@web-ts-toolkit/access-router 0.47.1 → 0.48.0

package/index.mjs

@@ -137,6 +137,12 @@ function genPagination({
   }
   return { skip: _skip, limit: _limit };
 }
+function parseSelectParam(select) {
+  if (select === void 0) return void 0;
+  const values = Array.isArray(select) ? select : [select];
+  const fields = values.flatMap((value) => String(value).split(/[\s,]+/)).filter(Boolean);
+  return fields.length > 0 ? fields : void 0;
+}
 function normalizeSelect(select) {
   if (Array.isArray(select)) return flattenDeep(select.map(normalizeSelect));
   if (isPlainObject(select)) {
@@ -178,6 +184,15 @@ function getDocPermissions(modelName, doc) {
   const permissions = getDocValue(doc, docPermissionField, {});
   return isPlainObject2(permissions) ? permissions : {};
 }
+function stripUnexposedDocPermissions(modelName, doc) {
+  const exposed = getModelOption(modelName, "exposedDocPermissionKeys");
+  if (exposed === void 0) return;
+  const docPermissionField = getModelOption(modelName, "documentPermissionField");
+  const current = getDocValue(doc, docPermissionField, void 0);
+  if (!isPlainObject2(current)) return;
+  const keep = /* @__PURE__ */ new Set(["_view", "_edit", ...exposed]);
+  setDocValue(doc, docPermissionField, Object.fromEntries(Object.entries(current).filter(([key]) => keep.has(key))));
+}
 function toObject(doc) {
   return isDocument(doc) ? doc.toObject() : doc;
 }
@@ -1166,11 +1181,11 @@ var classifyPermissionSchema = (permissionSchema, modelPermissionPrefix) => {
       }
       if (isBoolean(value)) {
         globalPermissionKeys[accessKey].push(schemaKey);
-        return;
+        continue;
       }
       if (hasModelPermission(value, modelPermissionPrefix)) {
         modelPermissionKeys[accessKey].push(schemaKey);
-        return;
+        continue;
       }
       globalPermissionKeys[accessKey].push(schemaKey);
     }
@@ -2432,7 +2447,8 @@ var Base = class {
         ...options,
         access: "read",
         lean: true,
-        includePermissions: false
+        includePermissions: false,
+        includeFieldPermissions: false
       };
       const result = await svc.findOne(filter2, this.sanitizeIncludeArgs(args), trustedOptions);
       if (result.success) {
@@ -2460,6 +2476,7 @@ var Base = class {
       ...options,
       lean: true,
       includePermissions: false,
+      includeFieldPermissions: false,
       includeCount: false
     };
     const trustedResult = await svc.find(filter2, trustedArgs, trustedOptions);
@@ -2590,7 +2607,7 @@ var Base = class {
               include: nestedInclude,
               overrides: { filter: authorized }
             },
-            { access: "read", lean: true, includePermissions: false }
+            { access: "read", lean: true, includePermissions: false, includeFieldPermissions: false }
           );
         } catch (error2) {
           const clientResult = this.getClientRequestErrorResult(error2);
@@ -2668,7 +2685,7 @@ var Base = class {
             include: nestedInclude,
             overrides: { filter: authorized }
           },
-          { access: "read", lean: true, includePermissions: false }
+          { access: "read", lean: true, includePermissions: false, includeFieldPermissions: false }
         );
       } catch (error2) {
         const clientResult = this.getClientRequestErrorResult(error2);
@@ -2753,7 +2770,7 @@ var Base = class {
             include: nestedInclude,
             overrides: { filter: authorized }
           },
-          { includeCount: false, lean: true, includePermissions: false }
+          { includeCount: false, lean: true, includePermissions: false, includeFieldPermissions: false }
         );
       } catch (error2) {
         const clientResult = this.getClientRequestErrorResult(error2);
@@ -3345,6 +3362,16 @@ async function getParentDoc(service, id, sub, args, options) {
 }
 
 // src/services/model-service-defaults.ts
+function applyPermissionsPosture(service, resolved) {
+  const posture = service.getPermissionsPosture();
+  if (posture.stripPermissionsField) {
+    resolved.includePermissions = false;
+    resolved.includeFieldPermissions = false;
+  } else if (posture.disableFieldPermissions) {
+    resolved.includeFieldPermissions = false;
+  }
+  return resolved;
+}
 function resolveFindOneArgs(service, args = {}) {
   return {
     select: args.select ?? service.defaults.findOneArgs?.select,
@@ -3355,13 +3382,15 @@ function resolveFindOneArgs(service, args = {}) {
   };
 }
 function resolveFindOneOptions(service, options = {}) {
-  return {
+  const includePermissions = options.includePermissions ?? service.defaults.findOneOptions?.includePermissions ?? true;
+  return applyPermissionsPosture(service, {
     skim: options.skim ?? service.defaults.findOneOptions?.skim ?? false,
-    includePermissions: options.includePermissions ?? service.defaults.findOneOptions?.includePermissions ?? true,
+    includePermissions,
+    includeFieldPermissions: options.includeFieldPermissions ?? service.defaults.findOneOptions?.includeFieldPermissions ?? includePermissions,
     access: options.access ?? service.defaults.findOneOptions?.access ?? "read",
     populateAccess: options.populateAccess ?? service.defaults.findOneOptions?.populateAccess,
     lean: options.lean ?? service.defaults.findOneOptions?.lean ?? false
-  };
+  });
 }
 function resolveFindByIdArgs(service, args = {}) {
   return {
@@ -3372,13 +3401,15 @@ function resolveFindByIdArgs(service, args = {}) {
   };
 }
 function resolveFindByIdOptions(service, options = {}) {
-  return {
+  const includePermissions = options.includePermissions ?? service.defaults.findByIdOptions?.includePermissions ?? true;
+  return applyPermissionsPosture(service, {
     skim: options.skim ?? service.defaults.findByIdOptions?.skim ?? false,
-    includePermissions: options.includePermissions ?? service.defaults.findByIdOptions?.includePermissions ?? true,
+    includePermissions,
+    includeFieldPermissions: options.includeFieldPermissions ?? service.defaults.findByIdOptions?.includeFieldPermissions ?? includePermissions,
     access: options.access ?? service.defaults.findByIdOptions?.access ?? "read",
     populateAccess: options.populateAccess ?? service.defaults.findByIdOptions?.populateAccess,
     lean: options.lean ?? service.defaults.findByIdOptions?.lean ?? false
-  };
+  });
 }
 function resolveFindArgs(service, args = {}) {
   return {
@@ -3394,13 +3425,15 @@ function resolveFindArgs(service, args = {}) {
   };
 }
 function resolveFindOptions(service, options = {}) {
-  return {
+  const includePermissions = options.includePermissions ?? service.defaults.findOptions?.includePermissions ?? true;
+  return applyPermissionsPosture(service, {
     skim: options.skim ?? service.defaults.findOptions?.skim ?? false,
-    includePermissions: options.includePermissions ?? service.defaults.findOptions?.includePermissions ?? true,
+    includePermissions,
+    includeFieldPermissions: options.includeFieldPermissions ?? service.defaults.findOptions?.includeFieldPermissions ?? includePermissions,
     includeCount: options.includeCount ?? service.defaults.findOptions?.includeCount ?? false,
     populateAccess: options.populateAccess ?? service.defaults.findOptions?.populateAccess ?? "read",
     lean: options.lean ?? service.defaults.findOptions?.lean ?? false
-  };
+  });
 }
 function resolveCreateArgs(service, args = {}) {
   return {
@@ -3408,11 +3441,13 @@ function resolveCreateArgs(service, args = {}) {
   };
 }
 function resolveCreateOptions(service, options = {}) {
-  return {
+  const includePermissions = options.includePermissions ?? service.defaults.createOptions?.includePermissions ?? true;
+  return applyPermissionsPosture(service, {
     skim: options.skim ?? service.defaults.createOptions?.skim ?? false,
-    includePermissions: options.includePermissions ?? service.defaults.createOptions?.includePermissions ?? true,
+    includePermissions,
+    includeFieldPermissions: options.includeFieldPermissions ?? service.defaults.createOptions?.includeFieldPermissions ?? includePermissions,
     populateAccess: options.populateAccess ?? service.defaults.createOptions?.populateAccess ?? "read"
-  };
+  });
 }
 function resolveUpdateOneArgs(service, args = {}) {
   return {
@@ -3421,11 +3456,13 @@ function resolveUpdateOneArgs(service, args = {}) {
   };
 }
 function resolveUpdateOneOptions(service, options = {}) {
-  return {
+  const includePermissions = options.includePermissions ?? service.defaults.updateOneOptions?.includePermissions ?? true;
+  return applyPermissionsPosture(service, {
     skim: options.skim ?? service.defaults.updateOneOptions?.skim ?? false,
-    includePermissions: options.includePermissions ?? service.defaults.updateOneOptions?.includePermissions ?? true,
+    includePermissions,
+    includeFieldPermissions: options.includeFieldPermissions ?? service.defaults.updateOneOptions?.includeFieldPermissions ?? includePermissions,
     populateAccess: options.populateAccess ?? service.defaults.updateOneOptions?.populateAccess ?? "read"
-  };
+  });
 }
 function resolveUpdateByIdArgs(service, args = {}) {
   return {
@@ -3434,11 +3471,13 @@ function resolveUpdateByIdArgs(service, args = {}) {
   };
 }
 function resolveUpdateByIdOptions(service, options = {}) {
-  return {
+  const includePermissions = options.includePermissions ?? service.defaults.updateByIdOptions?.includePermissions ?? true;
+  return applyPermissionsPosture(service, {
     skim: options.skim ?? service.defaults.updateByIdOptions?.skim ?? false,
-    includePermissions: options.includePermissions ?? service.defaults.updateByIdOptions?.includePermissions ?? true,
+    includePermissions,
+    includeFieldPermissions: options.includeFieldPermissions ?? service.defaults.updateByIdOptions?.includeFieldPermissions ?? includePermissions,
     populateAccess: options.populateAccess ?? service.defaults.updateByIdOptions?.populateAccess ?? "read"
-  };
+  });
 }
 function resolveUpsertArgs(service, args = {}) {
   return {
@@ -3447,11 +3486,13 @@ function resolveUpsertArgs(service, args = {}) {
   };
 }
 function resolveUpsertOptions(service, options = {}) {
-  return {
+  const includePermissions = options.includePermissions ?? service.defaults.upsertOptions?.includePermissions ?? true;
+  return applyPermissionsPosture(service, {
     skim: options.skim ?? service.defaults.upsertOptions?.skim ?? false,
-    includePermissions: options.includePermissions ?? service.defaults.upsertOptions?.includePermissions ?? true,
+    includePermissions,
+    includeFieldPermissions: options.includeFieldPermissions ?? service.defaults.upsertOptions?.includeFieldPermissions ?? includePermissions,
     populateAccess: options.populateAccess ?? service.defaults.upsertOptions?.populateAccess ?? "read"
-  };
+  });
 }
 function resolveExistsOptions(service, options = {}) {
   return {
@@ -3513,6 +3554,27 @@ var Service = class extends Base {
   getModelRouterOptions(modelName) {
     return getModelOptions(modelName);
   }
+  /**
+   * Router-level permission output postures (see `ModelRouterOptions`).
+   * Absolute: they win over client input and per-operation `defaults`.
+   */
+  getPermissionsPosture() {
+    return {
+      stripPermissionsField: this.options.stripPermissionsField ?? false,
+      disableFieldPermissions: this.options.disableFieldPermissions ?? false
+    };
+  }
+  /**
+   * Router posture `stripPermissionsField`: drop the whole document
+   * permissions field (including the empty placeholder) from output instead
+   * of emitting permission metadata. Returns true when applied.
+   */
+  stripPermissionsOutput(doc) {
+    if (!this.options.stripPermissionsField) return false;
+    const field = this.options.documentPermissionField;
+    if (field) unsetDocPath(doc, field);
+    return true;
+  }
   asServiceHookContext(context) {
     return context;
   }
@@ -3520,6 +3582,14 @@ var Service = class extends Base {
     const extra = this.options?.sortableFields ?? [];
     return extra.length > 0 ? [...allowedSortFields, ...extra] : allowedSortFields;
   }
+  /**
+   * With `requireExplicitSelect`, an omitted client select behaves as an
+   * `_id`-only projection, yielding field-less rows. Explicit selects pass
+   * through untouched.
+   */
+  resolveEffectiveSelect(select) {
+    return this.options?.requireExplicitSelect && select === void 0 ? ["_id"] : select;
+  }
   beginOp(op, filter2, extra) {
     const startedAt = Date.now();
     debug({
@@ -3544,8 +3614,9 @@ var Service = class extends Base {
   async findOne(filter2, args, options) {
     const filterErrors = this.validateClientFilter(filter2);
     if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
-    const { select, sort, populate, include, overrides } = this.resolveFindOneArgs(args);
-    const { skim, includePermissions, access, populateAccess, lean } = this.resolveFindOneOptions(options);
+    const { select: requestedSelect, sort, populate, include, overrides } = this.resolveFindOneArgs(args);
+    const select = this.resolveEffectiveSelect(requestedSelect);
+    const { skim, includePermissions, includeFieldPermissions, access, populateAccess, lean } = this.resolveFindOneOptions(options);
     const { filter: overrideFilter, select: overrideSelect, populate: overridePopulate } = overrides ?? {};
     let parsedFilter;
     let processedInclude;
@@ -3626,11 +3697,11 @@ var Service = class extends Base {
       throw error2;
     }
     let includeDocPermissions = includePermissions;
-    if (!includeDocPermissions && !skim) {
+    if (!includeDocPermissions && (!skim || includeFieldPermissions)) {
       includeDocPermissions = this.checkIfModelPermissionExists([access, "read", "update"]);
     }
     if (includeDocPermissions) doc = await this.addDocPermissions(doc, access, context);
-    if (includePermissions) doc = await this.addFieldPermissions(doc, access, context);
+    if (includeFieldPermissions) doc = await this.addFieldPermissions(doc, access, context);
     doc = await this.trimOutputFields(
       doc,
       access,
@@ -3648,13 +3719,16 @@ var Service = class extends Base {
         if (!shouldKeepCorrelatedRef(ref, keep)) unsetDocPath(doc, ref);
       }
     }
-    if (!includePermissions) doc = this.addEmptyPermissions(doc);
+    if (!this.stripPermissionsOutput(doc)) {
+      if (!includePermissions && !includeFieldPermissions) doc = this.addEmptyPermissions(doc);
+      stripUnexposedDocPermissions(this.modelName, doc);
+    }
     this.completeOp("findOne", startedAt, "success" /* Success */, _filter);
     return { success: true, kind: "single", code: "success" /* Success */, data: doc, query, context };
   }
   async findById(id, args, options) {
     const { select, populate, include, overrides } = this.resolveFindByIdArgs(args);
-    const { skim, includePermissions, access, populateAccess, lean } = this.resolveFindByIdOptions(options);
+    const { skim, includePermissions, includeFieldPermissions, access, populateAccess, lean } = this.resolveFindByIdOptions(options);
     const { select: overrideSelect, populate: overridePopulate, idFilter: overrideIdFilter } = overrides ?? {};
     const filter2 = overrideIdFilter ?? await this.genIDFilter(id);
     if (filter2 === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query: { filter: filter2 } };
@@ -3669,14 +3743,25 @@ var Service = class extends Base {
           populate: overridePopulate
         }
       },
-      { skim, includePermissions, access, populateAccess, lean }
+      { skim, includePermissions, includeFieldPermissions, access, populateAccess, lean }
     );
   }
   async find(filter2, args, options, decorate) {
     const filterErrors = this.validateClientFilter(filter2);
     if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
-    const { select, populate, include, sort, skip, limit, page, pageSize, overrides } = this.resolveFindArgs(args);
-    const { skim, includePermissions, includeCount, populateAccess, lean } = this.resolveFindOptions(options);
+    const {
+      select: requestedSelect,
+      populate,
+      include,
+      sort,
+      skip,
+      limit,
+      page,
+      pageSize,
+      overrides
+    } = this.resolveFindArgs(args);
+    const select = this.resolveEffectiveSelect(requestedSelect);
+    const { skim, includePermissions, includeFieldPermissions, includeCount, populateAccess, lean } = this.resolveFindOptions(options);
     const { filter: overrideFilter, select: overrideSelect, populate: overridePopulate } = overrides ?? {};
     let parsedFilter;
     let processedInclude;
@@ -3760,16 +3845,16 @@ var Service = class extends Base {
       }
       throw error2;
     }
-    const fieldPermissionAccess = includePermissions ? await this.getFieldPermissionAccess(docs.map((doc) => doc._id)) : void 0;
+    const fieldPermissionAccess = includeFieldPermissions ? await this.getFieldPermissionAccess(docs.map((doc) => doc._id)) : void 0;
     docs = await Promise.all(
       docs.map(async (doc, i) => {
         this.asServiceHookContext(contexts[i]).fieldPermissionAccess = fieldPermissionAccess;
         let includeDocPermissions = includePermissions;
-        if (!includeDocPermissions && !skim) {
+        if (!includeDocPermissions && (!skim || includeFieldPermissions)) {
           includeDocPermissions = this.checkIfModelPermissionExists(["list", "read", "update"]);
         }
         if (includeDocPermissions) doc = await this.addDocPermissions(doc, "list", contexts[i]);
-        if (includePermissions) doc = await this.addFieldPermissions(doc, "list", contexts[i]);
+        if (includeFieldPermissions) doc = await this.addFieldPermissions(doc, "list", contexts[i]);
         doc = await this.trimOutputFields(
           doc,
           "list",
@@ -3788,7 +3873,10 @@ var Service = class extends Base {
           }
         }
         doc = await _decorate(doc, contexts[i]);
-        if (!includePermissions) doc = this.addEmptyPermissions(doc);
+        if (!this.stripPermissionsOutput(doc)) {
+          if (!includePermissions && !includeFieldPermissions) doc = this.addEmptyPermissions(doc);
+          stripUnexposedDocPermissions(this.modelName, doc);
+        }
         return doc;
       })
     );
@@ -3806,7 +3894,7 @@ var Service = class extends Base {
   }
   async create(data, args, options, decorate) {
     const { populate } = this.resolveCreateArgs(args);
-    const { skim, includePermissions, populateAccess } = this.resolveCreateOptions(options);
+    const { skim, includePermissions, includeFieldPermissions, populateAccess } = this.resolveCreateOptions(options);
     const isArr = Array.isArray(data);
     let dataArr = isArr ? data : [data];
     const { maxBulkItems, maxBulkConcurrency } = this.getRequestComplexity();
@@ -3913,15 +4001,18 @@ var Service = class extends Base {
       contexts[index].currentDocument = doc;
       contexts[index].finalDocumentSnapshot = doc.toObject({ virtuals: false });
       let includeDocPermissions = includePermissions;
-      if (!includeDocPermissions && !skim) {
+      if (!includeDocPermissions && (!skim || includeFieldPermissions)) {
         includeDocPermissions = this.checkIfModelPermissionExists(["create", "read", "update"]);
       }
       if (includeDocPermissions) doc = await this.addDocPermissions(doc, "create", contexts[index]);
-      if (includePermissions) doc = await this.addFieldPermissions(doc, "read", contexts[index]);
+      if (includeFieldPermissions) doc = await this.addFieldPermissions(doc, "read", contexts[index]);
       if (resolvedPopulate.length > 0) await this.persist(() => populateDoc(doc, resolvedPopulate));
       doc = await this.trimOutputFields(doc, "read", this.baseFieldsExt);
       let outputDoc = await _decorate(doc, contexts[index]);
-      if (!includePermissions) outputDoc = this.addEmptyPermissions(outputDoc);
+      if (!this.stripPermissionsOutput(outputDoc)) {
+        if (!includePermissions && !includeFieldPermissions) outputDoc = this.addEmptyPermissions(outputDoc);
+        stripUnexposedDocPermissions(this.modelName, outputDoc);
+      }
       return outputDoc;
     });
     return {
@@ -3957,7 +4048,8 @@ var Service = class extends Base {
     return { ...typedIssue, detail, pointer: `#/${index}` };
   }
   async new(args, options) {
-    const { skim, includePermissions } = options ?? {};
+    const { skim, includePermissions: requestedPermissions } = options ?? {};
+    const includePermissions = this.options.stripPermissionsField ? false : requestedPermissions;
     const data = await this.model.new();
     let doc = data;
     doc = await this.trimOutputFields(doc, "create", this.baseFieldsExt);
@@ -3966,7 +4058,10 @@ var Service = class extends Base {
       includeDocPermissions = this.checkIfModelPermissionExists(["create", "read", "update"]);
     }
     if (includeDocPermissions) doc = await this.addDocPermissions(doc, "create", {});
-    if (!includePermissions) doc = this.addEmptyPermissions(doc);
+    if (!this.stripPermissionsOutput(doc)) {
+      if (!includePermissions) doc = this.addEmptyPermissions(doc);
+      stripUnexposedDocPermissions(this.modelName, doc);
+    }
     return {
       success: true,
       kind: "single",
@@ -3985,7 +4080,7 @@ var Service = class extends Base {
     const filterErrors = this.validateClientFilter(filter2);
     if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
     const { populate, overrides } = this.resolveUpdateOneArgs(args);
-    const { skim, includePermissions, populateAccess } = this.resolveUpdateOneOptions(options);
+    const { skim, includePermissions, includeFieldPermissions, populateAccess } = this.resolveUpdateOneOptions(options);
     const { filter: overrideFilter, populate: overridePopulate } = overrides ?? {};
     const [_filter, _populate] = await Promise.all([
       overrideFilter ?? this.genFilter("update", filter2),
@@ -4062,22 +4157,25 @@ var Service = class extends Base {
     this.asServiceHookContext(context).diff(doc);
     await this.changes(doc.toObject({ virtuals: false }), context);
     let includeDocPermissions = includePermissions;
-    if (!includeDocPermissions && !skim) {
+    if (!includeDocPermissions && (!skim || includeFieldPermissions)) {
       includeDocPermissions = this.checkIfModelPermissionExists(["read", "update"]);
     }
     if (includeDocPermissions) doc = await this.addDocPermissions(doc, "update", context);
-    if (includePermissions) doc = await this.addFieldPermissions(doc, "update", context);
+    if (includeFieldPermissions) doc = await this.addFieldPermissions(doc, "update", context);
     if (_populate) await this.persist(() => populateDoc(doc, _populate));
     doc = await this.trimOutputFields(doc, "read", this.baseFieldsExt);
     let outputDoc = doc;
     if (isFunction3(decorate)) outputDoc = await decorate(outputDoc, context);
-    if (!includePermissions) outputDoc = this.addEmptyPermissions(outputDoc);
+    if (!this.stripPermissionsOutput(outputDoc)) {
+      if (!includePermissions && !includeFieldPermissions) outputDoc = this.addEmptyPermissions(outputDoc);
+      stripUnexposedDocPermissions(this.modelName, outputDoc);
+    }
     this.completeOp("updateOne", startedAt, "success" /* Success */, _filter);
     return { success: true, kind: "single", code: "success" /* Success */, data: outputDoc, input: prepared };
   }
   async updateById(id, data, args = {}, options = {}, decorate) {
     const { populate, overrides } = this.resolveUpdateByIdArgs(args);
-    const { skim, includePermissions, populateAccess } = this.resolveUpdateByIdOptions(options);
+    const { skim, includePermissions, includeFieldPermissions, populateAccess } = this.resolveUpdateByIdOptions(options);
     const { populate: overridePopulate, idFilter: overrideIdFilter } = overrides;
     const filter2 = overrideIdFilter ?? await this.genIDFilter(id);
     if (filter2 === false) return { success: false, kind: "error", code: "forbidden" /* Forbidden */, query: { filter: filter2 } };
@@ -4090,7 +4188,7 @@ var Service = class extends Base {
           populate: overridePopulate
         }
       },
-      { skim, includePermissions, populateAccess },
+      { skim, includePermissions, includeFieldPermissions, populateAccess },
       decorate
     );
   }
@@ -4098,7 +4196,7 @@ var Service = class extends Base {
     const filterErrors = this.validateClientFilter(filter2);
     if (filterErrors.length > 0) return { success: false, kind: "error", code: "bad_request" /* BadRequest */, errors: filterErrors };
     const { populate, overrides } = this.resolveUpsertArgs(args);
-    const { skim, includePermissions, populateAccess } = this.resolveUpsertOptions(options);
+    const { skim, includePermissions, includeFieldPermissions, populateAccess } = this.resolveUpsertOptions(options);
     const { filter: overrideFilter, populate: overridePopulate } = overrides ?? {};
     const _filter = await (overrideFilter ?? this.genFilter("update", filter2));
     const query = { filter: _filter };
@@ -4120,7 +4218,7 @@ var Service = class extends Base {
             populate: overridePopulate
           }
         },
-        { skim, includePermissions, populateAccess },
+        { skim, includePermissions, includeFieldPermissions, populateAccess },
         decorate
       );
     } else {
@@ -4130,6 +4228,7 @@ var Service = class extends Base {
         {
           skim,
           includePermissions,
+          includeFieldPermissions,
           populateAccess
         },
         decorate
@@ -4454,11 +4553,11 @@ import { pick as pick4 } from "@web-ts-toolkit/utils";
 var PublicService = class extends Service {
   async _list(filter2, args, options) {
     const { select, populate, include, sort, skip, limit, page, pageSize, tasks } = this.resolvePublicListArgs(args);
-    const { skim, includePermissions, includeCount, populateAccess, lean } = this.resolvePublicListOptions(options);
+    const { skim, includePermissions, includeFieldPermissions, includeCount, populateAccess, lean } = this.resolvePublicListOptions(options);
     const result = await this.find(
       filter2,
       { select, populate, include, sort, skip, limit, page, pageSize },
-      { skim, includePermissions, includeCount, populateAccess, lean },
+      { skim, includePermissions, includeFieldPermissions, includeCount, populateAccess, lean },
       async (doc, context) => {
         doc = toObject(doc);
         return this.decorate(doc, "list", context);
@@ -4480,11 +4579,11 @@ var PublicService = class extends Service {
   }
   async _create(data, args, options) {
     const { select, populate, tasks } = this.resolvePublicCreateArgs(args);
-    const { skim, includePermissions, populateAccess } = this.resolvePublicCreateOptions(options);
+    const { skim, includePermissions, includeFieldPermissions, populateAccess } = this.resolvePublicCreateOptions(options);
     const result = await this.create(
       data,
       { populate },
-      { skim, includePermissions, populateAccess },
+      { skim, includePermissions, includeFieldPermissions, populateAccess },
       async (doc, context) => {
         let d = toObject(doc);
         d = await this.decorate(d, "create", context);
@@ -4503,7 +4602,7 @@ var PublicService = class extends Service {
   }
   async _read(id, args, options) {
     const { select, populate, include, tasks } = this.resolvePublicReadArgs(args);
-    const { skim, includePermissions, tryList, populateAccess, lean } = this.resolvePublicReadOptions(options);
+    const { skim, includePermissions, includeFieldPermissions, tryList, populateAccess, lean } = this.resolvePublicReadOptions(options);
     let access = "read";
     const idFilter = await this.genIDFilter(id);
     let result = await this.findById(
@@ -4514,7 +4613,7 @@ var PublicService = class extends Service {
         include,
         overrides: { idFilter }
       },
-      { skim, includePermissions, access, populateAccess, lean }
+      { skim, includePermissions, includeFieldPermissions, access, populateAccess, lean }
     );
     if (!result.success && (result.code === "bad_request" /* BadRequest */ || result.code === "forbidden" /* Forbidden */)) return result;
     if (tryList && (!result.success || !result.data)) {
@@ -4531,7 +4630,7 @@ var PublicService = class extends Service {
           include,
           overrides: { idFilter }
         },
-        { skim, includePermissions, access, populateAccess, lean }
+        { skim, includePermissions, includeFieldPermissions, access, populateAccess, lean }
       );
     }
     if (!result.success) {
@@ -4544,7 +4643,7 @@ var PublicService = class extends Service {
   }
   async _readFilter(filter2, args, options) {
     const { select, sort, populate, include, tasks } = this.resolvePublicReadFilterArgs(args);
-    const { skim, includePermissions, tryList, populateAccess, lean } = this.resolvePublicReadOptions(options);
+    const { skim, includePermissions, includeFieldPermissions, tryList, populateAccess, lean } = this.resolvePublicReadOptions(options);
     let access = "read";
     let result = await this.findOne(
       filter2,
@@ -4555,7 +4654,7 @@ var PublicService = class extends Service {
         include,
         overrides: {}
       },
-      { skim, includePermissions, access, populateAccess, lean }
+      { skim, includePermissions, includeFieldPermissions, access, populateAccess, lean }
     );
     if (!result.success && (result.code === "bad_request" /* BadRequest */ || result.code === "forbidden" /* Forbidden */)) return result;
     if (tryList && (!result.success || !result.data)) {
@@ -4573,7 +4672,7 @@ var PublicService = class extends Service {
           include,
           overrides: {}
         },
-        { skim, includePermissions, access, populateAccess, lean }
+        { skim, includePermissions, includeFieldPermissions, access, populateAccess, lean }
       );
     }
     if (!result.success) {
@@ -4585,13 +4684,14 @@ var PublicService = class extends Service {
     return { ...result, data: doc };
   }
   async _update(id, data, args, options) {
-    const { select, populate, tasks } = this.resolvePublicUpdateArgs(args);
-    const { skim, returningAll, includePermissions, populateAccess } = this.resolvePublicUpdateOptions(options);
+    const { select: requestedSelect, populate, tasks } = this.resolvePublicUpdateArgs(args);
+    const select = this.resolveEffectiveSelect(requestedSelect);
+    const { skim, returningAll, includePermissions, includeFieldPermissions, populateAccess } = this.resolvePublicUpdateOptions(options);
     const result = await this.updateById(
       id,
       data,
       { populate },
-      { skim, includePermissions, populateAccess },
+      { skim, includePermissions, includeFieldPermissions, populateAccess },
       async (doc, context) => {
         let d = toObject(doc);
         d = await this.decorate(d, "update", context);
@@ -4631,6 +4731,7 @@ var PublicService = class extends Service {
     return this._create(otherData, args, {
       skim: options?.skim,
       includePermissions: options?.includePermissions,
+      includeFieldPermissions: options?.includeFieldPermissions,
       populateAccess: options?.populateAccess
     });
   }
@@ -4660,9 +4761,11 @@ var PublicService = class extends Service {
     };
   }
   resolvePublicListOptions(options = {}) {
+    const includePermissions = options.includePermissions ?? this.defaults.publicListOptions?.includePermissions ?? false;
     return {
       skim: options.skim ?? this.defaults.publicListOptions?.skim ?? true,
-      includePermissions: options.includePermissions ?? this.defaults.publicListOptions?.includePermissions ?? false,
+      includePermissions,
+      includeFieldPermissions: options.includeFieldPermissions ?? this.defaults.publicListOptions?.includeFieldPermissions ?? includePermissions,
       includeCount: options.includeCount ?? this.defaults.publicListOptions?.includeCount ?? false,
       populateAccess: options.populateAccess ?? this.defaults.publicListOptions?.populateAccess ?? "read",
       lean: options.lean ?? this.defaults.publicListOptions?.lean ?? true
@@ -4676,9 +4779,11 @@ var PublicService = class extends Service {
     };
   }
   resolvePublicCreateOptions(options = {}) {
+    const includePermissions = options.includePermissions ?? this.defaults.publicCreateOptions?.includePermissions ?? true;
     return {
       skim: options.skim ?? this.defaults.publicCreateOptions?.skim ?? false,
-      includePermissions: options.includePermissions ?? this.defaults.publicCreateOptions?.includePermissions ?? true,
+      includePermissions,
+      includeFieldPermissions: options.includeFieldPermissions ?? this.defaults.publicCreateOptions?.includeFieldPermissions ?? includePermissions,
       populateAccess: options.populateAccess ?? this.defaults.publicCreateOptions?.populateAccess ?? "read"
     };
   }
@@ -4698,9 +4803,11 @@ var PublicService = class extends Service {
     };
   }
   resolvePublicReadOptions(options = {}) {
+    const includePermissions = options.includePermissions ?? this.defaults.publicReadOptions?.includePermissions ?? true;
     return {
       skim: options.skim ?? this.defaults.publicReadOptions?.skim ?? false,
-      includePermissions: options.includePermissions ?? this.defaults.publicReadOptions?.includePermissions ?? true,
+      includePermissions,
+      includeFieldPermissions: options.includeFieldPermissions ?? this.defaults.publicReadOptions?.includeFieldPermissions ?? includePermissions,
       tryList: options.tryList ?? this.defaults.publicReadOptions?.tryList ?? true,
       populateAccess: options.populateAccess ?? this.defaults.publicReadOptions?.populateAccess,
       lean: options.lean ?? this.defaults.publicReadOptions?.lean ?? false
@@ -4714,10 +4821,12 @@ var PublicService = class extends Service {
     };
   }
   resolvePublicUpdateOptions(options = {}) {
+    const includePermissions = options.includePermissions ?? this.defaults.publicUpdateOptions?.includePermissions ?? true;
     return {
       skim: options.skim ?? this.defaults.publicUpdateOptions?.skim ?? false,
       returningAll: options.returningAll ?? this.defaults.publicUpdateOptions?.returningAll ?? true,
-      includePermissions: options.includePermissions ?? this.defaults.publicUpdateOptions?.includePermissions ?? true,
+      includePermissions,
+      includeFieldPermissions: options.includeFieldPermissions ?? this.defaults.publicUpdateOptions?.includeFieldPermissions ?? includePermissions,
       populateAccess: options.populateAccess ?? this.defaults.publicUpdateOptions?.populateAccess ?? "read"
     };
   }
@@ -6792,23 +6901,32 @@ var listQuerySchema = z3.object({
   page_size: positiveIntegerString.optional(),
   skim: queryBooleanString.optional(),
   include_permissions: queryBooleanString.optional(),
+  include_field_permissions: queryBooleanString.optional(),
   include_count: queryBooleanString.optional(),
-  include_extra_headers: queryBooleanString.optional()
+  include_extra_headers: queryBooleanString.optional(),
+  select: stringOrStringArray.optional(),
+  sort: z3.string().optional().describe("Space-separated sort fields; prefix a field with - for descending order.")
 }).passthrough();
 var createQuerySchema = z3.object({
-  include_permissions: queryBooleanString.optional()
+  include_permissions: queryBooleanString.optional(),
+  include_field_permissions: queryBooleanString.optional()
 }).passthrough();
 var readQuerySchema = z3.object({
   include_permissions: queryBooleanString.optional(),
-  try_list: queryBooleanString.optional()
+  include_field_permissions: queryBooleanString.optional(),
+  try_list: queryBooleanString.optional(),
+  select: stringOrStringArray.optional()
 }).passthrough();
 var updateQuerySchema = z3.object({
   returning_all: queryBooleanString.optional(),
-  include_permissions: queryBooleanString.optional()
+  include_permissions: queryBooleanString.optional(),
+  include_field_permissions: queryBooleanString.optional(),
+  select: stringOrStringArray.optional()
 }).passthrough();
 var upsertQuerySchema = z3.object({
   returning_all: queryBooleanString.optional(),
-  include_permissions: queryBooleanString.optional()
+  include_permissions: queryBooleanString.optional(),
+  include_field_permissions: queryBooleanString.optional()
 }).passthrough();
 var listBodySchema = z3.object({
   filter: objectOrArraySchema.optional(),
@@ -6824,6 +6942,7 @@ var listBodySchema = z3.object({
   options: z3.object({
     skim: z3.boolean().optional(),
     includePermissions: z3.boolean().optional(),
+    includeFieldPermissions: z3.boolean().optional(),
     includeCount: z3.boolean().optional(),
     includeExtraHeaders: z3.boolean().optional(),
     populateAccess: z3.unknown().optional()
@@ -6842,6 +6961,7 @@ var readFilterBodySchema = z3.object({
   options: z3.object({
     skim: z3.boolean().optional(),
     includePermissions: z3.boolean().optional(),
+    includeFieldPermissions: z3.boolean().optional(),
     tryList: z3.boolean().optional(),
     populateAccess: z3.unknown().optional()
   }).passthrough().optional()
@@ -6854,6 +6974,7 @@ var readByIdBodySchema = z3.object({
   options: z3.object({
     skim: z3.boolean().optional(),
     includePermissions: z3.boolean().optional(),
+    includeFieldPermissions: z3.boolean().optional(),
     tryList: z3.boolean().optional(),
     populateAccess: z3.unknown().optional()
   }).passthrough().optional()
@@ -6865,6 +6986,7 @@ var advancedCreateBodySchema = z3.object({
   tasks: tasksSchema.optional(),
   options: z3.object({
     includePermissions: z3.boolean().optional(),
+    includeFieldPermissions: z3.boolean().optional(),
     populateAccess: z3.unknown().optional()
   }).passthrough().optional()
 }).passthrough();
@@ -6881,6 +7003,7 @@ var advancedUpdateBodySchema = z3.object({
   options: z3.object({
     returningAll: z3.boolean().optional(),
     includePermissions: z3.boolean().optional(),
+    includeFieldPermissions: z3.boolean().optional(),
     populateAccess: z3.unknown().optional()
   }).passthrough().optional()
 }).passthrough();
@@ -6893,6 +7016,7 @@ var advancedUpsertBodySchema = z3.object({
   options: z3.object({
     returningAll: z3.boolean().optional(),
     includePermissions: z3.boolean().optional(),
+    includeFieldPermissions: z3.boolean().optional(),
     populateAccess: z3.unknown().optional()
   }).passthrough().optional()
 }).passthrough();
@@ -6963,6 +7087,7 @@ var rootModelListArgsSchema = z5.object({
 var rootModelListOptionsSchema = z5.object({
   skim: z5.boolean().optional(),
   includePermissions: z5.boolean().optional(),
+  includeFieldPermissions: z5.boolean().optional(),
   includeCount: z5.boolean().optional(),
   populateAccess: z5.unknown().optional(),
   lean: z5.boolean().optional()
@@ -6979,6 +7104,7 @@ var rootModelReadFilterArgsSchema = rootModelReadArgsSchema.extend({
 var rootModelReadOptionsSchema = z5.object({
   skim: z5.boolean().optional(),
   includePermissions: z5.boolean().optional(),
+  includeFieldPermissions: z5.boolean().optional(),
   tryList: z5.boolean().optional(),
   populateAccess: z5.unknown().optional(),
   lean: z5.boolean().optional()
@@ -6991,6 +7117,7 @@ var rootModelCreateArgsSchema = z5.object({
 var rootModelCreateOptionsSchema = z5.object({
   skim: z5.boolean().optional(),
   includePermissions: z5.boolean().optional(),
+  includeFieldPermissions: z5.boolean().optional(),
   populateAccess: z5.unknown().optional()
 }).passthrough();
 var rootModelUpdateArgsSchema = z5.object({
@@ -7002,6 +7129,7 @@ var rootModelUpdateOptionsSchema = z5.object({
   skim: z5.boolean().optional(),
   returningAll: z5.boolean().optional(),
   includePermissions: z5.boolean().optional(),
+  includeFieldPermissions: z5.boolean().optional(),
   populateAccess: z5.unknown().optional()
 }).passthrough();
 var rootModelUpsertArgsSchema = rootModelUpdateArgsSchema;
@@ -7033,7 +7161,8 @@ var rootModelNewArgsSchema = z5.object({
 }).passthrough();
 var rootModelNewOptionsSchema = z5.object({
   skim: z5.boolean().optional(),
-  includePermissions: z5.boolean().optional()
+  includePermissions: z5.boolean().optional(),
+  includeFieldPermissions: z5.boolean().optional()
 }).passthrough();
 var rootModelQueryEntrySchema = z5.union([
   z5.object({
@@ -7202,16 +7331,29 @@ function setModelCollectionRoutes(context) {
   };
   router.get("", async (req) => {
     await context.assertAllowed(req, "list");
-    const { skip, limit, page, page_size, skim, include_permissions, include_count, include_extra_headers } = parseQuery(requestSchemas.listQuery, req.query);
+    const {
+      skip,
+      limit,
+      page,
+      page_size,
+      skim,
+      include_permissions,
+      include_field_permissions,
+      include_count,
+      include_extra_headers,
+      select,
+      sort
+    } = parseQuery(requestSchemas.listQuery, req.query);
     const svc = context.getPublicService(req);
     const includeCount = parseBooleanString(include_count);
     const includeExtraHeaders = parseBooleanString(include_extra_headers);
     const result = await svc._list(
       {},
-      { skip, limit, page, pageSize: page_size },
+      { select: parseSelectParam(select), sort, skip, limit, page, pageSize: page_size },
       {
         skim: parseBooleanString(skim),
         includePermissions: parseBooleanString(include_permissions),
+        includeFieldPermissions: parseBooleanString(include_field_permissions),
         includeCount
       }
     );
@@ -7234,7 +7376,7 @@ function setModelCollectionRoutes(context) {
     );
     const { filter: filter2, select, sort, populate, include, tasks, skip, limit, page, pageSize } = body;
     const advancedOptions = body.options ?? {};
-    const { skim, includePermissions, includeCount, includeExtraHeaders, populateAccess } = advancedOptions;
+    const { skim, includePermissions, includeFieldPermissions, includeCount, includeExtraHeaders, populateAccess } = advancedOptions;
     const svc = context.getPublicService(req);
     const listFilter = filter2 ?? {};
     const result = await svc._list(
@@ -7243,6 +7385,7 @@ function setModelCollectionRoutes(context) {
       {
         skim,
         includePermissions,
+        includeFieldPermissions,
         includeCount,
         populateAccess
       }
@@ -7259,14 +7402,21 @@ function setModelCollectionRoutes(context) {
   });
   router.post("", async (req) => {
     await context.assertAllowed(req, "create");
-    const { include_permissions } = parseQuery(requestSchemas.createQuery, req.query);
+    const { include_permissions, include_field_permissions } = parseQuery(requestSchemas.createQuery, req.query);
     const data = await parseBodyWithSchema(
       createBodySchema,
       req.body,
       context.getRequestSchema("requestSchemas.create")
     );
     const svc = context.getPublicService(req);
-    const result = await svc._create(data, {}, { includePermissions: parseBooleanString(include_permissions) });
+    const result = await svc._create(
+      data,
+      {},
+      {
+        includePermissions: parseBooleanString(include_permissions),
+        includeFieldPermissions: parseBooleanString(include_field_permissions)
+      }
+    );
     handleResultError(result);
     return formatModelCreatedResponse(result);
   });
@@ -7280,7 +7430,7 @@ function setModelCollectionRoutes(context) {
   });
   router.post(`/${options.mutationRouteSegment}`, async (req) => {
     await context.assertAllowed(req, "create");
-    const { include_permissions } = parseQuery(requestSchemas.createQuery, req.query);
+    const { include_permissions, include_field_permissions } = parseQuery(requestSchemas.createQuery, req.query);
     const intermediateBody = await parseNestedBodyWithSchema(
       advancedCreateBodySchema,
       req.body,
@@ -7296,13 +7446,14 @@ function setModelCollectionRoutes(context) {
     );
     const { data: finalData, select: finalSelect, populate: finalPopulate, tasks: finalTasks } = finalBody;
     const finalOptions = finalBody.options ?? {};
-    const { includePermissions, populateAccess } = finalOptions;
+    const { includePermissions, includeFieldPermissions, populateAccess } = finalOptions;
     const svc = context.getPublicService(req);
     const result = await svc._create(
       finalData,
       { select: finalSelect, populate: finalPopulate, tasks: finalTasks },
       {
         includePermissions: includePermissions ?? parseBooleanString(include_permissions),
+        includeFieldPermissions: includeFieldPermissions ?? parseBooleanString(include_field_permissions),
         populateAccess
       }
     );
@@ -7320,7 +7471,7 @@ function setModelCollectionRoutes(context) {
   router.get("/new", async (req) => {
     await context.assertAllowed(req, "new");
     const svc = context.getPublicService(req);
-    const result = await svc._new({}, { includePermissions: false });
+    const result = await svc._new({}, { includePermissions: false, includeFieldPermissions: false });
     handleResultError(result);
     return unwrapServiceData(result);
   });
@@ -7388,13 +7539,17 @@ function setModelDocumentRoutes(context) {
   router.get(`/:${options.idParam}`, async (req) => {
     await context.assertAllowed(req, "read");
     const id = parsePathParam(req.params[options.idParam], options.idParam);
-    const { include_permissions, try_list } = parseQuery(requestSchemas.readQuery, req.query);
+    const { include_permissions, include_field_permissions, try_list, select } = parseQuery(
+      requestSchemas.readQuery,
+      req.query
+    );
     const svc = context.getPublicService(req);
     const result = await svc._read(
       id,
-      {},
+      { select: parseSelectParam(select) },
       {
         includePermissions: parseBooleanString(include_permissions),
+        includeFieldPermissions: parseBooleanString(include_field_permissions),
         tryList: parseBooleanString(try_list)
       }
     );
@@ -7417,12 +7572,18 @@ function setModelDocumentRoutes(context) {
     );
     const { filter: filter2, select, sort, populate, include, tasks } = body;
     const advancedOptions = body.options ?? {};
-    const { skim, includePermissions, tryList, populateAccess } = advancedOptions;
+    const { skim, includePermissions, includeFieldPermissions, tryList, populateAccess } = advancedOptions;
     const svc = context.getPublicService(req);
     const result = await svc._readFilter(
       filter2 ?? {},
       { select, sort, populate, include, tasks },
-      { skim, includePermissions, tryList, populateAccess }
+      {
+        skim,
+        includePermissions,
+        includeFieldPermissions,
+        tryList,
+        populateAccess
+      }
     );
     handleResultError(result);
     return unwrapServiceData(result);
@@ -7446,12 +7607,18 @@ function setModelDocumentRoutes(context) {
     );
     const { select, populate, include, tasks } = body;
     const advancedOptions = body.options ?? {};
-    const { skim, includePermissions, tryList, populateAccess } = advancedOptions;
+    const { skim, includePermissions, includeFieldPermissions, tryList, populateAccess } = advancedOptions;
     const svc = context.getPublicService(req);
     const result = await svc._read(
       id,
       { select, populate, include, tasks },
-      { skim, includePermissions, tryList, populateAccess }
+      {
+        skim,
+        includePermissions,
+        includeFieldPermissions,
+        tryList,
+        populateAccess
+      }
     );
     handleResultError(result);
     return unwrapServiceData(result);
@@ -7468,7 +7635,10 @@ function setModelDocumentRoutes(context) {
   router.patch(`/:${options.idParam}`, async (req) => {
     await context.assertAllowed(req, "update");
     const id = parsePathParam(req.params[options.idParam], options.idParam);
-    const { returning_all, include_permissions } = parseQuery(requestSchemas.updateQuery, req.query);
+    const { returning_all, include_permissions, include_field_permissions, select } = parseQuery(
+      requestSchemas.updateQuery,
+      req.query
+    );
     const data = await parseBodyWithSchema(
       updateBodySchema,
       req.body,
@@ -7478,10 +7648,11 @@ function setModelDocumentRoutes(context) {
     const result = await svc._update(
       id,
       data,
-      {},
+      { select: parseSelectParam(select) },
       {
         returningAll: parseBooleanString(returning_all),
-        includePermissions: parseBooleanString(include_permissions)
+        includePermissions: parseBooleanString(include_permissions),
+        includeFieldPermissions: parseBooleanString(include_field_permissions)
       }
     );
     handleResultError(result);
@@ -7498,7 +7669,10 @@ function setModelDocumentRoutes(context) {
   router.patch(`/${options.mutationRouteSegment}/:${options.idParam}`, async (req) => {
     await context.assertAllowed(req, "update");
     const id = parsePathParam(req.params[options.idParam], options.idParam);
-    const { returning_all, include_permissions } = parseQuery(requestSchemas.updateQuery, req.query);
+    const { returning_all, include_permissions, include_field_permissions } = parseQuery(
+      requestSchemas.updateQuery,
+      req.query
+    );
     const intermediateBody = await parseNestedBodyWithSchema(
       advancedUpdateBodySchema,
       req.body,
@@ -7520,7 +7694,7 @@ function setModelDocumentRoutes(context) {
     );
     const { data: finalData, select: finalSelect, populate: finalPopulate, tasks: finalTasks } = finalBody;
     const finalOptions = finalBody.options ?? {};
-    const { returningAll, includePermissions, populateAccess } = finalOptions;
+    const { returningAll, includePermissions, includeFieldPermissions, populateAccess } = finalOptions;
     const svc = context.getPublicService(req);
     const result = await svc._update(
       id,
@@ -7529,6 +7703,7 @@ function setModelDocumentRoutes(context) {
       {
         returningAll: returningAll ?? parseBooleanString(returning_all),
         includePermissions: includePermissions ?? parseBooleanString(include_permissions),
+        includeFieldPermissions: includeFieldPermissions ?? parseBooleanString(include_field_permissions),
         populateAccess
       }
     );
@@ -7546,7 +7721,10 @@ function setModelDocumentRoutes(context) {
   router.put(`/`, async (req) => {
     await context.assertAllowed(req, "upsert");
     const svc = context.getPublicService(req);
-    const { returning_all, include_permissions } = parseQuery(requestSchemas.upsertQuery, req.query);
+    const { returning_all, include_permissions, include_field_permissions } = parseQuery(
+      requestSchemas.upsertQuery,
+      req.query
+    );
     const body = await parseBodyWithSchema(
       upsertBodySchema,
       req.body,
@@ -7557,7 +7735,8 @@ function setModelDocumentRoutes(context) {
       {},
       {
         returningAll: parseBooleanString(returning_all),
-        includePermissions: parseBooleanString(include_permissions)
+        includePermissions: parseBooleanString(include_permissions),
+        includeFieldPermissions: parseBooleanString(include_field_permissions)
       }
     );
     handleResultError(result);
@@ -7574,7 +7753,10 @@ function setModelDocumentRoutes(context) {
   router.put(`/${options.mutationRouteSegment}`, async (req) => {
     await context.assertAllowed(req, "upsert");
     const svc = context.getPublicService(req);
-    const { returning_all, include_permissions } = parseQuery(requestSchemas.upsertQuery, req.query);
+    const { returning_all, include_permissions, include_field_permissions } = parseQuery(
+      requestSchemas.upsertQuery,
+      req.query
+    );
     const intermediateBody = await parseNestedBodyWithSchema(
       advancedUpsertBodySchema,
       req.body,
@@ -7596,13 +7778,14 @@ function setModelDocumentRoutes(context) {
     );
     const { data: finalData, select: finalSelect, populate: finalPopulate, tasks: finalTasks } = finalBody;
     const finalOptions = finalBody.options ?? {};
-    const { returningAll, includePermissions, populateAccess } = finalOptions;
+    const { returningAll, includePermissions, includeFieldPermissions, populateAccess } = finalOptions;
     const result = await svc._upsert(
       finalData,
       { select: finalSelect, populate: finalPopulate, tasks: finalTasks },
       {
         returningAll: returningAll ?? parseBooleanString(returning_all),
         includePermissions: includePermissions ?? parseBooleanString(include_permissions),
+        includeFieldPermissions: includeFieldPermissions ?? parseBooleanString(include_field_permissions),
         populateAccess
       }
     );