@redact of sub-collections interferes with a higher-level @check

[zmullett]

[REQUIRED] Environment info

firebase-tools: 13.29.3

Platform: macOS

[REQUIRED] Test case

Attempting to check for membership by row presence in OrganizationMembership when querying for an associated Organization via a Project. The reason for doing it at project level is that the check expression will be a X OR Y expression in production.

schema.gql:

type Organization @table {
  id: UUID! @default(expr: "uuidV4()")
  # Other fields...
}

type OrganizationMembership @table(key: ["organization", "uid"]) {
  organization: Organization!
  uid: String!
}

type Project @table {
  id: UUID! @default(expr: "uuidV4()")
  organization: Organization!
  # Other fields...
}

queries.gql:

query GetProjectById($projectId: UUID!) @auth(level: USER) {
  project(id: $projectId)
    @check(
      # This expression would be expanded to have other OR-joined conditions;
      # for the sake of clarity these are omitted.
      expr: "this.organization.organizationMemberships_on_organization != []"
    ) {
    # !!! The @redact below causes the issue; the @check above cannot find the field.
    organization @redact {
      organizationMemberships_on_organization(
        where: { uid: { eq_expr: "auth.uid" } }
      ) {
        uid # Dummy field.
      }
    }
    # Other fields...
  }
}

[REQUIRED] Steps to reproduce

Add test Organization, OrganizationMembership and Project rows. The following mutations could be used:

mutation CreateOrganization() @auth(level: NO_ACCESS) {
  organization_insert(data: { })
}

mutation UpsertOrganizationMembership($organizationId: UUID!, $uid: String!)
@auth(level: NO_ACCESS) {
  organizationMembership_upsert(
    data: { organizationId: $organizationId, uid: $uid }
  )
}

mutation CreateProject($organizationId: UUID!)
@auth(level: USER) {
  project_insert(data: { organizationId: $organizationId })
}

[REQUIRED] Expected behavior

The @redact directive can be used anywhere in the structure and not affect @check directives. This is what would be expected from the documentation;

Redacted fields are still evaluated for side effects (including data changes and
`@check`) and the results are still available to later steps in CEL expressions
(via `response.fieldName`)

[REQUIRED] Actual behavior

@firebase/data-connect: DataConnect (11.2.0): DataConnect error while performing request: [{"message":"invalid expression (\"this.organization.organizationMemberships_on_organization != []\"): ERROR: <input>:1:5: undefined field 'organization'\n | this.organization.organizationMemberships_on_organization != []\n | ....^","locations":[{...}],"path":["query","GetProjectById","project"],"extensions":{"file":"connector/queries.gql"}}]

And a similar response is observed if the @redact is moved down to project.organization.organizationMemberships_on_organization:

@firebase/data-connect: DataConnect (11.2.0): DataConnect error while performing request: [{"message":"invalid expression (\"this.organization.organizationMemberships_on_organization != []\"): ERROR: <input>:1:18: undefined field 'organizationMemberships_on_organization'\n | this.organization.organizationMemberships_on_organization != []\n | .................^","locations":[{...}],"path":["query","GetProjectById","project"],"extensions":{"file":"connector/queries.gql"}}]

If the @redact is moved down to the field project.organization.organizationMemberships_on_organization.uid then the @check WAI.