fix(nextly): apply related-row field rules to a single's write response by mobeenabdullah · Pull Request #381 · nextlyhq/nextly

mobeenabdullah · 2026-07-28T18:01:12Z

Task 057, slice 2 — the Singles half.

What is wrong

SingleMutationService.update expands relationships for its response and forwards no caller:

updatedDoc = await this.queryService.expandRelationshipFields(
  updatedDoc,
  fieldConfigs
);

Those rows belong to another collection and carry that collection's field-level access.read rules. Read paths have evaluated them since #335; this path never did, so it returned every related field intact — including ones the same caller's GET withholds. That makes the write path a way around the rule: write anything, read the response back.

The decision this needed, and why it went this way

057 flags that mutation responses deserve a deliberate call rather than letting the answer fall out of the wiring: should a writer see related fields their own read rules deny?

They should not, and the reasoning is the codebase's own. #335 established that related-row rules are the target collection's decision — "the same decision the related row would get if it were read directly". A mutation response is a read of that row. And the counter-argument ("they just supplied the data") does not reach these fields: the writer supplied a relationship id, not the related row's protected columns. Nothing about writing a Single entitles you to read another collection's hidden fields.

The trap, and how it is avoided

#338 proved twice that setting enforceFieldAccess: true unconditionally strips fields from entitled callers, because "no caller supplied" and "anonymous" are indistinguishable at that layer. So enforcement here is keyed on a caller actually being present:

enforceFieldAccess: Boolean(options.user)

A trusted write (overrideAccess) and an internal write that forwards no user are unaffected. That is the same opt-in discipline every other surface uses, and it is why the second test below exists.

Verification

Two integration tests against a real database:

an authenticated writer gets the relationship expanded with the protected field absent;
the mirror — a trusted write still gets the whole row, so this does not become another case of hiding data from someone nothing denied.

The first was confirmed to fail on current main before any fix (expected { …(8) } to not have property "suspended"). Baselines after a full build: unit 400 failed both before and after, zero failing tests unique to this branch (name-set comparison); integration 708 → 710 passed, zero failures.

Scope

Singles only. The collection half (collection-mutation-service.ts) is deliberately left out: #378 is currently editing that file, and this decision applies there identically once it lands. Component-nested relationships on the write path remain with tasks/left-tasks/062, which is scoped as loader-side work.

Confirmed not already done or in flight

The test fails on current main, the call site still passes only fieldConfigs, and no open PR touches enforceFieldAccess.

coderabbitai · 2026-07-28T18:01:21Z

Warning

Review limit reached

@mobeenabdullah, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 24 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 51309252-c4b3-4de4-89d5-a4847f257d40

📥 Commits

Reviewing files that changed from the base of the PR and between 90108db and bb8c020.

⛔ Files ignored due to path filters (1)

.changeset/single-write-response-related-access.md is excluded by !.changeset/**

📒 Files selected for processing (2)

packages/nextly/src/domains/singles/__tests__/write-response-related-access.integration.test.ts
packages/nextly/src/domains/singles/services/single-mutation-service.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/single-write-response-related-access

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

mobeenabdullah · 2026-07-28T18:01:29Z

@codex please review this PR

pkg-pr-new · 2026-07-28T18:03:45Z

Open in StackBlitz

@nextlyhq/adapter-drizzle

npm i https://pkg.pr.new/@nextlyhq/adapter-drizzle@bb8c020

@nextlyhq/adapter-mysql

npm i https://pkg.pr.new/@nextlyhq/adapter-mysql@bb8c020

@nextlyhq/adapter-postgres

npm i https://pkg.pr.new/@nextlyhq/adapter-postgres@bb8c020

@nextlyhq/adapter-sqlite

npm i https://pkg.pr.new/@nextlyhq/adapter-sqlite@bb8c020

@nextlyhq/admin

npm i https://pkg.pr.new/@nextlyhq/admin@bb8c020

@nextlyhq/admin-css

npm i https://pkg.pr.new/@nextlyhq/admin-css@bb8c020

@nextlyhq/blocks-engine

npm i https://pkg.pr.new/@nextlyhq/blocks-engine@bb8c020

create-nextly-app

npm i https://pkg.pr.new/create-nextly-app@bb8c020

nextly

npm i https://pkg.pr.new/nextly@bb8c020

@nextlyhq/plugin-form-builder

npm i https://pkg.pr.new/@nextlyhq/plugin-form-builder@bb8c020

@nextlyhq/plugin-page-builder

npm i https://pkg.pr.new/@nextlyhq/plugin-page-builder@bb8c020

@nextlyhq/plugin-sdk

npm i https://pkg.pr.new/@nextlyhq/plugin-sdk@bb8c020

@nextlyhq/plugin-seo

npm i https://pkg.pr.new/@nextlyhq/plugin-seo@bb8c020

@nextlyhq/storage-s3

npm i https://pkg.pr.new/@nextlyhq/storage-s3@bb8c020

@nextlyhq/storage-uploadthing

npm i https://pkg.pr.new/@nextlyhq/storage-uploadthing@bb8c020

@nextlyhq/storage-vercel-blob

npm i https://pkg.pr.new/@nextlyhq/storage-vercel-blob@bb8c020

@nextlyhq/ui

npm i https://pkg.pr.new/@nextlyhq/ui@bb8c020

commit: bb8c020

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1d001b550d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

The write response expands relationships, and those rows carry the target collection's own field-level read rules. This path forwarded no caller, so it returned every related field intact - including ones the same caller's GET withholds, which made the write path a way around the rule. The writer supplied a relationship id, not the related row's protected fields, so the rule that applies is the target collection's own. Enforcement is keyed on a caller being present rather than switched on unconditionally: a trusted or internal write forwards none, and stripping there would hide fields from a writer nothing denied.

mobeenabdullah · 2026-07-28T18:16:34Z

Rebased onto main post-#380, because the two interact in a way worth testing together rather than separately.

#380 restored second-hop expansion for code-first collections. That lands in exactly the path this PR redacts: a code-first write response can now reach a related row's own relationships, and before this change every one of those came back unredacted too — so #380 widened the surface this closes.

Verified rather than assumed that the caller propagates that far: added a third integration test with a branding → author → org chain where org hides a field, asserting the writer's response carries org.name and not org.blocked. It passes with the fix and fails without it, alongside the first-hop case; the trusted-write mirror stays green in both states.

Re-measured on the rebased branch: unit 400 failed, unchanged from main; integration 713 passed, zero failures.

mobeenabdullah · 2026-07-28T18:16:36Z

@codex please review this PR

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4c292685f1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Keying enforcement on a user being present left an anonymous caller - one a public update rule admits - reading related fields their own GET strips. Absence of a user is not trust; overrideAccess is, and the expansion helper already short-circuits on it. This matches the read path, which enforces for every caller and bypasses only on overrideAccess. Also drops a PR reference from a test docblock: comments describe the code, not the history that produced it.

mobeenabdullah · 2026-07-28T18:50:25Z

@codex please review this PR

chatgpt-codex-connector · 2026-07-28T18:53:47Z

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: bb8c0205a6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

github-actions Bot added scope: core nextly type: docs Documentation only labels Jul 28, 2026

chatgpt-codex-connector Bot reviewed Jul 28, 2026

View reviewed changes

mobeenabdullah force-pushed the fix/single-write-response-related-access branch from 1d001b5 to 4c29268 Compare July 28, 2026 18:16

chatgpt-codex-connector Bot reviewed Jul 28, 2026

View reviewed changes

Comment thread packages/nextly/src/domains/singles/__tests__/write-response-related-access.integration.test.ts Outdated

Comment thread packages/nextly/src/domains/singles/services/single-mutation-service.ts Outdated

mobeenabdullah merged commit 22b43f2 into main Jul 28, 2026
15 checks passed

Uh oh!

Conversation

mobeenabdullah commented Jul 28, 2026

What is wrong

The decision this needed, and why it went this way

The trap, and how it is avoided

Verification

Scope

Confirmed not already done or in flight

Uh oh!

coderabbitai Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

mobeenabdullah commented Jul 28, 2026

Uh oh!

pkg-pr-new Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mobeenabdullah commented Jul 28, 2026

Uh oh!

mobeenabdullah commented Jul 28, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

mobeenabdullah commented Jul 28, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jul 28, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Jul 28, 2026 •

edited

Loading

pkg-pr-new Bot commented Jul 28, 2026 •

edited

Loading