Update visitors

packages/core/utils/src/sanitize/sanitizers.ts

@@ -113,6 +113,12 @@ const defaultSanitizeSort = curry((schema: Model, sort: unknown) => {
     // Remove keys for empty non-scalar values
     traverseQuerySort(
       ({ key, attribute, value }, { remove }) => {
+        // ID is not an attribute per se, so we need to make
+        // an extra check to ensure we're not removing it
+        if (key === 'id') {
+          return;
+        }
+
         if (!isScalarAttribute(attribute) && isEmpty(value)) {
           remove(key);
         }
@@ -135,6 +141,7 @@ const defaultSanitizeFields = curry((schema: Model, fields: unknown) => {
         if (key === 'id') {
           return;
         }
+
         if (isNil(attribute) || !isScalarAttribute(attribute)) {
           remove(key);
         }

packages/core/utils/src/sanitize/visitors/remove-disallowed-fields.ts

@@ -1,4 +1,4 @@
-import { isArray, isNil, toPath } from 'lodash/fp';
+import { isArray, isNil, isString, toPath } from 'lodash/fp';
 import type { Visitor } from '../../traverse/factory';
 
 export default (allowedFields: string[] | null = null): Visitor =>
@@ -8,9 +8,11 @@ export default (allowedFields: string[] | null = null): Visitor =>
       return;
     }
 
-    // Ignore invalid formats
+    // Throw on invalid formats
-    if (!isArray(allowedFields)) {
+    if (!(isArray(allowedFields) && allowedFields.every(isString))) {
-      return;
+      throw new TypeError(
+        `Expected array of strings for allowedFields but got "${typeof allowedFields}"`
+      );
     }
 
     if (isNil(path)) {

packages/core/utils/src/sanitize/visitors/remove-restricted-fields.ts

@@ -1,4 +1,4 @@
-import { isArray } from 'lodash/fp';
+import { isArray, isString } from 'lodash/fp';
 import type { Visitor } from '../../traverse/factory';
 
 export default (restrictedFields: string[] | null = null): Visitor =>
@@ -9,9 +9,11 @@ export default (restrictedFields: string[] | null = null): Visitor =>
       return;
     }
 
-    // Ignore invalid formats
+    // Throw on invalid formats
-    if (!isArray(restrictedFields)) {
+    if (!(isArray(restrictedFields) && restrictedFields.every(isString))) {
-      return;
+      throw new TypeError(
+        `Expected array of strings for restrictedFields but got "${typeof restrictedFields}"`
+      );
     }
 
     // Remove if an exact match was found

packages/core/utils/src/validate/validators.ts

@@ -29,9 +29,15 @@ const defaultValidateFilters = curry((schema: Model, filters: unknown) => {
     // keys that are not attributes or valid operators
     traverseQueryFilters(
       ({ key, attribute }) => {
+        // ID is not an attribute per se, so we need to make
+        // an extra check to ensure we're not removing it
+        if (key === 'id') {
+          return;
+        }
+
         const isAttribute = !!attribute;
 
-        if (!isAttribute && !isOperator(key) && key !== 'id') {
+        if (!isAttribute && !isOperator(key)) {
           throwInvalidParam({ key });
         }
       },
@@ -61,6 +67,7 @@ const defaultValidateSort = curry((schema: Model, sort: unknown) => {
   if (!schema) {
     throw new Error('Missing schema in defaultValidateSort');
   }
+
   return pipeAsync(
     // non attribute keys
     traverseQuerySort(
@@ -88,6 +95,12 @@ const defaultValidateSort = curry((schema: Model, sort: unknown) => {
     // keys for empty non-scalar values
     traverseQuerySort(
       ({ key, attribute, value }) => {
+        // ID is not an attribute per se, so we need to make
+        // an extra check to ensure we're not removing it
+        if (key === 'id') {
+          return;
+        }
+
         if (!isScalarAttribute(attribute) && isEmpty(value)) {
           throwInvalidParam({ key });
         }
@@ -108,6 +121,7 @@ const defaultValidateFields = curry((schema: Model, fields: unknown) => {
         if (key === 'id') {
           return;
         }
+
         if (isNil(attribute) || !isScalarAttribute(attribute)) {
           throwInvalidParam({ key });
         }

packages/core/utils/src/validate/visitors/throw-disallowed-fields.ts

@@ -1,4 +1,4 @@
-import { isArray, isNil, toPath } from 'lodash/fp';
+import { isArray, isNil, isString, toPath } from 'lodash/fp';
 import type { Visitor } from '../../traverse/factory';
 import { throwInvalidParam } from '../utils';
 
@@ -9,9 +9,11 @@ export default (allowedFields: string[] | null = null): Visitor =>
       return;
     }
 
-    // Ignore invalid formats
+    // Throw on invalid formats
-    if (!isArray(allowedFields)) {
+    if (!(isArray(allowedFields) && allowedFields.every(isString))) {
-      return;
+      throw new TypeError(
+        `Expected array of strings for allowedFields but got "${typeof allowedFields}"`
+      );
     }
 
     if (isNil(path)) {

packages/core/utils/src/validate/visitors/throw-restricted-fields.ts

@@ -1,4 +1,4 @@
-import { isArray } from 'lodash/fp';
+import { isArray, isString } from 'lodash/fp';
 import type { Visitor } from '../../traverse/factory';
 import { throwInvalidParam } from '../utils';
 

packages/core/utils/src/validate/visitors/throw-restricted-relations.ts

@@ -20,22 +20,13 @@ export default (auth: unknown): Visitor =>
     }
 
     const handleMorphRelation = async () => {
-      const newMorphValue: Record<string, unknown>[] = [];
-
       for (const element of (data as Record<string, MorphArray>)[key]) {
         const scopes = ACTIONS_TO_VERIFY.map((action) => `${element.__type}.${action}`);
         const isAllowed = await hasAccessToSomeScopes(scopes, auth);
 
-        if (isAllowed) {
+        if (!isAllowed) {
-          newMorphValue.push(element);
-        }
-      }
-
-      // If the new value is empty
-      if (newMorphValue.length === 0) {
           throwInvalidParam({ key });
-      } else {
+        }
-        set(key, newMorphValue);
       }
     };