grafeo-ogm 1.13.0 → 1.14.0

package/CHANGELOG.md

@@ -1,5 +1,47 @@
 # Changelog
 
+## 1.14.0 (2026-07-24) — 🛡️ Security release: NLS enforcement on interface reads & relationship writes, and a `_MATCHES` ReDoS guard
+
+> **Three security fixes.** Two are object-level authorization gaps: grafeo's node-level-security (NLS) policies were threaded correctly through the concrete-model read and write paths, but two paths silently skipped the **target type's** policy — nested relationship projections on **interface** reads, and **connect/disconnect** relationship writes — so a caller whose own access was correctly scoped could still read, or link/unlink, related nodes their policy forbids. The third hardens the `_MATCHES` filter operator against server-side ReDoS. If you use `policies` with interface models or nested `connect`/`disconnect`, or expose `_MATCHES` to untrusted input, upgrade.
+
+### 🛡️ Interface reads now apply the target type's `read` policy to nested projections
+
+`InterfaceModel.find` (and its `findFirst` / `findUnique` / `*OrThrow` siblings, which all route through it) applied the interface's source-side policy and the WHERE-side traversal policy — but compiled the **RETURN projection** without the read `policyContext` that `Model.find` passes. Every nested relationship pattern comprehension was therefore emitted with **no target-type policy**, so an interface query could project fields of related, policy-protected node types (e.g. another tenant's `author { email }`) that the target type's `read` policy is meant to filter out. The leak was silent and spanned every row the interface query returned.
+
+The fix threads the resolved read `policyContext` into the interface selection compile, exactly as the concrete-model path already does, so every nested projection AND-stitches the target type's read policy — including union and connection branches. **When no policy layer is configured the emitted Cypher is byte-identical** to before; the guard engages only when a policy actually resolves for the projected type.
+
+### 🛡️ Nested `connect` / `disconnect` now enforce the target type's `read` policy
+
+`MutationCompiler` was policy-unaware: the target `MATCH` emitted for a nested `connect` (MERGE) or `disconnect` selected the target node by the caller's `where` alone, with no policy. A caller operating under a bound `withContext(ctx)` — whose *source* node was correctly policy-filtered — could therefore link or unlink relationships to arbitrary target nodes their policy should forbid (cross-tenant / cross-owner relationship writes):
+
+```typescript
+// `Book` has a read policy scoped to the owner. Previously this linked a
+// foreign Book anyway — the target MATCH carried no Book policy. Now it
+// AND-stitches the Book read policy, so an unreadable target fails to
+// match and the MERGE is a no-op.
+ogm.withContext({ uid }).model('User').update({
+  where: { id: myId },
+  connect: { ownedBooks: { where: { id: someBookId } } },
+});
+```
+
+The fix threads the resolved policy context into `MutationCompiler` and AND-stitches the target type's `read` policy into every connect/disconnect target `MATCH` — all seven sites (single / array / `UNWIND` connect, specific disconnect, nested-in-update connect and disconnect, union targets), reached from both `update` and `updateMany`. `read` is the correct gate: row-level target visibility is expressed as the `read` policy, while `create`/`update` restrictives are WITH-CHECK predicates over a mutation-input bag that a referenced existing node has none of. **No-policy, bypass (`unsafe.bypassPolicies`), and no-target-policy paths stay byte-identical**; `create` and `upsert` (which never emits a relationship `MATCH`) are untouched. Policy predicates use the mutation's shared, monotonic parameter counter, so they never collide with the caller's `connect`/`disconnect` `where` params.
+
+### 🛡️ `_MATCHES` is now guarded against catastrophic-backtracking regexes (ReDoS)
+
+The `_MATCHES` filter operator forwards its value into a Neo4j `=~` predicate, which the server evaluates with Java's **backtracking** regex engine. An attacker able to influence a `where` filter could supply a catastrophic pattern (e.g. `(a+)+$`, `([a-z]+)+$`, `(a?)+$`) and pin shared Neo4j CPU — a server-side ReDoS ([CWE-1333](https://cwe.mitre.org/data/definitions/1333.html)). Parameterization stops injection but not this: the payload *is* the regex.
+
+Every `_MATCHES` value is now validated at compile time by a **sound-by-construction** guard. Rather than blocklisting known-bad shapes (always incomplete), it accepts a pattern **only when it can prove the pattern is linear**, and refuses everything it cannot model — alternation, quantified groups, lookaround, backreferences, unsupported escapes. The check is single-pass and bounded, so it cannot itself become a DoS vector, and Java-flavor divergences are modeled soundly (`\v` is the vertical-whitespace class; `\0`/octal escapes are refused; only inline flags that don't change the analysis — `i`/`m`/`s`/`d` — are honored, so `(?x)` COMMENTS mode and `(?u)`/`(?U)` Unicode widening are refused).
+
+- **Precision cost (intended, fail-closed).** Some linear-but-unprovable patterns are refused — notably **all alternation** (`(cat|dog)`) and **contains-style** `.*x.*` shapes. Reach for the dedicated, always-safe operators (`_CONTAINS` / `_STARTS_WITH` / `_ENDS_WITH` / `_IN`), simplify the pattern, or disable `_MATCHES` entirely via `features.filters.String.MATCHES` if you must run arbitrary regexes and accept the risk. The refusal error names these options.
+- **Common patterns keep working** — anchors, character classes, single wildcards (`^foo.*bar$`, `[A-Za-z0-9_]+`, `\d{3}-\d{4}`), fenced quantifiers (`[a-z]+@[a-z]+\.[a-z]+`), and inline-flag prefixes (`(?i)…`).
+
+### Tests
+
+Interface-read policy: two specs asserting the nested projection now carries the target `read` predicate for interface reads, and that the no-policy path stays byte-identical. Connect/disconnect policy: six specs covering connect and disconnect target MATCHes carrying the target `read` policy, the update-op-not-stitched case, byte-identical no-policy/bypass Cypher, and non-colliding parameter numbering. ReDoS guard: a 100+-case battery covering every known catastrophic family (nested quantifiers, nullable/overlapping alternation under repeat, custom-class and nested-group bases, unrolled adjacent optionals), fail-closed refusal of unmodeled constructs, acceptance of provably-linear patterns, and the three Java-flavor soundness regressions found and closed during adversarial review (`(?x)`, `\v`, `\0`). Full suite green (1629); lint and format clean.
+
+---
+
 ## 1.13.0 (2026-07-14) — ✨ `$cloneSubgraph` returns `nodesByLabel`
 
 > **First community-requested feature** ([#1](https://github.com/neomodular/grafeo-ogm/issues/1)). After deep-cloning a content subgraph, a caller often needs to post-process only the nodes of a **specific label** (re-normalize, re-stamp, re-index). Until now `nodeMapping` held every cloned id across all labels, forcing a broad-`IN`-plus-label-filter dance on the caller. The clone already visits every node with its labels in hand — so now it just tells you.

package/dist/cjs/compilers/mutation.compiler.d.ts

@@ -1,5 +1,7 @@
 import type { OGMLogger } from '../execution/executor';
+import type { PolicyContextBundle } from '../policy/types';
 import { NodeDefinition, SchemaMetadata } from '../schema/types';
+import { WhereCompiler } from './where.compiler';
 export interface MutationResult {
     cypher: string;
     params: Record<string, unknown>;
@@ -15,9 +17,44 @@ export declare class MutationCompiler {
      */
     private labelCache;
     private logger?;
+    /**
+     * WhereCompiler used ONLY to compile a relationship TARGET type's
+     * `read` policy predicate for connect/disconnect target MATCHes,
+     * mirroring the read paths (`WhereCompiler`/`SelectionCompiler`).
+     * Injected by the OGM so it shares the user's compiler options;
+     * lazily constructed with default options otherwise.
+     */
+    private policyWhereCompiler?;
     constructor(schema: SchemaMetadata, options?: {
         logger?: OGMLogger;
+        whereCompiler?: WhereCompiler;
     });
+    /**
+     * Resolve and compile the TARGET type's `read` policy predicate for a
+     * connect/disconnect target MATCH, mirroring the read path
+     * (`WhereCompiler.buildTargetBundle` + `WhereCompiler.compile`). You
+     * must be allowed to SEE a node to link/unlink it, so linking to an
+     * unreadable node is the IDOR this closes; the codebase models the
+     * row-level write gate for `update`/`delete` targets as `read`
+     * ReadRestrictive policies (see policy/types.ts), so `read` is both
+     * necessary and the semantically correct operation here.
+     *
+     * Returns `null` — leaving the emitted Cypher BYTE-IDENTICAL — when:
+     *   - no policy context is threaded (no policy bound / bypass active), OR
+     *   - no `paramCounter` is available to allocate policy params, OR
+     *   - the target type has no policy applicable to `read`, OR
+     *   - the resolved policy is `overridden` (compiles to nothing).
+     *
+     * When a target policy resolves, the compiled predicate is returned and
+     * its bound params are merged into `params`. Policy params use the
+     * shared `paramCounter` (`param<N>`), continuing the sequence started by
+     * the top-level WHERE, so they can never collide with the
+     * connect/disconnect `where` params (prefix-named, e.g.
+     * `connect_<field>_<prop>`) or the selection's params (allocated later
+     * from the same counter).
+     */
+    private buildTargetPolicyPredicate;
+    private getPolicyWhereCompiler;
     /**
      * Surface a logical operator that contributed zero effective conditions.
      * Mirrors WhereCompiler.warnEmptyLogical — fires only on the anomalous
@@ -39,7 +76,23 @@ export declare class MutationCompiler {
         cypher: string;
         params: Record<string, unknown>;
         preludes?: string[];
-    }, labels?: string[], returnMode?: 'node' | 'count'): MutationResult;
+    }, labels?: string[], returnMode?: 'node' | 'count', 
+    /**
+     * The caller's resolved policy bundle for this mutation (the SOURCE
+     * type's `update` bundle). Its `resolveForType` is used to resolve
+     * each connect/disconnect TARGET type's `read` policy. `undefined`
+     * when no policy is bound or a bypass is active — in which case the
+     * emitted Cypher is byte-identical to before this enforcement.
+     */
+    policyContext?: PolicyContextBundle, 
+    /**
+     * Shared `param<N>` counter, continued from the top-level WHERE
+     * compile so target-policy params never collide with connect/
+     * disconnect `where` params or the selection's params.
+     */
+    paramCounter?: {
+        count: number;
+    }): MutationResult;
     /**
      * Generate DELETE Cypher with optional cascade.
      */

package/dist/cjs/compilers/mutation.compiler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mutation.compiler.d.ts","sourceRoot":"","sources":["../../../src/compilers/mutation.compiler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EACL,cAAc,EAEd,cAAc,EACf,MAAM,iBAAiB,CAAC;AAqBzB,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED;;GAEG;AACH,qBAAa,gBAAgB;IAUzB,OAAO,CAAC,MAAM;IAThB;;;OAGG;IACH,OAAO,CAAC,UAAU,CAA6B;IAE/C,OAAO,CAAC,MAAM,CAAC,CAAY;gBAGjB,MAAM,EAAE,cAAc,EAC9B,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,SAAS,CAAA;KAAE;IAKlC;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAQxB,8EAA8E;IAC9E,WAAW,IAAI,IAAI;IAInB,OAAO,CAAC,oBAAoB;IAQ5B;;;OAGG;IACH,aAAa,CACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EACjC,OAAO,EAAE,cAAc,EACvB,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,cAAc;IAkDjB;;OAEG;IACH,aAAa,CACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC3C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC5C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC/C,OAAO,EAAE,cAAc,EACvB,WAAW,EAAE;QACX,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,EACD,MAAM,CAAC,EAAE,MAAM,EAAE,EACjB,UAAU,GAAE,MAAM,GAAG,OAAgB,GACpC,cAAc;IAqEjB;;OAEG;IACH,aAAa,CACX,OAAO,EAAE,cAAc,EACvB,WAAW,EAAE;QACX,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,EACD,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACpC,cAAc;IAsCjB;;;OAGG;IACH,YAAY,CACV,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,EAAE,cAAc,EACvB,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,cAAc;IA0FjB;;OAEG;IACH,gBAAgB,CACd,OAAO,EAAE,cAAc,EACvB,WAAW,EAAE;QACX,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,EACD,SAAS,CAAC,EAAE,MAAM,EAAE,EACpB,YAAY,CAAC,EAAE,MAAM,EAAE,GACtB,cAAc;IA2CjB;;;;OAIG;IACH,iBAAiB,CACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAC/B,OAAO,EAAE,cAAc,EACvB,cAAc,CAAC,EAAE,OAAO,EACxB,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,cAAc;IA8FjB,OAAO,CAAC,qBAAqB;IA0B7B,OAAO,CAAC,wBAAwB;IA0EhC;;;OAGG;IACH,OAAO,CAAC,iCAAiC;IAwLzC,OAAO,CAAC,aAAa;IA4NrB,OAAO,CAAC,gBAAgB;IAyExB;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAgD9B;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IA8bhC;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAcvC;IAEF;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAY3B;;;;;;;;OAQG;IACH,OAAO,CAAC,wBAAwB;IA4DhC;;;;;OAKG;IACH,OAAO,CAAC,8BAA8B;IAoGtC,qFAAqF;IACrF,OAAO,CAAC,gBAAgB,CAAK;IAE7B;;;OAGG;IACH,OAAO,CAAC,0BAA0B;IA+ElC,OAAO,CAAC,sBAAsB;IAS9B;;;OAGG;IACH,OAAO,CAAC,kCAAkC;IAoC1C,OAAO,CAAC,6BAA6B;IA0BrC,OAAO,CAAC,qBAAqB;CAQ9B"}
+{"version":3,"file":"mutation.compiler.d.ts","sourceRoot":"","sources":["../../../src/compilers/mutation.compiler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EACL,cAAc,EAEd,cAAc,EACf,MAAM,iBAAiB,CAAC;AAazB,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AASjD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED;;GAEG;AACH,qBAAa,gBAAgB;IAmBzB,OAAO,CAAC,MAAM;IAlBhB;;;OAGG;IACH,OAAO,CAAC,UAAU,CAA6B;IAE/C,OAAO,CAAC,MAAM,CAAC,CAAY;IAE3B;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB,CAAC,CAAgB;gBAGlC,MAAM,EAAE,cAAc,EAC9B,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,SAAS,CAAC;QAAC,aAAa,CAAC,EAAE,aAAa,CAAA;KAAE;IAMjE;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,OAAO,CAAC,0BAA0B;IA2ClC,OAAO,CAAC,sBAAsB;IAM9B;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAQxB,8EAA8E;IAC9E,WAAW,IAAI,IAAI;IAInB,OAAO,CAAC,oBAAoB;IAQ5B;;;OAGG;IACH,aAAa,CACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EACjC,OAAO,EAAE,cAAc,EACvB,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,cAAc;IAuDjB;;OAEG;IACH,aAAa,CACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC3C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC5C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC/C,OAAO,EAAE,cAAc,EACvB,WAAW,EAAE;QACX,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,EACD,MAAM,CAAC,EAAE,MAAM,EAAE,EACjB,UAAU,GAAE,MAAM,GAAG,OAAgB;IACrC;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,mBAAmB;IACnC;;;;OAIG;IACH,YAAY,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAC/B,cAAc;IAiFjB;;OAEG;IACH,aAAa,CACX,OAAO,EAAE,cAAc,EACvB,WAAW,EAAE;QACX,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,EACD,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACpC,cAAc;IAsCjB;;;OAGG;IACH,YAAY,CACV,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,EAAE,cAAc,EACvB,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,cAAc;IA0FjB;;OAEG;IACH,gBAAgB,CACd,OAAO,EAAE,cAAc,EACvB,WAAW,EAAE;QACX,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,EACD,SAAS,CAAC,EAAE,MAAM,EAAE,EACpB,YAAY,CAAC,EAAE,MAAM,EAAE,GACtB,cAAc;IA2CjB;;;;OAIG;IACH,iBAAiB,CACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAC/B,OAAO,EAAE,cAAc,EACvB,cAAc,CAAC,EAAE,OAAO,EACxB,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,cAAc;IA8FjB,OAAO,CAAC,qBAAqB;IA0B7B,OAAO,CAAC,wBAAwB;IAgFhC;;;OAGG;IACH,OAAO,CAAC,iCAAiC;IAsMzC,OAAO,CAAC,aAAa;IA4PrB,OAAO,CAAC,gBAAgB;IAuFxB;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAoD9B;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IA0dhC;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAcvC;IAEF;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAY3B;;;;;;;;OAQG;IACH,OAAO,CAAC,wBAAwB;IA4DhC;;;;;OAKG;IACH,OAAO,CAAC,8BAA8B;IAoGtC,qFAAqF;IACrF,OAAO,CAAC,gBAAgB,CAAK;IAE7B;;;OAGG;IACH,OAAO,CAAC,0BAA0B;IA+ElC,OAAO,CAAC,sBAAsB;IAS9B;;;OAGG;IACH,OAAO,CAAC,kCAAkC;IAoC1C,OAAO,CAAC,6BAA6B;IA0BrC,OAAO,CAAC,qBAAqB;CAQ9B"}

package/dist/cjs/compilers/mutation.compiler.js

@@ -4,6 +4,7 @@ exports.MutationCompiler = void 0;
 const errors_1 = require("../errors");
 const utils_1 = require("../schema/utils");
 const validation_1 = require("../utils/validation");
+const where_compiler_1 = require("./where.compiler");
 /**
  * Relationship filter suffixes that require EXISTS subquery patterns.
  * These match related nodes via relationship traversal rather than scalar property comparison.
@@ -23,6 +24,59 @@ class MutationCompiler {
         /** Counter for unique relationship filter variables within a single WHERE clause. */
         this.relFilterCounter = 0;
         this.logger = options?.logger;
+        this.policyWhereCompiler = options?.whereCompiler;
+    }
+    /**
+     * Resolve and compile the TARGET type's `read` policy predicate for a
+     * connect/disconnect target MATCH, mirroring the read path
+     * (`WhereCompiler.buildTargetBundle` + `WhereCompiler.compile`). You
+     * must be allowed to SEE a node to link/unlink it, so linking to an
+     * unreadable node is the IDOR this closes; the codebase models the
+     * row-level write gate for `update`/`delete` targets as `read`
+     * ReadRestrictive policies (see policy/types.ts), so `read` is both
+     * necessary and the semantically correct operation here.
+     *
+     * Returns `null` — leaving the emitted Cypher BYTE-IDENTICAL — when:
+     *   - no policy context is threaded (no policy bound / bypass active), OR
+     *   - no `paramCounter` is available to allocate policy params, OR
+     *   - the target type has no policy applicable to `read`, OR
+     *   - the resolved policy is `overridden` (compiles to nothing).
+     *
+     * When a target policy resolves, the compiled predicate is returned and
+     * its bound params are merged into `params`. Policy params use the
+     * shared `paramCounter` (`param<N>`), continuing the sequence started by
+     * the top-level WHERE, so they can never collide with the
+     * connect/disconnect `where` params (prefix-named, e.g.
+     * `connect_<field>_<prop>`) or the selection's params (allocated later
+     * from the same counter).
+     */
+    buildTargetPolicyPredicate(targetNodeDef, targetVar, params, policyContext, paramCounter) {
+        if (!policyContext || !paramCounter)
+            return null;
+        const targetPolicy = policyContext.resolveForType(targetNodeDef.typeName, 'read');
+        if (!targetPolicy)
+            return null;
+        const targetBundle = {
+            ctx: policyContext.ctx,
+            operation: 'read',
+            resolved: targetPolicy,
+            resolveForType: policyContext.resolveForType,
+            defaults: policyContext.defaults,
+        };
+        const compiled = this.getPolicyWhereCompiler().compile(undefined, targetVar, targetNodeDef, paramCounter, { policyContext: targetBundle });
+        if (compiled.preludes && compiled.preludes.length > 0)
+            throw new errors_1.OGMError(`Policy on "${targetNodeDef.typeName}" requires @cypher field ` +
+                `projection, which is not supported inside connect/disconnect ` +
+                `target filters. Refactor the policy to use stored properties.`);
+        if (!compiled.cypher)
+            return null;
+        (0, validation_1.mergeParams)(params, compiled.params);
+        return compiled.cypher;
+    }
+    getPolicyWhereCompiler() {
+        if (!this.policyWhereCompiler)
+            this.policyWhereCompiler = new where_compiler_1.WhereCompiler(this.schema);
+        return this.policyWhereCompiler;
     }
     /**
      * Surface a logical operator that contributed zero effective conditions.
@@ -67,7 +121,11 @@ class MutationCompiler {
             // Process relationship operations (nested create / connect)
             // Pass all previously created node vars as ancestors so WITH clauses
             // don't drop them from scope (needed for RETURN n at the end)
-            const relLines = this.buildCreateRelationships(input, nodeDef, nodeVar, prefix, params, createdVars.slice(0, -1));
+            const relLines = this.buildCreateRelationships(input, nodeDef, nodeVar, prefix, params, createdVars.slice(0, -1), // ancestors = all vars before current
+            // No policy context is threaded on the create path: `create`'s
+            // nested connect enforcement is out of scope for this fix, so
+            // the emitted create Cypher stays byte-identical.
+            undefined, undefined);
             lines.push(...relLines);
         }
         // Add extra labels to all created nodes
@@ -82,7 +140,21 @@ class MutationCompiler {
     /**
      * Generate UPDATE Cypher (SET properties + connect/disconnect).
      */
-    compileUpdate(_where, update, connect, disconnect, nodeDef, whereResult, labels, returnMode = 'node') {
+    compileUpdate(_where, update, connect, disconnect, nodeDef, whereResult, labels, returnMode = 'node', 
+    /**
+     * The caller's resolved policy bundle for this mutation (the SOURCE
+     * type's `update` bundle). Its `resolveForType` is used to resolve
+     * each connect/disconnect TARGET type's `read` policy. `undefined`
+     * when no policy is bound or a bypass is active — in which case the
+     * emitted Cypher is byte-identical to before this enforcement.
+     */
+    policyContext, 
+    /**
+     * Shared `param<N>` counter, continued from the top-level WHERE
+     * compile so target-policy params never collide with connect/
+     * disconnect `where` params or the selection's params.
+     */
+    paramCounter) {
         this.relFilterCounter = 0;
         const labelStr = this.getCachedLabelString(nodeDef);
         const lines = [];
@@ -117,18 +189,18 @@ class MutationCompiler {
             if (setClauses.length > 0)
                 lines.push(`SET ${setClauses.join(', ')}`);
             // Process nested relationship operations within update body
-            const relLines = this.buildUpdateRelationships(update, nodeDef, 'n', 'update', params);
+            const relLines = this.buildUpdateRelationships(update, nodeDef, 'n', 'update', params, 0, [], policyContext, paramCounter);
             lines.push(...relLines);
         }
         // Disconnect relationships (top-level) — must run before connects
         // so that blanket disconnects don't remove newly-connected relationships.
         if (disconnect) {
-            const disconnectLines = this.buildDisconnects(disconnect, nodeDef, params);
+            const disconnectLines = this.buildDisconnects(disconnect, nodeDef, params, policyContext, paramCounter);
             lines.push(...disconnectLines);
         }
         // Connect relationships (top-level)
         if (connect) {
-            const connectLines = this.buildConnects(connect, nodeDef, params);
+            const connectLines = this.buildConnects(connect, nodeDef, params, policyContext, paramCounter);
             lines.push(...connectLines);
         }
         lines.push(returnMode === 'count' ? 'RETURN count(n) AS count' : 'RETURN n');
@@ -390,7 +462,7 @@ class MutationCompiler {
         }
         return { propString: parts.join(', '), propParams };
     }
-    buildCreateRelationships(input, nodeDef, nodeVar, prefix, params, ancestorVars = []) {
+    buildCreateRelationships(input, nodeDef, nodeVar, prefix, params, ancestorVars = [], policyContext, paramCounter) {
         const lines = [];
         let nestedCounter = 0;
         // WITH clause must carry all ancestors + the node being created on
@@ -415,7 +487,7 @@ class MutationCompiler {
                         continue;
                     const memberInput = memberValue;
                     // Process creates/connects for this union member
-                    const memberLines = this.buildCreateRelationshipsForTarget(memberInput, memberNodeDef, relDef, nodeVar, `${prefix}_${key}_${memberKey}`, params, allVars, withClause, nestedCounter);
+                    const memberLines = this.buildCreateRelationshipsForTarget(memberInput, memberNodeDef, relDef, nodeVar, `${prefix}_${key}_${memberKey}`, params, allVars, withClause, nestedCounter, policyContext, paramCounter);
                     nestedCounter += memberLines.counterUsed;
                     lines.push(...memberLines.lines);
                 }
@@ -424,7 +496,7 @@ class MutationCompiler {
             const targetNodeDef = this.schema.nodes.get(relDef.target);
             if (!targetNodeDef)
                 continue;
-            const resultLines = this.buildCreateRelationshipsForTarget(relInput, targetNodeDef, relDef, nodeVar, `${prefix}_${key}`, params, allVars, withClause, nestedCounter);
+            const resultLines = this.buildCreateRelationshipsForTarget(relInput, targetNodeDef, relDef, nodeVar, `${prefix}_${key}`, params, allVars, withClause, nestedCounter, policyContext, paramCounter);
             nestedCounter += resultLines.counterUsed;
             lines.push(...resultLines.lines);
         }
@@ -434,7 +506,7 @@ class MutationCompiler {
      * Process create/connect operations for a specific target node type.
      * Used by buildCreateRelationships for both union-member and non-union targets.
      */
-    buildCreateRelationshipsForTarget(relInput, targetNodeDef, relDef, nodeVar, prefix, params, allVars, withClause, startCounter) {
+    buildCreateRelationshipsForTarget(relInput, targetNodeDef, relDef, nodeVar, prefix, params, allVars, withClause, startCounter, policyContext, paramCounter) {
         const lines = [];
         let counter = 0;
         const targetLabelStr = this.getCachedLabelString(targetNodeDef);
@@ -450,7 +522,7 @@ class MutationCompiler {
                 counter++;
                 const { propString, propParams } = this.buildCreateProperties(nodeSpec, targetNodeDef, `${prefix}_create${ci}`);
                 // Handle nested relationship creates within the created node
-                const nestedRelLines = this.buildCreateRelationships(nodeSpec, targetNodeDef, createVar, `${prefix}_create${ci}`, params, allVars);
+                const nestedRelLines = this.buildCreateRelationships(nodeSpec, targetNodeDef, createVar, `${prefix}_create${ci}`, params, allVars, policyContext, paramCounter);
                 const propsClause = propString.length > 0
                     ? ` { ${propString} }`
                     : ` { ${this.buildGeneratedIdClause(targetNodeDef)} }`;
@@ -522,8 +594,12 @@ class MutationCompiler {
                 counter++;
                 lines.push(`MATCH (${connectVar}:${targetLabelStr})`);
                 const conditions = this.buildConnectionWhereConditions(whereSpec, connectVar, `${prefix}_conn${ci}`, params, targetNodeDef);
-                if (conditions.length > 0)
-                    lines.push(`WHERE ${conditions.join(' AND ')}`);
+                const policyPredicate = this.buildTargetPolicyPredicate(targetNodeDef, connectVar, params, policyContext, paramCounter);
+                const connectConditions = policyPredicate
+                    ? [...conditions, policyPredicate]
+                    : conditions;
+                if (connectConditions.length > 0)
+                    lines.push(`WHERE ${connectConditions.join(' AND ')}`);
                 if (edgeInput && Object.keys(edgeInput).length > 0) {
                     // Use bare target var (no label) since connectVar is already bound by MATCH.
                     // Including labels on a bound variable in MERGE causes Neo4j to reject it.
@@ -560,7 +636,7 @@ class MutationCompiler {
         }
         return { lines, counterUsed: counter };
     }
-    buildConnects(connect, nodeDef, params) {
+    buildConnects(connect, nodeDef, params, policyContext, paramCounter) {
         const lines = [];
         for (const [fieldName, spec] of Object.entries(connect)) {
             const relDef = nodeDef.relationships.get(fieldName);
@@ -591,8 +667,12 @@ class MutationCompiler {
                         const connectVar = `target_${fieldName}_${ci}`;
                         lines.push(`MATCH (${connectVar}:${targetLabelStr})`);
                         const conditions = this.buildConnectionWhereConditions(whereSpec, connectVar, `connect_${fieldName}_${ci}`, params, targetNodeDef);
-                        if (conditions.length > 0)
-                            lines.push(`WHERE ${conditions.join(' AND ')}`);
+                        const policyPredicate = this.buildTargetPolicyPredicate(targetNodeDef, connectVar, params, policyContext, paramCounter);
+                        const connectConditions = policyPredicate
+                            ? [...conditions, policyPredicate]
+                            : conditions;
+                        if (connectConditions.length > 0)
+                            lines.push(`WHERE ${connectConditions.join(' AND ')}`);
                         if (edgeInput && Object.keys(edgeInput).length > 0) {
                             (0, validation_1.assertSafeIdentifier)(relDef.type, 'relationship type');
                             const escapedRelType = (0, validation_1.escapeIdentifier)(relDef.type);
@@ -661,8 +741,12 @@ class MutationCompiler {
                                 `to share the same shape.`);
                     }
                     const whereConditions = this.extractConnectWhereConditions(firstItem, 'target', 'connItem');
-                    if (whereConditions.length > 0)
-                        lines.push(`WHERE ${whereConditions.join(' AND ')}`);
+                    const policyPredicate = this.buildTargetPolicyPredicate(targetNodeDef, 'target', params, policyContext, paramCounter);
+                    const unwindConditions = policyPredicate
+                        ? [...whereConditions, policyPredicate]
+                        : whereConditions;
+                    if (unwindConditions.length > 0)
+                        lines.push(`WHERE ${unwindConditions.join(' AND ')}`);
                     const mergePattern = (0, utils_1.buildRelPattern)({
                         sourceVar: 'n',
                         relDef,
@@ -694,8 +778,12 @@ class MutationCompiler {
                 lines.push('WITH n');
                 lines.push(`MATCH (target:${targetLabelStr})`);
                 const matchConditions = this.buildConnectionWhereConditions(whereSpec, 'target', `connect_${fieldName}`, params, targetNodeDef);
-                if (matchConditions.length > 0)
-                    lines.push(`WHERE ${matchConditions.join(' AND ')}`);
+                const policyPredicate = this.buildTargetPolicyPredicate(targetNodeDef, 'target', params, policyContext, paramCounter);
+                const singleConnectConditions = policyPredicate
+                    ? [...matchConditions, policyPredicate]
+                    : matchConditions;
+                if (singleConnectConditions.length > 0)
+                    lines.push(`WHERE ${singleConnectConditions.join(' AND ')}`);
                 if (edgeInput && Object.keys(edgeInput).length > 0) {
                     // Use bare target var (no label) since target is already bound by MATCH
                     (0, validation_1.assertSafeIdentifier)(relDef.type, 'relationship type');
@@ -727,7 +815,7 @@ class MutationCompiler {
         }
         return lines;
     }
-    buildDisconnects(disconnect, nodeDef, params) {
+    buildDisconnects(disconnect, nodeDef, params, policyContext, paramCounter) {
         const lines = [];
         for (const [fieldName, spec] of Object.entries(disconnect)) {
             const relDef = nodeDef.relationships.get(fieldName);
@@ -766,8 +854,14 @@ class MutationCompiler {
                     });
                     lines.push(`OPTIONAL MATCH ${pattern}`);
                     const conditions = this.buildConnectionWhereConditions(whereSpec, targetVar, `disconnect_${fieldName}_${si}`, params, targetNodeDef);
-                    if (conditions.length > 0)
-                        lines.push(`WHERE ${conditions.join(' AND ')}`);
+                    const policyPredicate = targetNodeDef
+                        ? this.buildTargetPolicyPredicate(targetNodeDef, targetVar, params, policyContext, paramCounter)
+                        : null;
+                    const disconnectConditions = policyPredicate
+                        ? [...conditions, policyPredicate]
+                        : conditions;
+                    if (disconnectConditions.length > 0)
+                        lines.push(`WHERE ${disconnectConditions.join(' AND ')}`);
                     lines.push(`DELETE ${relVar}`);
                 }
             }
@@ -779,7 +873,7 @@ class MutationCompiler {
      * Each member key in the input is recursed into buildUpdateRelationships
      * with a narrowed relDef pointing at the concrete member type.
      */
-    dispatchUnionUpdateOps(key, memberEntries, relDef, nodeDef, sourceVar, prefix, params, depth, ancestorVars) {
+    dispatchUnionUpdateOps(key, memberEntries, relDef, nodeDef, sourceVar, prefix, params, depth, ancestorVars, policyContext, paramCounter) {
         const unionMembers = this.schema.unions.get(relDef.target);
         const lines = [];
         for (const [memberKey, memberValue] of Object.entries(memberEntries)) {
@@ -799,7 +893,7 @@ class MutationCompiler {
                 ...nodeDef,
                 relationships: new Map([[key, memberRelDef]]),
             };
-            lines.push(...this.buildUpdateRelationships({ [key]: memberItems }, memberNodeDef2, sourceVar, `${prefix}_${key}_${memberKey}`, params, depth + 1, ancestorVars));
+            lines.push(...this.buildUpdateRelationships({ [key]: memberItems }, memberNodeDef2, sourceVar, `${prefix}_${key}_${memberKey}`, params, depth + 1, ancestorVars, policyContext, paramCounter));
         }
         return lines;
     }
@@ -807,7 +901,7 @@ class MutationCompiler {
      * Process nested relationship operations within an update input.
      * Handles: create, connect, disconnect, update, and arrays of these.
      */
-    buildUpdateRelationships(update, nodeDef, sourceVar, prefix, params, depth = 0, ancestorVars = []) {
+    buildUpdateRelationships(update, nodeDef, sourceVar, prefix, params, depth = 0, ancestorVars = [], policyContext, paramCounter) {
         if (depth > 5)
             throw new errors_1.OGMError(`[neo4j-ogm] buildUpdateRelationships: max nesting depth (5) exceeded for prefix "${prefix}". ` +
                 'Nested relationship mutations beyond depth 5 are not supported.');
@@ -824,7 +918,7 @@ class MutationCompiler {
             const isUnionTarget = !this.schema.nodes.has(relDef.target) &&
                 this.schema.unions?.has(relDef.target);
             if (isUnionTarget) {
-                lines.push(...this.dispatchUnionUpdateOps(key, value, relDef, nodeDef, sourceVar, prefix, params, depth, ancestorVars));
+                lines.push(...this.dispatchUnionUpdateOps(key, value, relDef, nodeDef, sourceVar, prefix, params, depth, ancestorVars, policyContext, paramCounter));
                 continue;
             }
             const targetNodeDef = this.schema.nodes.get(relDef.target);
@@ -894,7 +988,7 @@ class MutationCompiler {
                         varCounter++;
                         const { propString, propParams } = this.buildCreateProperties(nodeSpec, targetNodeDef, `${itemPrefix}_create${ci}`);
                         // Handle nested relationship creates within the created node
-                        const nestedRelLines = this.buildCreateRelationships(nodeSpec, targetNodeDef, createVar, `${itemPrefix}_create${ci}`, params, allVars);
+                        const nestedRelLines = this.buildCreateRelationships(nodeSpec, targetNodeDef, createVar, `${itemPrefix}_create${ci}`, params, allVars, policyContext, paramCounter);
                         const propsClause = propString.length > 0
                             ? ` { ${propString} }`
                             : ` { ${this.buildGeneratedIdClause(targetNodeDef)} }`;
@@ -963,8 +1057,12 @@ class MutationCompiler {
                             // path (`buildDisconnects`). Restores backwards-compat with
                             // @neo4j/graphql-ogm's nested update.disconnect[].where shape.
                             const conditions = this.buildConnectionWhereConditions(whereSpec, discTarget, `${itemPrefix}_disc_${di}`, params, targetNodeDef);
-                            if (conditions.length > 0)
-                                lines.push(`WHERE ${conditions.join(' AND ')}`);
+                            const policyPredicate = this.buildTargetPolicyPredicate(targetNodeDef, discTarget, params, policyContext, paramCounter);
+                            const nestedDiscConditions = policyPredicate
+                                ? [...conditions, policyPredicate]
+                                : conditions;
+                            if (nestedDiscConditions.length > 0)
+                                lines.push(`WHERE ${nestedDiscConditions.join(' AND ')}`);
                             lines.push(`DELETE ${relVar}`);
                         }
                     }
@@ -993,8 +1091,12 @@ class MutationCompiler {
                         // top-level paths. Empty/undefined `whereSpec` short-circuits
                         // to `[]` inside the helper, so the no-where case still works.
                         const conditions = this.buildConnectionWhereConditions(whereSpec, connectVar, `${itemPrefix}_conn${ci}`, params, targetNodeDef);
-                        if (conditions.length > 0)
-                            lines.push(`WHERE ${conditions.join(' AND ')}`);
+                        const policyPredicate = this.buildTargetPolicyPredicate(targetNodeDef, connectVar, params, policyContext, paramCounter);
+                        const nestedConnConditions = policyPredicate
+                            ? [...conditions, policyPredicate]
+                            : conditions;
+                        if (nestedConnConditions.length > 0)
+                            lines.push(`WHERE ${nestedConnConditions.join(' AND ')}`);
                         if (edgeInput && Object.keys(edgeInput).length > 0) {
                             // Use bare target var (no label) since connectVar is already bound by MATCH
                             const relVar = `r_conn_${key}_${ci}`;
@@ -1065,7 +1167,7 @@ class MutationCompiler {
                         }
                     // Pre-compute nested relationship operations
                     const nestedParams = {};
-                    const nestedRelLines = this.buildUpdateRelationships(nodeUpdate, targetNodeDef, updateVar, itemPrefix, nestedParams, depth + 1, allVars);
+                    const nestedRelLines = this.buildUpdateRelationships(nodeUpdate, targetNodeDef, updateVar, itemPrefix, nestedParams, depth + 1, allVars, policyContext, paramCounter);
                     // Only emit the MATCH block if there's actual work to do
                     const hasWork = setClauses.length > 0 ||
                         edgeClauses.length > 0 ||