Let a schema allow every orderable relation at once (v0.19.2).

Ordering through a row-scoped relation is refused so a sort cannot rank rows
the caller may not read, and the override names the relations individually.
That reads well by hand and not at all for a schema that generates its order
inputs in a loop: the traversable names only exist once the type is built, so
there is nothing to name at the call site.

allow_scoped_ordering=True opts the whole order input in. Naming relations
stays the better habit, since it keeps the decision visible one relation at a
time, but a codebase that has decided every readable parent implies a readable
child can now say so once.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: jamietdavidson

API_REFERENCE.md

@@ -150,7 +150,7 @@ A field you resolve yourself: your callable receives `self` and runs once per pa
 
 ```python
 orm.filter(model_or_type, *, name=None, include=None, exclude=None)
-orm.order(model_or_type, *, name=None, include=None, exclude=None, allow_scoped_ordering=None)
+orm.order(model_or_type, *, name=None, include=None, exclude=None, allow_scoped_ordering=None  # names, or True for all)
 orm.group(model_or_type, *, name=None, include=None, exclude=None)
 orm.aggregate(model_or_type, *, name=None, include=None, exclude=None)
 ```

README.md

@@ -648,6 +648,8 @@ class PostOrder:
 
 `allow_scoped_ordering` only lifts the ordering restriction for the relations you name, on that one order input. `scope_rows` keeps scoping reads and filter traversal exactly as before, and another order input over the same model is unaffected. Naming a relation the order input cannot sort through is an error, so typos fail loudly.
 
+Pass `allow_scoped_ordering=True` to allow every relation that order input can sort through. Naming them one by one is the better habit — it keeps the decision visible per relation — but the names only exist once the type is built, so a schema generating its order inputs in a loop cannot list them. Reach for it when you have decided the rule holds across the model: every readable parent implies a readable child.
+
 If you build with `strawberry.Schema` directly instead of `orm.schema()`, the build-time check does not run; the offending query is rejected at execution instead.
 
 ### Common mistakes

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "strawberry-orm"
-version = "0.19.1"
+version = "0.19.2"
 description = "Unified, backend-agnostic ORM abstraction for Strawberry GraphQL"
 readme = "README.md"
 license = "MIT"

src/strawberry_orm/backends/_base.py

@@ -66,10 +66,20 @@ def _set_scoped_ordering_allowance(order_type: type, model: type, allowed: Any)
 
     Kept on the order type rather than keyed by model, so one order input
     opting in cannot widen another order input over the same model.
+
+    ``True`` allows every relation this order type can traverse. Naming them
+    individually is the safer habit, but it cannot be done without first
+    knowing the set, which only exists once the type is built - so a schema
+    that has decided its parents always imply readable children would
+    otherwise have to list them by hand.
     """
+    traversable = set(getattr(order_type, "_relation_models", {}))
+    if allowed is True:
+        order_type._scoped_ordering_allowed = frozenset(traversable)  # type: ignore[attr-defined]
+        return
     names = frozenset(allowed or ())
     order_type._scoped_ordering_allowed = names  # type: ignore[attr-defined]
-    unknown = names - set(getattr(order_type, "_relation_models", {}))
+    unknown = names - traversable
     if unknown:
         raise ValueError(
             f"allow_scoped_ordering names {sorted(unknown)} on "
@@ -878,7 +888,11 @@ def order_type(
         *,
         include: list[str] | tuple[str, ...] | set[str] | None = None,
         exclude: list[str] | tuple[str, ...] | set[str] | None = None,
-        allow_scoped_ordering: list[str] | tuple[str, ...] | set[str] | None = None,
+        allow_scoped_ordering: list[str]
+        | tuple[str, ...]
+        | set[str]
+        | bool
+        | None = None,
     ) -> Callable[[type], type]:
         """Decorator that builds a ``@oneOf`` order input from a user class.
 

tests/abstract/filter_traversal_scoping.py

@@ -189,6 +189,15 @@ def test_override_keeps_filter_traversal_scoped(self):
         schema = self.build(allow=["author"])
         assert titles(self.execute(schema, NESTED_HIDDEN)) == []
 
+    def test_true_allows_every_relation_the_type_can_order_through(self):
+        """The names only exist once the type is built, so a schema that has
+        decided its parents imply readable children cannot list them itself."""
+        assert self.build(allow=True) is not None
+
+    def test_true_still_keeps_reads_scoped(self):
+        schema = self.build(allow=True)
+        assert titles(self.execute(schema, NESTED_HIDDEN)) == []
+
     def test_override_must_name_a_relation_that_can_be_ordered_through(self):
         with pytest.raises(ValueError, match="allow_scoped_ordering"):
             self.build(allow=["not_a_relation"])