Method call

app/src/DataModel/Scripting/ScriptApiCall.cpp:445–544

* @brief Implements apiCall(method, params?) for the JS scripting engine. */

 * @brief Implements apiCall(method, params?) for the JS scripting engine.
 */
QVariantMap DataModel::ScriptApiCallBridge::call(const QJSValue& methodVal,
                                                 const QJSValue& paramsVal)
{
  QVariantMap out;

  if (!methodVal.isString()) {
    out.insert(QStringLiteral("ok"), false);
    out.insert(QStringLiteral("error"), QStringLiteral("apiCall: method must be a string"));
    return out;
  }

  const QString method = methodVal.toString();
  if (method.isEmpty()) {
    out.insert(QStringLiteral("ok"), false);
    out.insert(QStringLiteral("error"), QStringLiteral("apiCall: method must not be empty"));
    return out;
  }

  if (!API::CommandRegistry::instance().hasCommand(method)) {
    const auto unknown = dispatchApiCall(method, QJsonObject());
    out.insert(QStringLiteral("ok"), false);
    out.insert(QStringLiteral("error"), unknown.errorMessage);
    out.insert(QStringLiteral("errorCode"), unknown.errorCode);
    if (!unknown.errorData.isEmpty())
      out.insert(QStringLiteral("errorData"), unknown.errorData.toVariantMap());

    return out;
  }

  if (!isAllowed(method)) {
    out.insert(QStringLiteral("ok"), false);
    out.insert(QStringLiteral("errorCode"), QStringLiteral("METHOD_NOT_ALLOWED"));
    out.insert(QStringLiteral("error"),
               QStringLiteral("apiCall: method '%1' not in default allow-list "
                              "(enable apiCall.allowFullSurface in project to opt in)")
                 .arg(method));
    return out;
  }

  QJsonObject params;
  if (!paramsVal.isUndefined() && !paramsVal.isNull()) {
    if (!paramsVal.isObject() || paramsVal.isArray() || paramsVal.isCallable()) {
      out.insert(QStringLiteral("ok"), false);
      out.insert(QStringLiteral("error"), QStringLiteral("apiCall: params must be an object"));
      return out;
    }

    const QVariant qv = paramsVal.toVariant();
    params            = QJsonObject::fromVariantMap(qv.toMap());

    if (approxJsonSize(params) > kMaxBodyBytes) {
      out.insert(QStringLiteral("ok"), false);
      out.insert(QStringLiteral("error"),
                 QStringLiteral("apiCall: params exceed %1 byte cap").arg(kMaxBodyBytes));
      return out;
    }
  }