fix(medusa): Allowed properties expand (#4600)

What:
The expand allowed properties should allow all the segments whereas the allowed fields should be specific

packages/medusa/src/api/middlewares/transform-query.ts

@@ -11,6 +11,7 @@ import { BaseEntity } from "../../interfaces"
 import { FindConfig, QueryConfig, RequestQueryFields } from "../../types/common"
 import { omit } from "lodash"
 import { removeUndefinedProperties } from "../../utils"
+import { buildSelects, objectToStringPath } from "@medusajs/utils"
 
 /**
  * Middleware that transform the query input for the admin end points
@@ -151,7 +152,7 @@ function getStoreAllowedProperties<TEntity extends BaseEntity>(
       ? [...(validated.expand?.split(",") || []), ...includeKeys]
       : queryConfig?.allowedRelations || []
 
-  allowed.push(...fields, ...expand)
+  allowed.push(...fields, ...objectToStringPath(buildSelects(expand)))
 
   return allowed
 }
@@ -180,7 +181,7 @@ function getAllowedProperties<TEntity extends BaseEntity>(
       ? [...(validated.expand?.split(",") || []), ...includeKeys]
       : queryConfig?.defaultRelations || []
 
-  allowed.push(...fields, ...expand)
+  allowed.push(...fields, ...objectToStringPath(buildSelects(expand)))
 
   return allowed as string[]
 }

packages/medusa/src/api/routes/admin/orders/__tests__/get-order.js

@@ -50,7 +50,7 @@ describe("GET /admin/orders", () => {
             }
           ),
           // TODO [MEDUSA_FF_SALES_CHANNELS]: Remove when sales channel flag is removed entirely
-          relations: [...defaultAdminOrdersRelations, "sales_channel"],
+          relations: [...defaultAdminOrdersRelations, "sales_channel"].sort(),
         },
         {
           includes: undefined,

packages/medusa/src/api/routes/admin/orders/get-order.ts

@@ -72,7 +72,7 @@ export default async (req, res) => {
 
   order = cleanResponseData(order, req.allowedProperties)
 
-  res.json({ order: cleanResponseData(order, []) })
+  res.json({ order: order })
 }
 
 export class AdminGetOrdersOrderParams extends FindParams {}

packages/medusa/src/api/routes/admin/products/__tests__/get-product.js

@@ -56,16 +56,16 @@ describe("GET /admin/products/:id", () => {
             "metadata",
           ],
           relations: [
-            "variants",
-            "variants.prices",
-            "variants.options",
-            "profiles",
+            "collection",
             "images",
             "options",
+            "profiles",
+            "sales_channels",
             "tags",
             "type",
-            "collection",
-            "sales_channels",
+            "variants",
+            "variants.options",
+            "variants.prices",
           ],
         }
       )