Function validateRelationalDepth

api/src/utils/validate-query.ts:260–325

(query: Query)

}

function validateRelationalDepth(query: Query) {
	const maxRelationalDepth = Number(env['MAX_RELATIONAL_DEPTH']) > 2 ? Number(env['MAX_RELATIONAL_DEPTH']) : 2;

	// Process the fields in the same way as api/src/utils/get-ast-from-query.ts
	let fields = ['*'];

	if (query.fields) {
		fields = query.fields;
	}

	/**
	 * When using aggregate functions, you can't have any other regular fields
	 * selected. This makes sure you never end up in a non-aggregate fields selection error
	 */
	if (Object.keys(query.aggregate || {}).length > 0) {
		fields = [];
	}

	/**
	 * Similarly, when grouping on a specific field, you can't have other non-aggregated fields.
	 * The group query will override the fields query
	 */
	if (query.group) {
		fields = query.group;
	}

	fields = uniq(fields);

	for (const field of fields) {
		// Resolve user-defined aliases before measuring depth so that
		// alias={"myAlias":"json(category_id.metadata, color)"} is checked
		// against the actual relational path, not just the alias key.
		const resolved = query.alias?.[field] ?? field;

		if (getFieldRelationalDepth(resolved) > maxRelationalDepth) {
			throw new InvalidQueryError({ reason: 'Max relational depth exceeded' });
		}
	}

	if (query.filter) {
		const filterRelationalDepth = calculateFieldDepth(query.filter);

		if (filterRelationalDepth > maxRelationalDepth) {
			throw new InvalidQueryError({ reason: 'Max relational depth exceeded' });
		}
	}

	if (query.sort) {
		for (const sort of query.sort) {
			const field = sort.startsWith('-') ? sort.slice(1) : sort;
			const resolved = query.alias?.[field] ?? field;

			if (getFieldRelationalDepth(resolved) > maxRelationalDepth) {
				throw new InvalidQueryError({ reason: 'Max relational depth exceeded' });
			}
		}
	}