feat: validate ?columns mutation targets based on schema cache (#2542)
This returns an error for trying to update or insert into invalid columns, without hitting the database. This change also switches from `json_populate_recordset` for these operations `json_to_recordset` which should make no functional difference except allowing future flexibility.
This commit is contained in:
@@ -420,6 +420,28 @@ spec actualPgVersion = do
|
||||
, matchHeaders = []
|
||||
}
|
||||
|
||||
it "disallows ?columns which don't exist" $
|
||||
post "/articles?columns=helicopter"
|
||||
[json|[
|
||||
{"id": 204, "body": "yyy"},
|
||||
{"id": 205, "body": "zzz"}]|]
|
||||
`shouldRespondWith`
|
||||
[json|{"code":"PGRST118","details":null,"hint":null,"message":"Column 'helicopter' of relation 'articles' does not exist"} |]
|
||||
{ matchStatus = 400
|
||||
, matchHeaders = []
|
||||
}
|
||||
|
||||
it "returns missing table error even if also has invalid ?columns" $
|
||||
post "/garlic?columns=helicopter"
|
||||
[json|[
|
||||
{"id": 204, "body": "yyy"},
|
||||
{"id": 205, "body": "zzz"}]|]
|
||||
`shouldRespondWith`
|
||||
[json|{} |]
|
||||
{ matchStatus = 404
|
||||
, matchHeaders = []
|
||||
}
|
||||
|
||||
it "disallows array elements that are not json objects" $
|
||||
post "/articles?columns=id,body"
|
||||
[json|[
|
||||
@@ -431,7 +453,7 @@ spec actualPgVersion = do
|
||||
"code": "22023",
|
||||
"details": null,
|
||||
"hint": null,
|
||||
"message": "argument of json_populate_recordset must be an array of objects"}|]
|
||||
"message": "argument of json_to_recordset must be an array of objects"}|]
|
||||
{ matchStatus = 400
|
||||
, matchHeaders = []
|
||||
}
|
||||
|
||||
@@ -308,6 +308,28 @@ spec = do
|
||||
request methodPatch "/articles?id=eq.2001&columns=body" [("Prefer", "return=representation")]
|
||||
[json| {"body": "Some real content", "smth": "here", "other": "stuff", "fake_id": 13} |] `shouldRespondWith` 200
|
||||
|
||||
it "disallows ?columns which don't exist" $ do
|
||||
request methodPatch "/articles?id=eq.1&columns=helicopter"
|
||||
[("Prefer", "return=representation")]
|
||||
[json|{"body": "yyy"}|]
|
||||
`shouldRespondWith`
|
||||
[json|{"code":"PGRST118","details":null,"hint":null,"message":"Column 'helicopter' of relation 'articles' does not exist"} |]
|
||||
{ matchStatus = 400
|
||||
, matchHeaders = []
|
||||
}
|
||||
|
||||
it "returns missing table error even if also has invalid ?columns" $ do
|
||||
request methodPatch "/garlic?columns=helicopter"
|
||||
[("Prefer", "return=representation")]
|
||||
[json|[
|
||||
{"id": 204, "body": "yyy"},
|
||||
{"id": 205, "body": "zzz"}]|]
|
||||
`shouldRespondWith`
|
||||
[json|{} |]
|
||||
{ matchStatus = 404
|
||||
, matchHeaders = []
|
||||
}
|
||||
|
||||
context "tables with self reference foreign keys" $ do
|
||||
it "embeds children after update" $
|
||||
request methodPatch "/web_content?id=eq.0&select=id,name,web_content(name)"
|
||||
|
||||
Reference in New Issue
Block a user