Function sanitizeQueryMiddleware

api/src/middleware/sanitize-query.ts:10–38

(req, _res, next)

import { validateQuery } from '../utils/validate-query.js';

const sanitizeQueryMiddleware: RequestHandler = async (req, _res, next) => {
	req.sanitizedQuery = {};
	if (!req.query) return;

	// Skip sanitization and validation if query is empty
	if (Object.keys(req.query).length === 0) {
		Object.freeze(req.sanitizedQuery);
		return next();
	}

	try {
		req.sanitizedQuery = await sanitizeQuery(
			{
				fields: req.query['fields'] || '*',
				...req.query,
			},
			req.schema,
			req.accountability || null,
		);

		Object.freeze(req.sanitizedQuery);

		validateQuery(req.sanitizedQuery);
	} catch (error) {
		return next(error);
	}

	return next();
};

export default sanitizeQueryMiddleware;