Only allow deletion of related models in nested mutations

tests/Integration/Execution/MutationExecutor/BelongsToManyTest.php

@@ -689,6 +689,63 @@ public function testDeleteWithBelongsToMany(string $action): void
         $this->assertNotNull(User::find(2));
     }
 
+    /** @dataProvider existingModelMutations */
+    public function testDoNotDeleteWithoutRelationWithBelongsToMany(string $action): void
+    {
+        $users = [
+            factory(User::class)->create(),
+            factory(User::class)->create(),
+        ];
+
+        factory(Role::class)
+            ->createMany([[], []])
+            ->each(static function (Role $role, int $index) use ($users): void {
+                $role->users()->attach($users[$index]);
+            });
+
+        $this->graphQL(/** @lang GraphQL */ <<<GRAPHQL
+        mutation {
+            {$action}Role(input: {
+                id: 1
+                name: "is_user"
+                users: {
+                    delete: [{$users[1]->id}]
+                }
+            }) {
+                id
+                name
+                users {
+                    id
+                }
+            }
+        }
+GRAPHQL
+        )->assertJson([
+            'data' => [
+                "{$action}Role" => [
+                    'id' => '1',
+                    'name' => 'is_user',
+                    'users' => [
+                        [
+                            'id' => $users[0]->id,
+                        ],
+                    ],
+                ],
+            ],
+        ]);
+
+        $role = Role::findOrFail(1);
+        assert($role instanceof Role);
+        $this->assertCount(1, $role->users()->get());
+        $this->assertSame('is_user', $role->name);
+
+        $role = Role::findOrFail(2);
+        assert($role instanceof Role);
+        $this->assertCount(1, $role->users);
+        $this->assertNotNull(User::find($users[0]->id));
+        $this->assertNotNull(User::find($users[1]->id));
+    }
+
     /** @dataProvider existingModelMutations */
     public function testConnectWithBelongsToMany(string $action): void
     {

tests/Integration/Execution/MutationExecutor/HasManyTest.php

@@ -498,6 +498,61 @@ public function testDeleteHasMany(string $action): void
         ]);
     }
 
+    /** @dataProvider existingModelMutations */
+    public function testDeleteHasManyWithoutRelation(string $action): void
+    {
+        $tasks = [
+            factory(Task::class)->create(),
+            factory(Task::class)->create(),
+        ];
+
+        factory(User::class)
+            ->createMany([[], []])
+            ->each(static function (User $user, int $index) use ($tasks): void {
+                $user->tasks()->save($tasks[$index]);
+            });
+
+        $this->graphQL(/** @lang GraphQL */ <<<GRAPHQL
+        mutation {
+            {$action}User(input: {
+                id: 1
+                name: "foo"
+                tasks: {
+                    delete: [{$tasks[1]->id}]
+                }
+            }) {
+                id
+                name
+                tasks {
+                    id
+                }
+            }
+        }
+GRAPHQL
+        )->assertJson([
+            'data' => [
+                "{$action}User" => [
+                    'id' => '1',
+                    'name' => 'foo',
+                    'tasks' => [
+                        [
+                            'id' => (string) $tasks[0]->id,
+                        ],
+                    ],
+                ],
+            ],
+        ]);
+
+        $user = User::findOrFail(1);
+        assert($user instanceof User);
+        $this->assertCount(1, $user->tasks);
+
+        $user = User::findOrFail(2);
+        assert($user instanceof User);
+        $this->assertCount(1, $user->tasks);
+        $this->assertNotNull(Task::find($tasks[1]->id));
+    }
+
     /** @dataProvider existingModelMutations */
     public function testConnectHasMany(string $action): void
     {

tests/Integration/Execution/MutationExecutor/MorphManyTest.php

@@ -434,6 +434,53 @@ public function testUpdateAndDeleteMorphMany(string $action): void
         ]);
     }
 
+    /** @dataProvider existingModelMutations */
+    public function testShouldNotDeleteWithoutRelationUpdateAndDeleteMorphMany(string $action): void
+    {
+        $images = [
+            factory(Image::class)->create(),
+            factory(Image::class)->create(),
+        ];
+
+        factory(Task::class)
+            ->createMany([[], []])
+            ->each(static function (Task $task, int $index) use ($images): void {
+                $task->images()->save($images[$index]);
+            });
+
+        $this->graphQL(/** @lang GraphQL */ <<<GRAPHQL
+        mutation {
+            {$action}Task(input: {
+                id: 1
+                name: "foo"
+                images: {
+                    delete: [{$images[1]->id}]
+                }
+            }) {
+                id
+            }
+        }
+GRAPHQL
+        )->assertJson([
+            'data' => [
+                "{$action}Task" => [
+                    'id' => '1',
+                    'name' => 'foo',
+                    'images' => [
+                        [
+                            'id' => $images[0]->id,
+                        ],
+                    ],
+                ],
+            ],
+        ]);
+
+        $task = Task::findOrFail(2);
+        assert($task instanceof Task);
+        $this->assertCount(1, $task->images);
+        $this->assertNotNull(Image::find(2));
+    }
+
     /** @dataProvider existingModelMutations */
     public function testUpdateAndConnectMorphMany(string $action): void
     {