Function sanitizeQuery

api/src/utils/sanitize-query.ts:19–110

(
	rawQuery: Record<string, any>,
	schema: SchemaOverview,
	accountability?: Accountability | null,
)

 * Sanitize the query parameters and parse them where necessary.
 */
export async function sanitizeQuery(
	rawQuery: Record<string, any>,
	schema: SchemaOverview,
	accountability?: Accountability | null,
): Promise<Query> {
	const env = useEnv();

	const query: Query = {};

	const hasMaxLimit =
		'QUERY_LIMIT_MAX' in env &&
		Number(env['QUERY_LIMIT_MAX']) >= 0 &&
		!Number.isNaN(Number(env['QUERY_LIMIT_MAX'])) &&
		Number.isFinite(Number(env['QUERY_LIMIT_MAX']));

	if (rawQuery['limit'] !== undefined) {
		const limit = sanitizeLimit(rawQuery['limit']);

		if (typeof limit === 'number') {
			query.limit = limit === -1 && hasMaxLimit ? Number(env['QUERY_LIMIT_MAX']) : limit;
		}
	} else if (hasMaxLimit) {
		query.limit = Math.min(Number(env['QUERY_LIMIT_DEFAULT']), Number(env['QUERY_LIMIT_MAX']));
	}

	if (rawQuery['fields']) {
		query.fields = sanitizeFields(rawQuery['fields']);
	}

	if (rawQuery['groupBy']) {
		query.group = sanitizeFields(rawQuery['groupBy']);
	}

	if (rawQuery['aggregate']) {
		query.aggregate = sanitizeAggregate(rawQuery['aggregate']);
	}

	if (rawQuery['sort']) {
		query.sort = sanitizeSort(rawQuery['sort']);
	}

	if (rawQuery['filter']) {
		query.filter = await sanitizeFilter(rawQuery['filter'], schema, accountability || null);
	}

	if (rawQuery['offset'] !== undefined) {
		query.offset = sanitizeOffset(rawQuery['offset']);
	}

	if (rawQuery['page']) {
		query.page = sanitizePage(rawQuery['page']);
	}

	if (rawQuery['meta']) {
		(query as any).meta = sanitizeMeta(rawQuery['meta']);
	}

	if (rawQuery['search'] && typeof rawQuery['search'] === 'string') {