Adapter-specific query leak in FeathersJS service pagination
0 reputation · 10 Oct 2021, 20:17 UTC
0 reputation · 10 Oct 2021, 20:17 UTC
FeathersJS delegates query filtering and pagination logic directly to the underlying database adapter. While this allows for high performance, the framework does not provide a unified abstraction layer to normalize query syntax across different database drivers.
When transitioning a service from a NoSQL adapter to a SQL adapter, or when supporting multiple database types, the find method parameters may cause unexpected behavior because the adapter passes these filters directly to the driver without validation against a generic schema.
This creates a risk where adapter-specific query operators leak into the application logic, making the service layer tightly coupled to a specific database implementation.
find parameters before they reach the adapter?Use a before hook on the service’s find method to filter or translate params.query before it reaches the adapter. This hook provides a single place to enforce a common query syntax and prevent adapter‑specific operators from leaking into your service layer.
params.query object directly to the underlying adapter; the framework does not insert a universal normalization layer.$limit, $skip, $sort, $select, $or, $gt, $lt, $in, etc.). Any unknown keys are forwarded unchanged, which allows adapter‑specific operators to leak.before hook can inspect, remove, or map keys in context.params.query and then let the cleaned query continue to the adapter.normalizeQuery.js) that:
$limit, $skip, $sort to keep pagination intact.// app.hooks.js
module.exports = {
before: {
find: [ normalizeQuery ]
}
};
Do you need to retain any adapter‑specific operators (e.g., Sequelize.Op.like, MongoDB $text) in your normalized query? If yes, you must extend the hook with a translation map; if no, a simple whitelist‑filter is sufficient.
Use comments to ask for clarification. Post a solution as an answer.
No question comments on this page.