@opensaas/stack-core 0.40.0 → 0.41.0

package/src/access/query-validation.ts

@@ -46,6 +46,20 @@ import { ValidationError } from '../hooks/index.js'
  * deliberately no second copy of either the shape-recognition or the
  * field-read check: `access-filter.ts` supplies the RELATED list at each
  * hop and calls back into the same primitives this module already owns.
+ *
+ * #1092 — `validateQueryKeys` is also the include-nested counterpart: a
+ * `where`/`orderBy` a caller nests inside an `include` entry gets the same
+ * #912 check, called by `buildAccessScopedInclude` against the RELATED list
+ * instead of the current one — no second key-existence walker for that
+ * position. `validateQueryFieldReadAccess` needs no equivalent call there:
+ * `checkKeyReadableOrThrow` already treats a key `resolveQueryField` cannot
+ * resolve as "already handled elsewhere" and skips it, which is exactly the
+ * synthetic-back-relation tolerance below needs — nothing to change. The one
+ * thing this position needs that the top-level `where`/`orderBy` never did:
+ * a key neither call resolves is tried against the optional
+ * `resolveSyntheticRelation` hook before being rejected, because a synthetic
+ * back-relation (#1082) is nameable in a nested predicate too. Every
+ * existing caller omits the hook, so top-level behavior is unchanged.
  */
 
 // Prisma's logical combinators for a WHERE clause — never field names.
@@ -68,6 +82,23 @@ export interface ResolvedQueryField {
   isRelationship: boolean
 }
 
+/**
+ * Where an unresolved key's nested predicate should recurse when it turns out
+ * to name a synthetic back-relation (#1082) rather than a declared field —
+ * the source list the back-relation stands for, NOT `getRelatedListConfig`'s
+ * target (a synthetic field carries no `ref` of its own to follow).
+ */
+export interface SyntheticRelationTarget {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+  listConfig: ListConfig<any>
+  listName: string
+}
+
+export type ResolveSyntheticRelation = (
+  key: string,
+  listName: string,
+) => SyntheticRelationTarget | null
+
 /**
  * Resolve a `where`/`orderBy` key against a list's declared fields.
  *
@@ -133,22 +164,61 @@ function walkWhere(
   listName: string,
   config: OpenSaasConfig,
   isSudo: boolean,
+  resolveSyntheticRelation?: ResolveSyntheticRelation,
 ): void {
   if (where === null || typeof where !== 'object') return
 
   if (Array.isArray(where)) {
-    for (const entry of where) walkWhere(entry, listConfig, listName, config, isSudo)
+    for (const entry of where) {
+      walkWhere(entry, listConfig, listName, config, isSudo, resolveSyntheticRelation)
+    }
     return
   }
 
   for (const [key, value] of Object.entries(where as Record<string, unknown>)) {
     if (LOGICAL_OPERATORS.has(key)) {
-      walkWhere(value, listConfig, listName, config, isSudo)
+      walkWhere(value, listConfig, listName, config, isSudo, resolveSyntheticRelation)
       continue
     }
 
     const resolved = resolveQueryField(key, listConfig.fields)
     if (!resolved) {
+      const synthetic = resolveSyntheticRelation?.(key, listName)
+      if (synthetic) {
+        // A synthetic back-relation is always to-many (#1082's own
+        // construction site has no arity branch), so its nested value takes
+        // the same two shapes a declared to-many relationship's filter does
+        // — walk it exactly like the resolved-relationship branch below,
+        // against the synthetic's source list instead of `getRelatedListConfig`.
+        if (value !== null && typeof value === 'object' && !Array.isArray(value)) {
+          const syntheticEntries = Object.entries(value as Record<string, unknown>)
+          const syntheticHasQuantifier = syntheticEntries.some(([k]) => RELATION_QUANTIFIERS.has(k))
+          if (syntheticHasQuantifier) {
+            for (const [quantifier, quantifierValue] of syntheticEntries) {
+              if (RELATION_QUANTIFIERS.has(quantifier)) {
+                walkWhere(
+                  quantifierValue,
+                  synthetic.listConfig,
+                  synthetic.listName,
+                  config,
+                  isSudo,
+                  resolveSyntheticRelation,
+                )
+              }
+            }
+          } else {
+            walkWhere(
+              value,
+              synthetic.listConfig,
+              synthetic.listName,
+              config,
+              isSudo,
+              resolveSyntheticRelation,
+            )
+          }
+        }
+        continue
+      }
       if (isSudo) continue
       rejectUndeclaredKey(listName, key, 'where')
     }
@@ -175,7 +245,14 @@ function walkWhere(
         // related list.
         for (const [quantifier, quantifierValue] of relationEntries) {
           if (RELATION_QUANTIFIERS.has(quantifier)) {
-            walkWhere(quantifierValue, related.listConfig, related.listName, config, isSudo)
+            walkWhere(
+              quantifierValue,
+              related.listConfig,
+              related.listName,
+              config,
+              isSudo,
+              resolveSyntheticRelation,
+            )
           }
         }
       } else {
@@ -185,7 +262,14 @@ function walkWhere(
         // whole value object IS the nested WHERE clause here — walk it
         // directly, or an undeclared key reached exactly this way (one hop
         // through a to-one relation) would pass through unchecked.
-        walkWhere(value, related.listConfig, related.listName, config, isSudo)
+        walkWhere(
+          value,
+          related.listConfig,
+          related.listName,
+          config,
+          isSudo,
+          resolveSyntheticRelation,
+        )
       }
     }
   }
@@ -198,17 +282,41 @@ function walkOrderBy(
   listName: string,
   config: OpenSaasConfig,
   isSudo: boolean,
+  resolveSyntheticRelation?: ResolveSyntheticRelation,
 ): void {
   if (orderBy === null || typeof orderBy !== 'object') return
 
   if (Array.isArray(orderBy)) {
-    for (const entry of orderBy) walkOrderBy(entry, listConfig, listName, config, isSudo)
+    for (const entry of orderBy) {
+      walkOrderBy(entry, listConfig, listName, config, isSudo, resolveSyntheticRelation)
+    }
     return
   }
 
   for (const [key, value] of Object.entries(orderBy as Record<string, unknown>)) {
     const resolved = resolveQueryField(key, listConfig.fields)
     if (!resolved) {
+      const synthetic = resolveSyntheticRelation?.(key, listName)
+      if (synthetic) {
+        // `{ relation: { _count: 'asc' } }` orders by an aggregate — no
+        // nested field name to resolve, matching the declared-relationship
+        // branch below.
+        if (
+          value !== null &&
+          typeof value === 'object' &&
+          !('_count' in (value as Record<string, unknown>))
+        ) {
+          walkOrderBy(
+            value,
+            synthetic.listConfig,
+            synthetic.listName,
+            config,
+            isSudo,
+            resolveSyntheticRelation,
+          )
+        }
+        continue
+      }
       if (isSudo) continue
       rejectUndeclaredKey(listName, key, 'orderBy')
     }
@@ -220,7 +328,16 @@ function walkOrderBy(
       if ('_count' in (value as Record<string, unknown>)) continue
 
       const related = getRelatedListConfig(resolved.fieldConfig.ref, config)
-      if (related) walkOrderBy(value, related.listConfig, related.listName, config, isSudo)
+      if (related) {
+        walkOrderBy(
+          value,
+          related.listConfig,
+          related.listName,
+          config,
+          isSudo,
+          resolveSyntheticRelation,
+        )
+      }
     }
   }
 }
@@ -231,6 +348,11 @@ function walkOrderBy(
  * Throws a `ValidationError` naming the list and the offending key on the
  * first undeclared key found. `isSudo` bypasses the check entirely, matching
  * the write path's `sudo` escape hatch.
+ *
+ * `resolveSyntheticRelation` is the include-nested position's own addition
+ * (#1092, see module doc comment) — omit it (every top-level `where`/`orderBy`
+ * caller does) and a key `resolveQueryField` can't resolve rejects exactly as
+ * before.
  */
 export function validateQueryKeys(args: {
   where?: unknown
@@ -240,10 +362,15 @@ export function validateQueryKeys(args: {
   listName: string
   config: OpenSaasConfig
   isSudo: boolean
+  resolveSyntheticRelation?: ResolveSyntheticRelation
 }): void {
-  const { where, orderBy, listConfig, listName, config, isSudo } = args
-  if (where !== undefined) walkWhere(where, listConfig, listName, config, isSudo)
-  if (orderBy !== undefined) walkOrderBy(orderBy, listConfig, listName, config, isSudo)
+  const { where, orderBy, listConfig, listName, config, isSudo, resolveSyntheticRelation } = args
+  if (where !== undefined) {
+    walkWhere(where, listConfig, listName, config, isSudo, resolveSyntheticRelation)
+  }
+  if (orderBy !== undefined) {
+    walkOrderBy(orderBy, listConfig, listName, config, isSudo, resolveSyntheticRelation)
+  }
 }
 
 /**

package/src/access/relationship-count.test.ts

@@ -111,6 +111,41 @@ describe('buildRelationshipCountSelect', () => {
     )
     expect(select).toBeUndefined()
   })
+
+  // Issue #1111: a relationship hidden via field-level `read` access must not
+  // leak its true count, even when the related list's rows are otherwise
+  // fully readable — the same denial an ordinary `include` of that field
+  // already gets from `filterReadableFields`'s `checkFieldAccess` call.
+  it('omits a relation whose field-level `read` access denies it, even though the related list is fully readable', async () => {
+    const config: OpenSaasConfig = {
+      db: { provider: 'sqlite', prismaClientConstructor: () => null as never },
+      lists: {
+        User: list({
+          fields: {
+            name: text(),
+            posts: relationship({
+              ref: 'Post.author',
+              many: true,
+              access: { read: () => false },
+            }),
+          },
+          access: { operation: { query: () => true } },
+        }),
+        Post: list({
+          fields: { title: text(), author: relationship({ ref: 'User.posts' }) },
+          access: { operation: { query: () => true } },
+        }),
+      },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+    } as any
+
+    const select = await buildRelationshipCountSelect(
+      config.lists.User,
+      { session: null, context: makeContext() },
+      config,
+    )
+    expect(select).toBeUndefined()
+  })
 })
 
 describe('resolveRelationshipCountFilters', () => {
@@ -186,6 +221,46 @@ describe('resolveRelationshipCountFilters', () => {
     expect(findMany).not.toHaveBeenCalled()
   })
 
+  // Issue #1111: a relationship denied at the FIELD level (as opposed to the
+  // related list's operation-level `query` access, covered above) must also
+  // resolve to "always 0, no query needed" — the related list here (Post) is
+  // otherwise fully readable, so only the field-level check on `posts` itself
+  // can be what's denying it.
+  it('resolves a field-level-denied relationship without any query: count is always 0', async () => {
+    const config: OpenSaasConfig = {
+      db: { provider: 'sqlite', prismaClientConstructor: () => null as never },
+      lists: {
+        User: list({
+          fields: {
+            name: text(),
+            posts: relationship({
+              ref: 'Post.author',
+              many: true,
+              access: { read: () => false },
+            }),
+          },
+          access: { operation: { query: () => true } },
+        }),
+        Post: list({
+          fields: { title: text(), author: relationship({ ref: 'User.posts' }) },
+          access: { operation: { query: () => true } },
+        }),
+      },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+    } as any
+    const findMany = vi.fn(async () => [])
+    const where = { posts: { [RELATIONSHIP_COUNT_FILTER_KEY]: { operator: 'gt', value: 0 } } }
+    const resolved = await resolveRelationshipCountFilters(
+      where,
+      config.lists.User,
+      'User',
+      { session: null, context: makeContext(findMany) },
+      config,
+    )
+    expect(resolved).toEqual({ id: { in: [] } })
+    expect(findMany).not.toHaveBeenCalled()
+  })
+
   it('preserves sibling conditions, ANDing the resolved id constraint', async () => {
     const config = makeConfig()
     const findMany = vi.fn(async () => [{ id: 'u2', _count: { posts: 7 } }])

package/src/access/relationship-count.ts

@@ -1,8 +1,9 @@
-import type { Session, AccessContext, PrismaFilter } from './types.js'
+import type { Session, AccessContext, PrismaFilter, FieldAccess } from './types.js'
 import type { OpenSaasConfig, ListConfig, FieldConfig } from '../config/types.js'
 import type { FilterOperator, RelationshipCountFilterMarker } from '../filter/types.js'
 import { RELATIONSHIP_COUNT_FILTER_KEY } from '../filter/types.js'
 import { checkAccess, getRelatedListConfig } from './engine.js'
+import { isFieldReadableForPredicate } from './field-access.js'
 import { getDbKey } from '../lib/case-utils.js'
 
 /**
@@ -14,8 +15,10 @@ import { getDbKey } from '../lib/case-utils.js'
  * `_count` (`_count: { select: { orders: { where: <access filter> } } }`), so no
  * per-row query is issued and the count can never include rows the session
  * cannot read. This module is the single place the related list's
- * operation-level `query` access is folded into that `_count`, mirroring how
- * `buildAccessScopedInclude` folds it into relation includes.
+ * operation-level `query` access, AND the counting list's own field-level
+ * `read` access on the relationship field being counted (issue #1111), are
+ * folded into that `_count`, mirroring how `buildAccessScopedInclude` folds
+ * both into relation includes.
  *
  * It also resolves the count Filter spec's markers: Prisma cannot compare a
  * relation count in a `where`, so a to-many relationship's Filter spec emits a
@@ -46,11 +49,56 @@ export function isToManyRelationshipField(field: FieldConfig | undefined): boole
 }
 
 /** The per-relation entry the count `_count.select` uses for one relationship. */
-type CountAccessEntry =
+export type CountAccessEntry =
   | { kind: 'all' } // related list fully readable → count every related row
   | { kind: 'scoped'; where: PrismaFilter } // count only rows matching the access filter
   | { kind: 'denied' } // related list not readable at all → count is always 0
 
+/**
+ * Resolve one related list's operation-level `query` access, and — when the
+ * counting list has a field of its own for the relationship being counted —
+ * that field's own field-level `read` access, into the entry its `_count`
+ * select needs. The shared decision both `relationshipCountAccessEntry` below
+ * (field → related list, for this module's own admin-list-view and
+ * count-filter callers) and `access-filter.ts`'s caller-`_count` scoping
+ * (issue #1087, which already has the related list resolved — including a
+ * synthetic back-relation's, which has no field of its own on the counting
+ * list) build on.
+ *
+ * `fieldAccess` is the COUNTING list's own relationship field access — not
+ * the related list's — mirroring the check `filterReadableFields`
+ * (`field-visibility.ts`) runs before returning an ordinary `include` of that
+ * same field (issue #1111: a `_count` used to leak the true count of a
+ * relationship whose field-level `read` access denied the relationship
+ * itself, even when the related list's own rows were otherwise fully
+ * readable). Evaluated via `isFieldReadableForPredicate` — the pre-query
+ * evaluator #915 already built for the identical problem on `where`/`orderBy`
+ * — since there is no fetched row yet at `_count`-select-build time; a rule
+ * that depends on one denies here, the same as it would there. Checked BEFORE
+ * the related list's `query` access so a field-level denial short-circuits
+ * without needing the related list's access rule at all. Omitted entirely
+ * (`undefined`) for a synthetic back-relation, which has no field of its own
+ * on the counting list to evaluate.
+ */
+export async function resolveCountAccessEntryForList(
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+  relatedListConfig: ListConfig<any>,
+  args: CountArgs,
+  fieldAccess?: FieldAccess,
+): Promise<CountAccessEntry> {
+  if (fieldAccess) {
+    const canReadField = await isFieldReadableForPredicate(fieldAccess, args)
+    if (!canReadField) return { kind: 'denied' }
+  }
+
+  const queryAccess = relatedListConfig.access?.operation?.query
+  const result = await checkAccess(queryAccess, { session: args.session, context: args.context })
+
+  if (result === false) return { kind: 'denied' }
+  if (typeof result === 'object') return { kind: 'scoped', where: result }
+  return { kind: 'all' }
+}
+
 /**
  * Resolve the related list's operation-level `query` access for one to-many
  * relationship into the entry its `_count` select needs. Returns `null` when the
@@ -69,12 +117,7 @@ async function relationshipCountAccessEntry(
   const related = getRelatedListConfig(ref, config)
   if (!related) return null
 
-  const queryAccess = related.listConfig.access?.operation?.query
-  const result = await checkAccess(queryAccess, { session: args.session, context: args.context })
-
-  if (result === false) return { kind: 'denied' }
-  if (typeof result === 'object') return { kind: 'scoped', where: result }
-  return { kind: 'all' }
+  return resolveCountAccessEntryForList(related.listConfig, args, field.access)
 }
 
 /**

package/src/access/synthetic-include-read.test.ts

@@ -0,0 +1,179 @@
+import { describe, it, expect } from 'vitest'
+import { filterReadableFields } from './field-visibility.js'
+import type { OpenSaasConfig, FieldConfig } from '../config/types.js'
+import type { AccessContext } from './types.js'
+
+/**
+ * Regression coverage for issue #1082, Field Visibility half.
+ *
+ * `access-filter.test.ts` covers the pre-query scoping of a synthetic
+ * back-relation (`buildAccessScopedInclude`); these tests cover what happens
+ * to the rows it fetches. Before this fix, `filterReadableFields` recognised
+ * only a DECLARED relationship field (`fieldConfig?.type === 'relationship'`)
+ * as something to recurse into — a synthetic key has no declared field on the
+ * list it's fetched through, so it fell to the generic non-relationship
+ * branch and was copied into the result verbatim: no field-level `read` gate
+ * on the related rows, and no virtual field computed on them.
+ */
+
+// A relationship field pointing at another list.
+function rel(ref: string, many = false): FieldConfig {
+  return { type: 'relationship', ref, many } as unknown as FieldConfig
+}
+
+// A virtual field computed via resolveOutput.
+function virtualField(
+  resolveOutput: (args: { item: Record<string, unknown> }) => unknown,
+): FieldConfig {
+  return {
+    type: 'virtual',
+    virtual: true,
+    hooks: { resolveOutput },
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal field config for unit test
+  } as any as FieldConfig
+}
+
+function makeContext(): AccessContext {
+  return {
+    session: null,
+    _isSudo: false,
+    _resolveOutputChain: [],
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal context for unit test
+  } as any
+}
+
+// Term ← Bill.term (list-only ref, no field on Term) — schema generation
+// synthesizes `from_Bill_term` on Term, which no list config declares.
+function syntheticConfig(): OpenSaasConfig {
+  return {
+    db: { provider: 'sqlite' },
+    lists: {
+      Term: {
+        fields: { name: { type: 'text' } as FieldConfig },
+        access: { operation: { query: () => true } },
+      },
+      Bill: {
+        fields: {
+          amount: { type: 'integer' } as FieldConfig,
+          term: rel('Term'),
+          internalNotes: {
+            type: 'text',
+            access: { read: () => false },
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal field config for unit test
+          } as any as FieldConfig,
+          label: virtualField(({ item }) => `Bill #${item.amount}`),
+        },
+        access: { operation: { query: () => true } },
+      },
+    },
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+  } as any as OpenSaasConfig
+}
+
+describe('filterReadableFields — synthetic back-relation (#1082)', () => {
+  it('applies the owning list field-level read access to rows fetched through a synthetic key', async () => {
+    const config = syntheticConfig()
+    const termRow = {
+      id: 't1',
+      name: 'Term 1',
+      from_Bill_term: [{ id: 'b1', amount: 5, internalNotes: 'secret' }],
+    }
+
+    const result = await filterReadableFields(
+      termRow,
+      config.lists.Term.fields,
+      { session: null, context: makeContext() },
+      config,
+      0,
+      'Term',
+    )
+
+    const bills = result.from_Bill_term as Record<string, unknown>[]
+    expect(bills).toHaveLength(1)
+    expect(bills[0].amount).toBe(5)
+    expect('internalNotes' in bills[0]).toBe(false)
+  })
+
+  it('computes a virtual field on rows fetched through a synthetic key', async () => {
+    const config = syntheticConfig()
+    const termRow = {
+      id: 't1',
+      name: 'Term 1',
+      from_Bill_term: [{ id: 'b1', amount: 5 }],
+    }
+
+    const result = await filterReadableFields(
+      termRow,
+      config.lists.Term.fields,
+      { session: null, context: makeContext() },
+      config,
+      0,
+      'Term',
+    )
+
+    const bills = result.from_Bill_term as Record<string, unknown>[]
+    expect(bills[0].label).toBe('Bill #5')
+  })
+
+  it('recurses through a to-one value fetched through a synthetic key the same as a to-many', async () => {
+    const config = syntheticConfig()
+    const termRow = {
+      id: 't1',
+      name: 'Term 1',
+      from_Bill_term: { id: 'b1', amount: 5, internalNotes: 'secret' },
+    }
+
+    const result = await filterReadableFields(
+      termRow,
+      config.lists.Term.fields,
+      { session: null, context: makeContext() },
+      config,
+      0,
+      'Term',
+    )
+
+    const bill = result.from_Bill_term as Record<string, unknown>
+    expect(bill.amount).toBe(5)
+    expect(bill.label).toBe('Bill #5')
+    expect('internalNotes' in bill).toBe(false)
+  })
+
+  it('leaves a declared, non-relationship field on the row untouched by the synthetic path', async () => {
+    // `name` is a declared scalar field on Term itself — the synthetic
+    // fallback only ever applies to a key ABSENT from `fieldConfigs`, so it
+    // must never interfere with the list's own ordinary fields.
+    const config = syntheticConfig()
+    const termRow = { id: 't1', name: 'Term 1' }
+
+    const result = await filterReadableFields(
+      termRow,
+      config.lists.Term.fields,
+      { session: null, context: makeContext() },
+      config,
+      0,
+      'Term',
+    )
+
+    expect(result).toEqual({ id: 't1', name: 'Term 1' })
+  })
+
+  it('leaves an undeclared, non-synthetic key untouched (no config supplied)', async () => {
+    // Mirrors the pre-#1082 narrow-unit-test contract: without `config`
+    // there is nothing to resolve a synthetic key against, so the field
+    // passes through as a plain value — the same fallback
+    // `filterWritableFields` documents for its own `config`-less callers.
+    const config = syntheticConfig()
+    const termRow = { id: 't1', name: 'Term 1', from_Bill_term: [{ id: 'b1', amount: 5 }] }
+
+    const result = await filterReadableFields(
+      termRow,
+      config.lists.Term.fields,
+      { session: null, context: makeContext() },
+      undefined,
+      0,
+      'Term',
+    )
+
+    expect(result.from_Bill_term).toEqual([{ id: 'b1', amount: 5 }])
+  })
+})