wip

packages/core/framework/src/http/allowed-fields.ts

@@ -0,0 +1,26 @@
+export class AllowedFields extends Array<string> {
+  // temporary
+  nonExpandableFields = ["customers"]
+
+  #fields: string[] = []
+  #override: string[] = []
+
+  #shouldOverride = false
+
+  get shouldOverride(): boolean {
+    return this.#shouldOverride
+  }
+
+  extends(fields: string[]) {
+    this.#fields.push(...fields)
+  }
+
+  override(fields: string[]) {
+    this.#shouldOverride = true
+    this.#override.push(...fields)
+  }
+
+  getAllowed() {
+    return this.#shouldOverride ? this.#override : this.#fields
+  }
+}

packages/core/framework/src/http/router.ts

@@ -948,6 +948,10 @@ export class RoutesLoader {
       ? this.#sourceDir
       : [this.#sourceDir]
 
+    this.#app.use((req, res) => {
+      req.allowed = new AllowedFields()
+    })
+
     const promises = normalizedSourcePath.map(async (sourcePath) => {
       const apiRoutesLoader = new ApiRoutesLoader({
         app: this.#app,

packages/core/framework/src/http/utils/validate-query.ts

@@ -68,7 +68,8 @@ export function validateAndTransformQuery<TEntity extends BaseEntity>(
     next: NextFunction
   ) {
     try {
-      const allowed = (req.allowed ?? queryConfig.allowed ?? []) as string[]
+      req.allowed.push(queryConfig.allowed)
+      const allowed = req.allowed as string[]
       delete req.allowed
       const query = normalizeQuery(req)