@objectstack/runtime 3.0.9 → 3.0.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/runtime",
-  "version": "3.0.9",
+  "version": "3.0.10",
   "license": "Apache-2.0",
   "description": "ObjectStack Core Runtime & Query Engine",
   "type": "module",
@@ -15,10 +15,10 @@
   },
   "dependencies": {
     "zod": "^4.3.6",
-    "@objectstack/rest": "3.0.9",
-    "@objectstack/core": "3.0.9",
-    "@objectstack/spec": "3.0.9",
-    "@objectstack/types": "3.0.9"
+    "@objectstack/core": "3.0.10",
+    "@objectstack/rest": "3.0.10",
+    "@objectstack/spec": "3.0.10",
+    "@objectstack/types": "3.0.10"
   },
   "devDependencies": {
     "typescript": "^5.0.0",

package/src/http-dispatcher.ts

@@ -377,8 +377,14 @@ export class HttpDispatcher {
             // GET /data/:object/:id
             if (parts.length === 2 && m === 'GET') {
                 const id = parts[1];
+                // Spec: Only select/expand are allowlisted query params for GET by ID.
+                // All other query parameters are discarded to prevent parameter pollution.
+                const { select, expand } = query || {};
+                const allowedParams: Record<string, unknown> = {};
+                if (select != null) allowedParams.select = select;
+                if (expand != null) allowedParams.expand = expand;
                 // Spec: broker returns GetDataResponse = { object, id, record }
-                const result = await broker.call('data.get', { object: objectName, id, ...query }, { request: context.request });
+                const result = await broker.call('data.get', { object: objectName, id, ...allowedParams }, { request: context.request });
                 return { handled: true, response: this.success(result) };
             }
 
@@ -401,7 +407,7 @@ export class HttpDispatcher {
             // GET /data/:object (List)
             if (m === 'GET') {
                 // Spec: broker returns FindDataResponse = { object, records, total?, hasMore? }
-                const result = await broker.call('data.query', { object: objectName, filters: query }, { request: context.request });
+                const result = await broker.call('data.query', { object: objectName, query }, { request: context.request });
                 return { handled: true, response: this.success(result) };
             }
 
@@ -941,8 +947,9 @@ export class HttpDispatcher {
                         const { object, operation } = endpoint.objectParams;
                         // Map standard CRUD operations
                         if (operation === 'find') {
-                             const result = await broker.call('data.query', { object, filters: query }, { request: context.request });
-                             return { handled: true, response: this.success(result.data, { count: result.count }) };
+                             const result = await broker.call('data.query', { object, query }, { request: context.request });
+                             // Spec: FindDataResponse = { object, records, total?, hasMore? }
+                             return { handled: true, response: this.success(result.records, { total: result.total }) };
                         }
                         if (operation === 'get' && query.id) {
                              const result = await broker.call('data.get', { object, id: query.id }, { request: context.request });