Skip to content

New: Add queryHook for role-agnostic query filtering #106

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
taylortom merged 1 commit into from
Jun 15, 2026
Merged

New: Add queryHook for role-agnostic query filtering #106

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 13 additions & 2 deletions lib/AbstractApiModule.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,12 +110,22 @@ class AbstractApiModule extends AbstractModule {
this.accessCheckHook = new Hook()
/**
* Hook invoked before a query runs, allowing observers to merge access-control clauses into
* `req.apiData.query`. Preferred over `accessCheckHook` for filtering: keeps pagination counts
* and the `Link` header accurate, and avoids any need to top up short pages.
* `req.apiData.query`. Preferred over `accessCheckHook` for access filtering: keeps pagination
* counts and the `Link` header accurate, and avoids any need to top up short pages.
* Skipped for super users so they see unfiltered results, matching `checkAccess` behaviour.
* For user-driven query filters that must apply regardless of role, use `queryHook` instead.
* @type {Hook}
*/
this.accessQueryHook = new Hook()
/**
* Hook invoked before a list query runs, allowing observers to merge user-driven filter clauses
* into `req.apiData.query` (e.g. dashboard filters sourced from another collection). Unlike
* `accessQueryHook` this runs for every user, including super users — it expresses what the user
* asked to see, not what they are permitted to see. Runs after `requestHook` and before
* pagination, so counts and the `Link` header stay accurate.
* @type {Hook}
*/
this.queryHook = new Hook({ mutable: true })

await this.setValues()
this.validateValues()
Expand Down Expand Up @@ -495,6 +505,7 @@ class AbstractApiModule extends AbstractModule {
Object.keys(req.apiData.query).forEach(key => delete opts[key])

await this.requestHook.invoke(req)
await this.queryHook.invoke(req)
if (!req.auth.isSuper) await this.accessQueryHook.invoke(req)

await this.setUpPagination(req, res, mongoOpts)
Expand Down
Loading