Existing resource pages may retain access to records after scope changes

Filament applies configured resource and model scopes when a resource page initially loads a record. On subsequent Livewire requests, the record or its nested parent could be restored without reapplying those scopes.

This could allow a user with existing, valid Livewire component state to continue accessing a record after it is moved outside their current tenant or resource scope. Depending on the page and its configured actions, the user may be able to view or modify that record.

This issue requires previously authorized access, retained component state, and no applicable authorization check independently denying access. It does not allow users to forge Livewire component state or select arbitrary out-of-scope records.

The fix revalidates resource-page records and nested parents against their resource queries. It does not automatically revalidate models passed into separate components, such as relation managers or widgets. Applications must enforce any required scope restrictions when those components access the models.