[ShohanRahman]

fixes PRD-907

Read routes apply the scope of every collection they reach through a to-one relation, as well as the scope of the collection they serve. A related record outside its collection's scope is served empty, and the record it hangs off stays in the response.

What changes

1. get / list / list-related. The scope of each collection the projection reaches through a to-one relation is fetched (AuthorizationService.getRelationScopes). The columns it reads are added to the query, the scope is evaluated on each related record (ConditionTree.match), and a record outside it is served as null. The added columns are stripped before serialization.
2. csv / csv-related. The same redaction runs on every page of the export, so an out-of-scope related record's cells are empty.
3. Leaderboard chart. The aggregated collection's own scope is intersected into the filter. For a many-to-many, that is the through collection's scope, plus the foreign collection's scope nested through the target relation.
4. Rows and statuses are unchanged. The listed rows, the count and the get-one status are the same as before. A card whose account is out of scope is listed with account: null, the same way as a card with no account.

Notes for review

• Scopes are evaluated in memory with ConditionTree.match, so null handling follows the toolkit's matcher, not the datasource's SQL. For example, region != 'EU' keeps a holder whose region is NULL.
• Scopes apply whatever skipRelationReadPermissions says, because that option covers read permissions, not scopes.
• The agent-ruby counterpart is fix(agent): apply the scope of collections reached through a relation agent-ruby#421.

Tests

• test/security/related-collection-scopes.test.ts drives each route through the real AuthorizationService.
• test/utils/relation-scopes.test.ts covers the redaction itself: nested paths, a missing relation, and a deeper scope evaluated before its parent is emptied.
• The full agent suite passes: 97 suites, 2,020 tests.

Squash message

fix(agent): apply the scope of collections reached through a relation

Read routes fetch the scope of every collection a projection reaches
through a to-one relation and serve a related record outside it as null,
keeping the record it hangs off. The leaderboard intersects the scope of
the aggregated collection, and for a many-to-many the foreign collection's
through the target relation, into its filter.

Refs: PRD-907

Definition of Done

General

• Write an explicit title for the Pull Request, following Conventional Commits specification
• Test manually the implemented changes
• Validate the code quality (indentation, syntax, style, simplicity, readability)

Security

• Consider the security impact of the changes made

🤖 Generated with Claude Code

[linear-code]

PRD-907

[qltysh]

1 new issue

Tool	Category	Rule	Count
qlty	Structure	Function with many parameters (count = 4): collectRelationScopes	1

[qltysh]

Coverage Impact

This PR will not change total coverage.

Modified Files with Diff Coverage (8)

Rating	File	% Diff	Uncovered Line #s
	packages/agent/src/services/authorization/authorization.ts	100.0%
	packages/agent/src/routes/access/list-related.ts	100.0%
	packages/agent/src/routes/access/get.ts	100.0%
	packages/agent/src/routes/access/csv.ts	100.0%
	packages/agent/src/routes/access/chart.ts	100.0%
	packages/agent/src/routes/access/csv-related.ts	100.0%
	packages/agent/src/routes/access/list.ts	100.0%
	packages/agent/src/utils/relation-scopes.ts	100.0%
	Total	100.0%

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.