Validate view schema on upsert

packages/server/src/api/routes/tests/viewV2.spec.ts

@@ -141,7 +141,7 @@ describe.each([
           type: SortType.STRING,
         },
         schema: {
-          name: {
+          Price: {
             visible: true,
           },
         },
@@ -150,7 +150,11 @@ describe.each([
 
       expect(res).toEqual({
         ...newView,
-        schema: newView.schema,
+        schema: {
+          Price: {
+            visible: true,
+          },
+        },
         id: expect.any(String),
         version: 2,
       })

packages/server/src/sdk/app/views/index.ts

@@ -2,10 +2,11 @@ import {
   RenameColumn,
   TableSchema,
   View,
+  ViewUIFieldMetadata,
   ViewV2,
   ViewV2Enriched,
 } from "@budibase/types"
-import { db as dbCore } from "@budibase/backend-core"
+import { HTTPError, db as dbCore } from "@budibase/backend-core"
 import { cloneDeep } from "lodash"
 
 import * as utils from "../../../db/utils"
@@ -13,6 +14,7 @@ import { isExternalTableID } from "../../../integrations/utils"
 
 import * as internal from "./internal"
 import * as external from "./external"
+import sdk from "../../../sdk"
 
 function pickApi(tableId: any) {
   if (isExternalTableID(tableId)) {
@@ -31,14 +33,38 @@ export async function getEnriched(viewId: string): Promise<ViewV2Enriched> {
   return pickApi(tableId).getEnriched(viewId)
 }
 
+async function guardViewSchema(
+  tableId: string,
+  schema?: Record<string, ViewUIFieldMetadata>
+) {
+  if (!schema || !Object.keys(schema).length) {
+    return
+  }
+  const table = await sdk.tables.getTable(tableId)
+  if (schema) {
+    for (const field of Object.keys(schema)) {
+      if (!table.schema[field]) {
+        throw new HTTPError(
+          `Field "${field}" is not valid for the requested table`,
+          400
+        )
+      }
+    }
+  }
+}
+
 export async function create(
   tableId: string,
   viewRequest: Omit<ViewV2, "id" | "version">
 ): Promise<ViewV2> {
+  await guardViewSchema(tableId, viewRequest.schema)
+
   return pickApi(tableId).create(tableId, viewRequest)
 }
 
 export async function update(tableId: string, view: ViewV2): Promise<ViewV2> {
+  await guardViewSchema(tableId, view.schema)
+
   return pickApi(tableId).update(tableId, view)
 }