adminizer 5.0.0-build.9 → 5.1.0-build.25

package/lib/DataAccessor.js

@@ -1,9 +1,58 @@
 import { ControllerHelper } from "../helpers/controllerHelper.js";
 import { Adminizer } from "./Adminizer.js";
 import { isObject } from "../helpers/JsUtils.js";
-const MODEL_TOKEN_SUFFIX = "model";
+import { RecordAccessResolver } from "./access-graph/RecordAccessResolver.js";
+import { RecordAccessCache } from "./access-graph/RecordAccessCache.js";
+import { AccessGraphResolver, isGraphParentEdge } from "./access-graph/AccessGraphResolver.js";
+import { getTokenAction, modelCrudToken } from "./access-graph/shared.js";
 function hasCriteriaContent(criteria) {
-    return Object.keys(criteria).length > 0 || Object.getOwnPropertySymbols(criteria).length > 0;
+    return Object.keys(criteria).length > 0;
+}
+/**
+ * Rewrites the association keys of an access filter to their foreign-key columns
+ * (`via`), so the condition lands on plain columns of the JOIN alias in every adapter.
+ * Returns `undefined` when a key cannot be resolved to a real column — such a filter
+ * must keep the post-read verification instead of producing a broken JOIN.
+ */
+function mapAccessWhereToJoinColumns(where, attributes) {
+    const result = {};
+    for (const [key, value] of Object.entries(where)) {
+        const attr = attributes?.[key];
+        if (attr?.type === "association-many") {
+            return undefined;
+        }
+        if (attr?.type !== "association") {
+            result[key] = value;
+            continue;
+        }
+        // An association key must resolve to a plain FK column; a `via` that is itself
+        // the association (TypeORM models without a declared FK property) cannot.
+        if (!attr.via || attributes?.[attr.via]?.type === "association") {
+            return undefined;
+        }
+        result[attr.via] = value;
+    }
+    return result;
+}
+/**
+ * Access-filter shapes every adapter can AND into a JOIN's ON clause: plain columns
+ * compared to a primitive or to an `{in: [...primitives]}` list. Anything else (logic
+ * operators, adapter-specific subquery operands) stays on the post-read verification.
+ */
+function isPushdownSafeWhere(where) {
+    const isPrimitive = (value) => typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+    return Object.entries(where).every(([key, value]) => {
+        if (key === "and" || key === "or" || key === "not" || key.includes("$") || key.includes(".")) {
+            return false;
+        }
+        if (isPrimitive(value)) {
+            return true;
+        }
+        return isObject(value)
+            && Object.keys(value).length === 1
+            && Array.isArray(value.in)
+            && value.in.every(isPrimitive);
+    });
 }
 function isPlainCriteriaWhere(where) {
     if (!isObject(where)) {
@@ -20,9 +69,21 @@ function mergeCriteriaWhere(criteriaWhere, sanitizedCriteria) {
         return sanitizedCriteria;
     }
     if (isPlainCriteriaWhere(criteriaWhere)) {
+        // Spreading would drop the caller's own condition on a key record access also
+        // constrains (a filter on the parent column of a graph model, typically) —
+        // both must hold, so a collision becomes an explicit AND.
+        const collides = Object.keys(sanitizedCriteria).some((key) => key in criteriaWhere);
+        if (!collides) {
+            return {
+                ...criteriaWhere,
+                ...sanitizedCriteria
+            };
+        }
         return {
-            ...criteriaWhere,
-            ...sanitizedCriteria
+            and: [
+                criteriaWhere,
+                sanitizedCriteria
+            ]
         };
     }
     return {
@@ -39,36 +100,42 @@ export class DataAccessor {
     action;
     fields = null;
     actionVerb;
-    constructor(adminizer, user, modelResource, action) {
+    associatedPrimaryKeyCache = new Map();
+    recordAccessAssociationFieldsCache;
+    /** Set on the internal accessors used to verify associations — see disablePopulateAccess(). */
+    populateAccessDisabled = false;
+    /** Accessors of associated models, so their access lookups are resolved once per model. */
+    associatedAccessorCache = new Map();
+    /** Per-request record-access resolver; its memoized id lists live as long as this accessor. */
+    recordAccessResolver;
+    /**
+     * Memoization shared with the other accessors of the same request; pass one when
+     * building several accessors for one page so the membership lookups run once.
+     */
+    recordAccessCache;
+    constructor(adminizer, user, modelResource, action, recordAccessCache) {
+        this.recordAccessCache = recordAccessCache ?? new RecordAccessCache();
         this.adminizer = adminizer;
         this.user = user;
         this.modelResource = modelResource;
         this.action = action;
         this.actionVerb = getTokenAction(this.action);
     }
-    getModelConfig(modelName) {
-        const resolvedModelName = this.adminizer.modelHandler.resolveModelName(modelName);
-        const entry = Object.entries(this.adminizer.config.models)
-            .find(([key, config]) => {
-            if (key.toLowerCase() === resolvedModelName.toLowerCase()) {
-                return true;
-            }
-            if (!isObject(config)) {
-                return false;
-            }
-            return config.model?.toLowerCase() === resolvedModelName.toLowerCase();
-        });
-        const config = entry ? entry[1] : undefined;
+    getModelConfig(resourceName) {
+        const config = this.adminizer.config.models?.[resourceName];
         return isObject(config) ? config : undefined;
     }
-    accessRelationModel(modelName) {
-        return this.adminizer.modelHandler.internal("data-accessor").get(modelName);
-    }
-    resolveRelationTarget(modelName) {
+    resolveRelationTarget(modelName, resourceName) {
         if (!modelName) {
             return undefined;
         }
-        return this.adminizer.modelHandler.resolveModelName(modelName).toLowerCase();
+        return this.adminizer.modelHandler.resolveAssociationResource(modelName, resourceName);
+    }
+    getRelationModel(modelName, resourceName) {
+        const resolvedResourceName = this.resolveRelationTarget(modelName, resourceName);
+        return resolvedResourceName
+            ? this.adminizer.modelHandler.getResource(resolvedResourceName)
+            : undefined;
     }
     /**
      * Retrieves the fields for the given ModelResource based on action type,
@@ -79,6 +146,12 @@ export class DataAccessor {
         if (this.fields !== null) {
             return this.fields;
         }
+        // No access rights to the model at all beats every other outcome, including "no fields"
+        const tokenId = modelCrudToken(this.actionVerb, this.modelResource.name);
+        if (!this.adminizer.accessRightsHelper.hasStaticPermission(tokenId, this.user)) {
+            Adminizer.log.debug(`getFieldsConfig > No access rights to ${this.actionVerb} model: ${this.modelResource.name}`);
+            return undefined;
+        }
         if (!this.modelResource.model || !this.modelResource.model.attributes) {
             return {};
         }
@@ -86,59 +159,48 @@ export class DataAccessor {
         const actionConfig = ControllerHelper.findActionConfig(this.modelResource, this.action);
         const fieldsConfig = this.modelResource.config?.fields || {};
         const modelAttributes = this.modelResource.model.attributes;
-        const tokenId = `${this.actionVerb}-${this.modelResource.model.modelname}-${MODEL_TOKEN_SUFFIX}`;
-        if (!this.adminizer.accessRightsHelper.hasPermission(tokenId, this.user)) {
-            Adminizer.log.debug(`getFieldsConfig > No access rights to ${this.actionVerb} model: ${this.modelResource.model.modelname}`);
-            return undefined;
-        }
+        const primaryKey = (this.modelResource.model.primaryKey ?? 'id');
         const result = {};
         Object.entries(modelAttributes).forEach(([key, modelField]) => {
             // The fields that are recorded separately from the connection in some ORMs, because they are processed at the level above them.
             if (modelAttributes[key].primaryKeyForAssociation === true) {
-                return undefined;
+                return;
             }
             // Supports shorthand model attributes: fieldName: 'string'
             if (typeof modelField === "string") {
                 modelField = { type: modelField };
             }
-            // Set association type for a field
+            // Set association type for a field, on a copy — the shared model attributes stay untouched
             if (modelField && typeof modelField === "object") {
                 if (modelField.model) {
-                    modelField.type = "association";
+                    modelField = { ...modelField, type: "association" };
                 }
                 if (modelField.collection) {
-                    modelField.type = "association-many";
+                    modelField = { ...modelField, type: "association-many" };
                 }
             }
-            // Getting base field config
-            let fldConfig = { key: key, title: key };
-            let associatedModelConfig = undefined;
             // Action-specific config has priority over global; objects are merged
             const globalFieldConfig = fieldsConfig[key];
             const actionFieldConfig = actionConfig.fields?.[key];
-            if (globalFieldConfig || actionFieldConfig) {
-                const rawFieldConfig = { ...globalFieldConfig, ...actionFieldConfig };
-                const normalizedFieldConfig = this.adminizer.configHelper.normalizeFieldConfig(this.adminizer, rawFieldConfig, key, modelField);
-                if (!normalizedFieldConfig) {
-                    return;
-                }
-                if (!this.checkFieldAccess(key, normalizedFieldConfig)) {
-                    return;
-                }
-                fldConfig = { ...fldConfig, ...normalizedFieldConfig };
+            const rawFieldConfig = globalFieldConfig || actionFieldConfig
+                ? { ...globalFieldConfig, ...actionFieldConfig }
+                : undefined;
+            let fldConfig = this.buildBaseFieldConfig(key, modelField, rawFieldConfig, primaryKey);
+            if (!fldConfig) {
+                return;
             }
             // Populate associated fields configuration if field is an association
+            let associatedModelConfig = undefined;
             let populatedModelFieldsConfig = {};
             if (modelField.type === "association" || modelField.type === "association-many") {
                 const modelName = modelField.model || modelField.collection;
-                const resolvedModelName = modelName ? this.adminizer.modelHandler.resolveModelName(modelName) : undefined;
+                const resolvedModelName = this.resolveRelationTarget(modelName, modelField.resourceName);
                 if (modelName && resolvedModelName) {
-                    const tokenId = `read-${resolvedModelName}-${MODEL_TOKEN_SUFFIX}`;
-                    if (!this.adminizer.accessRightsHelper.hasPermission(tokenId, this.user)) {
-                        Adminizer.log.silly(`No access rights to model: ${this.modelResource.model.modelname}`);
-                        return undefined;
+                    if (!this.adminizer.accessRightsHelper.hasStaticPermission(modelCrudToken("read", resolvedModelName), this.user)) {
+                        Adminizer.log.silly(`No access rights to read associated model: ${resolvedModelName}`);
+                        return;
                     }
-                    const model = this.adminizer.modelHandler.model.get(modelName);
+                    const model = this.adminizer.modelHandler.getResource(resolvedModelName);
                     if (model) {
                         populatedModelFieldsConfig = this.getAssociatedFieldsConfig(resolvedModelName);
                         const modelCfg = this.getModelConfig(resolvedModelName);
@@ -186,22 +248,22 @@ export class DataAccessor {
         Object.keys(fields).forEach(appendField);
         return orderedFields;
     }
-    getAssociatedFieldsConfig(modelName) {
-        const resolvedModelName = this.adminizer.modelHandler.resolveModelName(modelName);
-        const model = this.adminizer.modelHandler.model.get(resolvedModelName);
-        const modelConfig = this.getModelConfig(resolvedModelName);
+    getAssociatedFieldsConfig(resourceName) {
+        const model = this.adminizer.modelHandler.getResource(resourceName);
+        const modelConfig = this.getModelConfig(resourceName);
         if (!model || !modelConfig) {
             return undefined;
         }
-        // Check if user has access to the associated model
-        const tokenId = `read-${resolvedModelName}-${MODEL_TOKEN_SUFFIX}`;
-        if (!this.adminizer.accessRightsHelper.hasPermission(tokenId, this.user)) {
-            Adminizer.log.debug(`getAssociatedFieldsConfig > No access rights to ${this.actionVerb} model: ${resolvedModelName}`);
+        // Defense in depth: the caller checks read access too, but this method must stay
+        // safe on its own for any future call site.
+        if (!this.adminizer.accessRightsHelper.hasStaticPermission(modelCrudToken("read", resourceName), this.user)) {
+            Adminizer.log.debug(`getAssociatedFieldsConfig > No access rights to read model: ${resourceName}`);
             return undefined;
         }
         const associatedFields = {};
         // Get the main fields configuration
         const fieldsConfig = modelConfig.fields || {};
+        const primaryKey = (model.primaryKey ?? 'id');
         // Merge action-specific fields configuration if it exists
         const addCfg = typeof modelConfig.add === "object" ? modelConfig.add : undefined;
         const editCfg = typeof modelConfig.edit === "object" ? modelConfig.edit : undefined;
@@ -224,22 +286,14 @@ export class DataAccessor {
                 actionSpecificConfig = {};
                 break;
             default:
-                throw `Action type error: unknown type [${this.action}]`;
+                throw new Error(`Action type error: unknown type [${this.action}]`);
         }
         const mergedFieldsConfig = { ...fieldsConfig, ...actionSpecificConfig };
         // Loop through model attributes and apply access checks
         Object.entries(model.attributes).forEach(([key, modelField]) => {
-            const fieldConfig = mergedFieldsConfig[key];
-            // Creating a basic config
-            let fldConfig = { key: key, title: key };
-            // If fieldConfig exists, normalize it and merge with the basic config
-            if (fieldConfig) {
-                const normalizedFieldConfig = this.adminizer.configHelper.normalizeFieldConfig(this.adminizer, fieldConfig, key, modelField);
-                if (!normalizedFieldConfig)
-                    return;
-                if (!this.checkFieldAccess(key, normalizedFieldConfig))
-                    return;
-                fldConfig = { ...fldConfig, ...normalizedFieldConfig };
+            const fldConfig = this.buildBaseFieldConfig(key, modelField, mergedFieldsConfig[key], primaryKey);
+            if (!fldConfig) {
+                return;
             }
             // Add the field to associatedFields regardless of config presence
             associatedFields[key] = {
@@ -251,8 +305,27 @@ export class DataAccessor {
         });
         return associatedFields;
     }
-    checkFieldAccess(key, fieldConfig) {
-        if (this.modelResource.model.primaryKey === key) {
+    /**
+     * Base config for a field: the normalized declared config merged over `{key, title}`,
+     * or `undefined` when the config is invalid or field access is denied.
+     */
+    buildBaseFieldConfig(key, modelField, rawFieldConfig, primaryKey) {
+        let fldConfig = { key: key, title: key };
+        if (rawFieldConfig) {
+            const normalizedFieldConfig = this.adminizer.configHelper.normalizeFieldConfig(this.adminizer, rawFieldConfig, key, modelField);
+            if (!normalizedFieldConfig) {
+                return undefined;
+            }
+            if (!this.checkFieldAccess(key, normalizedFieldConfig, primaryKey)) {
+                return undefined;
+            }
+            fldConfig = { ...fldConfig, ...normalizedFieldConfig };
+        }
+        return fldConfig;
+    }
+    checkFieldAccess(key, fieldConfig, primaryKey) {
+        // The primary key of the record's own model is always visible
+        if (primaryKey !== undefined && primaryKey === key) {
             return true;
         }
         if (this.user.isAdministrator) {
@@ -262,12 +335,12 @@ export class DataAccessor {
         // Check if `groupsAccessRights` is set in the fieldConfig
         if (fieldConfig.groupsAccessRights) {
             const allowedGroups = fieldConfig.groupsAccessRights.map((item) => item.toLowerCase());
-            return userGroups && userGroups.some(group => allowedGroups.includes(group));
-        }
-        else {
-            // If no specific groups are allowed, deny access if the user is in "default user group"
-            return !userGroups || !userGroups.includes(this.adminizer.config.registration?.defaultUserGroup);
+            return Boolean(userGroups?.some(group => allowedGroups.includes(group)));
         }
+        // No explicit list: the field is visible to everyone except members of the
+        // registration default group (both sides compared lowercased).
+        const defaultUserGroup = this.adminizer.config.registration?.defaultUserGroup?.toLowerCase();
+        return !userGroups || !defaultUserGroup || !userGroups.includes(defaultUserGroup);
     }
     getSelectedFields(select) {
         if (!select) {
@@ -284,9 +357,29 @@ export class DataAccessor {
         const populateConfig = criteria?.populate?.[fieldKey];
         return populateConfig && populateConfig !== true ? populateConfig : undefined;
     }
-    canUseSelectedFieldFallback() {
+    /** Administrators, and every user when authorization is switched off entirely. */
+    hasUnrestrictedAccess() {
         return this.user.isAdministrator || this.adminizer.config.auth?.enable === false;
     }
+    canUseSelectedFieldFallback() {
+        return this.hasUnrestrictedAccess();
+    }
+    /**
+     * Primary key of a field's associated model, for the PK-always-visible rule on
+     * populated records. Cached per field config: `process()` asks once per associated
+     * item of every record, and the answer cannot change within an accessor's lifetime.
+     */
+    associatedPrimaryKey(fieldConfig) {
+        if (this.associatedPrimaryKeyCache.has(fieldConfig)) {
+            return this.associatedPrimaryKeyCache.get(fieldConfig);
+        }
+        const modelName = fieldConfig.model?.model || fieldConfig.model?.collection;
+        const primaryKey = modelName
+            ? this.getRelationModel(modelName, fieldConfig.model?.resourceName)?.primaryKey
+            : undefined;
+        this.associatedPrimaryKeyCache.set(fieldConfig, primaryKey);
+        return primaryKey;
+    }
     /**
      * Returns filtered record applying config from this.fields on this record
      * @data - record from a specific model */
@@ -296,6 +389,10 @@ export class DataAccessor {
             this.fields = this.getFieldsConfig();
         }
         const filteredRecord = {};
+        // No access rights to the model at all: fail closed with an empty record
+        if (!this.fields) {
+            return filteredRecord;
+        }
         // Set the primary key value
         const primaryKey = (this.modelResource.model.primaryKey ?? 'id');
         filteredRecord[primaryKey] = record[primaryKey];
@@ -306,7 +403,7 @@ export class DataAccessor {
             if (!fieldConfig)
                 continue;
             // Check access to the field
-            if (this.checkFieldAccess(fieldKey, fieldConfig.config)) {
+            if (this.checkFieldAccess(fieldKey, fieldConfig.config, primaryKey)) {
                 const fieldType = fieldConfig.config.type;
                 const populateCriteria = this.getPopulateCriteria(criteria, fieldKey);
                 const selectedAssociatedFields = this.getSelectedFields(populateCriteria?.select);
@@ -319,7 +416,7 @@ export class DataAccessor {
                     if (Array.isArray(fieldValue)) {
                         // If the field value is an array of objects
                         filteredRecord[fieldKey] = (fieldValue.every(item => typeof item === 'object')
-                            ? fieldValue.map(associatedRecord => this.filterAssociatedRecord(associatedRecord, fieldConfig.populated, selectedAssociatedFields))
+                            ? fieldValue.map(associatedRecord => this.filterAssociatedRecord(associatedRecord, fieldConfig.populated, selectedAssociatedFields, this.associatedPrimaryKey(fieldConfig)))
                             : fieldValue); // If the array contains IDs, pass them as is (it can contain ids, because this function also can be called before saving something)
                     }
                     else {
@@ -328,30 +425,22 @@ export class DataAccessor {
                     }
                 }
                 // Handle single associations
-                else if (fieldType === 'association') {
+                else {
                     if (fieldValue && typeof fieldValue === 'object') {
                         // If the field value is an object
-                        filteredRecord[fieldKey] = this.filterAssociatedRecord(fieldValue, fieldConfig.populated, selectedAssociatedFields);
+                        filteredRecord[fieldKey] = this.filterAssociatedRecord(fieldValue, fieldConfig.populated, selectedAssociatedFields, this.associatedPrimaryKey(fieldConfig));
                     }
                     else {
                         // If the field value is an ID or null, pass it as is (it can contain id, because this function also can be called before saving something)
                         filteredRecord[fieldKey] = fieldValue;
                     }
                 }
-                // Handle cases where the field value is null or undefined
-                else if (fieldValue === undefined || fieldValue === null) {
-                    filteredRecord[fieldKey] = null;
-                }
-                // Log an error for unexpected scenarios
-                else {
-                    Adminizer.log.error(`Unexpected field configuration or value for: ${fieldConfig.model.model}.${fieldKey}`);
-                }
             }
         }
         return filteredRecord;
     }
     /** Filters associated records (simplified process() function) */
-    filterAssociatedRecord(associatedRecord, associatedFieldsConfig, selectedFields) {
+    filterAssociatedRecord(associatedRecord, associatedFieldsConfig, selectedFields, associatedPrimaryKey) {
         if (!associatedFieldsConfig && !selectedFields) {
             return {};
         }
@@ -362,7 +451,7 @@ export class DataAccessor {
             }
             const assocFieldConfig = associatedFieldsConfig?.[assocFieldKey];
             const assocFieldValue = associatedRecord[assocFieldKey];
-            if (assocFieldConfig && this.checkFieldAccess(assocFieldKey, assocFieldConfig.config)) {
+            if (assocFieldConfig && this.checkFieldAccess(assocFieldKey, assocFieldConfig.config, associatedPrimaryKey)) {
                 filteredAssociatedRecord[assocFieldKey] = assocFieldValue;
                 continue;
             }
@@ -376,167 +465,287 @@ export class DataAccessor {
     processMany(records, criteria) {
         return records.map(record => this.process(record, criteria));
     }
-    async sanitizeUserRelationAccess(criteria = {}) {
-        let sanitizedCriteria = {};
-        // Retrieve model configuration from adminpanel config
-        const modelName = this.modelResource.model.modelname;
-        const modelConfig = this.modelResource.config;
-        // Check if the model has `userAccessRelation` configured
-        if (!this.user.isAdministrator && modelConfig && modelConfig.userAccessRelation) {
-            Adminizer.log.warn(`[userAccessRelation] Model "${modelName}" has userAccessRelation="${modelConfig.userAccessRelation}". ` +
-                `User "${this.user.login}" (id: ${this.user.id}) will only see records they own.`);
-            // Get access field from userAccessRelation
-            const userAccessRelation = modelConfig.userAccessRelation;
-            if (typeof userAccessRelation === 'string') {
-                let accessField = userAccessRelation;
-                // Check if the relation points to `User` or `Group` in the model's attributes
-                const modelAttributes = this.modelResource.model.attributes;
-                const relation = modelAttributes[accessField];
-                const relationModel = this.resolveRelationTarget(relation?.model);
-                const relationCollection = this.resolveRelationTarget(relation?.collection);
-                if (!relation || !['user', 'group'].includes(relationModel ?? relationCollection ?? "")) {
-                    throw new Error(`Invalid userAccessRelation configuration for model ${modelName}`);
-                }
-                // Determine if the current user matches the access criteria
-                if (relationModel) {
-                    if (relationModel === 'user') {
-                        // Filter by the user's ID if related to User as a model
-                        sanitizedCriteria = { ...sanitizedCriteria, [accessField]: this.user.id };
-                    }
-                    else if (relationModel === 'group') {
-                        // Filter by user's group membership if related to Group as a model
-                        const userGroups = this.user.groups?.map((group) => group.id);
-                        sanitizedCriteria = { ...sanitizedCriteria, [accessField]: { in: userGroups } };
-                    }
-                }
-                /** Warning: collection relation access is not supported and needs adapter-level processing */
-                if (relationCollection) {
-                    Adminizer.log.warn(`Collection relation is not supported and was not tested. You may have an error here: ${JSON.stringify(relation, null, 2)}`);
-                    if (relationCollection === 'user') {
-                        // Ensure user's ID is part of the associated collection to User
-                        sanitizedCriteria = { ...sanitizedCriteria, [accessField]: { contains: this.user.id } };
-                    }
-                    else if (relationCollection === 'group') {
-                        // Ensure user's groups intersect with the collection to Group
-                        const userGroups = this.user.groups?.map((group) => group.id);
-                        sanitizedCriteria = { ...sanitizedCriteria, [accessField]: { intersects: userGroups } };
-                    }
-                }
+    /**
+     * {@link processMany} plus record-level access on populated associations.
+     *
+     * `sanitizeUserRelationAccess` confines the queried model only, while adapters
+     * populate associations regardless of record access — so a record the user may not reach can
+     * still be read through a relation of one they may. Records the target model's own rules
+     * keep out of reach are reduced to their primary key here, which costs one batched query
+     * per associated restricted model (memoized for the accessor's lifetime) — except the
+     * associations whose confinement {@link pushDownPopulateAccess} already compiled into
+     * the populate JOIN itself: those arrive pre-reduced and are skipped.
+     *
+     * Read paths only: write paths hand back the record the user just supplied.
+     */
+    async processManyWithAccess(records, criteria) {
+        const processed = this.processMany(records, criteria);
+        // Administrators only: `auth.enable: false` does not lift record scoping
+        // (`RecordAccessResolver.buildWhere` exempts administrators alone), so the
+        // populated records of a restricted model must not escape those rules either.
+        if (this.populateAccessDisabled || !processed.length || this.user.isAdministrator) {
+            return processed;
+        }
+        for (const [fieldKey, fieldConfig] of this.recordAccessAssociationFields()) {
+            if (criteria?.populateOn?.[fieldKey]) {
+                // The access condition ran inside the populate JOIN; records out of
+                // reach already arrived as bare foreign keys.
+                continue;
             }
-            else if (typeof userAccessRelation === 'object' && userAccessRelation !== null) {
-                // If userAccessRelation is an object
-                const { field, via } = userAccessRelation;
-                // Get attributes of the current model and validate the intermediate relation
-                const modelAttributes = this.modelResource.model.attributes;
-                const intermediateRelation = modelAttributes[field];
-                if (!intermediateRelation || !intermediateRelation.model) {
-                    throw new Error(`Invalid intermediate relation configuration for field "${field}" in model ${modelName}`);
-                }
-                // Retrieve the intermediate model
-                const intermediateModel = this.adminizer.modelHandler.model.get(intermediateRelation.model.toLowerCase());
-                if (!intermediateModel) {
-                    throw new Error(`Intermediate model "${intermediateRelation.model}" not found`);
-                }
-                // Validate the `via` field in the intermediate model
-                const intermediateAttributes = intermediateModel.attributes;
-                const viaRelation = intermediateAttributes[via];
-                if (!viaRelation || this.resolveRelationTarget(viaRelation.model) !== 'user') {
-                    throw new Error(`Unsupported or invalid via field "${via}" in intermediate model "${intermediateRelation.model}". ` +
-                        `Currently, only relations to "User" are supported`);
-                }
-                // Fetch all intermediate records associated with the user
-                const intermediateRecords = await this.accessRelationModel(intermediateRelation.model).find({ where: { [via]: this.user.id } });
-                const intermediateIds = (intermediateRecords || []).map((r) => r.id);
-                // Filter main model by all matching intermediate record IDs
-                sanitizedCriteria = { ...sanitizedCriteria, [field]: { in: intermediateIds } };
+            const referenced = this.collectAssociatedIds(processed, fieldKey, fieldConfig);
+            if (!referenced.size) {
+                continue;
+            }
+            const visibleIds = await this.visibleAssociatedIds(fieldConfig, Array.from(referenced.values()));
+            if (visibleIds === undefined) {
+                continue; // the associated model carries no record access rules
+            }
+            for (const record of processed) {
+                this.reduceInvisibleAssociations(record, fieldKey, fieldConfig, visibleIds);
             }
         }
-        return {
-            ...criteria,
-            where: mergeCriteriaWhere(criteria.where, sanitizedCriteria)
-        };
+        return processed;
+    }
+    /**
+     * Compiles the record-access confinement of single populated associations into the
+     * criteria (`populateOn`), so the adapter ANDs it into the populate JOIN's ON clause
+     * and {@link processManyWithAccess} skips the post-read query for those fields — the
+     * closed records arrive as bare foreign keys straight from the database. Only the
+     * associations the adapter declares pushdown-capable and whose access filter has an
+     * adapter-portable shape are compiled; the rest keep the post-read verification.
+     *
+     * Single associations only: a filtered-out belongsTo row still carries its foreign
+     * key, while a record dropped from a populated collection would lose its id — and an
+     * edit form saving that truncated collection would silently sever the links.
+     *
+     * Any incoming `populateOn` is discarded — this method is its sole author, because
+     * the verification skip above trusts the key.
+     */
+    async pushDownPopulateAccess(criteria = {}) {
+        const { populateOn: _discarded, ...rest } = criteria;
+        const result = rest;
+        if (this.populateAccessDisabled || this.user.isAdministrator) {
+            return result;
+        }
+        const populateOn = {};
+        for (const [fieldKey, fieldConfig] of this.recordAccessAssociationFields()) {
+            if (fieldConfig.config?.type !== "association") {
+                continue;
+            }
+            if (!this.modelResource.model?.canPushdownPopulateAccess?.(fieldKey)) {
+                continue;
+            }
+            const resourceName = this.associatedResourceName(fieldConfig);
+            const accessor = resourceName ? this.associatedAccessor(resourceName) : undefined;
+            if (!accessor) {
+                continue;
+            }
+            let accessWhere;
+            try {
+                accessWhere = await accessor.getRecordAccessWhere();
+            }
+            catch (e) {
+                // Unresolvable access rules keep the post-read verification, which fails closed.
+                Adminizer.log.error(`Could not resolve the record access of associated model "${resourceName}"`, e);
+                continue;
+            }
+            if (!hasCriteriaContent(accessWhere) || !isPushdownSafeWhere(accessWhere)) {
+                continue;
+            }
+            const joinWhere = mapAccessWhereToJoinColumns(accessWhere, this.adminizer.modelHandler.getResource(resourceName)?.attributes);
+            if (!joinWhere) {
+                continue;
+            }
+            populateOn[fieldKey] = joinWhere;
+        }
+        return Object.keys(populateOn).length ? { ...result, populateOn } : result;
     }
-    async setUserRelationAccess(record) {
-        let updatedRecord = { ...record };
-        // Check if model has `userAccessRelation` configured
-        if (this.modelResource.config && this.modelResource.config.userAccessRelation) {
-            // Get access field from userAccessRelation
-            const userAccessRelation = this.modelResource.config.userAccessRelation;
-            if (typeof userAccessRelation === 'string') {
-                let accessField = userAccessRelation;
-                // only admin can set user access relation manually
-                if (updatedRecord[accessField] && !this.user.isAdministrator) {
-                    delete updatedRecord[accessField];
+    /**
+     * Turns the association verification of {@link processManyWithAccess} off for this accessor.
+     * Used for the accessors that perform that verification themselves: they only read ids,
+     * and two restricted models referencing each other sideways would otherwise recurse.
+     */
+    disablePopulateAccess() {
+        this.populateAccessDisabled = true;
+        return this;
+    }
+    /**
+     * Association fields whose target model is access-restricted and whose content therefore
+     * needs verifying — except the edge pointing at this model's own graph parent, where
+     * the target is reachable by construction (a visible child hangs off a visible parent).
+     */
+    recordAccessAssociationFields() {
+        if (this.recordAccessAssociationFieldsCache) {
+            return this.recordAccessAssociationFieldsCache;
+        }
+        // May run before the first process() call — build the fields config here, or an
+        // empty list would be computed and cached.
+        if (!this.fields) {
+            this.fields = this.getFieldsConfig();
+        }
+        const result = [];
+        for (const [fieldKey, fieldConfig] of Object.entries(this.fields ?? {})) {
+            const fieldType = fieldConfig.config?.type;
+            if (fieldType !== "association" && fieldType !== "association-many") {
+                continue;
+            }
+            const resourceName = this.associatedResourceName(fieldConfig);
+            if (!resourceName || !this.hasRecordAccessRules(resourceName)) {
+                continue;
+            }
+            if (isGraphParentEdge(this.adminizer, this.modelResource.name, fieldKey, resourceName)) {
+                continue;
+            }
+            result.push([fieldKey, fieldConfig]);
+        }
+        this.recordAccessAssociationFieldsCache = result;
+        return result;
+    }
+    /** True when the model confines its records to the user, by its own relation or the graph. */
+    hasRecordAccessRules(resourceName) {
+        const modelConfig = this.adminizer.config.models?.[resourceName];
+        if (modelConfig?.userAccessRelation) {
+            return true;
+        }
+        return AccessGraphResolver.covers(this.adminizer, resourceName);
+    }
+    associatedResourceName(fieldConfig) {
+        const modelName = fieldConfig.model?.model || fieldConfig.model?.collection;
+        return modelName ? this.resolveRelationTarget(modelName, fieldConfig.model?.resourceName) : undefined;
+    }
+    /** Primary keys of the populated records referenced by a field, keyed by their string form. */
+    collectAssociatedIds(records, fieldKey, fieldConfig) {
+        const primaryKey = this.associatedPrimaryKey(fieldConfig) ?? "id";
+        const ids = new Map();
+        for (const record of records) {
+            const value = record[fieldKey];
+            const items = Array.isArray(value) ? value : [value];
+            for (const item of items) {
+                // Bare ids need no verification: they expose nothing beyond the reference
+                // the parent record already carries.
+                if (!item || typeof item !== "object") {
+                    continue;
                 }
-                // Check if the relation points to `User` or `Group` in the model's attributes
-                const modelAttributes = this.modelResource.model.attributes;
-                const relation = modelAttributes[accessField];
-                const relationModel = this.resolveRelationTarget(relation?.model);
-                if (relation && ['user', 'group'].includes(relationModel ?? "")) {
-                    if (relationModel === 'user') {
-                        if (!this.user.isAdministrator) {
-                            updatedRecord[accessField] = this.user.id;
-                        }
-                    }
-                    else if (relationModel === 'group') {
-                        const userGroups = this.user.groups || [];
-                        if (userGroups.length === 1) {
-                            updatedRecord[accessField] = userGroups[0].id;
-                        }
-                        else {
-                            throw new Error('Record cannot be saved because the user is associated with none or multiple groups.');
-                        }
-                    }
+                const id = item[primaryKey];
+                if (id !== null && id !== undefined) {
+                    ids.set(String(id), id);
                 }
             }
-            else if (typeof userAccessRelation === 'object' && userAccessRelation !== null) {
-                // If userAccessRelation is an object
-                const { field, via } = userAccessRelation;
-                // For non-admins: validate that the chosen intermediate record belongs to the user
-                if (updatedRecord[field] && !this.user.isAdministrator) {
-                    if (!via) {
-                        throw new Error(`Invalid userAccessRelation configuration: "via" is required`);
-                    }
-                    const modelAttributes = this.modelResource.model.attributes;
-                    const intermediateRelation = modelAttributes[field];
-                    if (!intermediateRelation || !intermediateRelation.model) {
-                        throw new Error(`Invalid intermediate relation configuration for field "${field}" in model ${this.modelResource.model.modelname}`);
-                    }
-                    const intermediateModel = this.adminizer.modelHandler.model.get(intermediateRelation.model.toLowerCase());
-                    if (!intermediateModel) {
-                        throw new Error(`Intermediate model "${intermediateRelation.model}" not found`);
-                    }
-                    // Validate the `via` field in the intermediate model
-                    const intermediateAttributes = intermediateModel.attributes;
-                    const viaRelation = intermediateAttributes[via];
-                    if (!viaRelation || this.resolveRelationTarget(viaRelation.model) !== 'user') {
-                        throw new Error(`Unsupported or invalid via field "${via}" in intermediate model "${intermediateRelation.model}". ` +
-                            `Currently, only relations to "User" are supported`);
-                    }
-                    const intermediatePk = (intermediateModel.primaryKey ?? 'id');
-                    const chosenId = typeof updatedRecord[field] === 'object'
-                        ? updatedRecord[field][intermediatePk]
-                        : updatedRecord[field];
-                    const record = await this.accessRelationModel(intermediateRelation.model).findOne({ where: { [intermediatePk]: chosenId, [via]: this.user.id } });
-                    if (!record) {
-                        throw new Error(`Access denied: "${field}" does not belong to the current user`);
-                    }
-                }
+        }
+        return ids;
+    }
+    /** Replaces populated records the user may not reach with their bare primary key. */
+    reduceInvisibleAssociations(record, fieldKey, fieldConfig, visibleIds) {
+        const primaryKey = this.associatedPrimaryKey(fieldConfig) ?? "id";
+        const data = record;
+        const value = data[fieldKey];
+        const reduce = (item) => {
+            if (!item || typeof item !== "object") {
+                return item;
+            }
+            const id = item[primaryKey];
+            if (id === null || id === undefined || visibleIds.has(String(id))) {
+                return item;
+            }
+            return id;
+        };
+        data[fieldKey] = Array.isArray(value) ? value.map(reduce) : reduce(value);
+    }
+    /**
+     * The associated model's own view accessor, shared between the pushdown and the
+     * post-read verification so its access lookups resolve once per model.
+     */
+    associatedAccessor(resourceName) {
+        let accessor = this.associatedAccessorCache.get(resourceName);
+        if (!accessor) {
+            const model = this.adminizer.modelHandler.getResource(resourceName);
+            if (!model) {
+                return undefined;
             }
+            accessor = new DataAccessor(this.adminizer, this.user, {
+                name: resourceName,
+                config: this.adminizer.config.models?.[resourceName],
+                model,
+                uri: `${this.adminizer.config.routePrefix}/model/${resourceName}`
+            }, "view", this.recordAccessCache).disablePopulateAccess();
+            this.associatedAccessorCache.set(resourceName, accessor);
         }
-        return updatedRecord;
+        return accessor;
     }
-}
-function getTokenAction(apAction) {
-    switch (apAction) {
-        case "add":
-            return "create";
-        case "list":
-        case "view":
-            return "read";
-        case "edit":
-            return "update";
-        case "remove":
-            return "delete";
+    /**
+     * Subset of `ids` the user may reach in the associated model, or `undefined` when that
+     * model has no record access rules. The target's own accessor is reused across calls, so its
+     * membership lookups are resolved once.
+     */
+    async visibleAssociatedIds(fieldConfig, ids) {
+        const resourceName = this.associatedResourceName(fieldConfig);
+        const accessor = resourceName ? this.associatedAccessor(resourceName) : undefined;
+        if (!resourceName || !accessor) {
+            return new Set();
+        }
+        const model = this.adminizer.modelHandler.getResource(resourceName);
+        if (!model) {
+            return new Set();
+        }
+        let accessWhere;
+        try {
+            accessWhere = await accessor.getRecordAccessWhere();
+        }
+        catch (e) {
+            // A misconfigured graph must not widen what the relation exposes.
+            Adminizer.log.error(`Could not resolve the record access of associated model "${resourceName}"`, e);
+            return new Set();
+        }
+        if (!hasCriteriaContent(accessWhere)) {
+            return undefined;
+        }
+        const primaryKey = (model.primaryKey ?? "id");
+        // The accessor is shared with the access resolution above, so `find` reuses its
+        // memoized membership lookups instead of querying them again.
+        const rows = await model.find({ where: { [primaryKey]: { in: ids } }, select: [primaryKey] }, accessor);
+        return new Set((rows ?? []).map((row) => String(row[primaryKey])));
+    }
+    async sanitizeUserRelationAccess(criteria = {}) {
+        const sanitizedCriteria = await this.getRecordAccessResolver().buildWhere();
+        // Both adapters read field conditions from `where` when it has keys and from the
+        // top level otherwise. Injecting `where` here would therefore make them ignore the
+        // top-level ones — a flat `{id}` update would silently widen to every record the
+        // user may reach — so the flat form is folded into `where` first.
+        // `populateOn` is discarded: only `pushDownPopulateAccess` may author it — the
+        // association verification trusts the key, so a smuggled one must not survive.
+        const { where, skip, limit, sort, select, populate, populateOn: _discarded, ...flat } = criteria;
+        // `sort` is an ordering directive only as a string; anything else is a model field.
+        if (sort !== undefined && typeof sort !== "string") {
+            flat.sort = sort;
+        }
+        const criteriaWhere = Object.keys(flat).length
+            ? mergeCriteriaWhere(where, flat)
+            : where;
+        return {
+            ...(skip !== undefined ? { skip } : {}),
+            ...(limit !== undefined ? { limit } : {}),
+            ...(typeof sort === "string" ? { sort } : {}),
+            ...(select !== undefined ? { select } : {}),
+            ...(populate !== undefined ? { populate } : {}),
+            where: mergeCriteriaWhere(criteriaWhere, sanitizedCriteria)
+        };
+    }
+    setUserRelationAccess(record) {
+        return this.getRecordAccessResolver().applyWriteRules(record);
+    }
+    /**
+     * Where-fragment confining this model to the records the user may reach
+     * (`userAccessRelation` or accessGraph); `{}` means no record-level constraint.
+     *
+     * For surfaces that reference records without reading them through the model API —
+     * the change history, for one — and therefore cannot rely on
+     * {@link sanitizeUserRelationAccess} doing it for them.
+     */
+    getRecordAccessWhere() {
+        return this.getRecordAccessResolver().buildWhere();
+    }
+    getRecordAccessResolver() {
+        this.recordAccessResolver ??= new RecordAccessResolver(this.adminizer, this.user, this.modelResource, this.actionVerb, this.recordAccessCache);
+        return this.recordAccessResolver;
     }
 }