next-data-kit 7.1.0 → 7.3.0

package/dist/index.d.cts

@@ -160,6 +160,7 @@ type TBaseOptions<TDoc, R> = {
     filterAllowed?: string[];
     maxLimit?: number;
     queryAllowed?: (keyof TDoc | string)[];
+    sortAllowed?: (keyof TDoc | string)[];
 };
 /**
  * Options when using a Mongoose model
@@ -565,6 +566,10 @@ declare const DataKit: <TAction extends (input: TDataKitInput<unknown>) => Promi
     limit?: {
         default: number;
     };
+    defaultSort?: {
+        path: string;
+        value: 1 | -1;
+    }[];
     className?: string;
     autoFetch?: boolean;
     debounce?: number;

package/dist/index.d.ts

@@ -160,6 +160,7 @@ type TBaseOptions<TDoc, R> = {
     filterAllowed?: string[];
     maxLimit?: number;
     queryAllowed?: (keyof TDoc | string)[];
+    sortAllowed?: (keyof TDoc | string)[];
 };
 /**
  * Options when using a Mongoose model
@@ -565,6 +566,10 @@ declare const DataKit: <TAction extends (input: TDataKitInput<unknown>) => Promi
     limit?: {
         default: number;
     };
+    defaultSort?: {
+        path: string;
+        value: 1 | -1;
+    }[];
     className?: string;
     autoFetch?: boolean;
     debounce?: number;

package/dist/index.js

@@ -153,7 +153,7 @@ var mongooseAdapter = (model, options = {}) => {
 };
 
 // src/server/action.ts
-async function executeDataKit(input, adapter, item, maxLimit, filterAllowed, queryAllowed) {
+async function executeDataKit(input, adapter, item, maxLimit, filterAllowed, queryAllowed, sortAllowed) {
   if (input.query) {
     const safeQuery = {};
     Object.keys(input.query).forEach((key) => {
@@ -186,6 +186,13 @@ async function executeDataKit(input, adapter, item, maxLimit, filterAllowed, que
     });
     input.filter = safeFilter;
   }
+  if (input.sorts && sortAllowed) {
+    input.sorts.forEach((sort) => {
+      if (!sortAllowed.includes(sort.path)) {
+        throw new Error(`[Security] Sort field '${sort.path}' is not allowed.`);
+      }
+    });
+  }
   switch (input.action ?? "FETCH") {
     case "FETCH": {
       if (!input.limit || !input.page) {
@@ -213,7 +220,7 @@ async function executeDataKit(input, adapter, item, maxLimit, filterAllowed, que
   }
 }
 async function dataKitServerAction(props) {
-  const { input, item, maxLimit = 100, queryAllowed, filterAllowed: explicitFilterAllowed } = props;
+  const { input, item, maxLimit = 100, queryAllowed, filterAllowed: explicitFilterAllowed, sortAllowed } = props;
   const filterCustom = "filterCustom" in props ? props.filterCustom : void 0;
   const filterAllowed = explicitFilterAllowed ?? (filterCustom ? Object.keys(filterCustom) : void 0);
   let finalAdapter;
@@ -229,7 +236,7 @@ async function dataKitServerAction(props) {
   } else {
     throw new Error("Either model or adapter must be provided");
   }
-  return executeDataKit(input, finalAdapter, item, maxLimit, filterAllowed, queryAllowed);
+  return executeDataKit(input, finalAdapter, item, maxLimit, filterAllowed, queryAllowed, sortAllowed);
 }
 
 // src/server/adapters/memory.ts
@@ -1401,6 +1408,7 @@ var DataKitInner = (props, ref) => {
     filterConfig,
     filters = [],
     limit: limitConfig,
+    defaultSort = [],
     className,
     autoFetch = true,
     debounce: debounce2 = 300,
@@ -1423,7 +1431,7 @@ var DataKitInner = (props, ref) => {
     initial: {
       limit: limitConfig?.default ?? 10,
       query: query ?? {},
-      sorts: [],
+      sorts: defaultSort,
       filter: filters.reduce((acc, f) => {
         if (f.defaultValue !== void 0) acc[f.id] = f.defaultValue;
         return acc;