Feat/validate query enhancement (#9705)

* feat(framework): Enhance query validation

* feat(framework): Enhance query validation

* feat(framework): Enhance query validation

* feat(framework): Enhance query validation

* fix

* split restriction per http domain

* fix

* fix unit tests

* fix middleware

* cleanup allowed fields

* update docs

* missing allowed

* export

* missing allowed

* missing fields

* improvements

* rm unnecessary fields

* wip

* update symbol support

* update symbol support

* update allowed

* update allowed

packages/medusa/src/api/store/carts/query-config.ts

@@ -1,3 +1,4 @@
+// TODO: Global todo, review all default fields to prevent over fetching by default
 export const defaultStoreCartFields = [
   "id",
   "currency_code",
@@ -33,8 +34,13 @@ export const defaultStoreCartFields = [
   "promotions.application_method.value",
   "promotions.application_method.type",
   "promotions.application_method.currency_code",
+  "items",
+  "items.thumbnail",
+  "region",
   "items.id",
+  "items.product",
   "items.product.id",
+  "items.variant",
   "items.variant_id",
   "items.product_id",
   "items.product.categories.id",

packages/medusa/src/api/store/customers/query-config.ts

@@ -15,6 +15,10 @@ const defaultStoreCustomersFields = [
 
 export const retrieveTransformQueryConfig = {
   defaults: defaultStoreCustomersFields,
+  allowed: [
+    ...defaultStoreCustomersFields.map((f) => f.replace("*", "")),
+    "orders",
+  ],
   isList: false,
 }
 

packages/medusa/src/api/store/return-reasons/query-config.ts

@@ -7,8 +7,8 @@ export const defaultStoreRetrieveReturnReasonFields = [
   "created_at",
   "updated_at",
   "deleted_at",
-  "*.parent_return_reason",
-  "*.return_reason_children",
+  "*parent_return_reason",
+  "*return_reason_children",
 ]
 
 export const retrieveTransformQueryConfig = {

packages/medusa/src/instrumentation/index.ts

@@ -1,5 +1,10 @@
 import { snakeCase } from "lodash"
-import { Query } from "@medusajs/framework"
+import {
+  MedusaNextFunction,
+  MedusaRequest,
+  MedusaResponse,
+  Query,
+} from "@medusajs/framework"
 import { ApiRoutesLoader } from "@medusajs/framework/http"
 import { Tracer } from "@medusajs/framework/telemetry"
 import type { SpanExporter } from "@opentelemetry/sdk-trace-node"
@@ -84,7 +89,11 @@ export function instrumentHttpLayer() {
    * OpenTelemetry
    */
   ApiRoutesLoader.traceMiddleware = (handler) => {
-    return async (req, res, next) => {
+    return async (
+      req: MedusaRequest<any>,
+      res: MedusaResponse,
+      next: MedusaNextFunction
+    ) => {
       if (shouldExcludeResource(req.originalUrl)) {
         return handler(req, res, next)
       }

packages/medusa/src/loaders/api.ts

@@ -3,6 +3,7 @@ import { join } from "path"
 import qs from "qs"
 import { RoutesLoader } from "@medusajs/framework/http"
 import { MedusaContainer, PluginDetails } from "@medusajs/framework/types"
+import { ConfigModule } from "@medusajs/framework/config"
 
 type Options = {
   app: Express
@@ -47,6 +48,12 @@ export default async ({ app, container, plugins }: Options) => {
     join(__dirname, "../api")
   )
 
+  const {
+    projectConfig: {
+      http: { restrictedFields },
+    },
+  } = container.resolve<ConfigModule>("configModule")
+
   // TODO: Figure out why this is causing issues with test when placed inside ./api.ts
   // Adding this here temporarily
   // Test: (packages/medusa/src/api/routes/admin/currencies/update-currency.ts)
@@ -54,6 +61,7 @@ export default async ({ app, container, plugins }: Options) => {
     await new RoutesLoader({
       app: app,
       sourceDir: sourcePaths,
+      baseRestrictedFields: restrictedFields?.store,
     }).load()
   } catch (err) {
     throw Error(