@stoker-platform/utils 0.5.77 → 0.5.79

package/lib/src/access/collection.d.ts

@@ -3,7 +3,7 @@ export declare const collectionAuthAccess: (permissions: CollectionPermissions)
 export declare const collectionAccess: (operation: "Read" | "Create" | "Update" | "Delete", permissions: CollectionPermissions) => boolean | undefined;
 export declare const collectionSomeWriteAccess: (permissions: CollectionPermissions) => boolean | undefined;
 export declare const collectionAllWriteAccess: (permissions: CollectionPermissions) => boolean | undefined;
-export declare const privateFieldAccess: (field: CollectionField, permissions?: StokerPermissions) => boolean | undefined;
-export declare const restrictCreateAccess: (field: CollectionField, permissions?: StokerPermissions) => boolean;
-export declare const restrictUpdateAccess: (field: CollectionField, permissions?: StokerPermissions) => boolean;
-export declare const canUpdateField: (collection: CollectionSchema, field: CollectionField, permissions: StokerPermissions) => boolean | undefined;
+export declare const privateFieldAccess: (field: CollectionField, permissions?: StokerPermissions, collection?: CollectionSchema, claims?: Record<string, unknown>) => boolean | undefined;
+export declare const restrictCreateAccess: (field: CollectionField, permissions?: StokerPermissions, collectionName?: string, claims?: Record<string, unknown>) => boolean;
+export declare const restrictUpdateAccess: (field: CollectionField, permissions?: StokerPermissions, collectionName?: string, claims?: Record<string, unknown>) => boolean;
+export declare const canUpdateField: (collection: CollectionSchema, field: CollectionField, permissions: StokerPermissions, claims: Record<string, unknown>) => boolean | undefined;

package/lib/src/access/collection.js

@@ -1,3 +1,4 @@
+import { evaluateFieldAccessCondition, fieldAccessGroupAccess, isFieldAccessGroupReference } from "./fieldAccess.js";
 export const collectionAuthAccess = (permissions) => {
     return !!permissions.auth;
 };
@@ -19,44 +20,53 @@ export const collectionAllWriteAccess = (permissions) => {
     }
     return;
 };
-export const privateFieldAccess = (field, permissions) => {
+export const privateFieldAccess = (field, permissions, collection, claims) => {
     if (!permissions)
         return true;
     if (!permissions.Role)
         return false;
+    if (isFieldAccessGroupReference(field.access)) {
+        if (!collection || !claims)
+            return false;
+        return fieldAccessGroupAccess(field, collection, permissions, claims);
+    }
     return field.access?.includes(permissions.Role);
 };
-export const restrictCreateAccess = (field, permissions) => {
-    if (!permissions)
-        return true;
-    if (!permissions.Role)
-        return false;
-    if (field.restrictCreate === true)
+const restrictWriteAccess = (restriction, permissions, collectionName, claims) => {
+    if (restriction === true)
         return false;
-    else if (typeof field.restrictCreate === "object") {
-        return field.restrictCreate?.includes(permissions.Role);
+    if (Array.isArray(restriction)) {
+        // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+        return restriction.includes(permissions.Role);
+    }
+    if (typeof restriction === "object" && restriction !== null) {
+        if (!collectionName || !claims)
+            return false;
+        return evaluateFieldAccessCondition(restriction, collectionName, permissions, claims);
     }
     return true;
 };
-export const restrictUpdateAccess = (field, permissions) => {
+export const restrictCreateAccess = (field, permissions, collectionName, claims) => {
     if (!permissions)
         return true;
     if (!permissions.Role)
         return false;
-    if (field.restrictUpdate === true)
+    return restrictWriteAccess(field.restrictCreate, permissions, collectionName, claims);
+};
+export const restrictUpdateAccess = (field, permissions, collectionName, claims) => {
+    if (!permissions)
+        return true;
+    if (!permissions.Role)
         return false;
-    else if (typeof field.restrictUpdate === "object") {
-        return field.restrictUpdate?.includes(permissions.Role);
-    }
-    return true;
+    return restrictWriteAccess(field.restrictUpdate, permissions, collectionName, claims);
 };
-export const canUpdateField = (collection, field, permissions) => {
+export const canUpdateField = (collection, field, permissions, claims) => {
     const { labels } = collection;
     return (permissions.collections &&
         // eslint-disable-next-line security/detect-object-injection
         collectionAccess("Update", permissions.collections[labels.collection]) &&
-        (!field.access || privateFieldAccess(field, permissions)) &&
-        restrictUpdateAccess(field, permissions) &&
+        (!field.access || privateFieldAccess(field, permissions, collection, claims)) &&
+        restrictUpdateAccess(field, permissions, labels.collection, claims) &&
         !(collection.auth &&
             !permissions.collections?.[labels.collection].auth &&
             ["Enabled", "Role", "Name", "Email", "Photo_URL"].includes(field.name)));

package/lib/src/access/document.d.ts

@@ -1,3 +1,3 @@
 import { CollectionSchema, CollectionsSchema, StokerPermissions, StokerRecord } from "@stoker-platform/types";
 export declare const documentAccess: (operation: "Read" | "Create" | "Update" | "Delete", collectionSchema: CollectionSchema, schema: CollectionsSchema, userId: string, permissions: StokerPermissions, record: StokerRecord) => boolean;
-export declare const dependencyAccess: (collectionSchema: CollectionSchema, schema: CollectionsSchema, userId: string, permissions: StokerPermissions, record: StokerRecord) => boolean;
+export declare const dependencyAccess: (collectionSchema: CollectionSchema, schema: CollectionsSchema, userId: string, permissions: StokerPermissions, record: StokerRecord, claims: Record<string, unknown>) => boolean;

package/lib/src/access/document.js

@@ -177,13 +177,13 @@ export const documentAccess = (operation, collectionSchema, schema, userId, perm
         granted = false;
     return granted;
 };
-export const dependencyAccess = (collectionSchema, schema, userId, permissions, record) => {
+export const dependencyAccess = (collectionSchema, schema, userId, permissions, record, claims) => {
     let granted = true;
     if (!permissions.Role) {
         granted = false;
         return granted;
     }
-    if (hasDependencyAccess(collectionSchema, schema, permissions).length === 0)
+    if (hasDependencyAccess(collectionSchema, schema, permissions, claims).length === 0)
         granted = false;
     if (!filterAccess("Read", collectionSchema, schema, userId, permissions, record, true))
         granted = false;

package/lib/src/access/fieldAccess.d.ts

@@ -0,0 +1,8 @@
+import { CollectionField, CollectionSchema, FieldAccessCondition, FieldAccessGroupReference, StokerPermissions, StokerRole } from "@stoker-platform/types";
+export declare const isFieldAccessGroupReference: (access?: StokerRole[] | FieldAccessGroupReference) => access is FieldAccessGroupReference;
+export declare const getFieldAccessRoles: (access?: StokerRole[] | FieldAccessGroupReference) => StokerRole[] | undefined;
+export declare const fieldRoleProjectionAccess: (field: CollectionField, role: StokerRole) => boolean;
+export declare const getFieldAccessGroupCondition: (field: CollectionField, collection: CollectionSchema) => FieldAccessCondition | undefined;
+export declare const getFieldAccessGroupFields: (collection: CollectionSchema) => Record<string, CollectionField[]>;
+export declare const evaluateFieldAccessCondition: (condition: FieldAccessCondition, collectionName: string, permissions?: StokerPermissions, claims?: Record<string, unknown>) => boolean;
+export declare const fieldAccessGroupAccess: (field: CollectionField, collection: CollectionSchema, permissions: StokerPermissions, claims: Record<string, unknown>) => boolean;

package/lib/src/access/fieldAccess.js

@@ -0,0 +1,78 @@
+export const isFieldAccessGroupReference = (access) => {
+    return !!access && !Array.isArray(access);
+};
+export const getFieldAccessRoles = (access) => {
+    return Array.isArray(access) ? access : undefined;
+};
+export const fieldRoleProjectionAccess = (field, role) => {
+    if (!field.access)
+        return true;
+    if (isFieldAccessGroupReference(field.access))
+        return false;
+    return field.access.includes(role);
+};
+export const getFieldAccessGroupCondition = (field, collection) => {
+    if (!isFieldAccessGroupReference(field.access))
+        return;
+    return collection.fieldAccessGroups?.[field.access.group];
+};
+export const getFieldAccessGroupFields = (collection) => {
+    const groups = {};
+    Object.keys(collection.fieldAccessGroups || {}).forEach((key) => {
+        // eslint-disable-next-line security/detect-object-injection
+        groups[key] = [];
+    });
+    collection.fields.forEach((field) => {
+        if (isFieldAccessGroupReference(field.access)) {
+            const { group } = field.access;
+            // eslint-disable-next-line security/detect-object-injection
+            if (groups[group])
+                groups[group].push(field);
+        }
+    });
+    return groups;
+};
+export const evaluateFieldAccessCondition = (condition, collectionName, permissions, claims) => {
+    if (!permissions)
+        return true;
+    if (permissions.Role && !condition.applicableRoles.includes(permissions.Role))
+        return false;
+    // eslint-disable-next-line security/detect-object-injection
+    const collectionPermissions = permissions.collections?.[collectionName];
+    const checks = [];
+    if (condition.collectionAuth !== undefined) {
+        checks.push(!!collectionPermissions?.auth === condition.collectionAuth);
+    }
+    if (condition.roles) {
+        checks.push(!!permissions.Role && condition.roles.includes(permissions.Role));
+    }
+    if (condition.claims) {
+        checks.push(Object.entries(condition.claims).every(([claim, expected]) => {
+            // eslint-disable-next-line security/detect-object-injection
+            let value = claims?.[claim];
+            if (value === undefined && claim === "role")
+                value = permissions.Role;
+            if (Array.isArray(expected))
+                return expected.some((item) => item === value);
+            return value === expected;
+        }));
+    }
+    if (condition.restrictions) {
+        const { recordOwner, recordUser, recordProperty, restrictEntities } = condition.restrictions;
+        checks.push((recordOwner === undefined || !!collectionPermissions?.recordOwner?.active === recordOwner) &&
+            (recordUser === undefined || !!collectionPermissions?.recordUser?.active === recordUser) &&
+            (recordProperty === undefined || !!collectionPermissions?.recordProperty?.active === recordProperty) &&
+            (restrictEntities === undefined || !!collectionPermissions?.restrictEntities === restrictEntities));
+    }
+    if (checks.length === 0)
+        return false;
+    if (condition.match === "all")
+        return checks.every(Boolean);
+    return checks.some(Boolean);
+};
+export const fieldAccessGroupAccess = (field, collection, permissions, claims) => {
+    const condition = getFieldAccessGroupCondition(field, collection);
+    if (!condition)
+        return false;
+    return evaluateFieldAccessCondition(condition, collection.labels.collection, permissions, claims);
+};

package/lib/src/access/getRelatedCollections.d.ts

@@ -1,2 +1,2 @@
 import { CollectionSchema, CollectionsSchema, StokerPermissions } from "@stoker-platform/types";
-export declare const getRelatedCollections: (collectionSchema: CollectionSchema, schema: CollectionsSchema, permissions?: StokerPermissions) => string[];
+export declare const getRelatedCollections: (collectionSchema: CollectionSchema, schema: CollectionsSchema, permissions?: StokerPermissions, claims?: Record<string, unknown>) => string[];

package/lib/src/access/getRelatedCollections.js

@@ -1,11 +1,11 @@
 import { isRelationField } from "../schema/isRelationField.js";
 import { collectionAccess, privateFieldAccess } from "../access/collection.js";
 import { hasDependencyAccess } from "./hasDependencyAccess.js";
-export const getRelatedCollections = (collectionSchema, schema, permissions) => {
+export const getRelatedCollections = (collectionSchema, schema, permissions, claims) => {
     const relatedCollections = [];
     for (const field of collectionSchema.fields) {
         if (isRelationField(field)) {
-            if (field.access && (!permissions || !privateFieldAccess(field, permissions)))
+            if (field.access && (!permissions || !privateFieldAccess(field, permissions, collectionSchema, claims)))
                 continue;
             const relatedCollection = schema.collections[field.collection];
             if (!relatedCollection)
@@ -15,7 +15,7 @@ export const getRelatedCollections = (collectionSchema, schema, permissions) =>
                 continue;
             if (!permissions ||
                 collectionAccess("Read", relatedCollectionPermissions) ||
-                hasDependencyAccess(collectionSchema, schema, permissions)) {
+                hasDependencyAccess(collectionSchema, schema, permissions, claims ?? {})) {
                 relatedCollections.push(field.collection);
             }
         }

package/lib/src/access/hasDependencyAccess.d.ts

@@ -1,2 +1,2 @@
 import { CollectionSchema, CollectionsSchema, DependencyField, StokerPermissions } from "@stoker-platform/types";
-export declare const hasDependencyAccess: (collection: CollectionSchema, schema: CollectionsSchema, permissions: StokerPermissions) => DependencyField[];
+export declare const hasDependencyAccess: (collection: CollectionSchema, schema: CollectionsSchema, permissions: StokerPermissions, claims: Record<string, unknown>) => DependencyField[];

package/lib/src/access/hasDependencyAccess.js

@@ -1,13 +1,13 @@
 import { privateFieldAccess } from "./collection.js";
 import { isRelationField } from "../schema/isRelationField.js";
-export const hasDependencyAccess = (collection, schema, permissions) => {
+export const hasDependencyAccess = (collection, schema, permissions, claims) => {
     const collections = Object.values(schema.collections);
     const { labels } = collection;
     const hasDependencyAccess = [];
     for (const collectionSchema of collections) {
         const { fields: dependencyFields } = collectionSchema;
         for (const field of dependencyFields) {
-            if (field.access && !privateFieldAccess(field, permissions))
+            if (field.access && !privateFieldAccess(field, permissions, collectionSchema, claims))
                 continue;
             if (!permissions.Role)
                 continue;

package/lib/src/access/write/addRecord.d.ts

@@ -1,2 +1,2 @@
 import { CollectionSchema, CollectionsSchema, StokerPermissions, StokerRecord } from "@stoker-platform/types";
-export declare const addRecordAccessControl: (record: StokerRecord, docId: string, collectionSchema: CollectionSchema, schema: CollectionsSchema, currentUserId?: string, currentUserPermissions?: StokerPermissions, permissions?: StokerPermissions) => void;
+export declare const addRecordAccessControl: (record: StokerRecord, docId: string, collectionSchema: CollectionSchema, schema: CollectionsSchema, currentUserId?: string, currentUserPermissions?: StokerPermissions, permissions?: StokerPermissions, claims?: Record<string, unknown>) => void;

package/lib/src/access/write/addRecord.js

@@ -1,7 +1,7 @@
 import { collectionAccess, collectionAuthAccess, privateFieldAccess, restrictCreateAccess } from "../collection.js";
 import { documentAccess } from "../document.js";
 import { permissionsWriteAccess } from "../permissions.js";
-export const addRecordAccessControl = (record, docId, collectionSchema, schema, currentUserId, currentUserPermissions, permissions) => {
+export const addRecordAccessControl = (record, docId, collectionSchema, schema, currentUserId, currentUserPermissions, permissions, claims) => {
     const { labels, fields } = collectionSchema;
     // eslint-disable-next-line security/detect-object-injection
     const collectionPermissions = currentUserPermissions?.collections?.[labels.collection];
@@ -27,11 +27,11 @@ export const addRecordAccessControl = (record, docId, collectionSchema, schema,
     for (const field of fields) {
         const value = record[field.name];
         if (field.access) {
-            if (!privateFieldAccess(field, currentUserPermissions) && value !== undefined) {
+            if (!privateFieldAccess(field, currentUserPermissions, collectionSchema, claims) && value !== undefined) {
                 granted = false;
             }
         }
-        if (value !== undefined && !restrictCreateAccess(field, currentUserPermissions))
+        if (value !== undefined && !restrictCreateAccess(field, currentUserPermissions, labels.collection, claims))
             granted = false;
     }
     if (!granted)

package/lib/src/access/write/updateRecord.d.ts

@@ -1,2 +1,2 @@
 import { CollectionSchema, CollectionsSchema, StokerPermissions, StokerRecord } from "@stoker-platform/types";
-export declare const updateRecordAccessControl: (partial: StokerRecord, originalRecord: StokerRecord, docId: string, collectionSchema: CollectionSchema, schema: CollectionsSchema, currentUserId?: string, currentUserPermissions?: StokerPermissions, userOperation?: string, permissions?: StokerPermissions, originalPermissions?: StokerPermissions | undefined) => void;
+export declare const updateRecordAccessControl: (partial: StokerRecord, originalRecord: StokerRecord, docId: string, collectionSchema: CollectionSchema, schema: CollectionsSchema, currentUserId?: string, currentUserPermissions?: StokerPermissions, userOperation?: string, permissions?: StokerPermissions, originalPermissions?: StokerPermissions | undefined, claims?: Record<string, unknown>) => void;

package/lib/src/access/write/updateRecord.js

@@ -2,7 +2,7 @@ import { collectionAccess, collectionAuthAccess, privateFieldAccess, restrictUpd
 import { documentAccess } from "../document.js";
 import { permissionsWriteAccess } from "../permissions.js";
 import { removeDeleteSentinels } from "../../operations/removeDeleteSentinels.js";
-export const updateRecordAccessControl = (partial, originalRecord, docId, collectionSchema, schema, currentUserId, currentUserPermissions, userOperation, permissions, originalPermissions) => {
+export const updateRecordAccessControl = (partial, originalRecord, docId, collectionSchema, schema, currentUserId, currentUserPermissions, userOperation, permissions, originalPermissions, claims) => {
     const { labels, fields } = collectionSchema;
     // eslint-disable-next-line security/detect-object-injection
     const collectionPermissions = currentUserPermissions?.collections?.[labels.collection];
@@ -50,12 +50,12 @@ export const updateRecordAccessControl = (partial, originalRecord, docId, collec
     for (const field of fields) {
         const value = partial[field.name];
         if (field.access) {
-            if (!privateFieldAccess(field, currentUserPermissions) && value !== undefined) {
+            if (!privateFieldAccess(field, currentUserPermissions, collectionSchema, claims) && value !== undefined) {
                 errorDetails = `Authenticated user does not have access to field ${field.name}`;
                 granted = false;
             }
         }
-        if (value !== undefined && !restrictUpdateAccess(field, currentUserPermissions)) {
+        if (value !== undefined && !restrictUpdateAccess(field, currentUserPermissions, labels.collection, claims)) {
             errorDetails = `Authenticated user does not have Update access to field ${field.name}`;
             granted = false;
         }

package/lib/src/main.d.ts

@@ -20,7 +20,8 @@ export { getCollection } from "./schema/getCollection.js";
 export { getDependencyFields } from "./schema/getDependencyFields.js";
 export { getField } from "./schema/getField.js";
 export { getFieldNames } from "./schema/getFieldNames.js";
-export { getRoleFields, getDependencyAccessFields, getDependencyIndexFields, getRoleGroups, getRoleGroup, getRoleExcludedFields, getUserRoleGroups, getAllRoleGroups, } from "./schema/getIndexFields.js";
+export { getRoleFields, getDependencyAccessFields, getDependencyIndexFields, getFieldAccessGroupIndexFields, getFieldAccessGroupRoles, getFieldAccessGroupKey, getRoleGroups, getRoleGroup, getRoleExcludedFields, getUserRoleGroups, getAllRoleGroups, } from "./schema/getIndexFields.js";
+export { isFieldAccessGroupReference, getFieldAccessRoles, fieldRoleProjectionAccess, getFieldAccessGroupCondition, getFieldAccessGroupFields, evaluateFieldAccessCondition, fieldAccessGroupAccess, } from "./access/fieldAccess.js";
 export { getAccessFields } from "./schema/getAccessFields.js";
 export { getSystemFieldsSchema } from "./schema/getSystemFieldsSchema.js";
 export { isRelationField } from "./schema/isRelationField.js";

package/lib/src/main.js

@@ -20,7 +20,8 @@ export { getCollection } from "./schema/getCollection.js";
 export { getDependencyFields } from "./schema/getDependencyFields.js";
 export { getField } from "./schema/getField.js";
 export { getFieldNames } from "./schema/getFieldNames.js";
-export { getRoleFields, getDependencyAccessFields, getDependencyIndexFields, getRoleGroups, getRoleGroup, getRoleExcludedFields, getUserRoleGroups, getAllRoleGroups, } from "./schema/getIndexFields.js";
+export { getRoleFields, getDependencyAccessFields, getDependencyIndexFields, getFieldAccessGroupIndexFields, getFieldAccessGroupRoles, getFieldAccessGroupKey, getRoleGroups, getRoleGroup, getRoleExcludedFields, getUserRoleGroups, getAllRoleGroups, } from "./schema/getIndexFields.js";
+export { isFieldAccessGroupReference, getFieldAccessRoles, fieldRoleProjectionAccess, getFieldAccessGroupCondition, getFieldAccessGroupFields, evaluateFieldAccessCondition, fieldAccessGroupAccess, } from "./access/fieldAccess.js";
 export { getAccessFields } from "./schema/getAccessFields.js";
 export { getSystemFieldsSchema } from "./schema/getSystemFieldsSchema.js";
 export { isRelationField } from "./schema/isRelationField.js";

package/lib/src/operations/addInitialValues.d.ts

@@ -1,2 +1,2 @@
-import { CollectionSchema, CollectionCustomization, StokerRecord, StokerRole } from "@stoker-platform/types";
-export declare const addInitialValues: (data: StokerRecord, collectionSchema: CollectionSchema, customization: CollectionCustomization, role?: StokerRole) => Promise<void>;
+import { CollectionSchema, CollectionCustomization, StokerPermissions, StokerRecord } from "@stoker-platform/types";
+export declare const addInitialValues: (data: StokerRecord, collectionSchema: CollectionSchema, customization: CollectionCustomization, permissions?: StokerPermissions, claims?: Record<string, unknown>) => Promise<void>;

package/lib/src/operations/addInitialValues.js

@@ -1,13 +1,14 @@
+import { privateFieldAccess } from "../access/collection.js";
 import { tryPromise } from "../getConfigValue.js";
 import { getField } from "../schema/getField.js";
 import { isRelationField } from "../schema/isRelationField.js";
 import { getLowercaseFields } from "./getLowercaseFields.js";
-export const addInitialValues = async (data, collectionSchema, customization, role) => {
+export const addInitialValues = async (data, collectionSchema, customization, permissions, claims) => {
     const { fields } = collectionSchema;
     for (const field of customization.fields) {
         const fieldSchema = getField(fields, field.name);
         if (field.custom?.initialValue !== undefined &&
-            !(role && fieldSchema.access && !fieldSchema.access.includes(role))) {
+            (!fieldSchema.access || privateFieldAccess(fieldSchema, permissions, collectionSchema, claims || {}))) {
             data[field.name] = await tryPromise(field.custom.initialValue, [data]);
             const lowercaseFields = getLowercaseFields(collectionSchema, [fieldSchema]);
             if (lowercaseFields.size === 1) {
@@ -16,7 +17,7 @@ export const addInitialValues = async (data, collectionSchema, customization, ro
         }
     }
     for (const field of fields) {
-        if (!(role && field.access && !field.access.includes(role))) {
+        if (!field.access || privateFieldAccess(field, permissions, collectionSchema, claims || {})) {
             if ("autoIncrement" in field && field.autoIncrement && !data[field.name]) {
                 data[field.name] = "Pending";
             }

package/lib/src/operations/prepareDenormalized.js

@@ -1,5 +1,6 @@
 import { isRelationField } from "../schema/isRelationField.js";
-import { getDependencyIndexFields, getRoleExcludedFields } from "../schema/getIndexFields.js";
+import { getDependencyIndexFields, getFieldAccessGroupIndexFields, getFieldAccessGroupKey, getRoleExcludedFields, } from "../schema/getIndexFields.js";
+import { getFieldAccessGroupFields } from "../access/fieldAccess.js";
 import { isDependencyField } from "../schema/isDependencyField.js";
 import { getFieldNames } from "../schema/getFieldNames.js";
 import { getField } from "../schema/getField.js";
@@ -65,6 +66,48 @@ options, allRoleGroups, arrayUnion, arrayRemove, deleteField, dependencyRef, uni
         }
     });
     const roleGroups = allRoleGroups[collectionSchema.labels.collection];
+    const fieldAccessGroups = getFieldAccessGroupFields(collectionSchema);
+    Object.entries(fieldAccessGroups).forEach(([groupKey, groupFields]) => {
+        if (groupFields.length === 0)
+            return;
+        for (const roleGroup of roleGroups) {
+            const overlayFieldsSchema = getFieldAccessGroupIndexFields(groupKey, collectionSchema, roleGroup);
+            if (overlayFieldsSchema.length === 0)
+                continue;
+            const overlayKey = getFieldAccessGroupKey(groupKey, roleGroup.key);
+            const overlayRecord = {};
+            overlayFieldsSchema.forEach((overlayField) => {
+                const names = [
+                    overlayField.name,
+                    `${overlayField.name}_Array`,
+                    `${overlayField.name}_Single`,
+                    `${overlayField.name}_Lowercase`,
+                ];
+                names.forEach((name) => {
+                    // eslint-disable-next-line security/detect-object-injection
+                    if (record[name] !== undefined)
+                        overlayRecord[name] = record[name];
+                });
+            });
+            if (operation === "create") {
+                overlayRecord.Collection_Path ||= path;
+                overlayRecord.Collection_Path_String = path.join("/");
+                batch.set(privateRef(overlayKey), overlayRecord);
+                if (batchSize)
+                    batchSize.size++;
+            }
+            if (operation === "update" && Object.keys(overlayRecord).length > 0) {
+                batch.update(privateRef(overlayKey), overlayRecord);
+                if (batchSize)
+                    batchSize.size++;
+            }
+            if (operation === "delete") {
+                batch.delete(privateRef(overlayKey));
+                if (batchSize)
+                    batchSize.size++;
+            }
+        }
+    });
     for (const group of roleGroups) {
         const excludedFields = getRoleExcludedFields(group, collectionSchema);
         const recordToUpdate = { ...record };
@@ -110,6 +153,18 @@ options, allRoleGroups, arrayUnion, arrayRemove, deleteField, dependencyRef, uni
                 batchSize++;
             }
         }
+        const fieldAccessGroups = getFieldAccessGroupFields(targetSchema);
+        for (const [groupKey, groupFields] of Object.entries(fieldAccessGroups)) {
+            if (groupFields.length === 0)
+                continue;
+            for (const roleGroup of targetRoleGroups) {
+                const overlayIndexFields = getFieldAccessGroupIndexFields(groupKey, targetSchema, roleGroup);
+                if (overlayIndexFields.some((overlayField) => overlayField.name === targetField.name) &&
+                    isRelationField(targetField)) {
+                    batchSize++;
+                }
+            }
+        }
         return batchSize;
     };
     const deleteFields = (field, targetSchema, targetField, id, relationPath) => {
@@ -142,6 +197,19 @@ options, allRoleGroups, arrayUnion, arrayRemove, deleteField, dependencyRef, uni
                 batch.update(twoWayPrivateRef(field, group.key, id), fieldUpdate);
             }
         }
+        const fieldAccessGroups = getFieldAccessGroupFields(targetSchema);
+        for (const [groupKey, groupFields] of Object.entries(fieldAccessGroups)) {
+            if (groupFields.length === 0)
+                continue;
+            for (const roleGroup of targetRoleGroups) {
+                const overlayIndexFields = getFieldAccessGroupIndexFields(groupKey, targetSchema, roleGroup);
+                const overlayKey = getFieldAccessGroupKey(groupKey, roleGroup.key);
+                if (overlayIndexFields.some((overlayField) => overlayField.name === targetField.name) &&
+                    isRelationField(targetField)) {
+                    batch.update(twoWayPrivateRef(field, overlayKey, id), fieldUpdate);
+                }
+            }
+        }
     };
     if (operation === "delete")
         return;
@@ -246,6 +314,28 @@ options, allRoleGroups, arrayUnion, arrayRemove, deleteField, dependencyRef, uni
                             }
                         }
                     }
+                    const fieldAccessGroups = getFieldAccessGroupFields(targetSchema);
+                    for (const [groupKey, groupFields] of Object.entries(fieldAccessGroups)) {
+                        if (groupFields.length === 0)
+                            continue;
+                        for (const roleGroup of targetRoleGroups) {
+                            const overlayIndexFields = getFieldAccessGroupIndexFields(groupKey, targetSchema, roleGroup);
+                            const overlayKey = getFieldAccessGroupKey(groupKey, roleGroup.key);
+                            if (overlayIndexFields.some((overlayField) => overlayField.name === targetField.name)) {
+                                const overlayFieldUpdate = { ...fieldUpdate };
+                                Object.keys(systemFields).forEach((systemField) => {
+                                    if (overlayIndexFields.some((overlayField) => overlayField.name === systemField)) {
+                                        // eslint-disable-next-line security/detect-object-injection
+                                        overlayFieldUpdate[systemField] = systemFields[systemField];
+                                    }
+                                });
+                                if (Object.keys(overlayFieldUpdate).length > 0) {
+                                    batch.update(twoWayPrivateRef(field, overlayKey, id), overlayFieldUpdate);
+                                    batchSize.size++;
+                                }
+                            }
+                        }
+                    }
                 }
             }
         }

package/lib/src/schema/getIndexFields.d.ts

@@ -2,6 +2,9 @@ import type { CollectionField, CollectionSchema, CollectionsSchema, StokerPermis
 export declare const getRoleFields: (collection: CollectionSchema, role: StokerRole) => CollectionField[];
 export declare const getDependencyAccessFields: (field: CollectionField, collection: CollectionSchema, schema: CollectionsSchema) => CollectionField[];
 export declare const getDependencyIndexFields: (field: CollectionField, collection: CollectionSchema, schema: CollectionsSchema) => CollectionField[];
+export declare const getFieldAccessGroupRoles: (groupKey: string, collection: CollectionSchema, roleGroup: RoleGroup) => string[];
+export declare const getFieldAccessGroupKey: (groupKey: string, roleGroupKey: string) => string;
+export declare const getFieldAccessGroupIndexFields: (groupKey: string, collection: CollectionSchema, roleGroup: RoleGroup) => CollectionField[];
 export declare const getRoleGroups: (collection: CollectionSchema, schema: CollectionsSchema) => Set<RoleGroup>;
 export declare const getRoleGroup: (role: StokerRole, collection: CollectionSchema, schema: CollectionsSchema) => RoleGroup | undefined;
 export declare const getRoleExcludedFields: (roleGroup: RoleGroup, collection: CollectionSchema) => CollectionField[];