fix(medusa): Fix get-query-config backward compatiblity (#6913)

.changeset/breezy-months-change.md

@@ -0,0 +1,5 @@
+---
+"@medusajs/medusa": patch
+---
+
+fix(medusa): Fix get-query-config backward compatiblity

packages/medusa/src/api/middlewares/__tests__/transform-query.spec.ts

@@ -382,6 +382,57 @@ describe("transformQuery", () => {
         ],
       })
     )
+
+    //////////////////////////////
+
+    mockRequest = {
+      query: {
+        fields: "store.name",
+      },
+    } as unknown as Request
+
+    queryConfig = {
+      defaultFields: [
+        "id",
+        "created_at",
+        "deleted_at",
+        "metadata.id",
+        "metadata.parent.id",
+        "metadata.children.id",
+        "metadata.product.id",
+      ],
+      allowedFields: [
+        "id",
+        "created_at",
+        "updated_at",
+        "deleted_at",
+        "metadata.id",
+        "metadata.parent.id",
+        "metadata.children.id",
+        "metadata.product.id",
+        "product",
+        "product.variants",
+        "store.name",
+      ],
+      allowedRelations: ["metadata", "product"],
+      isList: true,
+    }
+
+    middleware = transformQuery(extendedFindParamsMixin(), queryConfig)
+
+    await middleware(mockRequest, mockResponse, nextFunction)
+
+    expect(mockRequest.listConfig).toEqual(
+      expect.objectContaining({
+        select: ["store.name", "created_at", "id"],
+        relations: ["store"],
+      })
+    )
+    expect(mockRequest.remoteQueryConfig).toEqual(
+      expect.objectContaining({
+        fields: ["store.name", "created_at", "id"],
+      })
+    )
   })
 
   it("should throw when attempting to transform the input if disallowed fields are requested", async () => {
@@ -491,6 +542,52 @@ describe("transformQuery", () => {
 
     //////////////////////////////
 
+    mockRequest = {
+      query: {
+        expand: "store",
+      },
+    } as unknown as Request
+
+    queryConfig = {
+      defaultFields: [
+        "id",
+        "created_at",
+        "deleted_at",
+        "metadata.id",
+        "metadata.parent.id",
+        "metadata.children.id",
+        "metadata.product.id",
+      ],
+      allowedFields: [
+        "id",
+        "created_at",
+        "updated_at",
+        "deleted_at",
+        "metadata.id",
+        "metadata.parent.id",
+        "metadata.children.id",
+        "metadata.product.id",
+        "product",
+        "product.variants",
+        "store.name",
+      ],
+      allowedRelations: ["metadata", "product"],
+      isList: true,
+    }
+
+    middleware = transformQuery(extendedFindParamsMixin(), queryConfig)
+
+    await middleware(mockRequest, mockResponse, nextFunction)
+
+    expect(nextFunction).toHaveBeenCalledWith(
+      new MedusaError(
+        MedusaError.Types.INVALID_DATA,
+        `Requested fields [store] are not valid`
+      )
+    )
+
+    //////////////////////////////
+
     mockRequest = {
       query: {
         fields: "*product",

packages/medusa/src/utils/get-query-config.ts

@@ -24,6 +24,7 @@ export function prepareListQuery<
   T extends RequestQueryFields,
   TEntity extends BaseEntity
 >(validated: T, queryConfig: QueryConfig<TEntity> = {}) {
+  // TODO: this function will be simplified a lot once we drop support for the old api
   const { order, fields, limit = 50, expand, offset = 0 } = validated
   let {
     allowed = [],
@@ -126,11 +127,11 @@ export function prepareListQuery<
     )
   }
 
+  // TODO: maintain backward compatibility, remove in the future
   const { select, relations } = stringToSelectRelationObject(
     Array.from(allFields)
   )
 
-  // TODO: maintain backward compatibility, remove in the future
   let allRelations = new Set([
     ...relations,
     ...defaultRelations,
@@ -141,13 +142,13 @@ export function prepareListQuery<
     allRelations = new Set(expand.split(",").filter(Boolean))
   }
 
-  const allAllowedRelations = new Set([
+  if (allowedRelations.length && expand) {
-    ...Array.from(allAllowedFields),
+    const allAllowedRelations = new Set([...allowedRelations])
-    ...allowedRelations,
+
-  ])
+    const notAllowedRelations = getSetDifference(
-  const notAllowedRelations = !allowedRelations.length
+      allRelations,
-    ? new Set()
+      allAllowedRelations
-    : getSetDifference(allRelations, allAllowedRelations)
+    )
 
     if (allRelations.size && notAllowedRelations.size) {
       throw new MedusaError(
@@ -157,6 +158,7 @@ export function prepareListQuery<
         )}] are not valid`
       )
     }
+  }
   // End of expand compatibility
 
   let orderBy: { [k: symbol]: "DESC" | "ASC" } | undefined = {}