Skip to main content

queryModelWithPermissions

@webda/core

Function: queryModelWithPermissions()

queryModelWithPermissions<T>(model, query, context, options?): Promise<{ continuationToken?: string; results: T[]; total?: QueryTotal; }>

Defined in: packages/core/src/models/permissions.ts:955

Query a model as the caller

  • the client query may not read private (__) fields (400), and its LIMIT is lowered to MAX_QUERY_LIMIT;
  • the client query is a filter, optionally with a field list: DELETE, UPDATE and aggregations are refused (400, assertQueryStatement);
  • a model defining neither canAct form refuses every row: the store is not asked;
  • the model's static getPermissionQuery(context) is ANDed into the query;
  • every result is checked with the static canAct(context, "get", row) and refused ones are dropped. Refused rows are replaced by continuing the scan (next store pages, asking only for the missing rows), within a budget of SCAN_FACTOR x LIMIT rows (between MIN_SCANNED_ROWS and MAX_SCANNED_ROWS) and MAX_REFILL_PAGES store pages. When the budget is spent, an empty page carries no token;
  • the continuation token is sealed (sealContinuationToken): a store token counting or naming rows (Postgres/Firestore offsets, Dynamo keys, memory offsets) would otherwise reveal hidden matches. It is bound to the model, the query and the caller, expires after CONTINUATION_TOKEN_TTL_MS, and is sent back as is in OFFSET; any other value is a 400;
  • with options.count, the total (countModelWithPermissions) is counted concurrently with the page and returned as total when it can be given. Clients ask for it on the first page only;
  • with a field list (SELECT a, b.c WHERE ..., checked by assertSelectFields), each result is the public form of the row (toDTO(), built as the caller) reduced to the selected paths plus the primary key (projectFields of @webda/ql). The field list is applied last and never reaches the store: the rows are read whole, so the permission query, canAct and toDTO() see every field, and the page, the token and the total are those of the same query without field list. A token can be sent back with another field list.

Type Parameters​

T​

T = any

Parameters​

model​

any

the model class

query​

string

the client query

context​

IOperationContext

the caller context

options?​

count adds the total of the query

count?​

boolean

count the total of the query

Returns​

Promise<{ continuationToken?: string; results: T[]; total?: QueryTotal; }>

the query results the caller may read (partial plain objects with a field list), and the total when asked and allowed