Skip to content

Conversation

@spawnia
Copy link
Collaborator

@spawnia spawnia commented Feb 11, 2026

Summary

This PR scopes nested upsert lookups by id to the parent relation, to prevent updating unrelated models through nested mutations.

Related: #2744

Changes

  • Pass relation context into UpsertModel for nested relation resolvers and directive execution paths
  • Reject nested upsert-by-id when the target exists globally but is unrelated to the current parent
  • Add regression tests across nested relation types for this behavior

Test run

docker compose exec php vendor/bin/phpunit \
  tests/Integration/Execution/MutationExecutor/BelongsToTest.php \
  tests/Integration/Execution/MutationExecutor/BelongsToManyTest.php \
  tests/Integration/Execution/MutationExecutor/HasManyTest.php \
  tests/Integration/Execution/MutationExecutor/HasOneTest.php \
  tests/Integration/Execution/MutationExecutor/MorphManyTest.php \
  tests/Integration/Execution/MutationExecutor/MorphOneTest.php \
  tests/Integration/Execution/MutationExecutor/MorphToManyTest.php

Passed: OK (139 tests, 339 assertions)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant