fix(web): Fix issue with userScopedPrismaClientExtension (#1260)

Author: brendan-kellam

packages/web/src/prisma.ts

@@ -48,6 +48,16 @@ export const userScopedPrismaClientExtension = async (user?: UserWithAccounts) =
                                     ...getRepoPermissionFilterForUser(user),
                                 };
 
+                                return query(args);
+                            }
+                        },
+                        searchContext: {
+                            async $allOperations({ args, query }) {
+                                injectRepoPermissionFilterIntoRelation(
+                                    args as Record<string, unknown>,
+                                    getRepoPermissionFilterForUser(user),
+                                );
+
                                 return query(args);
                             }
                         }
@@ -57,6 +67,43 @@ export const userScopedPrismaClientExtension = async (user?: UserWithAccounts) =
         })
 }
 
+/**
+ * Injects a `Repo` permission filter into a nested `repos` relation referenced
+ * by an operation's `include` or `select` clause. Mutates `args` in place,
+ * normalizing `repos: true` into `repos: { where: <filter> }` and ANDing the
+ * filter onto any existing `where`.
+ */
+const injectRepoPermissionFilterIntoRelation = (
+    args: Record<string, unknown>,
+    filter: Prisma.RepoWhereInput,
+) => {
+    for (const key of ['include', 'select'] as const) {
+        const clause = args[key];
+        if (!clause || typeof clause !== 'object') {
+            continue;
+        }
+
+        const clauseRecord = clause as Record<string, unknown>;
+        const repos = clauseRecord.repos;
+
+        // `repos` is either absent or explicitly excluded - nothing to filter.
+        if (repos === undefined || repos === false) {
+            continue;
+        }
+
+        // Normalize `repos: true` into an object so we can attach a `where`.
+        const reposArgs = (repos === true ? {} : { ...(repos as Record<string, unknown>) }) as {
+            where?: Prisma.RepoWhereInput;
+        };
+
+        reposArgs.where = reposArgs.where
+            ? { AND: [reposArgs.where, filter] }
+            : filter;
+
+        clauseRecord.repos = reposArgs;
+    }
+};
+
 /**
  * Returns a filter for repositories that the user has access to.
  */