feat: validate ?columns mutation targets based on schema cache (#2542)

This returns an error for trying to update or insert into invalid columns, without hitting the database. This change also switches from `json_populate_recordset` for these operations `json_to_recordset` which should make no functional difference except allowing future flexibility.
This commit is contained in:
Alexander Ljungberg
2023-01-07 22:08:30 -05:00
committed by GitHub
parent 5a0f83ecb8
commit 43ad6d6aa0
14 changed files with 174 additions and 52 deletions
+23 -1
View File
@@ -420,6 +420,28 @@ spec actualPgVersion = do
, matchHeaders = []
}
it "disallows ?columns which don't exist" $
post "/articles?columns=helicopter"
[json|[
{"id": 204, "body": "yyy"},
{"id": 205, "body": "zzz"}]|]
`shouldRespondWith`
[json|{"code":"PGRST118","details":null,"hint":null,"message":"Column 'helicopter' of relation 'articles' does not exist"} |]
{ matchStatus = 400
, matchHeaders = []
}
it "returns missing table error even if also has invalid ?columns" $
post "/garlic?columns=helicopter"
[json|[
{"id": 204, "body": "yyy"},
{"id": 205, "body": "zzz"}]|]
`shouldRespondWith`
[json|{} |]
{ matchStatus = 404
, matchHeaders = []
}
it "disallows array elements that are not json objects" $
post "/articles?columns=id,body"
[json|[
@@ -431,7 +453,7 @@ spec actualPgVersion = do
"code": "22023",
"details": null,
"hint": null,
"message": "argument of json_populate_recordset must be an array of objects"}|]
"message": "argument of json_to_recordset must be an array of objects"}|]
{ matchStatus = 400
, matchHeaders = []
}
+22
View File
@@ -308,6 +308,28 @@ spec = do
request methodPatch "/articles?id=eq.2001&columns=body" [("Prefer", "return=representation")]
[json| {"body": "Some real content", "smth": "here", "other": "stuff", "fake_id": 13} |] `shouldRespondWith` 200
it "disallows ?columns which don't exist" $ do
request methodPatch "/articles?id=eq.1&columns=helicopter"
[("Prefer", "return=representation")]
[json|{"body": "yyy"}|]
`shouldRespondWith`
[json|{"code":"PGRST118","details":null,"hint":null,"message":"Column 'helicopter' of relation 'articles' does not exist"} |]
{ matchStatus = 400
, matchHeaders = []
}
it "returns missing table error even if also has invalid ?columns" $ do
request methodPatch "/garlic?columns=helicopter"
[("Prefer", "return=representation")]
[json|[
{"id": 204, "body": "yyy"},
{"id": 205, "body": "zzz"}]|]
`shouldRespondWith`
[json|{} |]
{ matchStatus = 404
, matchHeaders = []
}
context "tables with self reference foreign keys" $ do
it "embeds children after update" $
request methodPatch "/web_content?id=eq.0&select=id,name,web_content(name)"