grafeo-ogm 1.8.3 → 1.8.5

package/CHANGELOG.md

@@ -1,5 +1,188 @@
 # Changelog
 
+## 1.8.5 (2026-05-07) — 🚨 SECURITY ADVISORY
+
+> **CRITICAL.** When a query traversed a relationship in a WHERE filter (`_SOME` / `_NONE` / `_ALL` / `_SINGLE` / `*Connection*` / union-typed relationships), the target type's NLS `'read'` policy was NOT applied inside the `EXISTS` body. A kill-switched org with a leaked target-type ID could use `where: { contentRel_SOME: { id: 'leakedId' } }` as a confirmation oracle / IDOR vector — even when its source-type policy correctly denied direct reads of the target type. **Upgrade immediately if you use NLS policies on target types reachable via relationship filters.**
+
+### Affected versions
+
+`1.7.0` through `1.8.4` (all NLS-enabled releases prior to 1.8.5).
+
+### Severity
+
+**CRITICAL** — survived the v1.7.0 NLS audit, the v1.8.0 perf audit, and the v1.8.2 default-deny security fix. Identified by external reviewers running mutation-style analysis on a downstream service.
+
+### Impact
+
+`WhereCompiler.tryCompileRelationship`, `compileUnionRelationship`, and `tryCompileConnection`/`compileConnectionWhereInput` recursed into target types via `compileConditions(...)` directly — there was no path for the target's `'read'` policy to AND-stitch into the EXISTS body. `SelectionCompiler.compileNestedWhere` already had the correct pattern (re-resolve `targetPolicy` via `policyContext.resolveForType(targetTypeName, 'read')` and inject a synthesized bundle); WhereCompiler did not.
+
+`InterfaceModel.find()` and `aggregate()` had a related gap — they never passed `policyContext` to `whereCompiler.compile()` at all, so even with the source-side fix, user-where relationship traversals on interface entry points still bypassed target-side policy.
+
+### Reproducer
+
+```ts
+// User has a permissive NLS policy that grants 'read' iff !ctx.killed.
+ogm.policies.register('Content', {
+  permissive: [{
+    operations: ['read'],
+    appliesWhen: (ctx) => !ctx.killed,
+    when: () => ({}),
+  }],
+});
+
+// Attacker's ctx has killed = true. Direct reads correctly return [].
+await ogm.withContext({ killed: true })
+  .model('Content')
+  .findUnique({ where: { id: 'leaked' } });
+//   Pre/Post-1.8.5: WHERE false → []  ✅
+
+// Pre-1.8.5 IDOR: traverse via a relationship.
+await ogm.withContext({ killed: true, userId: 'attacker' })
+  .model('User')
+  .find({ where: { contentRel_SOME: { id: 'leaked' } } });
+//   Pre-1.8.5 cypher:
+//     MATCH (n:User)
+//     WHERE EXISTS { MATCH (n)-[:HAS_CONTENT]->(r0:Content) WHERE r0.id = $param0 }
+//     RETURN n
+//   The User-side policy fires, but Content's appliesWhen never runs.
+//   If the attacker has any User row at all (own profile), the EXISTS
+//   acts as a confirmation oracle: row exists ↔ leaked Content ID
+//   exists in the graph + linked to the attacker's user.
+//
+// Post-1.8.5 cypher:
+//     MATCH (n:User)
+//     WHERE EXISTS { MATCH (n)-[:HAS_CONTENT]->(r0:Content)
+//                    WHERE (r0.id = $param0) AND false }
+//     RETURN n
+//   Content's appliesWhen runs → permissives.length > 0 but all abstain
+//   → permClause = 'false' → EXISTS can never match → IDOR closed.
+```
+
+### Root cause
+
+`WhereCompiler.tryCompileRelationship` (line 856 pre-fix) and the union/connection variants recursed via:
+
+```ts
+const innerResult = this.compileConditions(value, relVar, targetNodeDef, ...);
+// ❌ No policyContext threaded — target policy never AND-stitched
+```
+
+The correct pattern, already present in `SelectionCompiler.compileNestedWhere` (selection.compiler.ts:826-847), is:
+
+```ts
+const targetPolicy = policyContext?.resolveForType(targetDef.typeName, 'read');
+const targetBundle = targetPolicy ? { ctx, operation: 'read', resolved: targetPolicy, ... } : undefined;
+const compiled = this.whereCompiler.compile(value, childVar, targetDef, ..., { policyContext: targetBundle });
+// ✅ result.cypher = (user filter) AND (target policy) AND-stitched
+```
+
+The fix mirrors this pattern at every WHERE-side relationship-traversal entry point.
+
+### Fix
+
+5 surfaces closed:
+
+- `src/compilers/where.compiler.ts` — `tryCompileRelationship` (`_SOME` / `_NONE` / `_NOT` / `_ALL` / `_SINGLE` quantifiers + bare-relationship shorthand): now builds `targetBundle = buildTargetBundle(targetNodeDef.typeName, policyContext)` and re-enters `this.compile()` with the bundle. Inner result already AND-stitches user + policy; the EXISTS template substitutes it.
+- `src/compilers/where.compiler.ts` — `compileUnionRelationship`: same pattern per union member, so each branch enforces ITS OWN target policy (not the union's).
+- `src/compilers/where.compiler.ts` — `tryCompileConnection` / `compileConnectionWhereInput`: `node` and `node_NOT` keys now route through `this.compile()` with target bundle. Recursive `AND` / `OR` / `NOT` paths inside connection-where propagate `policyContext` for any nested node-keys to pick up.
+- `src/compilers/where.compiler.ts` — `_SINGLE` quantifier: distinguishes user-`@cypher` vs policy-`@cypher` errors so authors get a precise message naming the target type when the policy is the blocker.
+- `src/interface-model.ts` — `find()` and `aggregate()` now pass a synthetic `PolicyContextBundle` with `resolved.overridden: true` (no top-level policy clause emit, since CASE-per-label already enforces source-side policy) and live `resolveForType` (so user-where relationship traversals enforce target-side policy via the new WhereCompiler logic).
+
+### What this DOES NOT change
+
+- **No-policy queries** — when no `policyContext` is present, the relationship-traversal code paths short-circuit identically to pre-1.8.5. Byte-identical Cypher emission, byte-identical params, zero overhead.
+- **Source-side policy** — the v1.7.0+ AND-stitch of source-type policy at the top-level `WHERE` is unchanged. `compilePolicyClause` is untouched.
+- **Edge WHERE** — relationship-properties types are NOT registered in the policy registry by design. No NLS on edges. `compileEdgeConditions` is unchanged.
+- **`null` relationship → `NOT EXISTS`** — graph-shape only (no row leakage). Documented as out-of-scope; no change.
+- **Policy-on-policy recursion** — when a policy's own `when()` partial uses `_SOME`, the recursive `compileConditions` calls inside `compilePolicyClause` deliberately do NOT thread `policyContext`. Adding this would create infinite-regress risk requiring cycle detection. Documented as deferred to v1.9.0.
+
+### Tests
+
+New file `tests/policy/where-relationship-traversal.spec.ts` — 7 regression tests using a real `WhereCompiler` instance and a real `PolicyContextBundle` with a real `resolveForType` callback. NO mocks of the WhereCompiler or OGM.
+
+Cases covered:
+1. `_SOME` + permissive on target → asserts target permissive predicate inside EXISTS body
+2. `_NONE` + restrictive on target → asserts restrictive AND-stitched inside `NOT EXISTS { ... }`
+3. `_ALL` + default-deny → asserts target unreachable
+4. `*Connection { node: {...} }` + permissive on target → asserts connection EXISTS body has policy
+5. Union relationship `_SOME: { Image: {...} }` + per-member permissive → policy in `Image` branch only
+6. `_SINGLE` + permissive (stored properties only) → works
+7. `_SINGLE` + policy with `@cypher` field → throws with target-type-named error
+
+Test count: **1381 → 1388** (+7). All 1388 pass.
+
+**Zero existing tests required modification.** The byte-identical regression contract held: when no `policyContext` is passed, every relationship-traversal path emits the same Cypher as pre-1.8.5.
+
+### Compatibility
+
+Public API surface unchanged. Cypher emission changes ONLY for queries with `policyContext` AND a relationship traversal AND a registered `'read'` policy on the target type — exactly the queries that were silently leaking pre-1.8.5.
+
+### Acknowledgement
+
+Discovered by external reviewers performing mutation-style analysis on a downstream service. Reported, scoped via parallel exploration agents, fixed via parallel implementation agents, tested with real-compiler regression tests, and shipped within hours.
+
+### For consumers writing tests against grafeo-ogm
+
+The failure mode that hid CRIT-3 in downstream services was mocking `clientOgm.find()` itself — those tests proved wiring (the service called the OGM with the right ctx) but never proved authorization (the kill-switch policy actually compiled to `WHERE false`). The robust pattern, used throughout grafeo-ogm's own test suite, is to construct a real `OGM` with a mocked `Driver` (capture `cypher` + `params` via `session.run`), let the real WhereCompiler run, and assert on the captured Cypher. See `tests/policy/where-relationship-traversal.spec.ts` for a concrete example. A first-class `TestDriver` API is planned for v1.9.0.
+
+---
+
+## 1.8.4 (2026-05-07)
+
+> **Backwards-compat fix.** `Model` now always auto-emits `__typename` in default projections — matching `@neo4j/graphql-ogm` behaviour. Apollo Client cache normalisation, type-discriminated unions in TS callers, and any consumer that uses `__typename` as a discriminator now get it on every concrete-type read and mutation, not just on union/interface targets.
+
+### What was happening
+
+```ts
+const result = await ogm.model('Book').find({ where: { id: 'b1' } });
+// Pre-1.8.4: { id: 'b1', title: 'Dune', pageCount: 412 }
+// Post-1.8.4: { __typename: 'Book', id: 'b1', title: 'Dune', pageCount: 412 }
+```
+
+Pre-1.8.4, `__typename` was auto-emitted ONLY when the target was abstract (union or interface with implementations) — `selection.compiler.ts:145-158`. Reads of concrete `@node` types (`Book`, `User`, etc.) returned the schema's scalar properties and nothing else. Mutations without explicit selection returned the bare Neo4j Node, which has no `__typename` field at all.
+
+This was a documented behaviour difference from `@neo4j/graphql-ogm` that consumers running Apollo Client / GraphQL pipelines hit immediately:
+
+- Apollo's `InMemoryCache` keys entries by `__typename + id`. Without `__typename` it can't normalise.
+- Discriminated-union pattern matching in TypeScript silently falls into the `default` branch.
+- Test fixtures depending on `__typename === 'Book'` evaluate to `false`.
+
+### Fix
+
+Three call sites in `src/model.ts` now route through the default projection (which includes `__typename`) instead of bailing to a bare `RETURN n`:
+
+- `defaultSelection()` (line 1728) — `__typename` is now the first scalar in the default selection list. `find()`, `findFirst()`, `findUnique()`, `findFirstOrThrow()`, `findUniqueOrThrow()`, `searchByVector()`, and `searchByPhrase()` all inherit this transitively via `resolveSelection()`.
+- `applySelectionSetToMutation()` (line 1770) — when `selectionSet` is undefined (the no-explicit-selection path used by `create()` / `update()` / `delete()` / `setLabels()`), now compiles `defaultSelection()` instead of leaving the bare `RETURN n`.
+- `applySelectionSetToUpsert()` (line 1888) — same fix for `upsert()`.
+
+`SelectionCompiler` already understood `__typename` as a synthetic scalar field (line 164 of `selection.compiler.ts`) — for concrete types it emits the constant string (`__typename: 'Book'`), for unions/interfaces it emits a `head([__label IN labels(n) WHERE __label IN [...]])` expression. The fix is purely a default-selection change; no compiler logic changed.
+
+### What this DOES NOT change
+
+- **Explicit `select` / `selectionSet`** — callers who specify their own projection get exactly what they ask for. We do NOT silently inject `__typename` into a user-supplied selection. If you want it, ask for it explicitly: `select: { __typename: true, id: true }`.
+- **InterfaceModel** — already emitted `__typename` via CASE-per-label (resolved from `labels(n)`). Unchanged.
+- **Abstract relationship targets** — `Model.find({ select: { authors: { ... } } })` where `authors` points at a union/interface still auto-emits `__typename` in the nested projection, same as pre-1.8.4.
+- **`@cypher` field** projections, `aggregate()`, `count()` — all unchanged.
+
+### Behaviour change risks
+
+Two edge cases for consumers to be aware of:
+
+1. **Wire size** — every entity result now includes a `__typename` field. For a 50-row result this is ~50 × ~13 bytes (`__typename: 'Book'`) = ~650 extra bytes. Negligible for almost all callers.
+2. **Schema-vs-store divergence** — pre-1.8.4 mutations without selection returned the raw Neo4j Node, including any properties stored on the node that are NOT in the GraphQL schema (e.g., legacy fields removed from the SDL but still present in the database). Post-1.8.4 the projection includes only schema-declared fields plus `__typename`. If your code relied on out-of-schema properties leaking through mutation responses, you must either (a) add them to the schema or (b) supply an explicit `selectionSet` that mentions them. Reads via `find()` already had this constraint pre-1.8.4 and behaved identically.
+
+### Tests
+
+- New file `tests/typename-auto-emit.spec.ts` — 11 regression tests covering `find()`, `findFirst()`, `findUnique()`, `create()`, `update()`, `upsert()`, explicit-select preservation, and unchanged InterfaceModel behaviour.
+- One existing test in `tests/policy/model-mutation.spec.ts:305` was updated — it asserted "policy bypass means cypher must NOT contain `ownerId`" via a bare substring match. With the new projection emitting `.\`ownerId\``, the test now asserts the policy's WHERE-clause shape (`n.\`ownerId\` = $...`) is absent, which was the test's actual intent.
+- Test count: **1370 → 1381** (+11). All pass.
+
+### Compatibility
+
+Public API surface unchanged. The Cypher emit changes for `find()`-family and mutation calls that did NOT pass an explicit `select` / `selectionSet`. Result shape gains a single `__typename` field; existing fields remain. This is the third backwards-compat fix in the v1.8.x series (after v1.8.1 connection-shape WHERE in nested disconnect/connect and v1.8.2 NLS permissive abstain default-deny).
+
+---
+
 ## 1.8.3 (2026-05-06)
 
 > **Bugfix.** `ogm.model('SomeInterface')` no longer silently returns an `InterfaceModel` — it now throws an `OGMError` immediately, naming the correct API. Pre-1.8.3 this returned an `InterfaceModel` cast to `any`, and the first mutation call (`.create()`, `.update()`, `.delete()`, `.upsert()`, `.setLabels()`) failed with `TypeError: this.create is not a function`.

package/dist/cjs/compilers/where.compiler.d.ts

@@ -70,6 +70,21 @@ export declare class WhereCompiler {
      * to guarantee no collision with `param0..N`.
      */
     private compilePolicyClause;
+    /**
+     * Build a `PolicyContextBundle` for a target type when crossing a
+     * node-type boundary inside a relationship traversal (`_SOME` /
+     * `_NONE` / `_ALL` / `_SINGLE` / connection-where `node`). Mirrors the
+     * canonical pattern at `selection.compiler.ts:826-847`.
+     *
+     * Returns `undefined` when:
+     *   - the input `policyContext` is `undefined` (caller has no policy state), OR
+     *   - `resolveForType(typeName, 'read')` returns `null` (no policy
+     *     registered for the target type).
+     *
+     * The synthesized bundle reuses the same `resolveForType` so further
+     * nesting (target → target's relationship → ...) keeps cascading.
+     */
+    private buildTargetBundle;
     private compileConditions;
     /**
      * Resolve the Cypher reference for a where-clause field. For stored

package/dist/cjs/compilers/where.compiler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"where.compiler.d.ts","sourceRoot":"","sources":["../../../src/compilers/where.compiler.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EACL,cAAc,EAGd,cAAc,EACf,MAAM,iBAAiB,CAAC;AAezB,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAqDD,KAAK,cAAc,GAAG,MAAM,CAAC;AA4B7B,MAAM,WAAW,oBAAoB;IACnC,mFAAmF;IACnF,iBAAiB,CAAC,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;IACxC;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;GAEG;AACH,qBAAa,aAAa;IAKtB,OAAO,CAAC,MAAM;IAJhB,OAAO,CAAC,iBAAiB,CAAsB;IAC/C,OAAO,CAAC,WAAW,CAAU;gBAGnB,MAAM,EAAE,cAAc,EAC9B,OAAO,CAAC,EAAE,oBAAoB;IAMhC,OAAO,CACL,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,IAAI,EACjD,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,cAAc,EACvB,YAAY,GAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAiB,EAC9C,OAAO,CAAC,EAAE;QACR;;;;;WAKG;QACH,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QACrC;;;;;;;;;;WAUG;QACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;KACrC,GACA,WAAW;IA2Cd;;;;;;;;OAQG;IACH,OAAO,CAAC,mBAAmB;IA6K3B,OAAO,CAAC,iBAAiB;IA4LzB;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAavB,OAAO,CAAC,oBAAoB;IAyH5B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,2BAA2B;IAqHnC,OAAO,CAAC,sBAAsB;IA2I9B;;;;;OAKG;IACH,OAAO,CAAC,wBAAwB;IAyFhC,OAAO,CAAC,qBAAqB;IA8B7B;;;;;;OAMG;IACH,OAAO,CAAC,sBAAsB;CAmF/B"}
+{"version":3,"file":"where.compiler.d.ts","sourceRoot":"","sources":["../../../src/compilers/where.compiler.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EACL,cAAc,EAGd,cAAc,EACf,MAAM,iBAAiB,CAAC;AAezB,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAqDD,KAAK,cAAc,GAAG,MAAM,CAAC;AA4B7B,MAAM,WAAW,oBAAoB;IACnC,mFAAmF;IACnF,iBAAiB,CAAC,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;IACxC;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;GAEG;AACH,qBAAa,aAAa;IAKtB,OAAO,CAAC,MAAM;IAJhB,OAAO,CAAC,iBAAiB,CAAsB;IAC/C,OAAO,CAAC,WAAW,CAAU;gBAGnB,MAAM,EAAE,cAAc,EAC9B,OAAO,CAAC,EAAE,oBAAoB;IAMhC,OAAO,CACL,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,IAAI,EACjD,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,cAAc,EACvB,YAAY,GAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAiB,EAC9C,OAAO,CAAC,EAAE;QACR;;;;;WAKG;QACH,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QACrC;;;;;;;;;;WAUG;QACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;KACrC,GACA,WAAW;IAoDd;;;;;;;;OAQG;IACH,OAAO,CAAC,mBAAmB;IA6K3B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,iBAAiB;IAgBzB,OAAO,CAAC,iBAAiB;IA2MzB;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAavB,OAAO,CAAC,oBAAoB;IA0I5B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,2BAA2B;IAiKnC,OAAO,CAAC,sBAAsB;IAsK9B;;;;;OAKG;IACH,OAAO,CAAC,wBAAwB;IA8GhC,OAAO,CAAC,qBAAqB;IA8B7B;;;;;;OAMG;IACH,OAAO,CAAC,sBAAsB;CAmF/B"}

package/dist/cjs/compilers/where.compiler.js

@@ -82,7 +82,7 @@ class WhereCompiler {
         // their own scopes and stitch their preludes into the EXISTS body inline.
         const scope = new cypher_field_projection_1.CypherFieldScope(nodeVar, options?.preserveVars ?? [], '__where');
         const userBody = hasUserWhere
-            ? this.compileConditions(where, nodeVar, nodeDef, paramCounter, 0, scope)
+            ? this.compileConditions(where, nodeVar, nodeDef, paramCounter, 0, scope, undefined, policyContext)
             : { cypher: '', params: {} };
         let cypher = userBody.cypher;
         const params = { ...userBody.params };
@@ -236,6 +236,34 @@ class WhereCompiler {
             ? permClause
             : `(${permClause} AND ${restClause})`;
     }
+    /**
+     * Build a `PolicyContextBundle` for a target type when crossing a
+     * node-type boundary inside a relationship traversal (`_SOME` /
+     * `_NONE` / `_ALL` / `_SINGLE` / connection-where `node`). Mirrors the
+     * canonical pattern at `selection.compiler.ts:826-847`.
+     *
+     * Returns `undefined` when:
+     *   - the input `policyContext` is `undefined` (caller has no policy state), OR
+     *   - `resolveForType(typeName, 'read')` returns `null` (no policy
+     *     registered for the target type).
+     *
+     * The synthesized bundle reuses the same `resolveForType` so further
+     * nesting (target → target's relationship → ...) keeps cascading.
+     */
+    buildTargetBundle(typeName, policyContext) {
+        if (!policyContext)
+            return undefined;
+        const targetPolicy = policyContext.resolveForType(typeName, 'read');
+        if (!targetPolicy)
+            return undefined;
+        return {
+            ctx: policyContext.ctx,
+            operation: 'read',
+            resolved: targetPolicy,
+            resolveForType: policyContext.resolveForType,
+            defaults: policyContext.defaults,
+        };
+    }
     compileConditions(where, nodeVar, nodeDef, counter, depth, scope, 
     /**
      * Optional shared params accumulator. When provided, every leaf
@@ -247,7 +275,18 @@ class WhereCompiler {
      * deep recursions write into a single owner object. Public callers
      * keep the old contract (no arg → fresh Map allocated locally).
      */
-    paramsTarget) {
+    paramsTarget, 
+    /**
+     * Policy context to thread through relationship / connection
+     * recursions so target-type `'read'` policies AND-stitch into the
+     * EXISTS body when crossing a node-type boundary. NOT used for
+     * leaf scalar predicates or for AND/OR/NOT logical recursions
+     * within the same node-type scope (those simply forward through).
+     *
+     * v1.8.5 — fixes CRIT-3 (target-policy bypass via `_SOME`/`_NONE`/
+     * `_ALL`/`_SINGLE` and `Connection_*` user-where filters).
+     */
+    policyContext) {
         if (depth > MAX_DEPTH)
             throw new errors_1.OGMError(`WHERE clause nesting depth exceeds maximum (${MAX_DEPTH})`);
         if (where == null)
@@ -277,7 +316,7 @@ class WhereCompiler {
                 // method with paramsTarget undefined at intermediate levels.
                 const subClauses = [];
                 for (const item of items) {
-                    const sub = this.compileConditions(item, nodeVar, nodeDef, counter, depth + 1, scope, params);
+                    const sub = this.compileConditions(item, nodeVar, nodeDef, counter, depth + 1, scope, params, policyContext);
                     if (sub.cypher)
                         subClauses.push(sub.cypher);
                 }
@@ -291,7 +330,7 @@ class WhereCompiler {
                     continue;
                 if (!(0, validation_1.isPlainObject)(value))
                     throw new errors_1.OGMError(`NOT operator requires an object value.`);
-                const sub = this.compileConditions(value, nodeVar, nodeDef, counter, depth + 1, scope, params);
+                const sub = this.compileConditions(value, nodeVar, nodeDef, counter, depth + 1, scope, params, policyContext);
                 if (sub.cypher)
                     clauses.push(`NOT (${sub.cypher})`);
                 continue;
@@ -330,14 +369,14 @@ class WhereCompiler {
                 continue;
             }
             // Connection operators (e.g. hasStatusConnection_SOME)
-            const connResult = this.tryCompileConnection(key, value, nodeVar, nodeDef, counter, depth);
+            const connResult = this.tryCompileConnection(key, value, nodeVar, nodeDef, counter, depth, policyContext);
             if (connResult) {
                 clauses.push(connResult.cypher);
                 (0, validation_1.mergeParams)(params, connResult.params);
                 continue;
             }
             // Relationship operators (e.g. drugs_SOME, drugs_NONE)
-            const relResult = this.tryCompileRelationship(key, value, nodeVar, nodeDef, counter, depth);
+            const relResult = this.tryCompileRelationship(key, value, nodeVar, nodeDef, counter, depth, policyContext);
             if (relResult) {
                 clauses.push(relResult.cypher);
                 (0, validation_1.mergeParams)(params, relResult.params);
@@ -377,7 +416,15 @@ class WhereCompiler {
             return scope.register(fieldName, propDef);
         return `${nodeVar}.${(0, validation_1.escapeIdentifier)(fieldName)}`;
     }
-    tryCompileConnection(key, value, nodeVar, nodeDef, counter, depth) {
+    tryCompileConnection(key, value, nodeVar, nodeDef, counter, depth, 
+    /**
+     * Policy context for target-type enforcement inside the connection's
+     * `node` filter. v1.8.5 — fixes CRIT-3: the target type's `'read'`
+     * policy MUST AND-stitch into the EXISTS body when crossing a node-
+     * type boundary via a connection-where filter. Edges have no NLS by
+     * design, so this never threads into `compileEdgeConditions`.
+     */
+    policyContext) {
         let connSuffix = null;
         let fieldName = '';
         for (const suffix of CONNECTION_SUFFIXES)
@@ -419,16 +466,24 @@ class WhereCompiler {
         const propsDef = relDef.properties
             ? (this.schema.relationshipProperties.get(relDef.properties) ?? null)
             : null;
-        const inner = this.compileConnectionWhereInput(value, relVar, edgeVar, targetNodeDef, propsDef, nodeScope, edgeScope, counter, depth);
+        const inner = this.compileConnectionWhereInput(value, relVar, edgeVar, targetNodeDef, propsDef, nodeScope, edgeScope, counter, depth, policyContext);
         const innerClauses = inner.cypher ? [inner.cypher] : [];
         const innerParams = inner.params;
         // Stitch the inner preludes (CALL { ... } + WITH ...) INSIDE the
         // EXISTS body, between the MATCH pattern and the inner WHERE.
+        //   - `nodeScope.emit()` — preludes from `@cypher` fields registered
+        //     directly on the connection-where input's edge-side scope.
+        //   - `edgeScope.emit()` — same, but edge-side.
+        //   - `inner.preludes` (v1.8.5) — preludes returned by the recursive
+        //     `compile()` calls on the node side, which now own their own
+        //     scopes.
         const innerPreludes = [];
         if (nodeScope.hasAny())
             innerPreludes.push(...nodeScope.emit());
         if (edgeScope.hasAny())
             innerPreludes.push(...edgeScope.emit());
+        if (inner.preludes && inner.preludes.length > 0)
+            innerPreludes.push(...inner.preludes);
         const preludeFragment = innerPreludes.length
             ? ` ${innerPreludes.join(' ')}`
             : '';
@@ -477,14 +532,43 @@ class WhereCompiler {
      * constrain the same `(relVar, edgeVar)` pair. This matches the codegen
      * shape declared in `connection-emitter.ts`.
      */
-    compileConnectionWhereInput(value, relVar, edgeVar, targetNodeDef, propsDef, nodeScope, edgeScope, counter, depth) {
+    compileConnectionWhereInput(value, relVar, edgeVar, targetNodeDef, propsDef, nodeScope, edgeScope, counter, depth, 
+    /**
+     * Policy context to thread into target-side `node` / `node_NOT`
+     * filters AND through nested AND/OR/NOT logical groups. Edge-side
+     * compilation never receives this — edges have no NLS by design.
+     * v1.8.5 — fixes CRIT-3.
+     */
+    policyContext) {
         const innerClauses = [];
         const innerParams = {};
+        /**
+         * Preludes returned by recursive `compile()` calls on the node side.
+         * Pre-1.8.5 the node-side scope was shared via `nodeScope`; now the
+         * inner `compile()` owns its own scope and we hoist its preludes back
+         * out so the caller (`tryCompileConnection`) can stitch them between
+         * `MATCH ${pattern}` and `WHERE ...` inside the EXISTS body.
+         */
+        const extraPreludes = [];
+        // Resolve the target type's `'read'` policy ONCE per connection-where
+        // input. The same bundle is reused across every `node` / `node_NOT`
+        // key we encounter at this level (and across nested AND/OR/NOT
+        // groups via direct policyContext threading).
+        const targetBundle = this.buildTargetBundle(targetNodeDef.typeName, policyContext);
         for (const [key, val] of Object.entries(value)) {
             if (val === undefined)
                 continue;
             if (key === 'node' || key === 'node_NOT') {
-                const nodeResult = this.compileConditions(val, relVar, targetNodeDef, counter, depth + 1, nodeScope);
+                // Re-enter the top-level `compile()` so that the target type's
+                // `'read'` policy AND-stitches into the same body that the user
+                // filter produces. `compile()` manages its own inner scope and
+                // returns any preludes via `WhereResult.preludes`; we hoist
+                // those into `extraPreludes` so the surrounding `tryCompileConnection`
+                // can stitch them inside the EXISTS body alongside the existing
+                // `nodeScope.emit()` content.
+                const nodeResult = this.compile(val, relVar, targetNodeDef, counter, targetBundle ? { policyContext: targetBundle } : undefined);
+                if (nodeResult.preludes && nodeResult.preludes.length > 0)
+                    extraPreludes.push(...nodeResult.preludes);
                 if (nodeResult.cypher) {
                     innerClauses.push(key === 'node_NOT'
                         ? `NOT (${nodeResult.cypher})`
@@ -508,34 +592,50 @@ class WhereCompiler {
                 if (items.length > MAX_LOGICAL_ARRAY_LENGTH)
                     throw new errors_1.OGMError(`${key} array length ${items.length} exceeds the maximum of ${MAX_LOGICAL_ARRAY_LENGTH}. ` +
                         `Restructure the predicate instead of passing a large logical array inside a connection where.`);
-                const subResults = items.map((item) => this.compileConnectionWhereInput(item, relVar, edgeVar, targetNodeDef, propsDef, nodeScope, edgeScope, counter, depth + 1));
+                // Thread `policyContext` through so deeply-nested connection-
+                // where keeps target-policy enforcement.
+                const subResults = items.map((item) => this.compileConnectionWhereInput(item, relVar, edgeVar, targetNodeDef, propsDef, nodeScope, edgeScope, counter, depth + 1, policyContext));
                 const subClauses = subResults.map((r) => r.cypher).filter(Boolean);
                 if (subClauses.length > 0) {
                     innerClauses.push(`(${subClauses.join(` ${key} `)})`);
-                    for (const r of subResults)
+                    for (const r of subResults) {
                         (0, validation_1.mergeParams)(innerParams, r.params);
+                        if (r.preludes && r.preludes.length > 0)
+                            extraPreludes.push(...r.preludes);
+                    }
                 }
                 continue;
             }
             if (key === 'NOT') {
                 if (!(0, validation_1.isPlainObject)(val))
                     throw new errors_1.OGMError(`NOT operator inside a connection where requires an object value.`);
-                const sub = this.compileConnectionWhereInput(val, relVar, edgeVar, targetNodeDef, propsDef, nodeScope, edgeScope, counter, depth + 1);
+                const sub = this.compileConnectionWhereInput(val, relVar, edgeVar, targetNodeDef, propsDef, nodeScope, edgeScope, counter, depth + 1, policyContext);
                 if (sub.cypher) {
                     innerClauses.push(`NOT (${sub.cypher})`);
                     (0, validation_1.mergeParams)(innerParams, sub.params);
                 }
+                if (sub.preludes && sub.preludes.length > 0)
+                    extraPreludes.push(...sub.preludes);
                 continue;
             }
             // Unknown key — silently ignore to remain forward-compatible with
             // future codegen additions.
         }
-        return {
+        const result = {
             cypher: innerClauses.join(' AND '),
             params: innerParams,
         };
+        if (extraPreludes.length > 0)
+            result.preludes = extraPreludes;
+        return result;
     }
-    tryCompileRelationship(key, value, nodeVar, nodeDef, counter, depth) {
+    tryCompileRelationship(key, value, nodeVar, nodeDef, counter, depth, 
+    /**
+     * Policy context to thread into the target type when crossing the
+     * relationship boundary. v1.8.5 — fixes CRIT-3 (target-policy bypass
+     * via `_SOME`/`_NONE`/`_ALL`/`_SINGLE` user-where filters).
+     */
+    policyContext) {
         let suffix = null;
         let fieldName = key;
         for (const s of RELATIONSHIP_SUFFIXES)
@@ -562,7 +662,7 @@ class WhereCompiler {
         const isUnionTarget = !this.schema.nodes.has(relDef.target) &&
             this.schema.unions?.has(relDef.target);
         if (isUnionTarget)
-            return this.compileUnionRelationship(suffix, value, nodeVar, relDef, counter, depth);
+            return this.compileUnionRelationship(suffix, value, nodeVar, relDef, counter, depth, policyContext);
         const targetNodeDef = (0, utils_1.resolveTargetDef)(relDef.target, this.schema);
         if (!targetNodeDef)
             throw new errors_1.OGMError(`Invalid relationship filter: target type for "${fieldName}" is not defined in the schema.`);
@@ -579,12 +679,19 @@ class WhereCompiler {
             // EXISTS never matches concrete-typed nodes.
             schema: this.schema,
         });
-        // Inner scope for any `@cypher` fields referenced inside the inner
-        // WHERE — preludes are stitched into the EXISTS body.
-        const innerScope = new cypher_field_projection_1.CypherFieldScope(relVar, [], '__where');
-        const innerResult = this.compileConditions(value, relVar, targetNodeDef, counter, depth + 1, innerScope);
-        const innerPreludeFragment = innerScope.hasAny()
-            ? ` ${innerScope.emit().join(' ')}`
+        // v1.8.5 — re-resolve the TARGET type's `'read'` policy when crossing
+        // the relationship boundary, mirroring `selection.compiler.ts:826-847`.
+        // Pre-1.8.5 this call site invoked `compileConditions` directly,
+        // skipping policy AND-stitching for the target — CRIT-3.
+        const targetBundle = this.buildTargetBundle(targetNodeDef.typeName, policyContext);
+        // Re-enter the top-level `compile()` so the target's policy clause
+        // (when present) AND-stitches into the same body that the user filter
+        // produces. `compile()` manages its own inner scope and returns any
+        // preludes via `WhereResult.preludes` for stitching inside EXISTS.
+        const innerResult = this.compile(value, relVar, targetNodeDef, counter, targetBundle ? { policyContext: targetBundle } : undefined);
+        const innerPreludes = innerResult.preludes ?? [];
+        const innerPreludeFragment = innerPreludes.length
+            ? ` ${innerPreludes.join(' ')}`
             : '';
         const whereClause = innerResult.cypher
             ? ` WHERE ${innerResult.cypher}`
@@ -617,9 +724,17 @@ class WhereCompiler {
             case '_SINGLE': {
                 // Exactly one relationship satisfies. Pattern comprehensions cannot
                 // contain CALL { ... } subqueries, so reject `@cypher` fields here.
-                if (innerScope.hasAny())
+                // v1.8.5: a `@cypher`-projecting policy on the TARGET type also
+                // produces preludes — distinguish that case so the error message
+                // points at the right cause.
+                if (innerPreludes.length > 0) {
+                    if (targetBundle)
+                        throw new errors_1.OGMError(`Policy on "${targetNodeDef.typeName}" requires @cypher field projection, ` +
+                            `which is not supported inside _SINGLE quantifiers. Refactor the policy ` +
+                            `to use stored properties, or refactor the predicate to _SOME + _NONE.`);
                     throw new errors_1.OGMError(`_SINGLE quantifiers do not support filtering by @cypher fields. ` +
                         `Refactor the predicate to use _SOME + _NONE, or remove the @cypher reference.`);
+                }
                 // Pre-1.7.5 we incremented `counter.count` here a second time
                 // even though no new variable was bound — this branch already
                 // claimed `r${counter.count}` at the top of the function and
@@ -641,10 +756,20 @@ class WhereCompiler {
      * Each member generates a separate EXISTS pattern using the member's labels.
      * Multiple members are combined with OR.
      */
-    compileUnionRelationship(suffix, value, nodeVar, relDef, counter, depth) {
+    compileUnionRelationship(suffix, value, nodeVar, relDef, counter, depth, 
+    /**
+     * Policy context to thread per-member: each union member receives its
+     * OWN target-bundle resolved via `policyContext.resolveForType(memberKey,
+     * 'read')`. Members without a registered policy compile as before (no
+     * extra clause). v1.8.5 — fixes CRIT-3 in the union path.
+     */
+    policyContext) {
         const unionMembers = this.schema.unions.get(relDef.target);
         const memberClauses = [];
         const allParams = {};
+        // depth-only suppression for unused-when-no-policy lint passes; keep
+        // for symmetry with `tryCompileRelationship`.
+        void depth;
         for (const [memberKey, memberValue] of Object.entries(value)) {
             if (!unionMembers.includes(memberKey))
                 throw new errors_1.OGMError(`Invalid union member key "${memberKey}" in WHERE filter. Expected one of: ${unionMembers.join(', ')}.`);
@@ -660,19 +785,25 @@ class WhereCompiler {
                 targetVar: relVar,
                 targetLabelRaw: labelStr,
             });
-            // Compile inner WHERE conditions for this member (if any properties specified)
+            // Per-member target bundle. `null` member-policy → undefined bundle
+            // → no policy stitching for this branch (original behavior).
+            const targetBundle = this.buildTargetBundle(memberDef.typeName, policyContext);
+            // Compile inner WHERE conditions for this member (if any properties
+            // specified). When the member has its own `'read'` policy, we still
+            // re-enter `compile()` so the policy AND-stitches into the EXISTS
+            // body even when `memberValue` is empty/null.
             const memberWhere = memberValue;
+            const hasUserMemberWhere = memberWhere && Object.keys(memberWhere).length > 0;
             let whereClause = '';
             let preludeFragment = '';
-            if (memberWhere && Object.keys(memberWhere).length > 0) {
-                const innerScope = new cypher_field_projection_1.CypherFieldScope(relVar, [], '__where');
-                const innerResult = this.compileConditions(memberWhere, relVar, memberDef, counter, depth + 1, innerScope);
-                if (innerResult.cypher) {
-                    whereClause = ` WHERE ${innerResult.cypher}`;
-                    (0, validation_1.mergeParams)(allParams, innerResult.params);
+            if (hasUserMemberWhere || targetBundle) {
+                const memberCompile = this.compile(hasUserMemberWhere ? memberWhere : undefined, relVar, memberDef, counter, targetBundle ? { policyContext: targetBundle } : undefined);
+                if (memberCompile.cypher) {
+                    whereClause = ` WHERE ${memberCompile.cypher}`;
+                    (0, validation_1.mergeParams)(allParams, memberCompile.params);
                 }
-                if (innerScope.hasAny())
-                    preludeFragment = ` ${innerScope.emit().join(' ')}`;
+                if (memberCompile.preludes && memberCompile.preludes.length > 0)
+                    preludeFragment = ` ${memberCompile.preludes.join(' ')}`;
             }
             memberClauses.push(`EXISTS { MATCH ${pattern}${preludeFragment}${whereClause} }`);
         }