{"version":3,"file":"params.mjs","sources":["../../../src/services/document-service/params.ts"],"sourcesContent":["import { pick } from 'lodash/fp';\nimport type { UID, Modules } from '@strapi/types';\nimport { SHARED_QUERY_PARAM_KEYS } from '@strapi/utils';\n\n/**\n * Division of allowlists:\n *\n * - ALLOWED_DOCUMENT_PARAM_KEYS: keys that are passed through to the query builder\n *   (transformParamsToQuery → convert-query-params). Only these affect the actual query.\n *   Used by pickAllowedQueryParams() so unknown keys are stripped before the transformer.\n *\n * - ALLOWED_DOCUMENT_ROOT_PARAM_KEYS: keys we accept at the document service entry when\n *   api.documents.strictParams is true (checkUnrecognizedRootParams). Must be a superset\n *   of ALLOWED_DOCUMENT_PARAM_KEYS. Can include keys we accept but do not pass to the\n *   query builder (e.g. REST-shaped keys that callers send; we allow them then strip).\n */\n\n/**\n * Keys passed to the query-params transformer. = SHARED_QUERY_PARAM_KEYS + withCount.\n */\nexport const ALLOWED_DOCUMENT_PARAM_KEYS = [...SHARED_QUERY_PARAM_KEYS, 'withCount'] as const;\n\n/**\n * Keys allowed at root when strictParams is true. = ALLOWED_DOCUMENT_PARAM_KEYS plus:\n * - data: create/update payload (never part of query params)\n * - pagination, count, ordering: REST-style keys core-api may pass; accepted then stripped (query builder uses flat page/pageSize/start/limit and does not use count/ordering at root)\n */\nexport const ALLOWED_DOCUMENT_ROOT_PARAM_KEYS = [\n  ...ALLOWED_DOCUMENT_PARAM_KEYS,\n  'data',\n  'pagination',\n  'count',\n  'ordering',\n] as const;\n\n/** Restrict to allowed query keys so only these reach the query-params transformer (security). */\nexport const pickAllowedQueryParams = (\n  params: Record<string, unknown>\n): Record<(typeof ALLOWED_DOCUMENT_PARAM_KEYS)[number], unknown> =>\n  pick(ALLOWED_DOCUMENT_PARAM_KEYS as unknown as string[], params) as Record<\n    (typeof ALLOWED_DOCUMENT_PARAM_KEYS)[number],\n    unknown\n  >;\n\nconst pickSelectionParams = <TUID extends UID.ContentType>(\n  data: unknown\n): Modules.Documents.Params.Pick<TUID, 'fields' | 'populate' | 'status'> => {\n  return pick(['fields', 'populate', 'status'], data);\n};\n\nexport { pickSelectionParams };\n"],"names":["ALLOWED_DOCUMENT_PARAM_KEYS","SHARED_QUERY_PARAM_KEYS","ALLOWED_DOCUMENT_ROOT_PARAM_KEYS","pickAllowedQueryParams","params","pick","pickSelectionParams","data"],"mappings":";;;AAIA;;;;;;;;;;;;;UAgBaA,2BAAAA,GAA8B;AAAIC,IAAAA,GAAAA,uBAAAA;AAAyB,IAAA;;AAExE;;;;UAKaC,gCAAAA,GAAmC;AAC3CF,IAAAA,GAAAA,2BAAAA;AACH,IAAA,MAAA;AACA,IAAA,YAAA;AACA,IAAA,OAAA;AACA,IAAA;;AAGF,mGACO,MAAMG,sBAAAA,GAAyB,CACpCC,MAAAA,GAEAC,IAAAA,CAAKL,6BAAoDI,MAAAA;AAK3D,MAAME,sBAAsB,CAC1BC,IAAAA,GAAAA;AAEA,IAAA,OAAOF,IAAAA,CAAK;AAAC,QAAA,QAAA;AAAU,QAAA,UAAA;AAAY,QAAA;KAAS,EAAEE,IAAAA,CAAAA;AAChD;;;;"}