Skip to content

Commit e81e3bf

Browse files
committed
enforce filter by scopes to have exact matches with the allowed_scopes
if we encounter an exact match on requested_field with allowed_scopes do not continue to check for additional filter with attribute and predicate.
1 parent 7181844 commit e81e3bf

1 file changed

Lines changed: 12 additions & 6 deletions

File tree

lib/jsonapi/filtering.rb

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -64,15 +64,21 @@ def jsonapi_filter_params(allowed_fields, allowed_scopes)
6464
to_filter = to_filter.split(',')
6565
end
6666

67-
# filter by attributes
68-
# {"first_name_eq"=>"Beau"}
69-
if predicates.any? && (field_names - allowed_fields).empty?
67+
# filter by scopes expects an exact match
68+
# with the `allowed_scopes`. Predicates can be a part of named scopes
69+
# and should be handled first
70+
# Make sure to move to the next after a match
71+
# {"created_before"=>"2013-02-01"}
72+
# {"created_before_gt"=>"2013-02-01"}
73+
if allowed_scopes.include?(requested_field)
7074
filtered[requested_field] = to_filter
75+
next
7176
end
7277

73-
# filter by scopes
74-
# {"created_before"=>"2013-02-01"}
75-
if (field_names - allowed_scopes).empty?
78+
79+
# filter by attributes
80+
# {"first_name_eq"=>"Beau"}
81+
if predicates.any? && (field_names - allowed_fields).empty?
7682
filtered[requested_field] = to_filter
7783
end
7884
end

0 commit comments

Comments
 (0)