json-rest-api 1.0.25 → 1.0.27

package/docs/API.md

@@ -2052,6 +2052,11 @@ const result = await api.resources.articles.query({
 // GET /articles?fields[articles]=title,summary&fields[users]=name,avatar
 ```
 
+An unknown field raises `RestApiFieldsetError` with the stable code
+`REST_API_FIELDSET_INVALID` and HTTP status `400`. The same error is preserved
+for primary resources and included relationships, so transports can classify it
+without parsing error messages.
+
 ### Including Related Resources
 
 Load related resources in a single request:

package/docs/GUIDE/GUIDE_X_Row_Policies.md

@@ -204,6 +204,8 @@ column('id', { scopeName: 'users', alias: 'visible_users' })
 column('status', { alias: null }) // translated but deliberately unqualified
 ```
 
+The active resource's default qualifier and storage adapter are fixed when the policy hook begins. Calling `column()` later from a Knex grouping callback therefore still targets the table or alias of that query, even after the surrounding hook has returned. This applies to normal Knex and AnyAPI queries. A `scopeName` option resolves that target resource through the storage registry; use the explicit `alias` option only when the policy itself introduces another query alias.
+
 `value()` accepts the same `scopeName` option:
 
 ```js

package/index.js

@@ -33,6 +33,7 @@ export { S3Storage } from './plugins/storage/s3-storage.js'
 
 // Error classes for consumers who need them
 export {
+  RestApiFieldsetError,
   RestApiValidationError,
   RestApiResourceError,
   RestApiPayloadError

package/lib/error-context.js

@@ -0,0 +1,21 @@
+import { HookedApiError } from 'hooked-api'
+
+export function isRestApiError (error) {
+  return error instanceof HookedApiError
+}
+
+/**
+ * Add operational context to unexpected failures without erasing typed API
+ * errors that callers and transports need to classify.
+ */
+export function wrapUnexpectedError (error, { message, context } = {}) {
+  if (isRestApiError(error)) {
+    return error
+  }
+
+  const wrappedError = new Error(`${message}: ${error.message}`, {
+    cause: error
+  })
+  wrappedError.context = context
+  return wrappedError
+}

package/lib/rest-api-errors.js

@@ -1,5 +1,7 @@
 import { HookedApiError } from 'hooked-api'
 
+export const REST_API_FIELDSET_ERROR_CODE = 'REST_API_FIELDSET_INVALID'
+
 /**
  * REST API specific error classes that can be mapped to HTTP status codes
  * by the HTTP plugin or other protocol plugins
@@ -90,3 +92,36 @@ export class RestApiPayloadError extends HookedApiError {
     }
   }
 }
+
+/**
+ * Invalid JSON:API sparse fieldset.
+ *
+ * The structured code lets transports distinguish invalid client input from
+ * query or include failures without parsing the human-readable message.
+ */
+export class RestApiFieldsetError extends HookedApiError {
+  constructor ({ field, resourceType } = {}) {
+    super(
+      `Unknown sparse field '${field}' requested for '${resourceType}'`,
+      REST_API_FIELDSET_ERROR_CODE
+    )
+    this.type = 'rest_api_fieldset'
+    this.statusCode = 400
+    this.details = {
+      field,
+      resourceType
+    }
+  }
+
+  toJSON () {
+    return {
+      name: this.name,
+      message: this.message,
+      code: this.code,
+      type: this.type,
+      statusCode: this.statusCode,
+      details: this.details,
+      stack: this.stack
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "json-rest-api",
-  "version": "1.0.25",
+  "version": "1.0.27",
   "main": "index.js",
   "type": "module",
   "scripts": {

package/plugins/core/connectors/lib/transport-http-helpers.js

@@ -1,3 +1,5 @@
+import { REST_API_FIELDSET_ERROR_CODE } from '../../../../lib/rest-api-errors.js'
+
 const JSON_API_WRITE_CONTENT_TYPES = [
   'application/vnd.api+json',
   'application/json'
@@ -63,6 +65,14 @@ export function mapRestApiErrorToHttp (error) {
       detail: issue.message,
       ...(issue.instancePath ? { source: { pointer: issue.instancePath } } : {})
     }))
+  } else if (error.code === REST_API_FIELDSET_ERROR_CODE) {
+    status = 400
+    errors = [{
+      status: '400',
+      code: error.code,
+      title: 'Invalid Sparse Fieldset',
+      detail: error.message
+    }]
   } else if (error.code === 'REST_API_VALIDATION') {
     status = 422
     if (error.details?.violations?.length) {

package/plugins/core/lib/anyapi/query/anyapi-query-adapter.js

@@ -71,14 +71,6 @@ const SELECT_METHODS = new Set(['select', 'columns', 'distinct'])
 
 const AGGREGATE_METHODS = new Set(['count', 'min', 'max', 'sum', 'avg'])
 
-const CALLBACK_FIRST_METHODS = new Set([
-  'where',
-  'andWhere',
-  'orWhere',
-  'having',
-  'orHaving',
-])
-
 const isFunction = (value) => typeof value === 'function'
 const isObject = (value) => value && typeof value === 'object' && !Array.isArray(value)
 
@@ -149,13 +141,6 @@ const translateJoinObject = (adapter, obj) => {
   return result
 }
 
-const maybeWrapCallback = (adapter, callback) => {
-  if (!isFunction(callback)) return callback
-  return function wrappedCallback (...args) {
-    return callback.apply(adapter.proxy, args)
-  }
-}
-
 const isRaw = (value) => Boolean(value && typeof value === 'object' && typeof value.toSQL === 'function' && value.toSQL().method)
 
 const ensureArray = (value) => (Array.isArray(value) ? value : [value])
@@ -317,12 +302,39 @@ export class AnyapiQueryAdapter {
     this.aliasActualNames.set(alias, alias)
   }
 
-  #translateWhereArgs (method, args) {
+  #wrapQueryCallback (callback) {
+    if (!isFunction(callback)) return callback
+    const adapter = this
+
+    return function wrappedCallback (...args) {
+      const callbackTarget = this
+      const callbackProxy = adapter.#createProxy(callbackTarget)
+      const callbackArgs = args.map((arg) => arg === callbackTarget ? callbackProxy : arg)
+      return callback.apply(callbackProxy, callbackArgs)
+    }
+  }
+
+  #wrapJoinCallback (callback) {
+    if (!isFunction(callback)) return callback
+    const adapter = this
+
+    return function wrappedCallback (...args) {
+      const callbackTarget = this
+      const callbackProxy = adapter.#createJoinProxy(callbackTarget)
+      const callbackArgs = args.map((arg) => arg === callbackTarget ? callbackProxy : arg)
+      return callback.apply(callbackProxy, callbackArgs)
+    }
+  }
+
+  #translateWhereArgs (args, { joinClause = false } = {}) {
     if (args.length === 0) return args
     const [first, ...rest] = args
 
     if (isFunction(first)) {
-      return [maybeWrapCallback(this, first), ...rest]
+      const wrappedGroup = joinClause
+        ? this.#wrapJoinCallback(first)
+        : this.#wrapQueryCallback(first)
+      return [wrappedGroup, ...rest]
     }
 
     if (isObject(first) && !isRaw(first)) {
@@ -337,7 +349,7 @@ export class AnyapiQueryAdapter {
 
     if (rest.length > 0 && isFunction(rest[rest.length - 1])) {
       const newRest = [...rest]
-      newRest[newRest.length - 1] = maybeWrapCallback(this, rest[rest.length - 1])
+      newRest[newRest.length - 1] = this.#wrapQueryCallback(rest[rest.length - 1])
       return [translatedFirst, ...newRest]
     }
 
@@ -350,7 +362,7 @@ export class AnyapiQueryAdapter {
     const translatedColumn = this.translateColumn(column)
 
     if (isFunction(values)) {
-      return [translatedColumn, maybeWrapCallback(this, values), ...rest]
+      return [translatedColumn, this.#wrapQueryCallback(values), ...rest]
     }
 
     return [translatedColumn, values, ...rest]
@@ -439,7 +451,7 @@ export class AnyapiQueryAdapter {
     const [first, ...rest] = args
 
     if (isFunction(first)) {
-      return [maybeWrapCallback(this, first), ...rest]
+      return [this.#wrapJoinCallback(first), ...rest]
     }
 
     if (isObject(first) && !isRaw(first)) {
@@ -454,7 +466,7 @@ export class AnyapiQueryAdapter {
 
     const translatedRest = rest.map((value, index) => {
       if (isFunction(value)) {
-        return maybeWrapCallback(this, value)
+        return this.#wrapJoinCallback(value)
       }
       if (typeof value !== 'string') {
         return value
@@ -475,7 +487,7 @@ export class AnyapiQueryAdapter {
     const translatedColumn = typeof column === 'string' ? this.translateColumn(column) : column
 
     if (isFunction(values)) {
-      return [translatedColumn, maybeWrapCallback(this, values), ...rest]
+      return [translatedColumn, this.#wrapQueryCallback(values), ...rest]
     }
 
     return [translatedColumn, values, ...rest]
@@ -510,7 +522,7 @@ export class AnyapiQueryAdapter {
           let translatedArgs = args
 
           if (WHERE_METHODS.has(prop)) {
-            translatedArgs = adapter.#translateWhereArgs(prop, args)
+            translatedArgs = adapter.#translateWhereArgs(args, { joinClause: true })
           } else if (WHERE_IN_METHODS.has(prop)) {
             translatedArgs = adapter.#translateWhereInArgs(args)
           } else if (BETWEEN_METHODS.has(prop)) {
@@ -607,7 +619,7 @@ export class AnyapiQueryAdapter {
           let translatedArgs = args
 
           if (WHERE_METHODS.has(prop)) {
-            translatedArgs = adapter.#translateWhereArgs(prop, args)
+            translatedArgs = adapter.#translateWhereArgs(args)
           } else if (WHERE_IN_METHODS.has(prop)) {
             translatedArgs = adapter.#translateWhereInArgs(args)
           } else if (BETWEEN_METHODS.has(prop)) {
@@ -630,8 +642,6 @@ export class AnyapiQueryAdapter {
             translatedArgs = adapter.#translateSelectArgs(args)
           } else if (AGGREGATE_METHODS.has(prop)) {
             translatedArgs = adapter.#translateAggregateArgs(args)
-          } else if (CALLBACK_FIRST_METHODS.has(prop) && args.length && isFunction(args[0])) {
-            translatedArgs = [maybeWrapCallback(adapter, args[0]), ...args.slice(1)]
           }
 
           const result = value.apply(target, translatedArgs)

package/plugins/core/lib/querying/knex-process-includes.js

@@ -1,4 +1,5 @@
 import { buildIncludedResources } from './knex-relationship-includes.js'
+import { isRestApiError, wrapUnexpectedError } from '../../../../lib/error-context.js'
 
 /**
  * Processes the ?include= parameter to load related resources efficiently
@@ -143,6 +144,8 @@ export const processIncludes = async (scope, records, deps) => {
 
     return includeResult.included
   } catch (error) {
+    if (isRestApiError(error)) throw error
+
     const { log, context } = deps || {}
 
     if (log) {
@@ -157,10 +160,13 @@ export const processIncludes = async (scope, records, deps) => {
       console.error('[PROCESS-INCLUDES] Error processing includes:', error)
     }
 
-    const enhancedError = new Error(
-      `Failed to process includes${context?.scopeName ? ` for scope '${context.scopeName}'` : ''}: ${error.message}`
-    )
-    enhancedError.originalError = error
-    throw enhancedError
+    throw wrapUnexpectedError(error, {
+      message: `Failed to process includes${context?.scopeName ? ` for scope '${context.scopeName}'` : ''}`,
+      context: {
+        scopeName: context?.scopeName,
+        includeParam: context?.queryParams?.include,
+        recordCount: records?.length || 0
+      }
+    })
   }
 }

package/plugins/core/lib/querying/knex-relationship-includes.js

@@ -84,6 +84,7 @@ import {
 import { unwrapQueryBuilderState } from './query-builder-utils.js'
 import { RELATIONSHIPS_KEY, RELATIONSHIP_METADATA_KEY, ROW_NUMBER_KEY, COMPUTED_DEPENDENCIES_KEY, DEFAULT_QUERY_LIMIT } from '../querying-writing/knex-constants.js'
 import { RestApiResourceError } from '../../../../lib/rest-api-errors.js'
+import { isRestApiError, wrapUnexpectedError } from '../../../../lib/error-context.js'
 import {
   getFieldValue as getStorageFieldValue,
   getIdColumn as getStorageIdColumn,
@@ -415,14 +416,18 @@ const loadRelationshipMetadata = async (scopes, records, scopeName) => {
       }
     })
   } catch (error) {
-    // Log error with context and re-throw
+    if (isRestApiError(error)) throw error
+
     const errorContext = {
       scopeName,
       recordCount: records?.length || 0,
       error: error.message
     }
     console.error('[loadRelationshipMetadata] Error loading relationship metadata:', errorContext)
-    throw new Error(`Failed to load relationship metadata for scope '${scopeName}': ${error.message}`)
+    throw wrapUnexpectedError(error, {
+      message: `Failed to load relationship metadata for scope '${scopeName}'`,
+      context: errorContext
+    })
   }
 }
 
@@ -626,6 +631,8 @@ export const loadBelongsTo = async (scope, deps) => {
       }
     }
   } catch (error) {
+    if (isRestApiError(error)) throw error
+
     // Log error with detailed context
     log.error('[INCLUDE] Error loading belongsTo relationship:', {
       fieldName,
@@ -636,13 +643,10 @@ export const loadBelongsTo = async (scope, deps) => {
       stack: error.stack
     })
 
-    // Re-throw with enhanced error message
-    const enhancedError = new Error(
-      `Failed to load belongsTo relationship '${includeName}' for field '${fieldName}': ${error.message}`
-    )
-    enhancedError.originalError = error
-    enhancedError.context = { fieldName, includeName, targetScope: fieldDef.belongsTo }
-    throw enhancedError
+    throw wrapUnexpectedError(error, {
+      message: `Failed to load belongsTo relationship '${includeName}' for field '${fieldName}'`,
+      context: { fieldName, includeName, targetScope: fieldDef.belongsTo }
+    })
   }
 }
 
@@ -1159,6 +1163,8 @@ export const loadHasMany = async (scope, deps) => {
       }
     }
   } catch (error) {
+    if (isRestApiError(error)) throw error
+
     // Log error with detailed context
     log.error('[INCLUDE] Error loading hasMany relationship:', {
       scopeName,
@@ -1169,13 +1175,10 @@ export const loadHasMany = async (scope, deps) => {
       stack: error.stack
     })
 
-    // Re-throw with enhanced error message
-    const enhancedError = new Error(
-      `Failed to load hasMany relationship '${includeName}' for scope '${scopeName}': ${error.message}`
-    )
-    enhancedError.originalError = error
-    enhancedError.context = { scopeName, includeName, hasThrough: !!relDef.through }
-    throw enhancedError
+    throw wrapUnexpectedError(error, {
+      message: `Failed to load hasMany relationship '${includeName}' for scope '${scopeName}'`,
+      context: { scopeName, includeName, hasThrough: !!relDef.through }
+    })
   }
 }
 
@@ -1539,6 +1542,8 @@ export const loadPolymorphicBelongsTo = async (scope, deps) => {
       }
     })
   } catch (error) {
+    if (isRestApiError(error)) throw error
+
     // Log error with detailed context
     log.error('[INCLUDE] Error loading polymorphic belongsTo relationship:', {
       relName,
@@ -1548,13 +1553,10 @@ export const loadPolymorphicBelongsTo = async (scope, deps) => {
       stack: error.stack
     })
 
-    // Re-throw with enhanced error message
-    const enhancedError = new Error(
-      `Failed to load polymorphic belongsTo relationship '${relName}': ${error.message}`
-    )
-    enhancedError.originalError = error
-    enhancedError.context = { relName, types: relDef?.belongsToPolymorphic?.types }
-    throw enhancedError
+    throw wrapUnexpectedError(error, {
+      message: `Failed to load polymorphic belongsTo relationship '${relName}'`,
+      context: { relName, types: relDef?.belongsToPolymorphic?.types }
+    })
   }
 }
 
@@ -1759,6 +1761,8 @@ export const loadReversePolymorphic = async (scope, deps) => {
       }
     }
   } catch (error) {
+    if (isRestApiError(error)) throw error
+
     // Log error with detailed context
     log.error('[INCLUDE] Error loading reverse polymorphic relationship:', {
       scopeName,
@@ -1770,13 +1774,10 @@ export const loadReversePolymorphic = async (scope, deps) => {
       stack: error.stack
     })
 
-    // Re-throw with enhanced error message
-    const enhancedError = new Error(
-      `Failed to load reverse polymorphic relationship '${includeName}' via '${relDef?.via}' for scope '${scopeName}': ${error.message}`
-    )
-    enhancedError.originalError = error
-    enhancedError.context = { scopeName, includeName, via: relDef?.via, targetScope: relDef?.target }
-    throw enhancedError
+    throw wrapUnexpectedError(error, {
+      message: `Failed to load reverse polymorphic relationship '${includeName}' via '${relDef?.via}' for scope '${scopeName}'`,
+      context: { scopeName, includeName, via: relDef?.via, targetScope: relDef?.target }
+    })
   }
 }
 
@@ -1897,6 +1898,8 @@ export const processIncludes = async (scope, deps) => {
           }
         }
       } catch (includeError) {
+        if (isRestApiError(includeError)) throw includeError
+
         // Log specific include error and continue with other includes
         log.error('[INCLUDE] Error processing include:', {
           scopeName,
@@ -1918,6 +1921,8 @@ export const processIncludes = async (scope, deps) => {
       }
     }
   } catch (error) {
+    if (isRestApiError(error)) throw error
+
     // Log error with full context
     log.error('[INCLUDE] Error in processIncludes:', {
       scopeName,
@@ -2019,6 +2024,8 @@ export const buildIncludedResources = async (scope, deps) => {
       recordsWithRelationships: records
     }
   } catch (error) {
+    if (isRestApiError(error)) throw error
+
     // Log comprehensive error information
     log.error('[INCLUDE] Failed to build included resources:', {
       scopeName,
@@ -2028,15 +2035,14 @@ export const buildIncludedResources = async (scope, deps) => {
       stack: error.stack
     })
 
-    // Re-throw with additional context
-    const enhancedError = new Error(`Failed to build included resources for scope '${scopeName}': ${error.message}`)
-    enhancedError.originalError = error
-    enhancedError.context = {
-      scopeName,
-      includeParam,
-      recordCount: records?.length || 0
-    }
-    throw enhancedError
+    throw wrapUnexpectedError(error, {
+      message: `Failed to build included resources for scope '${scopeName}'`,
+      context: {
+        scopeName,
+        includeParam,
+        recordCount: records?.length || 0
+      }
+    })
   }
 }
 

package/plugins/core/lib/querying/storage-adapter-utils.js

@@ -1,5 +1,9 @@
 export const createStorageAdapterUtilities = (hookParams, { getStorageAdapter } = {}) => {
   const context = hookParams?.context || {}
+  const activeQuery = context.knexQuery || {}
+  const activeScopeName = activeQuery.scopeName
+  const activeTableName = activeQuery.tableName
+  const activeStorageAdapter = activeQuery.storageAdapter || context.storageAdapter
   const storageCache = new Map()
 
   const fetchStorageAdapter = (scopeName) => {
@@ -7,13 +11,9 @@ export const createStorageAdapterUtilities = (hookParams, { getStorageAdapter }
     if (storageCache.has(scopeName)) return storageCache.get(scopeName)
 
     let adapter = null
-    if (scopeName === context?.knexQuery?.scopeName) {
-      adapter = context.storageAdapter ||
-        context.knexQuery?.storageAdapter ||
+    if (scopeName === activeScopeName) {
+      adapter = activeStorageAdapter ||
         (typeof getStorageAdapter === 'function' ? getStorageAdapter(scopeName) : null)
-      if (adapter && !context.storageAdapter) {
-        context.storageAdapter = adapter
-      }
     } else {
       adapter = typeof getStorageAdapter === 'function' ? getStorageAdapter(scopeName) : null
     }
@@ -23,8 +23,8 @@ export const createStorageAdapterUtilities = (hookParams, { getStorageAdapter }
   }
 
   const defaultAliasForScope = (scopeName) => {
-    if (scopeName === context?.knexQuery?.scopeName) {
-      return context.knexQuery?.tableName || scopeName
+    if (scopeName === activeScopeName) {
+      return activeTableName || scopeName
     }
     return scopeName
   }

package/plugins/core/lib/querying-writing/knex-field-helpers.js

@@ -1,6 +1,7 @@
 import { buildQuerySelection } from '../querying/knex-query-helpers-base.js'
 import { createSelectTranslator } from '../storage/storage-adapter.js'
 import { buildQueryFieldRuntimes } from './query-field-helpers.js'
+import { RestApiFieldsetError } from '../../../../lib/rest-api-errors.js'
 
 /**
  * Checks if a field exists only in code, not in the database
@@ -211,7 +212,12 @@ export const buildFieldSelection = async (scope, deps) => {
       if (nonDatabaseFields.has(field)) return
 
       const fieldDef = schemaStructure[field]
-      if (!fieldDef) throw new Error(`Unknown sparse field '${field}' requested for '${scopeName}'`)
+      if (!fieldDef) {
+        throw new RestApiFieldsetError({
+          field,
+          resourceType: scopeName
+        })
+      }
 
       if (fieldDef.belongsToPolymorphic) {
         return

package/tests/computed-fields.test.js

@@ -4,6 +4,23 @@ import knexLib from 'knex'
 import { cleanTables } from './helpers/test-utils.js'
 import { storageMode } from './helpers/storage-mode.js'
 import { createComputedFieldsApi } from './fixtures/api-configs.js'
+import {
+  REST_API_FIELDSET_ERROR_CODE,
+  RestApiFieldsetError
+} from '../index.js'
+import { mapRestApiErrorToHttp } from '../plugins/core/connectors/lib/transport-http-helpers.js'
+
+function assertFieldsetError (error, { field, resourceType }) {
+  assert(error instanceof RestApiFieldsetError)
+  assert.equal(error.code, REST_API_FIELDSET_ERROR_CODE)
+  assert.equal(error.statusCode, 400)
+  assert.deepEqual(error.details, { field, resourceType })
+  assert.equal(
+    error.message,
+    `Unknown sparse field '${field}' requested for '${resourceType}'`
+  )
+  return true
+}
 
 // Create Knex instance for tests
 const knex = knexLib({
@@ -365,7 +382,10 @@ describe('Computed Fields and Sparse Fieldsets', () => {
             fields: { products: 'name,unknown_field' }
           }
         }),
-        /Unknown sparse field 'unknown_field'/
+        (error) => assertFieldsetError(error, {
+          field: 'unknown_field',
+          resourceType: 'products'
+        })
       )
     })
 
@@ -377,9 +397,56 @@ describe('Computed Fields and Sparse Fieldsets', () => {
             fields: { products: 'name,reviews_ids' }
           }
         }),
-        /Unknown sparse field 'reviews_ids'/
+        (error) => assertFieldsetError(error, {
+          field: 'reviews_ids',
+          resourceType: 'products'
+        })
       )
     })
+
+    it('should preserve fieldset errors from empty included relationships', async () => {
+      const productWithoutReviews = await api.resources.products.post({
+        name: 'No Reviews',
+        price: 25,
+        cost: 10
+      })
+
+      await assert.rejects(
+        api.resources.products.get({
+          id: productWithoutReviews.id,
+          queryParams: {
+            include: ['reviews'],
+            fields: {
+              products: 'name',
+              reviews: 'definitelyHidden'
+            }
+          }
+        }),
+        (error) => assertFieldsetError(error, {
+          field: 'definitelyHidden',
+          resourceType: 'reviews'
+        })
+      )
+    })
+
+    it('should map fieldset errors to an HTTP 400 response', () => {
+      const error = new RestApiFieldsetError({
+        field: 'definitelyHidden',
+        resourceType: 'reviews'
+      })
+
+      assert.deepEqual(mapRestApiErrorToHttp(error), {
+        status: 400,
+        body: {
+          errors: [{
+            status: '400',
+            code: REST_API_FIELDSET_ERROR_CODE,
+            title: 'Invalid Sparse Fieldset',
+            detail: "Unknown sparse field 'definitelyHidden' requested for 'reviews'"
+          }]
+        }
+      })
+    })
   })
 
   describe('Async Computed Fields', () => {

package/tests/fixtures/api-configs.js

@@ -1,5 +1,6 @@
 import { Api } from 'hooked-api'
 import {
+  AutoFilterPlugin,
   FileHandlingPlugin,
   QueryProjectionsPlugin,
   RestApiAnyapiKnexPlugin,
@@ -1733,21 +1734,38 @@ export async function createRowPolicyApi (knex, pluginOptions = {}) {
           return false
         }
 
-        query.whereIn(
-          column('access_group'),
-          groups.map((group) => value('access_group', group))
-        )
+        query.where(function visibilityGrants () {
+          this.whereRaw('1 = 0')
+          this.orWhere(function groupVisibilityGrant () {
+            this.whereIn(
+              column('access_group'),
+              groups.map((group) => value('access_group', group))
+            )
+          })
+        })
         return true
       },
       ...(rowPolicyOptions.policies || {})
     }
   })
 
+  await api.use(AutoFilterPlugin, {
+    resolvers: {
+      workspace: ({ context }) => context.scopeValues?.workspaceId
+    },
+    presets: {
+      workspace: {
+        filters: [{ field: 'workspace_id', resolver: 'workspace' }]
+      }
+    }
+  })
+
   await api.addResource('policy_projects', {
     schema: {
       id: { type: 'id' },
       name: { type: 'string', required: true, max: 200 },
-      access_group: { type: 'string', required: true }
+      access_group: { type: 'string', required: true },
+      workspace_id: { type: 'string', required: true }
     },
     relationships: {
       tasks: { type: 'hasMany', target: 'policy_tasks', foreignKey: 'project_id' },
@@ -1759,6 +1777,7 @@ export async function createRowPolicyApi (knex, pluginOptions = {}) {
         otherKey: 'task_id'
       }
     },
+    autofilter: 'workspace',
     rowPolicy: 'groupVisibility',
     tableName: 'row_policy_projects'
   })
@@ -1770,6 +1789,7 @@ export async function createRowPolicyApi (knex, pluginOptions = {}) {
       id: { type: 'id' },
       title: { type: 'string', required: true, max: 200, search: true },
       access_group: { type: 'string', required: true },
+      workspace_id: { type: 'string', required: true },
       project_id: {
         type: 'number',
         nullable: true,
@@ -1787,6 +1807,7 @@ export async function createRowPolicyApi (knex, pluginOptions = {}) {
         otherKey: 'project_id'
       }
     },
+    autofilter: 'workspace',
     rowPolicy: 'groupVisibility',
     tableName: 'row_policy_tasks'
   })

package/tests/includes.test.js

@@ -2,6 +2,10 @@ import { describe, it, before, beforeEach, after } from 'node:test'
 import assert from 'node:assert/strict'
 import knexLib from 'knex'
 import { createBasicApi, createExtendedApi } from './fixtures/api-configs.js'
+import {
+  REST_API_FIELDSET_ERROR_CODE,
+  RestApiFieldsetError
+} from '../index.js'
 import {
   validateJsonApiStructure,
   resourceIdentifier,
@@ -165,6 +169,51 @@ describe('Include/Sideloading Operations', () => {
       assert(includedTypes.includes('publishers'))
       assert(includedTypes.includes('countries'))
     })
+
+    it('should preserve typed fieldset errors across included relationships', async () => {
+      const requests = [
+        {
+          resource: basicApi.resources.countries,
+          id: testData.country.id,
+          include: 'books',
+          primaryType: 'countries',
+          includedType: 'books'
+        },
+        {
+          resource: basicApi.resources.books,
+          id: testData.book.id,
+          include: 'publisher',
+          primaryType: 'books',
+          includedType: 'publishers'
+        }
+      ]
+
+      for (const request of requests) {
+        await assert.rejects(
+          request.resource.get({
+            id: request.id,
+            queryParams: {
+              include: [request.include],
+              fields: {
+                [request.primaryType]: 'id',
+                [request.includedType]: 'definitelyHidden'
+              }
+            },
+            simplified: false
+          }),
+          (error) => {
+            assert(error instanceof RestApiFieldsetError)
+            assert.equal(error.code, REST_API_FIELDSET_ERROR_CODE)
+            assert.equal(error.statusCode, 400)
+            assert.deepEqual(error.details, {
+              field: 'definitelyHidden',
+              resourceType: request.includedType
+            })
+            return true
+          }
+        )
+      }
+    })
   })
 
   describe('Nested Includes', () => {

package/tests/row-policy.test.js

@@ -11,6 +11,7 @@ import {
 } from './helpers/test-utils.js'
 import { storageMode } from './helpers/storage-mode.js'
 import { createRowPolicyApi } from './fixtures/api-configs.js'
+import { createStorageAdapterUtilities } from '../plugins/core/lib/querying/storage-adapter-utils.js'
 
 const knex = knexLib({
   client: 'better-sqlite3',
@@ -23,17 +24,23 @@ const knex = knexLib({
 let api
 const policyEvents = []
 
-const adminContext = () => ({ visibility: { all: true } })
-const groupContext = (...groups) => ({ visibility: { groups } })
+const adminContext = (workspaceId = 'workspace-a') => ({
+  visibility: { all: true },
+  scopeValues: { workspaceId }
+})
+const groupContext = (...groups) => ({
+  visibility: { groups },
+  scopeValues: { workspaceId: 'workspace-a' }
+})
 
-const postProject = async (name, accessGroup) => {
+const postProject = async (name, accessGroup, context = adminContext()) => {
   return api.resources.policy_projects.post({
     inputRecord: createJsonApiDocument('policy_projects', {
       name,
       access_group: accessGroup
     }),
     simplified: false
-  }, adminContext())
+  }, context)
 }
 
 const postTask = async ({ title, accessGroup, projectId, context = adminContext() }) => {
@@ -53,6 +60,39 @@ const postTask = async ({ title, accessGroup, projectId, context = adminContext(
 }
 
 describe('RowPolicy Plugin', () => {
+  it('keeps active query translation stable after the hook context is restored', () => {
+    const queryStorageAdapter = {
+      translateColumn: (field) => field === 'id' ? 'record_id' : field
+    }
+    const ambientStorageAdapter = {
+      translateColumn: (field) => field === 'id' ? 'wrong_id' : field
+    }
+    const context = {
+      knexQuery: {
+        scopeName: 'organisationUnits',
+        tableName: 'organisation_units',
+        storageAdapter: queryStorageAdapter
+      },
+      storageAdapter: ambientStorageAdapter
+    }
+    const utilities = createStorageAdapterUtilities({ context })
+
+    delete context.knexQuery
+    delete context.storageAdapter
+
+    assert.equal(
+      utilities.translateColumn('organisationUnits', 'id'),
+      'organisation_units.record_id'
+    )
+    assert.equal(
+      utilities.translateColumn('organisationUnits', 'id', 'visible_units'),
+      'visible_units.record_id'
+    )
+    assert.equal(utilities.defaultAliasForScope('users'), 'users')
+    assert.equal(Object.hasOwn(context, 'knexQuery'), false)
+    assert.equal(Object.hasOwn(context, 'storageAdapter'), false)
+  })
+
   before(async () => {
     api = await createRowPolicyApi(knex, {
       onPolicy: (event) => policyEvents.push(event)
@@ -73,7 +113,7 @@ describe('RowPolicy Plugin', () => {
     ])
   })
 
-  it('applies visibility before offset pagination and counts the same dataset', async () => {
+  it('applies deferred grouped visibility before offset pagination and counts the same dataset', async () => {
     await postProject('Allowed 1', 'group-a')
     await postProject('Hidden 1', 'group-b')
     await postProject('Allowed 2', 'group-a')
@@ -112,6 +152,22 @@ describe('RowPolicy Plugin', () => {
     )
   })
 
+  it('combines row policy visibility with the resource autofilter', async () => {
+    await postProject('Visible', 'group-a')
+    await postProject('Wrong group', 'group-b')
+    await postProject('Wrong workspace', 'group-a', adminContext('workspace-b'))
+
+    const result = await api.resources.policy_projects.query({
+      queryParams: { sort: ['id'] },
+      simplified: false
+    }, groupContext('group-a'))
+
+    assert.deepEqual(
+      result.data.map((record) => record.attributes.name),
+      ['Visible']
+    )
+  })
+
   it('keeps cursor pagination inside the visible dataset', async () => {
     await postProject('Allowed 1', 'group-a')
     await postProject('Hidden 1', 'group-b')
@@ -404,7 +460,7 @@ describe('RowPolicy Plugin', () => {
     const result = await api.resources.policy_projects.query({
       queryParams: { page: { number: 1, size: 10 } },
       simplified: false
-    })
+    }, { scopeValues: { workspaceId: 'workspace-a' } })
 
     assert.deepEqual(result.data, [])
     assert.equal(result.meta.pagination.total, 0)