fix: query validation on relationship fields (#4353)

packages/payload/src/database/queryValidation/validateSearchParams.ts

@@ -120,24 +120,28 @@ export async function validateSearchParam({
           if (segments[0] === 'parent' || segments[0] === 'version') {
             segments.shift()
           } else {
-            segments.forEach((segment, pathIndex) => {
-              if (fieldAccess[segment]) {
-                if (pathIndex === segments.length - 1) {
-                  fieldAccess = fieldAccess[segment]
-                } else if ('fields' in fieldAccess[segment]) {
-                  fieldAccess = fieldAccess[segment].fields
-                } else if ('blocks' in fieldAccess[segment]) {
-                  fieldAccess = fieldAccess[segment]
+            if (['json', 'relationship', 'richText'].includes(field.type)) {
+              fieldAccess = fieldAccess[field.name]
+            } else {
+              segments.forEach((segment, pathIndex) => {
+                if (fieldAccess[segment]) {
+                  if (pathIndex === segments.length - 1) {
+                    fieldAccess = fieldAccess[segment]
+                  } else if ('fields' in fieldAccess[segment]) {
+                    fieldAccess = fieldAccess[segment].fields
+                  } else if ('blocks' in fieldAccess[segment]) {
+                    fieldAccess = fieldAccess[segment]
+                  }
                 }
-              }
-            })
+              })
+            }
           }
 
           fieldAccess = fieldAccess.read.permission
         } else {
           fieldAccess = policies[entityType][entitySlug].fields
 
-          if (['json', 'richText'].includes(field.type)) {
+          if (['json', 'relationship', 'richText'].includes(field.type)) {
             fieldAccess = fieldAccess[field.name]
           } else {
             segments.forEach((segment, pathIndex) => {

test/relationships/config.ts

@@ -42,6 +42,8 @@ export const defaultAccessRelSlug = 'strict-access'
 export const chainedRelSlug = 'chained'
 export const customIdSlug = 'custom-id'
 export const customIdNumberSlug = 'custom-id-number'
+export const polymorphicRelationshipsSlug = 'polymorphic-relationships'
+
 export default buildConfigWithDefaults({
   collections: [
     {
@@ -232,6 +234,16 @@ export default buildConfigWithDefaults({
 
       slug: 'movieReviews',
     },
+    {
+      slug: polymorphicRelationshipsSlug,
+      fields: [
+        {
+          type: 'relationship',
+          name: 'polymorphic',
+          relationTo: ['movies'],
+        },
+      ],
+    },
   ],
   onInit: async (payload) => {
     await payload.create({

test/relationships/int.spec.ts

@@ -563,6 +563,46 @@ describe('Relationships', () => {
       })
     })
   })
+
+  describe('Polymorphic Relationships', () => {
+    it('should allow REST querying on polymorphic relationships', async () => {
+      const movie = await payload.create({
+        collection: 'movies',
+        data: {
+          name: 'Pulp Fiction 2',
+        },
+      })
+      await payload.create({
+        collection: 'polymorphic-relationships',
+        data: {
+          polymorphic: {
+            value: movie.id,
+            relationTo: 'movies',
+          },
+        },
+      })
+
+      const query = await client.find({
+        slug: 'polymorphic-relationships',
+        query: {
+          and: [
+            {
+              'polymorphic.value': {
+                equals: movie.id,
+              },
+            },
+            {
+              'polymorphic.relationTo': {
+                equals: 'movies',
+              },
+            },
+          ],
+        },
+      })
+
+      expect(query.result.docs).toHaveLength(1)
+    })
+  })
 })
 
 async function createPost(overrides?: Partial<Post>) {