CodeMirror/budibase
1
0
Fork 0
mirror of synced 2024-07-07 15:25:52 +12:00
Code Issues Projects Releases Wiki Activity

Don't allow saving _viewId on row.patch

Browse source
This commit is contained in:
Adria Navarro 2023-07-31 09:58:49 +02:00
parent ed256242c8
commit 752e901b3d
2 changed files with 27 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
packages/server/src/api/controllers/row/index.ts
View file

@ -37,6 +37,11 @@ export async function patch(
const appId = ctx.appId
const tableId = utils.getTableId(ctx)
const body = ctx.request.body
if (body._viewId) {
ctx.throw(400, "Table row endpoints cannot contain view info")
}
// if it doesn't have an _id then its save
if (body && !body._id) {
return save(ctx)
@ -62,7 +67,7 @@ export async function patch(
}
}
export const save = async (ctx: UserCtx<Row>) => {
export const save = async (ctx: UserCtx<Row, Row>) => {
const appId = ctx.appId
const tableId = utils.getTableId(ctx)
const body = ctx.request.body
@ -73,7 +78,7 @@ export const save = async (ctx: UserCtx<Row>) => {
// if it has an ID already then its a patch
if (body && body._id) {
return patch(ctx)
return patch(ctx as UserCtx<PatchRowRequest, PatchRowResponse>)
}
const { row, table, squashed } = await quotas.addRow(() =>
quotas.addQuery(() => pickApi(tableId).save(ctx), {

21
packages/server/src/api/routes/tests/row.spec.ts
View file

@ -392,7 +392,7 @@ describe("/rows", () => {
expect(saved.optsFieldStrKnown).toEqual("Alpha")
})
it("should not allow creating a table row with view id data", async () => {
it("should throw an error when creating a table row with view id data", async () => {
const res = await request
.post(`/api/${row.tableId}/rows`)
.send({ ...row, _viewId: generator.guid() })
@ -452,6 +452,25 @@ describe("/rows", () => {
await assertRowUsage(rowUsage)
await assertQueryUsage(queryUsage)
})
it("should throw an error when creating a table row with view id data", async () => {
const existing = await config.createRow()
const res = await config.api.row.patch(
table._id!,
{
...existing,
_id: existing._id!,
_rev: existing._rev!,
tableId: table._id!,
_viewId: generator.guid(),
},
{ expectStatus: 400 }
)
expect(res.body.message).toEqual(
"Table row endpoints cannot contain view info"
)
})
})
describe("destroy", () => {