feat(medusa): Allow all relations on /admin/* endpoints (#2763)

integration-tests/api/__tests__/admin/order/order.js

@@ -1444,22 +1444,6 @@ describe("/admin/orders", () => {
       )
     })
 
-    it("throws on invalid relation", async () => {
-      const api = useApi()
-
-      try {
-        await api.get("/admin/orders?fields=id&expand=variants", {
-          headers: {
-            authorization: "Bearer test_token",
-          },
-        })
-      } catch (error) {
-        expect(error.response.data.message).toBe(
-          "Relations [variants] are not valid"
-        )
-      }
-    })
-
     it("lists all orders with a fulfillment status = fulfilled and payment status = captured", async () => {
       const api = useApi()
 
@@ -2355,22 +2339,6 @@ describe("/admin/orders", () => {
         })
       )
     })
-
-    it("throws on invalid relation", async () => {
-      const api = useApi()
-
-      try {
-        await api.get("/admin/orders/test-order?fields=id&expand=variants", {
-          headers: {
-            authorization: "Bearer test_token",
-          },
-        })
-      } catch (error) {
-        expect(error.response.data.message).toBe(
-          "Relations [variants] are not valid"
-        )
-      }
-    })
   })
 
   describe("POST /orders/:id/refund", () => {

packages/medusa/src/api/routes/admin/draft-orders/index.ts

@@ -91,20 +91,6 @@ export const defaultAdminDraftOrdersFields: (keyof DraftOrder)[] = [
   "no_notification_order",
 ]
 
-export const allowedAdminDraftOrdersFields = [
-  "id",
-  "status",
-  "display_id",
-  "cart_id",
-  "canceled_at",
-  "created_at",
-  "updated_at",
-  "metadata",
-  "no_notification_order",
-]
-
-export const allowedAdminDraftOrdersRelations = ["cart"]
-
 export type AdminPostDraftOrdersDraftOrderRegisterPaymentRes = {
   order: Order
 }

packages/medusa/src/api/routes/admin/gift-cards/index.ts

@@ -47,22 +47,6 @@ export const defaultAdminGiftCardFields: (keyof GiftCard)[] = [
 
 export const defaultAdminGiftCardRelations = ["region", "order"]
 
-export const allowedAdminGiftCardFields = [
-  "id",
-  "code",
-  "value",
-  "balance",
-  "region_id",
-  "is_disabled",
-  "ends_at",
-  "created_at",
-  "updated_at",
-  "deleted_at",
-  "metadata",
-]
-
-export const allowedAdminGiftCardRelations = ["region"]
-
 export type AdminGiftCardsRes = {
   gift_card: GiftCard
 }

packages/medusa/src/api/routes/admin/notifications/index.ts

@@ -24,7 +24,6 @@ export default (app) => {
 }
 
 export const defaultAdminNotificationsRelations = ["resends"]
-export const allowedAdminNotificationsRelations = ["resends"]
 
 export const defaultAdminNotificationsFields = [
   "id",
@@ -37,17 +36,6 @@ export const defaultAdminNotificationsFields = [
   "updated_at",
 ]
 
-export const allowedAdminNotificationsFields = [
-  "id",
-  "resource_type",
-  "resource_id",
-  "provider_id",
-  "event_name",
-  "to",
-  "created_at",
-  "updated_at",
-]
-
 export type AdminNotificationsListRes = {
   notifications: Notification[]
 }

packages/medusa/src/api/routes/admin/orders/index.ts

@@ -29,8 +29,6 @@ export default (app, featureFlagRouter: FlagRouter) => {
     transformQuery(AdminGetOrdersParams, {
       defaultRelations: relations,
       defaultFields: defaultAdminOrdersFields,
-      allowedFields: allowedAdminOrdersFields,
-      allowedRelations: allowedAdminOrdersRelations,
       isList: true,
     }),
     middlewares.wrap(require("./list-orders").default)
@@ -56,8 +54,6 @@ export default (app, featureFlagRouter: FlagRouter) => {
           "gift_card_tax_total",
         ].includes(field)
       }),
-      allowedFields: allowedAdminOrdersFields,
-      allowedRelations: allowedAdminOrdersRelations,
       isList: false,
     }),
     middlewares.wrap(require("./get-order").default)
@@ -324,55 +320,6 @@ export const defaultAdminOrdersFields = [
   "no_notification",
 ] as (keyof Order)[]
 
-export const allowedAdminOrdersFields = [
-  "id",
-  "status",
-  "fulfillment_status",
-  "payment_status",
-  "display_id",
-  "cart_id",
-  "draft_order_id",
-  "customer_id",
-  "email",
-  "region_id",
-  "currency_code",
-  "tax_rate",
-  "canceled_at",
-  "created_at",
-  "updated_at",
-  "metadata",
-  "shipping_total",
-  "discount_total",
-  "tax_total",
-  "refunded_total",
-  "subtotal",
-  "gift_card_total",
-  "total",
-  "paid_total",
-  "refundable_amount",
-  "no_notification",
-]
-
-export const allowedAdminOrdersRelations = [
-  "customer",
-  "region",
-  "edits",
-  "sales_channel",
-  "billing_address",
-  "shipping_address",
-  "discounts",
-  "discounts.rule",
-  "shipping_methods",
-  "payments",
-  "fulfillments",
-  "fulfillments.tracking_links",
-  "returns",
-  "claims",
-  "swaps",
-  "swaps.return_order",
-  "swaps.additional_items",
-]
-
 export const filterableAdminOrdersFields = [
   "id",
   "status",

packages/medusa/src/api/routes/admin/price-lists/index.ts

@@ -9,7 +9,6 @@ import middlewares, {
 import { AdminGetPriceListPaginationParams } from "./list-price-lists"
 import { AdminGetPriceListsPriceListProductsParams } from "./list-price-list-products"
 import {
-  allowedAdminProductFields,
   defaultAdminProductFields,
   defaultAdminProductRelations,
 } from "../products"
@@ -37,7 +36,6 @@ export default (app, featureFlagRouter: FlagRouter) => {
   route.get(
     "/:id/products",
     transformQuery(AdminGetPriceListsPriceListProductsParams, {
-      allowedFields: allowedAdminProductFields,
       defaultFields: defaultAdminProductFields,
       defaultRelations: defaultAdminProductRelations.filter(
         (r) => r !== "variants.prices"
@@ -95,8 +93,6 @@ export const defaultAdminPriceListFields = [
 
 export const defaultAdminPriceListRelations = ["prices", "customer_groups"]
 
-export const allowedAdminPriceListFields = ["prices", "customer_groups"]
-
 export type AdminPriceListRes = {
   price_list: PriceList
 }

packages/medusa/src/api/routes/admin/product-tags/index.ts

@@ -15,7 +15,6 @@ export default (app) => {
     transformQuery(AdminGetProductTagsParams, {
       defaultFields: defaultAdminProductTagsFields,
       defaultRelations: defaultAdminProductTagsRelations,
-      allowedFields: allowedAdminProductTagsFields,
       isList: true,
     }),
     middlewares.wrap(require("./list-product-tags").default)
@@ -24,13 +23,6 @@ export default (app) => {
   return app
 }
 
-export const allowedAdminProductTagsFields = [
-  "id",
-  "value",
-  "created_at",
-  "updated_at",
-]
-
 export const defaultAdminProductTagsFields = [
   "id",
   "value",

packages/medusa/src/api/routes/admin/product-types/index.ts

@@ -15,7 +15,6 @@ export default (app) => {
     transformQuery(AdminGetProductTypesParams, {
       defaultFields: defaultAdminProductTypeFields,
       defaultRelations: defaultAdminProductTypeRelations,
-      allowedFields: allowedAdminProductTypeFields,
       isList: true,
     }),
     middlewares.wrap(require("./list-product-types").default)
@@ -24,13 +23,6 @@ export default (app) => {
   return app
 }
 
-export const allowedAdminProductTypeFields = [
-  "id",
-  "value",
-  "created_at",
-  "updated_at",
-]
-
 export const defaultAdminProductTypeFields = [
   "id",
   "value",

packages/medusa/src/api/routes/admin/products/index.ts

@@ -73,7 +73,6 @@ export default (app, featureFlagRouter: FlagRouter) => {
     transformQuery(FindParams, {
       defaultRelations: defaultAdminProductRelations,
       defaultFields: defaultAdminProductFields,
-      allowedFields: allowedAdminProductFields,
       isList: false,
     }),
     middlewares.wrap(require("./get-product").default)
@@ -84,7 +83,6 @@ export default (app, featureFlagRouter: FlagRouter) => {
     transformQuery(AdminGetProductsParams, {
       defaultRelations: defaultAdminProductRelations,
       defaultFields: defaultAdminProductFields,
-      allowedFields: allowedAdminProductFields,
       isList: true,
     }),
     middlewares.wrap(require("./list-products").default)
@@ -134,45 +132,6 @@ export const defaultAdminProductFields: (keyof Product)[] = [
 
 export const defaultAdminGetProductsVariantsFields = ["id", "product_id"]
 
-export const allowedAdminProductFields = [
-  "id",
-  "title",
-  "subtitle",
-  "status",
-  "external_id",
-  "description",
-  "handle",
-  "is_giftcard",
-  "discountable",
-  "thumbnail",
-  "profile_id",
-  "collection_id",
-  "type_id",
-  "weight",
-  "length",
-  "height",
-  "width",
-  "hs_code",
-  "origin_country",
-  "mid_code",
-  "material",
-  "created_at",
-  "updated_at",
-  "deleted_at",
-  "metadata",
-]
-
-export const allowedAdminProductRelations = [
-  "variants",
-  "variants.prices",
-  "images",
-  "options",
-  "tags",
-  "type",
-  "collection",
-  "sales_channels",
-]
-
 export type AdminProductsDeleteOptionRes = {
   option_id: string
   object: "option"

packages/medusa/src/api/routes/admin/variants/index.ts

@@ -16,7 +16,6 @@ export default (app) => {
     transformQuery(AdminGetVariantsParams, {
       defaultRelations: defaultAdminVariantRelations,
       defaultFields: defaultAdminVariantFields,
-      allowedFields: allowedAdminVariantFields,
       isList: true,
     }),
     middlewares.wrap(require("./list-variants").default)
@@ -50,35 +49,6 @@ export const defaultAdminVariantFields: (keyof ProductVariant)[] = [
   "metadata",
 ]
 
-export const allowedAdminVariantFields = [
-  "id",
-  "title",
-  "product_id",
-  "sku",
-  "barcode",
-  "ean",
-  "upc",
-  "inventory_quantity",
-  "allow_backorder",
-  "weight",
-  "length",
-  "height",
-  "width",
-  "hs_code",
-  "origin_country",
-  "mid_code",
-  "material",
-  "created_at",
-  "updated_at",
-  "metadata",
-]
-
-export const allowedAdminVariantRelations: (keyof ProductVariant)[] = [
-  "product",
-  "prices",
-  "options",
-]
-
 export type AdminVariantsListRes = PaginatedResponse & {
   variants: PricedVariant[]
 }

packages/medusa/src/api/routes/store/orders/index.ts

@@ -83,45 +83,6 @@ export const defaultStoreOrdersFields = [
   "total",
 ] as (keyof Order)[]
 
-export const allowedStoreOrdersRelations = [
-  "shipping_address",
-  "fulfillments",
-  "fulfillments.tracking_links",
-  "billing_address",
-  "items",
-  "items.variant",
-  "items.variant.product",
-  "shipping_methods",
-  "discounts",
-  "discounts.rule",
-  "customer",
-  "payments",
-  "region",
-]
-
-export const allowedStoreOrdersFields = [
-  "id",
-  "status",
-  "fulfillment_status",
-  "payment_status",
-  "display_id",
-  "cart_id",
-  "customer_id",
-  "email",
-  "region_id",
-  "currency_code",
-  "items.refundable",
-  "tax_rate",
-  "created_at",
-  "shipping_total",
-  "discount_total",
-  "tax_total",
-  "refunded_total",
-  "gift_card_total",
-  "subtotal",
-  "total",
-]
-
 export type StoreOrdersRes = {
   order: Order
 }