Only allow deletion of related models in nested mutations

tests/Integration/Execution/MutationExecutor/BelongsToManyTest.php

@@ -679,6 +679,61 @@ public function testDeleteWithBelongsToMany(string $action): void
         $this->assertNotNull(User::find(2));
     }
 
+    /**
+     * @dataProvider existingModelMutations
+     */
+    public function testDoNotDeleteWithoutRelationWithBelongsToMany(string $action): void
+    {
+        $users = [factory(User::class)->create(), factory(User::class)->create()];
+        factory(Role::class)
+            ->createMany([[], []])
+            ->each(function (Role $role, int $index) use ($users): void {
+                $role->users()->attach($users[$index]);
+            });
+
+        $this->graphQL(/** @lang GraphQL */ <<<GRAPHQL
+        mutation {
+            {$action}Role(input: {
+                id: 1
+                name: "is_user"
+                users: {
+                    delete: [2]
+                }
+            }) {
+                id
+                name
+                users {
+                    id
+                }
+            }
+        }
+GRAPHQL
+        )->assertJson([
+            'data' => [
+                "{$action}Role" => [
+                    'id' => '1',
+                    'name' => 'is_user',
+                    'users' => [
+                        [
+                            'id' => '1',
+                        ],
+                    ],
+                ],
+            ],
+        ]);
+
+        /** @var Role $role */
+        $role = Role::find(1);
+        $this->assertCount(1, $role->users()->get());
+        $this->assertSame('is_user', $role->name);
+
+        /** @var Role $role */
+        $role = Role::find(2);
+        $this->assertCount(1, $role->users()->get());
+        $this->assertNotNull(User::find(1));
+        $this->assertNotNull(User::find(2));
+    }
+
     /**
      * @dataProvider existingModelMutations
      */

tests/Integration/Execution/MutationExecutor/HasManyTest.php

@@ -503,6 +503,59 @@ public function testDeleteHasMany(string $action): void
         ]);
     }
 
+    /**
+     * @dataProvider existingModelMutations
+     */
+    public function testDeleteHasManyWithoutRelation(string $action): void
+    {
+        $tasks = [factory(Task::class)->create(), factory(Task::class)->create()];
+        factory(User::class)
+            ->createMany([[], []])
+            ->each(function (User $user, int $index) use ($tasks): void {
+                $user->tasks()->save($tasks[$index]);
+            });
+
+        $this->graphQL(/** @lang GraphQL */ <<<GRAPHQL
+        mutation {
+            ${$action}User(input: {
+                id: 1
+                name: "foo"
+                tasks: {
+                    delete: [{$tasks[1]->id}]
+                }
+            }) {
+                id
+                name
+                tasks {
+                    id
+                }
+            }
+        }
+GRAPHQL
+        )->assertJson([
+            'data' => [
+                "${$action}User" => [
+                    'id' => '1',
+                    'name' => 'foo',
+                    'tasks' => [
+                        [
+                            'id' => (string) $tasks[0]->id,
+                        ],
+                    ],
+                ],
+            ],
+        ]);
+
+        /** @var User $user */
+        $user = User::find(1);
+        $this->assertCount(1, $user->tasks()->get());
+
+        /** @var User $user */
+        $user = User::find(2);
+        $this->assertCount(1, $user->tasks()->get());
+        $this->assertNotNull(Task::find($tasks[1]->id));
+    }
+
     /**
      * @dataProvider existingModelMutations
      */

tests/Integration/Execution/MutationExecutor/MorphManyTest.php

@@ -439,6 +439,50 @@ public function testUpdateAndDeleteMorphMany(string $action): void
         ]);
     }
 
+    /**
+     * @dataProvider existingModelMutations
+     */
+    public function testShouldNotDeleteWithoutRelationUpdateAndDeleteMorphMany(string $action): void
+    {
+        $images = [factory(Image::class)->create(), factory(Image::class)->create()];
+        factory(Task::class)
+            ->createMany([[], []])
+            ->each(function (Task $task, int $index) use ($images): void {
+                $task->images()->save($images[$index]);
+            });
+
+        $this->graphQL(/** @lang GraphQL */ "
+        mutation {
+            {$action}Task(input: {
+                id: 1
+                name: \"foo\"
+                images: {
+                    delete: [1]
+                }
+            }) {
+                id
+            }
+        }
+        ")->assertJson([
+            'data' => [
+                "{$action}Task" => [
+                    'id' => '1',
+                    'name' => 'foo',
+                    'images' => [
+                        [
+                            'id' => $images[0]->id,
+                        ]
+                    ],
+                ],
+            ],
+        ]);
+
+        /** @var Task $task */
+        $task = Task::find(2);
+        $this->assertCount(1, $task->images()->get());
+        $this->assertNotNull(Image::find(2));
+    }
+
     /**
      * @dataProvider existingModelMutations
      */