[diogomrts]

hide_fields/show_fields keep a field out of responses, the OpenAPI filter schema, sparse fieldsets, includes and derived sort, but a derived filter can still reference it. Whether a record comes back then reveals the hidden value: filter[secret]=private, or filter[secret][greater_than]=a to narrow it down. The same goes for hidden calculations and relationships, and for fields outside a show_fields allowlist.

filter_ref_transformer/0 returns nil for a hidden field, and Ash.Filter falls back to the name as given, which only checks public?. The transformer now maps a hidden field to a name that matches no field, so the filter fails with no_such_field, as it does for an unknown field. The fields that make up the JSON:API id stay filterable, and filters built from a route's own path params opt out with filter_ref_transformer(allow_hidden?: true).

Contributor checklist

Leave anything that you believe does not apply unchecked.

• I accept the AI Policy, or AI was not used in the creation of this PR.
• Bug fixes include regression tests
• Chores
• Documentation changes
• Features include unit/acceptance tests
• Refactoring
• Update dependencies

[zachdaniel]

🚀 Thank you for your contribution! 🚀