Merge pull request #3 from nothingbuttumbleweed/master

cleanQuery method before the middleware is called
florianholzapfel · Jun 18, 2013 · a76572b · a76572b
2 parents 719bad3 + 807f7ac
commit a76572b
Showing 1 changed file with 45 additions and 41 deletions.
diff --git a/lib/express-restify-mongoose.js b/lib/express-restify-mongoose.js
@@ -41,56 +41,60 @@ var restify = function(app, model, options) {
 	} else {
 		options.middleware = [];
 	}
+    options.middleware.unshift(cleanQuery);
+
+    var queryOptions = {protected: ["skip", "limit", "sort", "populate"], current: {}};
 
 	var uri_items = util.format('%s%s/%ss', options.prefix, options.version, model.modelName);
 	var uri_item = util.format('%s%s/%ss/:id', options.prefix, options.version, model.modelName);
-
-	function buildQuery(query, options) {
-		var skip = options.skip;
-		var limit = options.limit;
-		var sort = options.sort;
-		var populate = options.populate;
 
-		delete options.skip;
-		delete options.limit;
-		delete options.sort;
-		delete options.populate;
-
+    function cleanQuery(req, res, next) {
+        queryOptions.current = {};
+        for(var key in req.query) {
+            if(!model.schema.paths.hasOwnProperty(key)) {
+                if(queryOptions.protected.indexOf(key) != -1) {
+                    queryOptions.current[key] = req.query[key];
+                }
+                delete req.query[key];
+            }
+        }
+        next();
+    }
+
+	function buildQuery(query, options) {
 		for(var key in options) {
-			if(model.schema.paths.hasOwnProperty(key)) {
-				query.where(key);
+            query.where(key);
 
-				var value = options[key];
-				if('>' == value[0]) {
-					if('=' == value[1]) {
-						query.gte(value.substr(2));
-					} else {
-						query.gt(value.substr(1));
-					}
-				}
-				else if('<' == value[0]) {
-					if('=' == value[1]) {
-						query.lte(value.substr(2));
-					} else {
-						query.lt(value.substr(1));
-					}
-				} else {
-					query.equals(value);
-				}
-			}
+            var value = options[key];
+            if('>' == value[0]) {
+                if('=' == value[1]) {
+                    query.gte(value.substr(2));
+                } else {
+                    query.gt(value.substr(1));
+                }
+            }
+            else if('<' == value[0]) {
+                if('=' == value[1]) {
+                    query.lte(value.substr(2));
+                } else {
+                    query.lt(value.substr(1));
+                }
+            } else {
+                query.equals(value);
+            }
 		}
 
-		if(skip) {
-			query.skip(skip);
+		if(queryOptions.current.skip) {
+			query.skip(queryOptions.current.skip);
 		}
-		if(limit) {
-			query.limit(limit);
+		if(queryOptions.current.limit) {
+			query.limit(queryOptions.current.limit);
 		}
-		if(sort) {
-			query.sort(sort);
+		if(queryOptions.current.sort) {
+			query.sort(queryOptions.current.sort);
 		}
-		if(populate) {
-			var arr = populate.split(',');
+		if(queryOptions.current.populate) {
+			var arr = queryOptions.current.populate.split(',');
 			for(var i = 0; i < arr.length; ++i) {
 				query = query.populate(arr[i]);
 			}
@@ -136,7 +140,7 @@ var restify = function(app, model, options) {
 	write_middleware.push(ensureContentType);
 
 	app.get(uri_items, options.middleware, function(req, res) {
-		buildQuery(model.find(), req.query).exec(function(err, items) {
+        buildQuery(model.find(), req.query).exec(function(err, items) {
 			if(err) {
 				res.send(400, 'Bad request');
 			} else {
@@ -179,4 +183,4 @@ var restify = function(app, model, options) {
 	});
 };
 
-module.exports.serve = restify;
+module.exports.serve = restify;