@web-ts-toolkit/access-router 0.55.0 → 0.56.0

package/index.js

@@ -2251,7 +2251,8 @@ function normalizeSelection(select, catalog, label) {
     includeId: selection.includes("_id")
   };
 }
-function captureVirtualPopulateDependencies(runtime, modelName, options) {
+function captureVirtualPopulateDependencies(runtime, modelName, options, globalOptions = runtime.getGlobalOptions()) {
+  const requireReadOperationAccessForPopulateDependencies = globalOptions.requireReadOperationAccessForPopulateDependencies !== false;
   const model = runtime.getModelInstance(modelName);
   const targets = /* @__PURE__ */ new Map();
   const scopes = [];
@@ -2300,6 +2301,7 @@ function captureVirtualPopulateDependencies(runtime, modelName, options) {
               {
                 catalog,
                 documentPermissionField,
+                requireReadOperationAccessForPopulateDependencies,
                 operationAccess: { read: readOption("operationAccess.read") },
                 baseFilter: { read: readOption("baseFilter.read") },
                 overrideFilter: { read: readOption("overrideFilter.read") },
@@ -2379,8 +2381,8 @@ function captureVirtualPopulateDependencies(runtime, modelName, options) {
   visit(options.virtuals ?? {}, model?.schema, "", [], !!model && varyingModel(model));
   return Object.freeze({ scopes: Object.freeze(scopes) });
 }
-function captureVirtualPopulateSnapshot(runtime, modelName, options) {
-  const snapshot = captureVirtualPopulateDependencies(runtime, modelName, options);
+function captureVirtualPopulateSnapshot(runtime, modelName, options, globalOptions = runtime.getGlobalOptions()) {
+  const snapshot = captureVirtualPopulateDependencies(runtime, modelName, options, globalOptions);
   const token = () => {
   };
   snapshots.set(token, snapshot);
@@ -2791,6 +2793,7 @@ var init_runtime = __esm({
             requestPermissionField: "_permissions",
             globalPermissions: () => ({}),
             requireRegisteredPopulateModels: true,
+            requireReadOperationAccessForPopulateDependencies: true,
             logger: defaultLogger,
             requestComplexity: defaultRequestComplexity
           },
@@ -2963,9 +2966,16 @@ var init_runtime = __esm({
       }
       /** Shallowly replace supplied global values; nested objects such as requestComplexity are not deep-merged. */
       setGlobalOptions(options) {
-        this.globalOptions.assign(options);
+        const next = { ...options };
+        if ("requireReadOperationAccessForPopulateDependencies" in next)
+          next.requireReadOperationAccessForPopulateDependencies = next.requireReadOperationAccessForPopulateDependencies !== false;
+        this.globalOptions.assign(next);
       }
       setGlobalOption(key, value) {
+        if (key === "requireReadOperationAccessForPopulateDependencies") {
+          this.globalOptions.set("requireReadOperationAccessForPopulateDependencies", value !== false);
+          return;
+        }
         this.globalOptions.set(key, value);
       }
       getGlobalOptions() {
@@ -4606,14 +4616,21 @@ function getCapturedAuthorizationOption(configuration, key) {
   const defaultValue = key.startsWith("operationAccess.") ? (0, import_utils21.get)(configuration.operationAccessDefaults, key.slice("operationAccess.".length)) : void 0;
   return resolveNestedOption((path, fallback) => (0, import_utils21.get)(configuration, path, fallback), key, defaultValue);
 }
-function captureModelAuthorizationConfiguration(runtime, modelName, options = runtime.getModelOptions(modelName)) {
+function captureModelAuthorizationConfiguration(runtime, modelName, options = runtime.getModelOptions(modelName), globalOptions = runtime.getGlobalOptions()) {
   const model = runtime.getModelInstance(modelName);
   if (!model) return authorizationError(`unknown receiving model: ${modelName}`);
   const virtuals = options.virtuals;
   return copyAuthorizationValue(
     {
       catalog: captureAuthorizationFieldCatalog(model.schema, virtuals, options.documentPermissionField),
-      virtualPopulateSnapshot: captureVirtualPopulateSnapshot(runtime, modelName, options),
+      virtualPopulateSnapshot: captureVirtualPopulateSnapshot(
+        runtime,
+        modelName,
+        options,
+        globalOptions
+      ),
+      requireReadOperationAccessForPopulateDependencies: globalOptions.requireReadOperationAccessForPopulateDependencies !== false,
+      requireRegisteredPopulateModels: globalOptions.requireRegisteredPopulateModels,
       permissionSchema: options.permissionSchema,
       virtuals,
       alwaysSelectFields: options.alwaysSelectFields,
@@ -5273,7 +5290,8 @@ function createVirtualPopulateBatch(owner) {
     owner: { ...owner },
     rows: [],
     requests: [],
-    rowCache: owner.core && getRequestRowCache(owner.core) || new Cache()
+    rowCache: owner.core && getRequestRowCache(owner.core) || new Cache(),
+    readGuards: /* @__PURE__ */ new Map()
   });
   return batch;
 }
@@ -5322,12 +5340,19 @@ function captureVirtualPopulateRows(batch, inputs, plan, publicPopulate = [], so
       }
       const record3 = storage(value);
       if (!record3) return;
-      const occurrence = { address, plan: currentPlan, refs: /* @__PURE__ */ new Map(), dependencies: /* @__PURE__ */ new Map() };
+      const occurrence = {
+        address,
+        plan: currentPlan,
+        refs: /* @__PURE__ */ new Map(),
+        referenceTargets: /* @__PURE__ */ new Map(),
+        dependencies: /* @__PURE__ */ new Map()
+      };
       row.occurrences.set(addressKey(address), occurrence);
       for (const candidate of currentPlan.candidates) {
         const dependencies = (candidate.populateDependencies ?? []).map((dependency) => {
           if (!occurrence.refs.has(dependency.path))
             occurrence.refs.set(dependency.path, originalRef(value, dependency.path));
+          occurrence.referenceTargets.set(dependency.path, dependency.target);
           const request = {
             binding: dependency.target,
             target: dependency.target,
@@ -5388,6 +5413,27 @@ function referenceIds(original) {
   if (!original.present || original.value == null) return [];
   return (Array.isArray(original.value) ? original.value : [original.value]).filter((id) => id != null);
 }
+function targetReadAllowed(state, target) {
+  let pending = state.readGuards.get(target.identity);
+  if (!pending) {
+    const { owner } = state;
+    pending = getRequestWorkState(owner.request, owner.runtime).hookGate.run(
+      () => evaluateRouteGuard(
+        owner.request,
+        owner.permissions,
+        getCapturedAuthorizationOption(target.configuration, "operationAccess.read")
+      )
+    ).then(
+      (allowed) => !!allowed,
+      () => {
+        warn("Virtual populated dependency unavailable", { modelName: target.modelName, category: "policy" });
+        return false;
+      }
+    );
+    state.readGuards.set(target.identity, pending);
+  }
+  return pending;
+}
 function executeVirtualPopulateBatch(batch) {
   const state = batches.get(batch);
   if (!state) throw new Error("Unknown private populate batch");
@@ -5404,14 +5450,8 @@ async function execute(state) {
     if (!pending) {
       pending = (async () => {
         try {
-          const allowed = await work.hookGate.run(
-            () => evaluateRouteGuard(
-              owner.request,
-              owner.permissions,
-              getCapturedAuthorizationOption(target.configuration, "operationAccess.read")
-            )
-          );
-          if (!allowed) return void 0;
+          if (target.configuration.requireReadOperationAccessForPopulateDependencies !== false && !await targetReadAllowed(state, target))
+            return void 0;
           const parts = await work.hookGate.run(
             () => resolveAccessFilterParts({
               req: owner.request,
@@ -5496,6 +5536,12 @@ function readVirtualPopulateOriginalReference(row, address, path) {
 function hasVirtualPopulatePublicReference(row, address, path) {
   return !!rows.get(row)?.publicRequests.some((request) => addressKey(request.address) === addressKey([...address, path]));
 }
+function isVirtualPopulateReferenceVisible(row, address, path) {
+  const record3 = rows.get(row);
+  const occurrence = record3?.occurrences.get(addressKey(address));
+  const target = occurrence?.refs.get(path)?.present ? occurrence.referenceTargets.get(path) : void 0;
+  return record3 && target ? targetReadAllowed(record3.batch, target) : Promise.resolve(true);
+}
 function readVirtualPopulateInputs(row, address, virtualName) {
   const record3 = rows.get(row);
   if (!record3?.batch.completed) return { available: false };
@@ -5654,7 +5700,7 @@ var init_virtual_populate_execution = __esm({
       const option = getCapturedAuthorizationOption(configuration, `${key}.${access}`);
       return key === "operationAccess" || typeof option === "function" ? option : void 0;
     });
-    compatible = (a, b) => a.binding.runtime === b.binding.runtime && a.binding.model === b.binding.model && a.binding.schema === b.binding.schema && a.access === b.access && a.requestRead === b.requestRead && // Different captures may share only an equivalent terminal persisted binding/policy.
+    compatible = (a, b) => a.binding.runtime === b.binding.runtime && a.binding.model === b.binding.model && a.binding.schema === b.binding.schema && a.access === b.access && a.requestRead === b.requestRead && a.binding.configuration.requireReadOperationAccessForPopulateDependencies === b.binding.configuration.requireReadOperationAccessForPopulateDependencies && // Different captures may share only an equivalent terminal persisted binding/policy.
     equivalentVirtualPopulatePredicate(
       a.binding.configuration.catalog.persistedPaths,
       b.binding.configuration.catalog.persistedPaths
@@ -6364,6 +6410,7 @@ async function finalizeSingleDoc(args, input) {
   if (!captured && documentPermissionField in output) keep.add(documentPermissionField);
   const trimmed = {};
   for (const key of keep) {
+    if (privateRow && !await isVirtualPopulateReferenceVisible(privateRow, privateAddress, key)) continue;
     if (privateRow && !hasVirtualPopulatePublicReference(privateRow, privateAddress, key)) {
       const ref = readVirtualPopulateOriginalReference(privateRow, privateAddress, key);
       if (ref) {
@@ -7269,6 +7316,11 @@ function modelServiceOptions(receiver, read) {
   if (call?.receiver !== receiver) return read();
   return call.options ??= read();
 }
+function modelServiceGlobalOptions(receiver, runtime) {
+  const call = dispatch.getStore();
+  if (call?.receiver !== receiver) return runtime.getGlobalOptions();
+  return call.globalOptions ??= runtime.getGlobalOptions();
+}
 
 // src/services/base.ts
 init_request_work();
@@ -7709,7 +7761,7 @@ function staticObjectIdReference(runtime, source, path, target) {
   const scalar = type?.instance === "Array" ? type.$embeddedSchemaType ?? type.embeddedSchemaType ?? type.caster : type;
   return scalar?.instance === "ObjectId" && (type?.options?.ref ?? scalar.options?.ref) === target && type?.options?.refPath === void 0 && scalar.options?.refPath === void 0;
 }
-function captureRelatedTargets(runtime, modelName, args = {}, depth = 0) {
+function captureRelatedTargets(runtime, modelName, args = {}, depth = 0, globalOptions = runtime.getGlobalOptions()) {
   if (depth > 32) authorizationError("related descriptor depth exceeded");
   assertPublicAdmission(args.populate, "populate");
   assertPublicAdmission(args.include, "include");
@@ -7723,16 +7775,16 @@ function captureRelatedTargets(runtime, modelName, args = {}, depth = 0) {
       targets.push({
         path,
         modelName: model,
-        configuration: captureModelAuthorizationConfiguration(runtime, model),
+        configuration: captureModelAuthorizationConfiguration(runtime, model, void 0, globalOptions),
         staticObjectIdReference: staticObjectIdReference(runtime, modelName, path, model)
       });
-    else if (model && !runtime.getGlobalOption("requireRegisteredPopulateModels", true)) {
+    else if (model && !(globalOptions.requireRegisteredPopulateModels === void 0 ? true : globalOptions.requireRegisteredPopulateModels)) {
       targets.push({ path, modelName: model, kind: "passthrough", configuration: { catalog: { paths: [] } } });
     }
   }
   for (const entry of entries(args.include)) {
     if (!runtime.hasModel(entry.model)) authorizationError(`Model ${entry.model} not found`);
-    const configuration = captureModelAuthorizationConfiguration(runtime, entry.model);
+    const configuration = captureModelAuthorizationConfiguration(runtime, entry.model, void 0, globalOptions);
     const queryIntent = entry.op === "count" ? void 0 : captureModelServiceIntent(
       {
         defaults: configuration.defaults ?? {},
@@ -7758,7 +7810,13 @@ function captureRelatedTargets(runtime, modelName, args = {}, depth = 0) {
       configuration,
       queryIntent,
       operationGuard: runtime.getModelOption(entry.model, `operationAccess.${entry.op}`),
-      relatedTargets: captureRelatedTargets(runtime, entry.model, queryIntent?.args ?? entry.args ?? {}, depth + 1)
+      relatedTargets: captureRelatedTargets(
+        runtime,
+        entry.model,
+        queryIntent?.args ?? entry.args ?? {},
+        depth + 1,
+        globalOptions
+      )
     });
   }
   if (new Set(targets.map((target) => target.path)).size !== targets.length)
@@ -9330,7 +9388,9 @@ function prepareSubdocumentOutput(service, sub, operation, virtualAccess, output
     captureRelatedTargets(
       getServiceExecutors(service).binding().runtime,
       service.getServiceModelName(),
-      { populate }
+      { populate },
+      0,
+      configuration
     ),
     void 0,
     configuration,
@@ -10369,10 +10429,12 @@ var Service = class extends Base {
         model: this.model.mongooseModel,
         modelName: this.modelName
       }),
-      configuration: () => this.requestRuntime.getModelInstance(this.modelName) ? captureModelAuthorizationConfiguration(this.requestRuntime, this.modelName, {
-        ...this.options,
-        defaults: this.defaults
-      }) : { catalog: { paths: [] }, ...this.options },
+      configuration: () => this.requestRuntime.getModelInstance(this.modelName) ? captureModelAuthorizationConfiguration(
+        this.requestRuntime,
+        this.modelName,
+        { ...this.options, defaults: this.defaults },
+        modelServiceGlobalOptions(this, this.requestRuntime)
+      ) : { catalog: { paths: [] }, ...this.options },
       permissions: () => this.requestCore.getPermissions?.() ?? new permission_default({}),
       parse: (filter2) => this.parseClientData(filter2, this.getCorrelatedExecState().scheduler),
       validate: (filter2, expanded) => {
@@ -10901,12 +10963,13 @@ var Service = class extends Base {
     });
   }
   captureRelated(args, defaults) {
+    const globalOptions = modelServiceGlobalOptions(this, this.requestRuntime);
     const effective = { populate: args?.populate ?? defaults?.populate, include: args?.include ?? defaults?.include };
     if (effective.include) {
       const processed = this.processInclude(effective.include);
       effective.include = [...processed.includes, ...processed.correlatedIncludes];
     }
-    return captureRelatedTargets(this.requestRuntime, this.modelName, effective);
+    return captureRelatedTargets(this.requestRuntime, this.modelName, effective, 0, globalOptions);
   }
   /** Canonical population uses the target's retained policy for both fetch and output. */
   async genExecutionPopulate(execution, access, populate) {
@@ -10928,12 +10991,11 @@ var Service = class extends Base {
         modelPermissionPrefix: captured.configuration.modelPermissionPrefix
       });
       if (sourceState === "denied") continue;
-      const modelName = getModelRef(this.modelName, descriptor.path);
+      const target = captured.relatedTargets.find((target2) => target2.path === descriptor.path);
+      const modelName = target?.modelName;
       if (!modelName) continue;
-      if (!this.requestRuntime.hasModel(modelName)) {
-        if (captured.relatedTargets.some((target) => target.path === descriptor.path && target.kind === "passthrough")) {
-          result2.push({ path: descriptor.path, select: descriptor.select });
-        }
+      if (target.kind === "passthrough") {
+        result2.push({ path: descriptor.path, select: descriptor.select });
         continue;
       }
       const policy = relatedPolicy(state.authorization, state.binding, descriptor.path);
@@ -10986,7 +11048,7 @@ var Service = class extends Base {
           schema: childState.binding.model.schema,
           configuration: targetConfiguration,
           requestRead: targetAccess === "read" && policy?.operation.mode !== "grant" && readServiceAuthorization(childState.authorization, childState.binding).authorization.rows.mode === "request",
-          staticObjectIdReference: captured.relatedTargets.find((target) => target.path === descriptor.path)?.staticObjectIdReference
+          staticObjectIdReference: captured.relatedTargets.find((target2) => target2.path === descriptor.path)?.staticObjectIdReference
         }
       });
       result2.push(ret);
@@ -11030,15 +11092,13 @@ var Service = class extends Base {
       transferDocumentAuthorizationGraph(source, copy2);
       return copy2;
     }
-    let targetMongooseModel;
-    try {
-      const inst = this.requestRuntime.getModelInstance?.(
-        meta.targetModelName
-      );
-      void inst;
-      targetMongooseModel = inst;
-    } catch {
-      targetMongooseModel = parentContext.mongooseModel;
+    let targetMongooseModel = meta.fetchBinding?.model;
+    if (!targetMongooseModel) {
+      try {
+        targetMongooseModel = this.requestRuntime.getModelInstance(meta.targetModelName);
+      } catch {
+        targetMongooseModel = parentContext.mongooseModel;
+      }
     }
     const targetContext = {
       mongooseModel: targetMongooseModel ?? parentContext.mongooseModel,

package/index.mjs

@@ -2231,7 +2231,8 @@ function normalizeSelection(select, catalog, label) {
     includeId: selection.includes("_id")
   };
 }
-function captureVirtualPopulateDependencies(runtime, modelName, options) {
+function captureVirtualPopulateDependencies(runtime, modelName, options, globalOptions = runtime.getGlobalOptions()) {
+  const requireReadOperationAccessForPopulateDependencies = globalOptions.requireReadOperationAccessForPopulateDependencies !== false;
   const model = runtime.getModelInstance(modelName);
   const targets = /* @__PURE__ */ new Map();
   const scopes = [];
@@ -2280,6 +2281,7 @@ function captureVirtualPopulateDependencies(runtime, modelName, options) {
               {
                 catalog,
                 documentPermissionField,
+                requireReadOperationAccessForPopulateDependencies,
                 operationAccess: { read: readOption("operationAccess.read") },
                 baseFilter: { read: readOption("baseFilter.read") },
                 overrideFilter: { read: readOption("overrideFilter.read") },
@@ -2359,8 +2361,8 @@ function captureVirtualPopulateDependencies(runtime, modelName, options) {
   visit(options.virtuals ?? {}, model?.schema, "", [], !!model && varyingModel(model));
   return Object.freeze({ scopes: Object.freeze(scopes) });
 }
-function captureVirtualPopulateSnapshot(runtime, modelName, options) {
-  const snapshot = captureVirtualPopulateDependencies(runtime, modelName, options);
+function captureVirtualPopulateSnapshot(runtime, modelName, options, globalOptions = runtime.getGlobalOptions()) {
+  const snapshot = captureVirtualPopulateDependencies(runtime, modelName, options, globalOptions);
   const token = () => {
   };
   snapshots.set(token, snapshot);
@@ -2783,6 +2785,7 @@ var init_runtime = __esm({
             requestPermissionField: "_permissions",
             globalPermissions: () => ({}),
             requireRegisteredPopulateModels: true,
+            requireReadOperationAccessForPopulateDependencies: true,
             logger: defaultLogger,
             requestComplexity: defaultRequestComplexity
           },
@@ -2955,9 +2958,16 @@ var init_runtime = __esm({
       }
       /** Shallowly replace supplied global values; nested objects such as requestComplexity are not deep-merged. */
       setGlobalOptions(options) {
-        this.globalOptions.assign(options);
+        const next = { ...options };
+        if ("requireReadOperationAccessForPopulateDependencies" in next)
+          next.requireReadOperationAccessForPopulateDependencies = next.requireReadOperationAccessForPopulateDependencies !== false;
+        this.globalOptions.assign(next);
       }
       setGlobalOption(key, value) {
+        if (key === "requireReadOperationAccessForPopulateDependencies") {
+          this.globalOptions.set("requireReadOperationAccessForPopulateDependencies", value !== false);
+          return;
+        }
         this.globalOptions.set(key, value);
       }
       getGlobalOptions() {
@@ -4599,14 +4609,21 @@ function getCapturedAuthorizationOption(configuration, key) {
   const defaultValue = key.startsWith("operationAccess.") ? get7(configuration.operationAccessDefaults, key.slice("operationAccess.".length)) : void 0;
   return resolveNestedOption((path, fallback) => get7(configuration, path, fallback), key, defaultValue);
 }
-function captureModelAuthorizationConfiguration(runtime, modelName, options = runtime.getModelOptions(modelName)) {
+function captureModelAuthorizationConfiguration(runtime, modelName, options = runtime.getModelOptions(modelName), globalOptions = runtime.getGlobalOptions()) {
   const model = runtime.getModelInstance(modelName);
   if (!model) return authorizationError(`unknown receiving model: ${modelName}`);
   const virtuals = options.virtuals;
   return copyAuthorizationValue(
     {
       catalog: captureAuthorizationFieldCatalog(model.schema, virtuals, options.documentPermissionField),
-      virtualPopulateSnapshot: captureVirtualPopulateSnapshot(runtime, modelName, options),
+      virtualPopulateSnapshot: captureVirtualPopulateSnapshot(
+        runtime,
+        modelName,
+        options,
+        globalOptions
+      ),
+      requireReadOperationAccessForPopulateDependencies: globalOptions.requireReadOperationAccessForPopulateDependencies !== false,
+      requireRegisteredPopulateModels: globalOptions.requireRegisteredPopulateModels,
       permissionSchema: options.permissionSchema,
       virtuals,
       alwaysSelectFields: options.alwaysSelectFields,
@@ -5277,7 +5294,8 @@ function createVirtualPopulateBatch(owner) {
     owner: { ...owner },
     rows: [],
     requests: [],
-    rowCache: owner.core && getRequestRowCache(owner.core) || new Cache()
+    rowCache: owner.core && getRequestRowCache(owner.core) || new Cache(),
+    readGuards: /* @__PURE__ */ new Map()
   });
   return batch;
 }
@@ -5326,12 +5344,19 @@ function captureVirtualPopulateRows(batch, inputs, plan, publicPopulate = [], so
       }
       const record3 = storage(value);
       if (!record3) return;
-      const occurrence = { address, plan: currentPlan, refs: /* @__PURE__ */ new Map(), dependencies: /* @__PURE__ */ new Map() };
+      const occurrence = {
+        address,
+        plan: currentPlan,
+        refs: /* @__PURE__ */ new Map(),
+        referenceTargets: /* @__PURE__ */ new Map(),
+        dependencies: /* @__PURE__ */ new Map()
+      };
       row.occurrences.set(addressKey(address), occurrence);
       for (const candidate of currentPlan.candidates) {
         const dependencies = (candidate.populateDependencies ?? []).map((dependency) => {
           if (!occurrence.refs.has(dependency.path))
             occurrence.refs.set(dependency.path, originalRef(value, dependency.path));
+          occurrence.referenceTargets.set(dependency.path, dependency.target);
           const request = {
             binding: dependency.target,
             target: dependency.target,
@@ -5392,6 +5417,27 @@ function referenceIds(original) {
   if (!original.present || original.value == null) return [];
   return (Array.isArray(original.value) ? original.value : [original.value]).filter((id) => id != null);
 }
+function targetReadAllowed(state, target) {
+  let pending = state.readGuards.get(target.identity);
+  if (!pending) {
+    const { owner } = state;
+    pending = getRequestWorkState(owner.request, owner.runtime).hookGate.run(
+      () => evaluateRouteGuard(
+        owner.request,
+        owner.permissions,
+        getCapturedAuthorizationOption(target.configuration, "operationAccess.read")
+      )
+    ).then(
+      (allowed) => !!allowed,
+      () => {
+        warn("Virtual populated dependency unavailable", { modelName: target.modelName, category: "policy" });
+        return false;
+      }
+    );
+    state.readGuards.set(target.identity, pending);
+  }
+  return pending;
+}
 function executeVirtualPopulateBatch(batch) {
   const state = batches.get(batch);
   if (!state) throw new Error("Unknown private populate batch");
@@ -5408,14 +5454,8 @@ async function execute(state) {
     if (!pending) {
       pending = (async () => {
         try {
-          const allowed = await work.hookGate.run(
-            () => evaluateRouteGuard(
-              owner.request,
-              owner.permissions,
-              getCapturedAuthorizationOption(target.configuration, "operationAccess.read")
-            )
-          );
-          if (!allowed) return void 0;
+          if (target.configuration.requireReadOperationAccessForPopulateDependencies !== false && !await targetReadAllowed(state, target))
+            return void 0;
           const parts = await work.hookGate.run(
             () => resolveAccessFilterParts({
               req: owner.request,
@@ -5500,6 +5540,12 @@ function readVirtualPopulateOriginalReference(row, address, path) {
 function hasVirtualPopulatePublicReference(row, address, path) {
   return !!rows.get(row)?.publicRequests.some((request) => addressKey(request.address) === addressKey([...address, path]));
 }
+function isVirtualPopulateReferenceVisible(row, address, path) {
+  const record3 = rows.get(row);
+  const occurrence = record3?.occurrences.get(addressKey(address));
+  const target = occurrence?.refs.get(path)?.present ? occurrence.referenceTargets.get(path) : void 0;
+  return record3 && target ? targetReadAllowed(record3.batch, target) : Promise.resolve(true);
+}
 function readVirtualPopulateInputs(row, address, virtualName) {
   const record3 = rows.get(row);
   if (!record3?.batch.completed) return { available: false };
@@ -5655,7 +5701,7 @@ var init_virtual_populate_execution = __esm({
       const option = getCapturedAuthorizationOption(configuration, `${key}.${access}`);
       return key === "operationAccess" || typeof option === "function" ? option : void 0;
     });
-    compatible = (a, b) => a.binding.runtime === b.binding.runtime && a.binding.model === b.binding.model && a.binding.schema === b.binding.schema && a.access === b.access && a.requestRead === b.requestRead && // Different captures may share only an equivalent terminal persisted binding/policy.
+    compatible = (a, b) => a.binding.runtime === b.binding.runtime && a.binding.model === b.binding.model && a.binding.schema === b.binding.schema && a.access === b.access && a.requestRead === b.requestRead && a.binding.configuration.requireReadOperationAccessForPopulateDependencies === b.binding.configuration.requireReadOperationAccessForPopulateDependencies && // Different captures may share only an equivalent terminal persisted binding/policy.
     equivalentVirtualPopulatePredicate(
       a.binding.configuration.catalog.persistedPaths,
       b.binding.configuration.catalog.persistedPaths
@@ -6366,6 +6412,7 @@ async function finalizeSingleDoc(args, input) {
   if (!captured && documentPermissionField in output) keep.add(documentPermissionField);
   const trimmed = {};
   for (const key of keep) {
+    if (privateRow && !await isVirtualPopulateReferenceVisible(privateRow, privateAddress, key)) continue;
     if (privateRow && !hasVirtualPopulatePublicReference(privateRow, privateAddress, key)) {
       const ref = readVirtualPopulateOriginalReference(privateRow, privateAddress, key);
       if (ref) {
@@ -7242,6 +7289,11 @@ function modelServiceOptions(receiver, read) {
   if (call?.receiver !== receiver) return read();
   return call.options ??= read();
 }
+function modelServiceGlobalOptions(receiver, runtime) {
+  const call = dispatch.getStore();
+  if (call?.receiver !== receiver) return runtime.getGlobalOptions();
+  return call.globalOptions ??= runtime.getGlobalOptions();
+}
 
 // src/services/base.ts
 init_request_work();
@@ -7682,7 +7734,7 @@ function staticObjectIdReference(runtime, source, path, target) {
   const scalar = type?.instance === "Array" ? type.$embeddedSchemaType ?? type.embeddedSchemaType ?? type.caster : type;
   return scalar?.instance === "ObjectId" && (type?.options?.ref ?? scalar.options?.ref) === target && type?.options?.refPath === void 0 && scalar.options?.refPath === void 0;
 }
-function captureRelatedTargets(runtime, modelName, args = {}, depth = 0) {
+function captureRelatedTargets(runtime, modelName, args = {}, depth = 0, globalOptions = runtime.getGlobalOptions()) {
   if (depth > 32) authorizationError("related descriptor depth exceeded");
   assertPublicAdmission(args.populate, "populate");
   assertPublicAdmission(args.include, "include");
@@ -7696,16 +7748,16 @@ function captureRelatedTargets(runtime, modelName, args = {}, depth = 0) {
       targets.push({
         path,
         modelName: model,
-        configuration: captureModelAuthorizationConfiguration(runtime, model),
+        configuration: captureModelAuthorizationConfiguration(runtime, model, void 0, globalOptions),
         staticObjectIdReference: staticObjectIdReference(runtime, modelName, path, model)
       });
-    else if (model && !runtime.getGlobalOption("requireRegisteredPopulateModels", true)) {
+    else if (model && !(globalOptions.requireRegisteredPopulateModels === void 0 ? true : globalOptions.requireRegisteredPopulateModels)) {
       targets.push({ path, modelName: model, kind: "passthrough", configuration: { catalog: { paths: [] } } });
     }
   }
   for (const entry of entries(args.include)) {
     if (!runtime.hasModel(entry.model)) authorizationError(`Model ${entry.model} not found`);
-    const configuration = captureModelAuthorizationConfiguration(runtime, entry.model);
+    const configuration = captureModelAuthorizationConfiguration(runtime, entry.model, void 0, globalOptions);
     const queryIntent = entry.op === "count" ? void 0 : captureModelServiceIntent(
       {
         defaults: configuration.defaults ?? {},
@@ -7731,7 +7783,13 @@ function captureRelatedTargets(runtime, modelName, args = {}, depth = 0) {
       configuration,
       queryIntent,
       operationGuard: runtime.getModelOption(entry.model, `operationAccess.${entry.op}`),
-      relatedTargets: captureRelatedTargets(runtime, entry.model, queryIntent?.args ?? entry.args ?? {}, depth + 1)
+      relatedTargets: captureRelatedTargets(
+        runtime,
+        entry.model,
+        queryIntent?.args ?? entry.args ?? {},
+        depth + 1,
+        globalOptions
+      )
     });
   }
   if (new Set(targets.map((target) => target.path)).size !== targets.length)
@@ -9315,7 +9373,9 @@ function prepareSubdocumentOutput(service, sub, operation, virtualAccess, output
     captureRelatedTargets(
       getServiceExecutors(service).binding().runtime,
       service.getServiceModelName(),
-      { populate }
+      { populate },
+      0,
+      configuration
     ),
     void 0,
     configuration,
@@ -10354,10 +10414,12 @@ var Service = class extends Base {
         model: this.model.mongooseModel,
         modelName: this.modelName
       }),
-      configuration: () => this.requestRuntime.getModelInstance(this.modelName) ? captureModelAuthorizationConfiguration(this.requestRuntime, this.modelName, {
-        ...this.options,
-        defaults: this.defaults
-      }) : { catalog: { paths: [] }, ...this.options },
+      configuration: () => this.requestRuntime.getModelInstance(this.modelName) ? captureModelAuthorizationConfiguration(
+        this.requestRuntime,
+        this.modelName,
+        { ...this.options, defaults: this.defaults },
+        modelServiceGlobalOptions(this, this.requestRuntime)
+      ) : { catalog: { paths: [] }, ...this.options },
       permissions: () => this.requestCore.getPermissions?.() ?? new permission_default({}),
       parse: (filter2) => this.parseClientData(filter2, this.getCorrelatedExecState().scheduler),
       validate: (filter2, expanded) => {
@@ -10886,12 +10948,13 @@ var Service = class extends Base {
     });
   }
   captureRelated(args, defaults) {
+    const globalOptions = modelServiceGlobalOptions(this, this.requestRuntime);
     const effective = { populate: args?.populate ?? defaults?.populate, include: args?.include ?? defaults?.include };
     if (effective.include) {
       const processed = this.processInclude(effective.include);
       effective.include = [...processed.includes, ...processed.correlatedIncludes];
     }
-    return captureRelatedTargets(this.requestRuntime, this.modelName, effective);
+    return captureRelatedTargets(this.requestRuntime, this.modelName, effective, 0, globalOptions);
   }
   /** Canonical population uses the target's retained policy for both fetch and output. */
   async genExecutionPopulate(execution, access, populate) {
@@ -10913,12 +10976,11 @@ var Service = class extends Base {
         modelPermissionPrefix: captured.configuration.modelPermissionPrefix
       });
       if (sourceState === "denied") continue;
-      const modelName = getModelRef(this.modelName, descriptor.path);
+      const target = captured.relatedTargets.find((target2) => target2.path === descriptor.path);
+      const modelName = target?.modelName;
       if (!modelName) continue;
-      if (!this.requestRuntime.hasModel(modelName)) {
-        if (captured.relatedTargets.some((target) => target.path === descriptor.path && target.kind === "passthrough")) {
-          result2.push({ path: descriptor.path, select: descriptor.select });
-        }
+      if (target.kind === "passthrough") {
+        result2.push({ path: descriptor.path, select: descriptor.select });
         continue;
       }
       const policy = relatedPolicy(state.authorization, state.binding, descriptor.path);
@@ -10971,7 +11033,7 @@ var Service = class extends Base {
           schema: childState.binding.model.schema,
           configuration: targetConfiguration,
           requestRead: targetAccess === "read" && policy?.operation.mode !== "grant" && readServiceAuthorization(childState.authorization, childState.binding).authorization.rows.mode === "request",
-          staticObjectIdReference: captured.relatedTargets.find((target) => target.path === descriptor.path)?.staticObjectIdReference
+          staticObjectIdReference: captured.relatedTargets.find((target2) => target2.path === descriptor.path)?.staticObjectIdReference
         }
       });
       result2.push(ret);
@@ -11015,15 +11077,13 @@ var Service = class extends Base {
       transferDocumentAuthorizationGraph(source, copy2);
       return copy2;
     }
-    let targetMongooseModel;
-    try {
-      const inst = this.requestRuntime.getModelInstance?.(
-        meta.targetModelName
-      );
-      void inst;
-      targetMongooseModel = inst;
-    } catch {
-      targetMongooseModel = parentContext.mongooseModel;
+    let targetMongooseModel = meta.fetchBinding?.model;
+    if (!targetMongooseModel) {
+      try {
+        targetMongooseModel = this.requestRuntime.getModelInstance(meta.targetModelName);
+      } catch {
+        targetMongooseModel = parentContext.mongooseModel;
+      }
     }
     const targetContext = {
       mongooseModel: targetMongooseModel ?? parentContext.mongooseModel,