue #1103)', () => {
+    function secretsConfig() {
+        return {
+            db: { provider: 'sqlite' },
+            lists: {
+                Author: {
+                    fields: { name: { type: 'text' }, secrets: rel('Secret.author', true) },
+                    access: { operation: { query: () => true } },
+                },
+                Secret: {
+                    fields: { value: { type: 'text' } },
+                    access: { operation: { query: () => false } },
+                },
+            },
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+        };
+    }
+    it('drops a to-many relation whose related list denies query access outright, and records the denial', async () => {
+        const config = secretsConfig();
+        const { include, toOneAccessFilters } = await buildAccessScopedInclude({ secrets: true }, config.lists.Author.fields, { session: null, context: makeContext() }, config, 'Author');
+        // Never asked of Prisma at all — same treatment as a denied to-one.
+        expect(include).toEqual({});
+        expect(toOneAccessFilters).toEqual({ filters: { secrets: { kind: 'denied' } }, nested: {} });
+    });
+    it('records the denial even when the caller also asked for a `take`/`where` — a denied relation has no shape to preserve', async () => {
+        const config = secretsConfig();
+        const { include, toOneAccessFilters } = await buildAccessScopedInclude({ secrets: { take: 5, where: { value: { equals: 'x' } } } }, config.lists.Author.fields, { session: null, context: makeContext() }, config, 'Author');
+        expect(include).toEqual({});
+        expect(toOneAccessFilters).toEqual({ filters: { secrets: { kind: 'denied' } }, nested: {} });
+    });
+    // Code-review finding on #1103's own PR: a caller's `Include` type allows a
+    // bare `boolean` for a relation, so `{ secrets: false }` (or a conditional
+    // `{ secrets: cond ? true : undefined }` that resolved to `undefined`)
+    // explicitly opts the relation OUT — no different from the key being
+    // absent altogether. Before this guard, the loop evaluated (and, once
+    // denied, recorded) the key regardless of its value, so a denied relation
+    // the caller explicitly disabled still ended up forced to `[]` downstream
+    // by `field-visibility.ts` — surfacing a value for a key nobody asked for.
+    it('treats an explicit `false` include value as not requested, even when the related list denies query access', async () => {
+        const config = secretsConfig();
+        const { include, toOneAccessFilters } = await buildAccessScopedInclude({ secrets: false }, config.lists.Author.fields, { session: null, context: makeContext() }, config, 'Author');
+        expect(include).toEqual({});
+        expect(toOneAccessFilters).toEqual({ filters: {}, nested: {} });
+    });
+    it('treats an explicit `undefined` include value as not requested, even when the related list denies query access', async () => {
+        const config = secretsConfig();
+        const { include, toOneAccessFilters } = await buildAccessScopedInclude({ secrets: undefined }, config.lists.Author.fields, { session: null, context: makeContext() }, config, 'Author');
+        expect(include).toEqual({});
+        expect(toOneAccessFilters).toEqual({ filters: {}, nested: {} });
+    });
+    it('treats an explicit `false` include value as not requested even when the related list is fully open — never flips it to `true`', async () => {
+        const config = secretsConfig();
+        config.lists.Secret.access = { operation: { query: () => true } };
+        const { include, toOneAccessFilters } = await buildAccessScopedInclude({ secrets: false }, config.lists.Author.fields, { session: null, context: makeContext() }, config, 'Author');
+        expect(include).toEqual({});
+        expect(toOneAccessFilters).toEqual({ filters: {}, nested: {} });
+    });
+});
+describe('resolveToOneAccessVisibility (issue #974)', () => {
+    function makeVisibilityContext(findMany) {
+        return {
+            session: null,
+            _isSudo: false,
+            _resolveOutputChain: [],
+            prisma: { owner: { findMany } },
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal context for unit test
+        };
+    }
+    it('passes a denied filter straight through with no query', async () => {
+        const findMany = vi.fn();
+        const context = makeVisibilityContext(findMany);
+        const resolved = await resolveToOneAccessVisibility([{ id: 'c1' }], { filters: { owner: { kind: 'denied' } }, nested: {} }, { session: null, context });
+        expect(resolved).toEqual({ filters: { owner: { kind: 'denied' } }, nested: {} });
+        expect(findMany).not.toHaveBeenCalled();
+    });
+    it('skips the query when no row carries a value at the scoped key', async () => {
+        const findMany = vi.fn();
+        const context = makeVisibilityContext(findMany);
+        const tree = {
+            filters: {
+                owner: {
+                    kind: 'scoped',
+                    relatedListName: 'Owner',
+                    accessWhere: { id: { equals: 'u1' } },
+                },
+            },
+            nested: {},
+        };
+        const resolved = await resolveToOneAccessVisibility([{ id: 'c1', owner: null }], tree, {
+            session: null,
+            context,
+        });
+        expect(resolved).toEqual({
+            filters: { owner: { kind: 'visible', ids: new Set() } },
+            nested: {},
+        });
+        expect(findMany).not.toHaveBeenCalled();
+    });
+    it('batches every row into ONE existence check, through the raw Prisma client, using the exact access filter', async () => {
+        const findMany = vi.fn().mockResolvedValue([{ id: 'u1' }, { id: 'u2' }]);
+        const context = makeVisibilityContext(findMany);
+        const tree = {
+            filters: {
+                owner: {
+                    kind: 'scoped',
+                    relatedListName: 'Owner',
+                    accessWhere: { studioId: { equals: 's1' } },
+                },
+            },
+            nested: {},
+        };
+        const items = [
+            { id: 'c1', owner: { id: 'u1' } },
+            { id: 'c2', owner: { id: 'u2' } },
+            { id: 'c3', owner: { id: 'u3' } }, // excluded by the mocked response below
+            { id: 'c4', owner: null }, // contributes no id
+        ];
+        const resolved = await resolveToOneAccessVisibility(items, tree, { session: null, context });
+        // One call, not one per row.
+        expect(findMany).toHaveBeenCalledTimes(1);
+        expect(findMany).toHaveBeenCalledWith({
+            where: { AND: [{ studioId: { equals: 's1' } }, { id: { in: ['u1', 'u2', 'u3'] } }] },
+            select: { id: true },
+        });
+        expect(resolved.filters.owner).toEqual({ kind: 'visible', ids: new Set(['u1', 'u2']) });
+    });
+    it('recurses into nested trees, flattening rows reached through a to-many hop into one batch', async () => {
+        const ownerFindMany = vi.fn().mockResolvedValue([{ id: 'u1' }]);
+        const context = {
+            session: null,
+            _isSudo: false,
+            _resolveOutputChain: [],
+            prisma: { owner: { findMany: ownerFindMany } },
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal context for unit test
+        };
+        const tree = {
+            filters: {},
+            nested: {
+                children: {
+                    filters: {
+                        owner: {
+                            kind: 'scoped',
+                            relatedListName: 'Owner',
+                            accessWhere: { id: { equals: 'u1' } },
+                        },
+                    },
+                    nested: {},
+                },
+            },
+        };
+        const items = [
+            {
+                id: 'p1',
+                children: [
+                    { id: 'c1', owner: { id: 'u1' } },
+                    { id: 'c2', owner: { id: 'u9' } },
+                ],
+            },
+            { id: 'p2', children: [{ id: 'c3', owner: { id: 'u1' } }] },
+        ];
+        const resolved = await resolveToOneAccessVisibility(items, tree, { session: null, context });
+        // Every child across BOTH parents resolved in one batched call.
+        expect(ownerFindMany).toHaveBeenCalledTimes(1);
+        expect(ownerFindMany).toHaveBeenCalledWith({
+            where: { AND: [{ id: { equals: 'u1' } }, { id: { in: ['u1', 'u9'] } }] },
+            select: { id: true },
+        });
+        expect(resolved.nested.children.filters.owner).toEqual({
+            kind: 'visible',
+            ids: new Set(['u1']),
+        });
+    });
+});
+/**
+ * Regression coverage for issue #1082: a list-only `ref` (`ref: 'Term'`, no
+ * target field) makes schema generation synthesize a back-relation on `Term`
+ * (`from_Bill_term`) that no list config declares. Before this fix,
+ * `buildAccessScopedInclude` treated any key it couldn't resolve to a
+ * DECLARED relationship as "not governed by access control" and passed it
+ * through unchanged — so a caller naming `from_Bill_term` in `include`
+ * bypassed `Bill`'s own `query` access entirely. These tests pin the fix: a
+ * synthetic key is scoped exactly like the declared relationship field it
+ * stands for.
+ */
+describe('buildAccessScopedInclude — synthetic back-relation (#1082)', () => {
+    // Term ← Bill.term (list-only ref) ← Bill.lineItems (declared, to-many).
+    // `from_Bill_term` is the back-relation schema generation synthesizes on
+    // Term; nothing in `Term.fields` declares it.
+    function syntheticConfig(billQuery) {
+        const config = {
+            db: { provider: 'sqlite' },
+            lists: {
+                Term: {
+                    fields: { name: { type: 'text' } },
+                    access: { operation: { query: () => true } },
+                },
+                Bill: {
+                    fields: {
+                        amount: { type: 'integer' },
+                        term: rel('Term'), // list-only ref — synthesizes `from_Bill_term` on Term
+                        lineItems: rel('LineItem.bill', true),
+                    },
+                    access: { operation: { query: billQuery } },
+                },
+                LineItem: {
+                    fields: { sku: { type: 'text' }, bill: rel('Bill.lineItems') },
+                    access: { operation: { query: () => true } },
+                },
+            },
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+        };
+        return config;
+    }
+    it('drops the relation entirely when the owning list denies query access', async () => {
+        const config = syntheticConfig(() => false);
+        const { include } = await buildAccessScopedInclude({ from_Bill_term: true }, config.lists.Term.fields, { session: null, context: makeContext() }, config, 'Term');
+        expect(include).toEqual({});
+    });
+    it('AND-folds the owning list access filter with the caller-supplied where', async () => {
+        const config = syntheticConfig(() => ({ paid: { equals: true } }));
+        const { include } = await buildAccessScopedInclude({ from_Bill_term: { where: { amount: { gt: 10 } } } }, config.lists.Term.fields, { session: null, context: makeContext() }, config, 'Term');
+        expect(include).toEqual({
+            from_Bill_term: {
+                where: { AND: [{ paid: { equals: true } }, { amount: { gt: 10 } }] },
+            },
+        });
+    });
+    it('scopes a nested include against the OWNING list fields and consumes depth', async () => {
+        const config = syntheticConfig(() => true);
+        const lineItemQuery = vi.fn(() => true);
+        config.lists.LineItem.access = { operation: { query: lineItemQuery } };
+        const { include } = await buildAccessScopedInclude({ from_Bill_term: { include: { lineItems: true } } }, config.lists.Term.fields, { session: null, context: makeContext() }, config, 'Term');
+        // The nested `lineItems` key was resolved against Bill's own fields (not
+        // Term's, which has no `lineItems` field at all) — proof the recursion
+        // used the owning list, not the synthetic key's declaring list.
+        expect(lineItemQuery).toHaveBeenCalledTimes(1);
+        expect(include).toEqual({ from_Bill_term: { include: { lineItems: true } } });
+    });
+    it('a synthetic hop counts toward the read-include depth cap the same as a declared one', async () => {
+        // A chain like `chainConfig` builds (L0 ↔ L1 ↔ … via declared `next`/`prev`),
+        // except the FIRST hop is synthetic: L1's `prev` is a list-only ref, so L0
+        // never declares `next` at all — it only gets `from_L1_prev` synthesized
+        // onto it. Every hop past that first one is declared, exactly matching the
+        // mixed synthetic-then-declared case the depth cap must bound identically.
+        const chainLength = READ_INCLUDE_MAX_DEPTH + 2;
+        const { config } = chainConfig(chainLength);
+        delete config.lists.L0.fields.next;
+        config.lists.L1.fields.prev = rel('L0');
+        // Outer `from_L1_prev` (hop 1) + nestedInclude(HOPS_AT_CAP) (HOPS_AT_CAP
+        // more, via the declared `next` chain from L1 onward) = HOPS_AT_CAP + 1.
+        const requested = { from_L1_prev: nestedInclude(READ_INCLUDE_MAX_DEPTH) };
+        await expect(buildAccessScopedInclude(requested, config.lists.L0.fields, { session: null, context: makeContext() }, config, 'L0')).rejects.toThrow(AccessScopeDepthExceededError);
+    });
+    it('still resolves a synthetic hop one level shallower than the cap', async () => {
+        const chainLength = READ_INCLUDE_MAX_DEPTH + 1;
+        const { config } = chainConfig(chainLength);
+        delete config.lists.L0.fields.next;
+        config.lists.L1.fields.prev = rel('L0');
+        const requested = { from_L1_prev: nestedInclude(READ_INCLUDE_MAX_DEPTH - 1) };
+        const { include } = await buildAccessScopedInclude(requested, config.lists.L0.fields, { session: null, context: makeContext() }, config, 'L0');
+        expect(includeDepth(include)).toBe(READ_INCLUDE_MAX_DEPTH);
+    });
+    it('rejects a key that resolves to neither a declared relationship nor a synthetic one', async () => {
+        const config = syntheticConfig(() => true);
+        await expect(buildAccessScopedInclude({ from_Nonexistent_field: true }, config.lists.Term.fields, { session: null, context: makeContext() }, config, 'Term')).rejects.toThrow(UndeclaredIncludeKeyError);
+    });
+});
+/**
+ * Regression coverage for issue #1092: a `where`/`orderBy` a caller nests
+ * inside an `include` entry reached Prisma with neither #912's key-existence
+ * check nor #915's field-read check — a probing oracle over exactly the
+ * fields those two tickets close one level up. `secret`/`secretNote` below
+ * deny field-level `read` outright; every other field is a normal declared
+ * field, so a throw in these tests can only come from the new validation.
+ */
+describe('buildAccessScopedInclude — nested where/orderBy validation (#1092)', () => {
+    function blogConfig() {
+        return {
+            db: { provider: 'sqlite' },
+            lists: {
+                Author: {
+                    fields: {
+                        name: { type: 'text' },
+                        posts: rel('Post.author', true),
+                    },
+                    access: { operation: { query: () => true } },
+                },
+                Post: {
+                    fields: {
+                        title: { type: 'text' },
+                        secret: { type: 'text', access: { read: () => false } },
+                        author: rel('Author.posts'),
+                        comments: rel('Comment.post', true),
+                    },
+                    access: { operation: { query: () => true } },
+                },
+                Comment: {
+                    fields: {
+                        body: { type: 'text' },
+                        secretNote: { type: 'text', access: { read: () => false } },
+                        post: rel('Post.comments'),
+                    },
+                    access: { operation: { query: () => true } },
+                },
+            },
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+        };
+    }
+    it('throws when a nested `where` names a field the session cannot read', async () => {
+        const config = blogConfig();
+        await expect(buildAccessScopedInclude({ posts: { where: { secret: { equals: 'x' } } } }, config.lists.Author.fields, { session: null, context: makeContext() }, config, 'Author')).rejects.toThrow(ValidationError);
+        await expect(buildAccessScopedInclude({ posts: { where: { secret: { equals: 'x' } } } }, config.lists.Author.fields, { session: null, context: makeContext() }, config, 'Author')).rejects.toThrow(/"secret" is denied by field-level read access/);
+    });
+    it('throws when a nested `where` names a key the related list does not declare, naming the related list and key', async () => {
+        const config = blogConfig();
+        await expect(buildAccessScopedInclude({ posts: { where: { bogusField: { equals: 'x' } } } }, config.lists.Author.fields, { session: null, context: makeContext() }, config, 'Author')).rejects.toThrow(/Cannot query "Post" — "bogusField" is not a field of this list/);
+    });
+    it('applies the same two checks to a nested `orderBy`', async () => {
+        const config = blogConfig();
+        await expect(buildAccessScopedInclude({ posts: { orderBy: { secret: 'asc' } } }, config.lists.Author.fields, { session: null, context: makeContext() }, config, 'Author')).rejects.toThrow(ValidationError);
+        await expect(buildAccessScopedInclude({ posts: { orderBy: { bogusField: 'asc' } } }, config.lists.Author.fields, { session: null, context: makeContext() }, config, 'Author')).rejects.toThrow(/Cannot query "Post"/);
+    });
+    it('resolves against the RELATED list, not the current one — a key valid on the parent but not the related list is rejected', async () => {
+        const config = blogConfig();
+        // `name` is declared on Author, not on Post — validating against the
+        // wrong list would let this through.
+        await expect(buildAccessScopedInclude({ posts: { where: { name: { equals: 'x' } } } }, config.lists.Author.fields, { session: null, context: makeContext() }, config, 'Author')).rejects.toThrow(/Cannot query "Post" — "name"/);
+    });
+    it('recurses through AND/OR/NOT', async () => {
+        const config = blogConfig();
+        await expect(buildAccessScopedInclude({
+            posts: {
+                where: { AND: [{ title: { contains: 'x' } }, { OR: [{ secret: { equals: 'x' } }] }] },
+            },
+        }, config.lists.Author.fields, { session: null, context: makeContext() }, config, 'Author')).rejects.toThrow(ValidationError);
+    });
+    it("the key-existence check recurses through a relation quantifier nested inside the entry's own where", async () => {
+        // #912's existence check (`validateQueryKeys`) is the reused #912/#915
+        // top-level walker, which already recurses through a relation quantifier
+        // regardless of caller position — an undeclared key nested that deep
+        // still rejects, naming the list it actually resolved against (Comment,
+        // not Post).
+        const config = blogConfig();
+        await expect(buildAccessScopedInclude({ posts: { where: { comments: { some: { bogusField: { equals: 'x' } } } } } }, config.lists.Author.fields, { session: null, context: makeContext() }, config, 'Author')).rejects.toThrow(/Cannot query "Comment" — "bogusField"/);
+    });
+    it("scopes a relation quantifier nested inside the entry's own where against the DEEPER related list — a read-denied field one hop further out still throws (#916)", async () => {
+        // Without this, #1092's fix would only move the oracle one hop further
+        // out instead of closing it: `posts: { where: { comments: { some: {...} } } }`
+        // names Comment, a list the entry's own #912/#915 checks never reach —
+        // only `buildAccessScopedWhere` (#916), reused here, does.
+        const config = blogConfig();
+        await expect(buildAccessScopedInclude({ posts: { where: { comments: { some: { secretNote: { equals: 'x' } } } } } }, config.lists.Author.fields, { session: null, context: makeContext() }, config, 'Author')).rejects.toThrow(/Cannot query "Comment" — "secretNote"/);
+    });
+    it("folds the deeper related list's own query access into a relation quantifier nested inside the entry's own where", async () => {
+        const config = blogConfig();
+        config.lists.Comment.access = {
+            operation: { query: () => ({ approved: { equals: true } }) },
+        };
+        const { include } = await buildAccessScopedInclude({ posts: { where: { comments: { some: { body: { contains: 'hi' } } } } } }, config.lists.Author.fields, { session: null, context: makeContext() }, config, 'Author');
+        expect(include).toEqual({
+            posts: {
+                where: {
+                    comments: {
+                        some: { AND: [{ approved: { equals: true } }, { body: { contains: 'hi' } }] },
+                    },
+                },
+            },
+        });
+    });
+    it("throws when the deeper related list denies query access outright, matching #916's loud failure", async () => {
+        const config = blogConfig();
+        config.lists.Comment.access = { operation: { query: () => false } };
+        await expect(buildAccessScopedInclude({ posts: { where: { comments: { some: { body: { contains: 'hi' } } } } } }, config.lists.Author.fields, { session: null, context: makeContext() }, config, 'Author')).rejects.toThrow(RelationFilterAccessDeniedError);
+    });
+    it('recurses through a further nested include, at every level the walk reaches', async () => {
+        const config = blogConfig();
+        await expect(buildAccessScopedInclude({ posts: { include: { comments: { where: { secretNote: { equals: 'x' } } } } } }, config.lists.Author.fields, { session: null, context: makeContext() }, config, 'Author')).rejects.toThrow(/Cannot query "Comment" — "secretNote"/);
+    });
+    it('accepts a foreign-key scalar a to-one relationship implies, matching the top-level resolver', async () => {
+        const config = blogConfig();
+        await expect(buildAccessScopedInclude({ posts: { where: { authorId: { equals: 'a1' } } } }, config.lists.Author.fields, { session: null, context: makeContext() }, config, 'Author')).resolves.not.toThrow();
+    });
+    it('leaves a legitimate nested where over readable, declared fields unchanged, still AND-combined with the access filter', async () => {
+        const config = blogConfig();
+        config.lists.Post.access = { operation: { query: () => ({ published: { equals: true } }) } };
+        const { include } = await buildAccessScopedInclude({ posts: { where: { title: { contains: 'hello' } } } }, config.lists.Author.fields, { session: null, context: makeContext() }, config, 'Author');
+        expect(include).toEqual({
+            posts: {
+                where: { AND: [{ published: { equals: true } }, { title: { contains: 'hello' } }] },
+            },
+        });
+    });
+    it('equivalence: the same read-denied predicate throws whether it names the current list, a relation quantifier, or an include-nested where', async () => {
+        // Mirrors the triage comment's three-position table for #1092 — the
+        // include-nested position (the one gap) now matches the other two.
+        const config = blogConfig();
+        await expect(buildAccessScopedInclude({ posts: { where: { secret: { equals: 'x' } } } }, config.lists.Author.fields, { session: null, context: makeContext() }, config, 'Author')).rejects.toThrow(ValidationError);
+    });
+    describe('synthetic back-relation nested in a where (#1082 interaction)', () => {
+        function syntheticNestedConfig() {
+            const config = {
+                db: { provider: 'sqlite' },
+                lists: {
+                    Company: {
+                        fields: {
+                            name: { type: 'text' },
+                            terms: rel('Term', true),
+                        },
+                        access: { operation: { query: () => true } },
+                    },
+                    Term: {
+                        fields: { name: { type: 'text' } },
+                        access: { operation: { query: () => true } },
+                    },
+                    Bill: {
+                        fields: {
+                            amount: { type: 'integer' },
+                            term: rel('Term'), // list-only ref — synthesizes `from_Bill_term` on Term
+                        },
+                        access: { operation: { query: () => true } },
+                    },
+                },
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+            };
+            return config;
+        }
+        it('does not throw for a nested predicate naming a synthetic back-relation', async () => {
+            const config = syntheticNestedConfig();
+            await expect(buildAccessScopedInclude({ terms: { where: { from_Bill_term: { some: { amount: { gt: 5 } } } } } }, config.lists.Company.fields, { session: null, context: makeContext() }, config, 'Company')).resolves.not.toThrow();
+        });
+        it("recurses into the synthetic's own SOURCE list — an invalid key nested under it still throws, naming that list", async () => {
+            const config = syntheticNestedConfig();
+            await expect(buildAccessScopedInclude({ terms: { where: { from_Bill_term: { some: { bogusField: { equals: 'x' } } } } } }, config.lists.Company.fields, { session: null, context: makeContext() }, config, 'Company')).rejects.toThrow(/Cannot query "Bill" — "bogusField"/);
+        });
+        it("folds the synthetic's own SOURCE list's query access into the nested quantifier clause", async () => {
+            // Regression coverage for a Codex review finding on #1108: the deeper
+            // #916-style scoping originally only recognised a DECLARED
+            // relationship — a synthetic key's nested quantifier passed through
+            // with neither the source list's `query` access folded in nor its
+            // fields' read access checked, even though the shallow #912/#915
+            // checks (validateQueryKeys/validateQueryFieldReadAccess) already
+            // correctly tolerated and resolved the synthetic key itself.
+            const config = syntheticNestedConfig();
+            config.lists.Bill.access = { operation: { query: () => ({ paid: { equals: true } }) } };
+            const { include } = await buildAccessScopedInclude({ terms: { where: { from_Bill_term: { some: { amount: { gt: 5 } } } } } }, config.lists.Company.fields, { session: null, context: makeContext() }, config, 'Company');
+            expect(include).toEqual({
+                terms: {
+                    where: {
+                        from_Bill_term: {
+                            some: { AND: [{ paid: { equals: true } }, { amount: { gt: 5 } }] },
+                        },
+                    },
+                },
+            });
+        });
+        it('throws when a field nested under a synthetic quantifier is denied by field-level read access', async () => {
+            const config = syntheticNestedConfig();
+            config.lists.Bill.fields.secretAmount = {
+                type: 'integer',
+                access: { read: () => false },
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal field config for unit test
+            };
+            await expect(buildAccessScopedInclude({ terms: { where: { from_Bill_term: { some: { secretAmount: { gt: 5 } } } } } }, config.lists.Company.fields, { session: null, context: makeContext() }, config, 'Company')).rejects.toThrow(/"secretAmount" is denied by field-level read access/);
+        });
+        it("throws when the synthetic's own SOURCE list denies query access outright, matching #916's loud failure", async () => {
+            const config = syntheticNestedConfig();
+            config.lists.Bill.access = { operation: { query: () => false } };
+            await expect(buildAccessScopedInclude({ terms: { where: { from_Bill_term: { some: { amount: { gt: 5 } } } } } }, config.lists.Company.fields, { session: null, context: makeContext() }, config, 'Company')).rejects.toThrow(RelationFilterAccessDeniedError);
+        });
+    });
+    describe("a to-one relation's `is: null`/`isNot: null` inside a nested quantifier (Codex review finding on #1108)", () => {
+        // Root -> Parent (to-many, unscoped) -> Owner (to-one, query-scoped by a
+        // filter). Parent's own access is `true` (no filter), so the outer
+        // AND-fold is a no-op and cannot mask what this test is isolating: the
+        // fold that happens INSIDE the quantifier's own value.
+        function nullQuantifierConfig() {
+            return {
+                db: { provider: 'sqlite' },
+                lists: {
+                    Root: {
+                        fields: { name: { type: 'text' }, parent: rel('Parent', true) },
+                        access: { operation: { query: () => true } },
+                    },
+                    Parent: {
+                        fields: { name: { type: 'text' }, owner: rel('Owner') },
+                        access: { operation: { query: () => true } },
+                    },
+                    Owner: {
+                        fields: { name: { type: 'text' } },
+                        access: { operation: { query: () => ({ secret: { equals: true } }) } },
+                    },
+                },
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+            };
+        }
+        it('preserves `is: null` rather than inverting it into an access-filter match', async () => {
+            // Before this fix, folding the access filter into a quantifier's
+            // value unconditionally turned `is: null` ("has no related row") into
+            // `is: <accessWhere>` ("has a related row matching the filter") —
+            // the opposite of the caller's own predicate.
+            const config = nullQuantifierConfig();
+            const { include } = await buildAccessScopedInclude({ parent: { where: { owner: { is: null } } } }, config.lists.Root.fields, { session: null, context: makeContext() }, config, 'Root');
+            expect(include).toEqual({ parent: { where: { owner: { is: null } } } });
+        });
+        it('preserves `isNot: null` the same way', async () => {
+            const config = nullQuantifierConfig();
+            const { include } = await buildAccessScopedInclude({ parent: { where: { owner: { isNot: null } } } }, config.lists.Root.fields, { session: null, context: makeContext() }, config, 'Root');
+            expect(include).toEqual({ parent: { where: { owner: { isNot: null } } } });
+        });
     });
 });
 //# sourceMappingURL=access-filter.test.js.map