next-data-kit 7.2.0 → 7.3.0

package/README.md

@@ -292,6 +292,7 @@ dataKitServerAction({
   maxLimit?: number,          // Default: 100
   queryAllowed?: string[],    // Whitelist for query fields
   filterAllowed?: string[],   // Auto-derived from filterCustom
+  sortAllowed?: string[],     // Whitelist for sortable fields
 });
 ```
 
@@ -320,12 +321,13 @@ dataKitServerAction({
   maxLimit?: number,
   queryAllowed?: string[],
   filterAllowed?: string[],
+  sortAllowed?: string[],
 });
 ```
 
 ### Security & Filtering
 
-**Two ways to query data:**
+**Three security whitelists:**
 
 1. **`filterCustom`** - User-facing filters (search, dropdowns, etc.)
      - Client `filters` prop → validated against `filterCustom` keys
@@ -335,6 +337,10 @@ dataKitServerAction({
      - Explicit whitelist required
      - Use for: `{ active: true }`, user-specific queries
 
+3. **`sortAllowed`** - Sortable fields whitelist
+     - Prevents sorting on arbitrary/sensitive fields
+     - Recommended for production security
+
 ```typescript
 dataKitServerAction({
 	model: UserModel,
@@ -345,6 +351,7 @@ dataKitServerAction({
 		role: value => ({ role: value }),
 	},
 	queryAllowed: ['organizationId', 'active'],
+	sortAllowed: ['name', 'email', 'createdAt'], // Only allow sorting these fields
 });
 ```
 

package/dist/{action-C-MJOe6-.d.cts → action-De2eEXMg.d.cts}

@@ -157,6 +157,7 @@ type TBaseOptions<TDoc, R> = {
     filterAllowed?: string[];
     maxLimit?: number;
     queryAllowed?: (keyof TDoc | string)[];
+    sortAllowed?: (keyof TDoc | string)[];
 };
 /**
  * Options when using a Mongoose model

package/dist/{action-C-MJOe6-.d.ts → action-De2eEXMg.d.ts}

@@ -157,6 +157,7 @@ type TBaseOptions<TDoc, R> = {
     filterAllowed?: string[];
     maxLimit?: number;
     queryAllowed?: (keyof TDoc | string)[];
+    sortAllowed?: (keyof TDoc | string)[];
 };
 /**
  * Options when using a Mongoose model

package/dist/index.cjs

@@ -179,7 +179,7 @@ var mongooseAdapter = (model, options = {}) => {
 };
 
 // src/server/action.ts
-async function executeDataKit(input, adapter, item, maxLimit, filterAllowed, queryAllowed) {
+async function executeDataKit(input, adapter, item, maxLimit, filterAllowed, queryAllowed, sortAllowed) {
   if (input.query) {
     const safeQuery = {};
     Object.keys(input.query).forEach((key) => {
@@ -212,6 +212,13 @@ async function executeDataKit(input, adapter, item, maxLimit, filterAllowed, que
     });
     input.filter = safeFilter;
   }
+  if (input.sorts && sortAllowed) {
+    input.sorts.forEach((sort) => {
+      if (!sortAllowed.includes(sort.path)) {
+        throw new Error(`[Security] Sort field '${sort.path}' is not allowed.`);
+      }
+    });
+  }
   switch (input.action ?? "FETCH") {
     case "FETCH": {
       if (!input.limit || !input.page) {
@@ -239,7 +246,7 @@ async function executeDataKit(input, adapter, item, maxLimit, filterAllowed, que
   }
 }
 async function dataKitServerAction(props) {
-  const { input, item, maxLimit = 100, queryAllowed, filterAllowed: explicitFilterAllowed } = props;
+  const { input, item, maxLimit = 100, queryAllowed, filterAllowed: explicitFilterAllowed, sortAllowed } = props;
   const filterCustom = "filterCustom" in props ? props.filterCustom : void 0;
   const filterAllowed = explicitFilterAllowed ?? (filterCustom ? Object.keys(filterCustom) : void 0);
   let finalAdapter;
@@ -255,7 +262,7 @@ async function dataKitServerAction(props) {
   } else {
     throw new Error("Either model or adapter must be provided");
   }
-  return executeDataKit(input, finalAdapter, item, maxLimit, filterAllowed, queryAllowed);
+  return executeDataKit(input, finalAdapter, item, maxLimit, filterAllowed, queryAllowed, sortAllowed);
 }
 
 // src/server/adapters/memory.ts