@stoker-platform/cli 0.5.137 → 0.5.138

package/lib/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stoker-platform/cli",
-    "version": "0.5.136",
+    "version": "0.5.137",
     "type": "module",
     "license": "SEE LICENSE IN LICENSE.md",
     "main": "./lib/src/main.js",

package/lib/src/lint/lintSchema.js

@@ -1,8 +1,73 @@
-import { tryPromise, getCustomization, getField, getInverseRelationType, isDependencyField, isRelationField, systemFields, isIncludedField, getSystemFieldsSchema, getAccessFields, getDependencyIndexFields, isPaginationEnabled, roleHasOperationAccess, tryFunction, getFieldCustomization, } from "@stoker-platform/utils";
+import { tryPromise, getCustomization, getField, getInverseRelationType, isDependencyField, isRelationField, systemFields, isIncludedField, getSystemFieldsSchema, getAccessFields, getDependencyIndexFields, getFieldAccessGroupFields, getFieldAccessRoles, isFieldAccessGroupReference, isPaginationEnabled, roleHasOperationAccess, tryFunction, getFieldCustomization, } from "@stoker-platform/utils";
 import { generateSchema } from "../deploy/schema/generateSchema.js";
 import { getCustomizationFiles } from "@stoker-platform/node-client";
 import { join } from "path";
 import { pathToFileURL } from "url";
+const lintFieldAccessCondition = (condition, label, collectionSchema, roles, errors, warnings, schema, options) => {
+    const checks = [
+        condition.collectionAuth !== undefined,
+        condition.roles !== undefined,
+        condition.claims !== undefined,
+        condition.restrictions !== undefined,
+    ].filter(Boolean).length;
+    if (checks === 0) {
+        errors.push(`${label} has no checks. At least one of collectionAuth, roles, claims or restrictions is required.`);
+    }
+    if (checks > 1 && condition.match === undefined) {
+        errors.push(`${label} has multiple checks but no explicit match. Set match to "any" or "all".`);
+    }
+    if (!condition.applicableRoles.length) {
+        errors.push(`${label} must include at least one applicable role`);
+    }
+    condition.applicableRoles.forEach((role) => {
+        if (!roles.includes(role)) {
+            errors.push(`${label} has an applicable role ${role} that does not exist`);
+        }
+        else if (options?.requireCollectionReadAccess && !roleHasOperationAccess(collectionSchema, role, "read")) {
+            errors.push(`${label} includes applicable role ${role}, but that role does not have collection read access`);
+        }
+    });
+    condition.roles?.forEach((role) => {
+        if (!roles.includes(role)) {
+            errors.push(`${label} has a role ${role} that does not exist`);
+        }
+        else if (!condition.applicableRoles.includes(role)) {
+            errors.push(`${label} has a role ${role} that is not included in applicable roles`);
+        }
+    });
+    if (condition.claims) {
+        const standardClaims = ["role", "doc", "collection", "tenant"];
+        const tokenFields = new Set();
+        Object.values(schema.collections).forEach((tokenCollection) => {
+            tokenCollection.fields
+                .filter((field) => field.saveToAuthToken)
+                .forEach((field) => tokenFields.add(field.name));
+        });
+        Object.keys(condition.claims).forEach((claim) => {
+            if (!standardClaims.includes(claim) && !tokenFields.has(claim)) {
+                warnings.push(`${label} references claim ${claim} which is not a standard claim or a saveToAuthToken field of an auth collection. Ensure the claim is set on the auth token.`);
+            }
+        });
+    }
+    if (condition.restrictions) {
+        const attributeTypes = collectionSchema.access.attributeRestrictions?.map((restriction) => restriction.type) || [];
+        const restrictionKeys = [
+            ["recordOwner", "Record_Owner"],
+            ["recordUser", "Record_User"],
+            ["recordProperty", "Record_Property"],
+        ];
+        restrictionKeys.forEach(([key, type]) => {
+            // eslint-disable-next-line security/detect-object-injection
+            if (condition.restrictions?.[key] !== undefined && !attributeTypes.includes(type)) {
+                errors.push(`${label} references restriction ${key} but the collection does not declare a ${type} attribute restriction`);
+            }
+        });
+        if (condition.restrictions.restrictEntities !== undefined &&
+            !collectionSchema.access.entityRestrictions?.restrictions) {
+            errors.push(`${label} references restriction restrictEntities but the collection does not declare entity restrictions`);
+        }
+    }
+};
 export const lintSchema = async (noLog = false) => {
     const path = join(process.cwd(), "lib", "main.js");
     const url = pathToFileURL(path).href;
@@ -132,6 +197,26 @@ export const lintSchema = async (noLog = false) => {
         const customization = customizationModules[collectionName];
         const readRoles = roles.filter((role) => roleHasOperationAccess(collectionSchema, role, "read"));
         const fieldNames = fields.map((field) => field.name);
+        if (collectionSchema.fieldAccessGroups) {
+            const groupFields = getFieldAccessGroupFields(collectionSchema);
+            const groupKeyRegex = /^[A-Za-z][A-Za-z0-9-]*$/;
+            for (const [groupKey, condition] of Object.entries(collectionSchema.fieldAccessGroups)) {
+                if (!groupKeyRegex.test(groupKey)) {
+                    errors.push(`Collection ${collectionName} has a field access group key ${groupKey} that is invalid. Keys must start with a letter and contain only letters, digits and hyphens.`);
+                }
+                if (fieldNames.includes(groupKey)) {
+                    errors.push(`Collection ${collectionName} has a field access group key ${groupKey} that collides with a field name`);
+                }
+                if (roles.includes(groupKey)) {
+                    errors.push(`Collection ${collectionName} has a field access group key ${groupKey} that collides with a role name`);
+                }
+                // eslint-disable-next-line security/detect-object-injection
+                if (!groupFields[groupKey]?.length) {
+                    warnings.push(`Collection ${collectionName} has a field access group ${groupKey} that is not referenced by any field`);
+                }
+                lintFieldAccessCondition(condition, `Collection ${collectionName} field access group ${groupKey}`, collectionSchema, roles, errors, warnings, schema, { requireCollectionReadAccess: true });
+            }
+        }
         const firestoreRegex = /^(?!\/)(?!.*\/)(?!\.$)(?!\.\.$)(?!__.*__)[^/\s]{1,1500}$/;
         if (!firestoreRegex.test(collectionName)) {
             errors.push(`Invalid collection name: ${collectionName}. Must be a valid Firestore collection ID.`);
@@ -285,13 +370,19 @@ export const lintSchema = async (noLog = false) => {
                             errors.push(`Collection ${collectionName} has a relation list field ${relation.field} that does not exist in collection ${relation.collection}`);
                         }
                         else {
-                            if (relation.roles) {
+                            if (isFieldAccessGroupReference(relationField.access)) {
+                                errors.push(`Collection ${collectionName} has a relation list field ${relation.field} for collection ${relation.collection} that is in a field access group. Field access group fields cannot be used as relation list fields.`);
+                            }
+                            else if (relation.roles) {
                                 for (const role of relation.roles) {
                                     if (!roles.includes(role)) {
                                         errors.push(`Collection ${collectionName} has a relation list field ${relation.field} for collection ${relation.collection} with role ${role} that does not exist`);
                                     }
-                                    if (relationField.access && !relationField.access.includes(role)) {
-                                        errors.push(`Collection ${collectionName} has a relation list field ${relation.field} for collection ${relation.collection} with role ${role} that does not have access to the field`);
+                                    if (relationField.access) {
+                                        const accessibleRoles = getFieldAccessRoles(relationField.access);
+                                        if (!accessibleRoles?.includes(role)) {
+                                            errors.push(`Collection ${collectionName} has a relation list field ${relation.field} for collection ${relation.collection} with role ${role} that does not have access to the field`);
+                                        }
                                     }
                                 }
                             }
@@ -334,9 +425,13 @@ export const lintSchema = async (noLog = false) => {
                     if (index > 0 && !rangeField.nullable) {
                         errors.push(`Collection ${collectionName} has a preload cache range field ${field} that must be nullable`);
                     }
-                    if (rangeField.access) {
+                    if (isFieldAccessGroupReference(rangeField.access)) {
+                        errors.push(`Collection ${collectionName} has a preload cache range field ${field} that is in a field access group. Field access group fields cannot be used as preload cache range fields.`);
+                    }
+                    else if (rangeField.access) {
                         preloadCache.roles.forEach((role) => {
-                            if (!rangeField.access?.includes(role)) {
+                            const accessibleRoles = getFieldAccessRoles(rangeField.access);
+                            if (!accessibleRoles?.includes(role)) {
                                 errors.push(`Collection ${collectionName} has a preload cache range field ${field} that can't be accessed by role ${role}`);
                             }
                         });
@@ -418,6 +513,17 @@ export const lintSchema = async (noLog = false) => {
                         statusField.archived.every((value) => statusFieldSchema.values?.includes(value)))))) {
                 errors.push(`Collection ${collectionName} has a status field ${statusField.field} with values that do not match the matching field's values`);
             }
+            else if (isFieldAccessGroupReference(statusFieldSchema.access)) {
+                errors.push(`Collection ${collectionName} has a status field ${statusField.field} that is in a field access group. Field access group fields cannot be used as status fields.`);
+            }
+            else if (statusFieldSchema.access) {
+                for (const role of readRoles) {
+                    const accessibleRoles = getFieldAccessRoles(statusFieldSchema.access);
+                    if (!accessibleRoles?.includes(role)) {
+                        errors.push(`Collection ${collectionName} has a status field ${statusField.field} that can't be accessed by role ${role}`);
+                    }
+                }
+            }
         }
         const defaultSort = (await tryPromise(customization?.admin?.defaultSort));
         if (defaultSort) {
@@ -434,6 +540,9 @@ export const lintSchema = async (noLog = false) => {
                         errors.push(`Collection ${collectionName} has a default sort field ${defaultSort.field} that must be required or nullable.`);
                     }
                 }
+                if (isFieldAccessGroupReference(fieldSchema.access)) {
+                    errors.push(`Collection ${collectionName} has a default sort field ${defaultSort.field} that is in a field access group. Field access group fields cannot be used as default sort fields.`);
+                }
             }
         }
         const breadcrumbs = (await tryPromise(customization?.admin?.breadcrumbs));
@@ -446,9 +555,13 @@ export const lintSchema = async (noLog = false) => {
         }
         const cards = (await tryPromise(customization?.admin?.cards));
         if (cards) {
+            const cardsStatusFieldSchema = getField(fields, cards.statusField);
             if (cards.statusField && !fieldNames.includes(cards.statusField)) {
                 errors.push(`Collection ${collectionName} has a cards status field ${cards.statusField} that does not exist`);
             }
+            else if (cards.statusField && isFieldAccessGroupReference(cardsStatusFieldSchema.access)) {
+                errors.push(`Collection ${collectionName} has a cards status field ${cards.statusField} that is in a field access group. Field access group fields cannot be used as status fields.`);
+            }
             if (!fieldNames.concat(systemFields).includes(cards.headerField)) {
                 errors.push(`Collection ${collectionName} has a cards header field ${cards.headerField} that does not exist`);
             }
@@ -646,13 +759,21 @@ export const lintSchema = async (noLog = false) => {
                     errors.push(`Collection ${collectionName} has a filter field ${filter.field} that does not exist`);
                 }
                 else {
-                    if ("roles" in filter && filter.roles) {
+                    if (field.access) {
+                        if (isFieldAccessGroupReference(field.access)) {
+                            errors.push(`Collection ${collectionName} has a filter for field ${filter.field} that is in a field access group. Field access group fields cannot be used as filter fields.`);
+                        }
+                    }
+                    else if ("roles" in filter && filter.roles) {
                         for (const role of filter.roles) {
                             if (!roles.includes(role)) {
                                 errors.push(`Collection ${collectionName} has a filter for field ${filter.field} that has an access role ${role} that does not exist`);
                             }
-                            if (field.access && !field.access.includes(role)) {
-                                errors.push(`Collection ${collectionName} has a filter for field ${filter.field} that has an access role ${role} that does not have access to the field`);
+                            if (field.access) {
+                                const accessibleRoles = getFieldAccessRoles(field.access);
+                                if (!accessibleRoles?.includes(role)) {
+                                    errors.push(`Collection ${collectionName} has a filter for field ${filter.field} that has an access role ${role} that does not have access to the field`);
+                                }
                             }
                         }
                     }
@@ -762,7 +883,25 @@ export const lintSchema = async (noLog = false) => {
             }
             for (const role of operations.delete) {
                 for (const field of fields) {
-                    if (field.access && !field.access.includes(role)) {
+                    if (!field.access)
+                        continue;
+                    const accessibleRoles = getFieldAccessRoles(field.access);
+                    if (isFieldAccessGroupReference(field.access)) {
+                        const fieldAccessGroup = collectionSchema.fieldAccessGroups?.[field.access.group];
+                        const checks = [
+                            fieldAccessGroup?.collectionAuth !== undefined,
+                            fieldAccessGroup?.roles !== undefined,
+                            fieldAccessGroup?.claims !== undefined,
+                            fieldAccessGroup?.restrictions !== undefined,
+                        ].filter(Boolean).length;
+                        if (!(fieldAccessGroup?.applicableRoles?.some((applicableRole) => applicableRole === role) &&
+                            fieldAccessGroup?.roles?.includes(role) &&
+                            (checks === 1 || fieldAccessGroup?.match === "any")) &&
+                            !(collectionSchema.auth && checks === 1 && fieldAccessGroup?.collectionAuth !== undefined)) {
+                            warnings.push(`Collection ${collectionName} can be deleted by role ${role}, who may not have access to field ${field.name} because it is in a field access group`);
+                        }
+                    }
+                    else if (!accessibleRoles?.includes(role)) {
                         warnings.push(`Collection ${collectionName} can be deleted by role ${role}, who does not have access to field ${field.name}`);
                     }
                 }
@@ -1137,8 +1276,14 @@ export const lintSchema = async (noLog = false) => {
             const accessFields = getAccessFields(collectionSchema, role);
             for (const field of accessFields) {
                 allAccessFields.add(field);
-                if (field.access && !field.access.includes(role)) {
-                    errors.push(`Role ${role} requires access to field ${field.name}, as it is required for access control.`);
+                if (field.access) {
+                    const accessibleRoles = getFieldAccessRoles(field.access);
+                    if (isFieldAccessGroupReference(field.access)) {
+                        errors.push(`Role ${role} requires access to field ${field.name} for access control, but the field is in a field access group so access may not be determinable.`);
+                    }
+                    else if (!accessibleRoles?.includes(role)) {
+                        errors.push(`Role ${role} requires access to field ${field.name}, as it is required for access control.`);
+                    }
                 }
             }
         }
@@ -1198,31 +1343,54 @@ export const lintSchema = async (noLog = false) => {
             ].includes(type)) {
                 errors.push(`Collection ${collectionName} has a field ${name} with an invalid type ${type}`);
             }
-            if (access) {
+            if (isFieldAccessGroupReference(access)) {
+                if (!collectionSchema.fieldAccessGroups?.[access.group]) {
+                    errors.push(`Collection ${collectionName} has a field ${name} with access group ${access.group} that does not exist`);
+                }
+            }
+            else if (access) {
                 for (const role of access) {
                     if (!roles.includes(role)) {
                         errors.push(`Collection ${collectionName} has a field ${name} with access role ${role} that does not exist`);
                     }
                 }
             }
-            if (typeof restrictCreate === "object") {
-                for (const role of restrictCreate) {
-                    if (!roles.includes(role)) {
-                        errors.push(`Collection ${collectionName} has a field ${name} with restrict create role ${role} that does not exist`);
+            const lintRestrictWrite = (restriction, label) => {
+                if (Array.isArray(restriction)) {
+                    for (const role of restriction) {
+                        if (!roles.includes(role)) {
+                            errors.push(`Collection ${collectionName} has a field ${name} with ${label} role ${role} that does not exist`);
+                        }
                     }
                 }
-            }
-            if (typeof restrictUpdate === "object") {
-                for (const role of restrictUpdate) {
-                    if (!roles.includes(role)) {
-                        errors.push(`Collection ${collectionName} has a field ${name} with restrict update role ${role} that does not exist`);
-                    }
+                else if (typeof restriction === "object" && restriction !== null) {
+                    lintFieldAccessCondition(restriction, `Collection ${collectionName} field ${name} ${label} condition`, collectionSchema, roles, errors, warnings, schema);
                 }
-            }
+            };
+            lintRestrictWrite(restrictCreate, "restrict create");
+            lintRestrictWrite(restrictUpdate, "restrict update");
             if (required) {
                 const createRoles = operations.create || [];
                 for (const role of createRoles) {
-                    if (access && !access.includes(role)) {
+                    if (!access)
+                        continue;
+                    const accessibleRoles = getFieldAccessRoles(access);
+                    if (isFieldAccessGroupReference(access)) {
+                        const fieldAccessGroup = collectionSchema.fieldAccessGroups?.[access.group];
+                        const checks = [
+                            fieldAccessGroup?.collectionAuth !== undefined,
+                            fieldAccessGroup?.roles !== undefined,
+                            fieldAccessGroup?.claims !== undefined,
+                            fieldAccessGroup?.restrictions !== undefined,
+                        ].filter(Boolean).length;
+                        if (!(fieldAccessGroup?.applicableRoles?.some((applicableRole) => applicableRole === role) &&
+                            fieldAccessGroup?.roles?.includes(role) &&
+                            (checks === 1 || fieldAccessGroup?.match === "any")) &&
+                            !(collectionSchema.auth && checks === 1 && fieldAccessGroup?.collectionAuth !== undefined)) {
+                            warnings.push(`Collection ${collectionName} has a required field ${name} that role ${role} with create access may not be able to access because it is in a field access group`);
+                        }
+                    }
+                    else if (!accessibleRoles?.includes(role)) {
                         errors.push(`Collection ${collectionName} has a required field ${name} that is not accessible to role ${role} which has create access`);
                     }
                 }
@@ -1400,13 +1568,19 @@ export const lintSchema = async (noLog = false) => {
                 if (isRelationField(field) && !field.titleField) {
                     errors.push(`Collection ${collectionName} has sorting enabled for relation field ${name}, but no title field has been set`);
                 }
-                if (typeof sorting === "object" && sorting.roles) {
+                if (isFieldAccessGroupReference(field.access)) {
+                    errors.push(`Collection ${collectionName} has a sorting field ${field.name} that is in a field access group. Field access group fields cannot be used as sorting fields.`);
+                }
+                else if (typeof sorting === "object" && sorting.roles) {
                     for (const role of sorting.roles) {
                         if (!roles.includes(role)) {
                             errors.push(`Collection ${collectionName} has sorting enabled for field ${name} with role ${role} that does not exist`);
                         }
-                        if (field.access && !field.access.includes(role)) {
-                            errors.push(`Collection ${collectionName} has sorting enabled for field ${name} with role ${role} that does not have access to the field`);
+                        if (field.access) {
+                            const accessibleRoles = getFieldAccessRoles(field.access);
+                            if (!accessibleRoles?.includes(role)) {
+                                errors.push(`Collection ${collectionName} has sorting enabled for field ${name} with role ${role} that does not have access to the field`);
+                            }
                         }
                     }
                 }

package/lib/src/lint/securityReport.js

@@ -1,5 +1,5 @@
 import { generateSchema } from "../deploy/schema/generateSchema.js";
-import { getAccessFields, getField, getDependencyIndexFields, isDependencyField, isRelationField, getRoleGroups, getFieldCustomization, } from "@stoker-platform/utils";
+import { getAccessFields, getField, getDependencyIndexFields, getFieldAccessGroupFields, getFieldAccessGroupIndexFields, getRoleFields, isDependencyField, isRelationField, getRoleGroups, getFieldCustomization, roleHasOperationAccess, } from "@stoker-platform/utils";
 import { join } from "node:path";
 import { pathToFileURL } from "node:url";
 /* eslint-disable security/detect-object-injection */
@@ -31,6 +31,12 @@ export const securityReport = async () => {
         roleGroups.forEach(() => {
             writeRuleReads[collectionName].batch.add("Main Document");
         });
+        const fieldAccessGroups = getFieldAccessGroupFields(collectionSchema);
+        Object.values(fieldAccessGroups).forEach((groupFields) => {
+            if (groupFields.length === 0)
+                return;
+            writeRuleReads[collectionName].batch.add(`Main Document`);
+        });
         if (auth) {
             writeRuleReads[collectionName].main.add("Document Lock Lookup");
             writeRuleReads[collectionName].batch.add("Document Lock Lookup");
@@ -58,7 +64,7 @@ export const securityReport = async () => {
         roles[role] = {};
         for (const [collectionName, collectionSchema] of Object.entries(schema.collections)) {
             const { fields, access } = collectionSchema;
-            if (access.operations.read?.includes(role)) {
+            if (roleHasOperationAccess(collectionSchema, role, "read")) {
                 for (const field of fields) {
                     if (field.access)
                         continue;
@@ -123,9 +129,9 @@ export const securityReport = async () => {
                                 roles[role][field.collection][`${collectionName} "${field.name}" Relation${field.preserve ? "- Preserved" : ""}`] = new Set();
                             }
                             const restrictCreate = field.restrictCreate === true ||
-                                (typeof field.restrictCreate === "object" && field.restrictCreate.includes(role));
+                                (Array.isArray(field.restrictCreate) && field.restrictCreate.includes(role));
                             const restrictUpdate = field.restrictUpdate === true ||
-                                (typeof field.restrictUpdate === "object" && field.restrictUpdate.includes(role));
+                                (Array.isArray(field.restrictUpdate) && field.restrictUpdate.includes(role));
                             if (access.operations.assignable === true ||
                                 (typeof access.operations.assignable === "object" &&
                                     access.operations.assignable.includes(role)) ||
@@ -148,6 +154,34 @@ export const securityReport = async () => {
                     }
                 }
             }
+            if (roleHasOperationAccess(collectionSchema, role, "read")) {
+                const fieldAccessGroups = getFieldAccessGroupFields(collectionSchema);
+                const roleFields = getRoleFields(collectionSchema, role);
+                const roleFieldNames = new Set(roleFields.map((field) => field.name));
+                for (const [groupKey, groupFields] of Object.entries(fieldAccessGroups)) {
+                    if (groupFields.length === 0)
+                        continue;
+                    // eslint-disable-next-line security/detect-object-injection
+                    if (!collectionSchema.fieldAccessGroups?.[groupKey]?.applicableRoles.includes(role))
+                        continue;
+                    const groupFieldNames = new Set(groupFields.map((field) => field.name));
+                    const overlayFields = getFieldAccessGroupIndexFields(groupKey, collectionSchema);
+                    for (const overlayField of overlayFields) {
+                        if (overlayField.name === "id" || overlayField.name === "Collection_Path") {
+                            continue;
+                        }
+                        if (groupFieldNames.has(overlayField.name))
+                            continue;
+                        if (roleFieldNames.has(overlayField.name))
+                            continue;
+                        roles[role][collectionName] ||= {};
+                        if (!roles[role][collectionName][overlayField.name]) {
+                            roles[role][collectionName][overlayField.name] = new Set();
+                        }
+                        roles[role][collectionName][overlayField.name].add(`Field Access Group ${groupKey}- Index`);
+                    }
+                }
+            }
         }
     }
     console.log("Security Rule Write Reads:\n");
@@ -178,6 +212,7 @@ export const securityReport = async () => {
         console.log("\n");
     }
     console.log("\n\nPossible Excess Permissions:\n");
+    console.log("(Includes fields on field access group overlays that are not on the role's mirror, after filtering overlay metadata to the roles declared on each field access group.)\n");
     for (const [role, collections] of Object.entries(roles)) {
         console.log(`${role.toUpperCase()}\n`);
         for (const [collection, fields] of Object.entries(collections)) {

package/lib/src/ops/auditDenormalized.js

@@ -1,5 +1,5 @@
 import { fetchCurrentSchema, initializeStoker, getStokerFirestore } from "@stoker-platform/node-client";
-import { getDependencyIndexFields, getLowercaseFields, getRoleGroups, getSingleFieldRelations, isDependencyField, isRelationField, } from "@stoker-platform/utils";
+import { getDependencyIndexFields, getFieldAccessGroupFields, getFieldAccessGroupIndexFields, getLowercaseFields, getRoleGroups, getSingleFieldRelations, isDependencyField, isRelationField, } from "@stoker-platform/utils";
 import { join } from "node:path";
 import isEqual from "lodash/isEqual.js";
 import isEmpty from "lodash/isEmpty.js";
@@ -117,6 +117,62 @@ export const auditDenormalized = async (options) => {
                 }
             });
         }
+        const fieldAccessGroups = getFieldAccessGroupFields(collectionSchema);
+        for (const [groupKey, groupFields] of Object.entries(fieldAccessGroups)) {
+            if (groupFields.length === 0)
+                continue;
+            const overlayIndexFields = getFieldAccessGroupIndexFields(groupKey, collectionSchema);
+            const overlaySnapshot = await db
+                .collection("tenants")
+                .doc(options.tenant)
+                .collection("system_fields")
+                .doc(collectionName)
+                .collection(`${collectionName}-${groupKey}`)
+                .get();
+            const overlayIds = new Set();
+            const lowercaseFields = getLowercaseFields(collectionSchema, overlayIndexFields);
+            const lowercaseFieldNames = Array.from(lowercaseFields).map((field) => field.name);
+            overlaySnapshot.forEach((overlay) => {
+                overlayIds.add(overlay.id);
+                const overlayData = overlay.data();
+                for (const indexField of overlayIndexFields) {
+                    if (indexField.name === "Collection_Path_String")
+                        continue;
+                    if (isRelationField(indexField)) {
+                        const overlayValue = {
+                            [indexField.name]: overlayData[indexField.name],
+                            [`${indexField.name}_Array`]: overlayData[`${indexField.name}_Array`],
+                        };
+                        const collectionValue = {
+                            [indexField.name]: collectionData[overlay.id]?.[indexField.name],
+                            [`${indexField.name}_Array`]: collectionData[overlay.id]?.[`${indexField.name}_Array`],
+                        };
+                        if (singleFieldRelationNames.includes(indexField.name)) {
+                            overlayValue[`${indexField.name}_Single`] = overlayData[`${indexField.name}_Single`];
+                            collectionValue[`${indexField.name}_Single`] =
+                                collectionData[overlay.id]?.[`${indexField.name}_Single`];
+                        }
+                        if (!isEqual(overlayValue, collectionValue)) {
+                            console.log(`${collectionName} ${overlay.id} Field Access Group ${groupKey}: ${indexField.name} - ${JSON.stringify(overlayValue)} !== ${JSON.stringify(collectionValue)}`);
+                        }
+                    }
+                    else {
+                        const overlayValue = overlayData[indexField.name];
+                        const collectionValue = collectionData[overlay.id]?.[indexField.name];
+                        if (!isEqual(overlayValue, collectionValue)) {
+                            console.log(`${collectionName} ${overlay.id} Field Access Group ${groupKey}: ${indexField.name} - ${JSON.stringify(overlayValue)} !== ${JSON.stringify(collectionValue)}`);
+                        }
+                    }
+                    if (lowercaseFieldNames.includes(indexField.name)) {
+                        const overlayValue = overlayData[`${indexField.name}_Lowercase`];
+                        const collectionValue = collectionData[overlay.id]?.[`${indexField.name}_Lowercase`];
+                        if (!isEqual(overlayValue, collectionValue)) {
+                            console.log(`${collectionName} ${overlay.id} Field Access Group ${groupKey}: ${indexField.name}_Lowercase - ${JSON.stringify(overlayValue)} !== ${JSON.stringify(collectionValue)}`);
+                        }
+                    }
+                }
+            });
+        }
         console.log(`${collectionName} audited.\n`);
     }
     process.exit();

package/lib/src/ops/explainPreloadQueries.js

@@ -1,4 +1,4 @@
-import { fetchCurrentSchema, getCollectionRefs, initializeStoker, getStokerFirestore, } from "@stoker-platform/node-client";
+import { fetchCurrentSchema, getCollectionRefs, initializeStoker, getStokerFirestore, getUser, } from "@stoker-platform/node-client";
 import { tryPromise, getRange } from "@stoker-platform/utils";
 import { Filter } from "firebase-admin/firestore";
 import { join } from "path";
@@ -43,6 +43,11 @@ export const explainPreloadQueries = async (options) => {
     if (!permissionsSnapshot.exists) {
         throw new Error("User not found");
     }
+    const user = await getUser(options.id);
+    if (!user) {
+        throw new Error("User not found");
+    }
+    const claims = user.customClaims ?? {};
     const permissions = permissionsSnapshot.data();
     const timezone = await tryPromise(globalConfig.timezone);
     const preloadConfigSync = await tryPromise(globalConfig.preload?.sync);
@@ -63,7 +68,7 @@ export const explainPreloadQueries = async (options) => {
         const rangeConstraints = preloadCache?.range;
         const constraints = (await tryPromise(collectionSchema.custom?.preloadCacheConstraints));
         const orQueries = (await tryPromise(collectionSchema.custom?.preloadCacheOrQueries));
-        const queries = getCollectionRefs(options.tenant, [collection], schema, options.id, permissions).map((ref) => {
+        const queries = getCollectionRefs(options.tenant, [collection], schema, options.id, permissions, claims).map((ref) => {
             const disjunctions = [];
             if (rangeConstraints) {
                 const { start, end } = getRange(rangeConstraints, timezone);

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stoker-platform/cli",
-    "version": "0.5.137",
+    "version": "0.5.138",
     "type": "module",
     "license": "SEE LICENSE IN LICENSE.md",
     "main": "./lib/src/main.js",
@@ -24,9 +24,9 @@
         "@google-cloud/secret-manager": "^6.1.2",
         "@google-cloud/storage": "^7.19.0",
         "@inquirer/prompts": "^8.5.2",
-        "@stoker-platform/node-client": "0.5.86",
-        "@stoker-platform/types": "0.5.64",
-        "@stoker-platform/utils": "0.5.77",
+        "@stoker-platform/node-client": "0.5.87",
+        "@stoker-platform/types": "0.5.65",
+        "@stoker-platform/utils": "0.5.78",
         "algoliasearch": "^5.53.0",
         "commander": "^15.0.0",
         "cross-spawn": "^7.0.6",