@rtorcato/db-common / allow

Function: allow()

allow<T>(items, cols): T[]

Defined in: allow.ts:11

Keep only the items whose col is in the allowlist. Column identifiers can't be parameterized, so when where/orderBy input comes from a query string the caller must allowlist columns before mapping them into SQL — otherwise a junk ?sort=name;DROP… rides through. Works on Condition[] and Sort[] alike (both have a col).

allow(where({ status: 'active', evil: 1 }), ['status']) // → [{ col: 'status', op: 'eq', val: 'active' }]

Type Parameters

T

T extends object

Parameters

items

T[]

cols

readonly string[]

Returns

T[]