Fixes Dataloader error when resolving relationships when access is `f…

…alse` on related to-one item (#8216)

.changeset/shy-falcons-think.md

@@ -0,0 +1,5 @@
+---
+'@keystone-6/core': patch
+---
+
+Fixes Dataloader error when resolving relationships when access is `false` on related to-one item

packages/core/src/lib/core/queries/output-field.ts

@@ -102,12 +102,12 @@ async function fetchRelatedItems(
 ) {
   const operationAccess = await getOperationAccess(foreignList, context, 'query');
   if (!operationAccess) {
-    return [];
+    return toFetch.map(() => undefined);
   }
 
   const accessFilters = await getAccessFilters(foreignList, context, 'query');
   if (accessFilters === false) {
-    return [];
+    return toFetch.map(() => undefined);
   }
 
   const resolvedWhere = await accessControlledFilter(

tests/api-tests/relationships/crud/one-to-many.test.ts

@@ -3,7 +3,7 @@ import { text, relationship } from '@keystone-6/core/fields';
 import { list } from '@keystone-6/core';
 import { setupTestRunner } from '@keystone-6/api-tests/test-runner';
 import type { KeystoneContext } from '@keystone-6/core/types';
-import { allowAll } from '@keystone-6/core/access';
+import { allowAll, denyAll } from '@keystone-6/core/access';
 import { apiTestConfig, ContextFromRunner } from '../../utils';
 
 type IdType = any;
@@ -107,6 +107,27 @@ const runner = setupTestRunner({
   }),
 });
 
+const runnerWithDeny = setupTestRunner({
+  config: apiTestConfig({
+    lists: {
+      Company: list({
+        access: denyAll,
+        fields: {
+          name: text(),
+          locations: relationship({ ref: 'Location.company', many: true }),
+        },
+      }),
+      Location: list({
+        access: allowAll,
+        fields: {
+          name: text(),
+          company: relationship({ ref: 'Company.locations' }),
+        },
+      }),
+    },
+  }),
+});
+
 describe(`One-to-many relationships`, () => {
   describe('Read', () => {
     test(
@@ -205,6 +226,22 @@ describe(`One-to-many relationships`, () => {
         );
       })
     );
+
+    test(
+      'Deny access to related items returns null',
+      runnerWithDeny(async ({ context }) => {
+        await createReadData(context.sudo());
+        const companies = await context.query.Company.findMany({
+          query: 'id name',
+        });
+        expect(companies.toString()).toBe('');
+
+        const locations = await context.query.Location.findMany({
+          query: 'id name company { id name }',
+        });
+        expect(locations[0].company).toBeNull();
+      })
+    );
   });
 
   describe('Count', () => {