strapi/packages/strapi-utils/lib/buildQuery.js

const _ = require('lodash');

const findModelByAssoc = assoc => {
  const { models } = assoc.plugin ? strapi.plugins[assoc.plugin] : strapi;
  return models[assoc.collection || assoc.model];
};

const isAttribute = (model, field) => _.has(model.attributes, field) || model.primaryKey === field;

const createFilterValidator = model => ({ field }) => {
  const fieldParts = field.split('.');

  let isValid = true;
  let tmpModel = model;
  for (let i = 0; i < fieldParts.length; i++) {
    const field = fieldParts[i];

    const assoc = tmpModel.associations.find(ast => ast.alias === field);

    if (assoc) {
      tmpModel = findModelByAssoc(assoc);
      continue;
    }

    if (!assoc && (!isAttribute(tmpModel, field) || i !== fieldParts.length - 1)) {
      isValid = false;
      break;
    }
  }

  return isValid;
};

const buildQuery = ({ model, filters, ...rest }) => {
  const validator = createFilterValidator(model);

  if (filters.where && Array.isArray(filters.where)) {
    filters.where.forEach(whereClause => {
      if (!validator(whereClause)) {
        const err = new Error(
          `Your filters contain a field '${
            whereClause.field
          }' that doesn't appear on your model definition nor it's relations`
        );

        err.status = 400;
        throw err;
      }
    });
  }

  const hook = strapi.hook[model.orm];

  return hook.load().buildQuery({ model, filters, ...rest });
};

module.exports = buildQuery;