database-proxy
Version:
Through a set of access control rules configuration database access to realize the client directly access the database via HTTP.
28 lines (27 loc) • 950 B
JavaScript
;
Object.defineProperty(exports, "__esModule", { value: true });
exports.LookupHandler = void 0;
const types_1 = require("../../types");
/**
* 此验证器是缺省验证器，不可配置：
* - 检查 aggregate 操作中是否包含 $lookup，并禁止客户端进行 $lookup 操作
*
* @TODO 未来可考虑支持 $lookup 的子查询权限验证，相对复杂，暂不考虑
*
* @param config
* @param context
*/
const LookupHandler = async function (_config, context) {
var _a;
const { action } = context.params;
if (action !== types_1.ActionType.AGGREGATE) {
return null;
}
const stages = ((_a = context.params) === null || _a === void 0 ? void 0 : _a.stages) || [];
const [foundLookup] = stages.filter((item) => item.stageKey === '$lookup');
if (foundLookup) {
return '$lookup operation is forbidden for client';
}
return null;
};
exports.LookupHandler = LookupHandler;