fix: querying virtual fields deeply with draft: true (#12868)

Fixes an issue when querying deeply new relationship virtual fields with
`draft: true`. Changes the method for `where` sanitization, before it
was done in `validateSearchParam` which didn't work with versions
properly, now there's a separate `sanitizeWhereQuery` function that does
this.

Author: r1tsuu

packages/payload/src/collections/operations/count.ts

@@ -6,6 +6,7 @@ import type { Collection } from '../config/types.js'
 importexecuteAccessfrom'../../auth/executeAccess.js'
 import{combineQueries}from'../../database/combineQueries.js'
 import{validateQueryPaths}from'../../database/queryValidation/validateQueryPaths.js'
+import{sanitizeWhereQuery}from'../../database/sanitizeWhereQuery.js'
 import{killTransaction}from'../../utilities/killTransaction.js'
 import{buildAfterOperation}from'./utils.js'
 
@@ -71,6 +72,7 @@ export const countOperation = async <TSlug extends CollectionSlug>(
 letresult: {totalDocs: number}
 
 constfullWhere=combineQueries(where!,accessResult!)
+sanitizeWhereQuery({fields: collectionConfig.flattenedFields, payload,where: fullWhere})
 
 awaitvalidateQueryPaths({
  collectionConfig,

packages/payload/src/collections/operations/countVersions.ts

@@ -5,6 +5,7 @@ import type { Collection } from '../config/types.js'
 importexecuteAccessfrom'../../auth/executeAccess.js'
 import{combineQueries}from'../../database/combineQueries.js'
 import{validateQueryPaths}from'../../database/queryValidation/validateQueryPaths.js'
+import{sanitizeWhereQuery}from'../../database/sanitizeWhereQuery.js'
 import{buildVersionCollectionFields,typeCollectionSlug}from'../../index.js'
 import{killTransaction}from'../../utilities/killTransaction.js'
 import{buildAfterOperation}from'./utils.js'
@@ -77,6 +78,8 @@ export const countVersionsOperation = async <TSlug extends CollectionSlug>(
 
 constversionFields=buildVersionCollectionFields(payload.config,collectionConfig,true)
 
+sanitizeWhereQuery({fields: versionFields, payload,where: fullWhere})
+
 awaitvalidateQueryPaths({
  collectionConfig,
 overrideAccess: overrideAccess!,

packages/payload/src/collections/operations/delete.ts

@@ -13,6 +13,7 @@ import type {
 importexecuteAccessfrom'../../auth/executeAccess.js'
 import{combineQueries}from'../../database/combineQueries.js'
 import{validateQueryPaths}from'../../database/queryValidation/validateQueryPaths.js'
+import{sanitizeWhereQuery}from'../../database/sanitizeWhereQuery.js'
 import{APIError}from'../../errors/index.js'
 import{afterRead}from'../../fields/hooks/afterRead/index.js'
 import{deleteUserPreferences}from'../../preferences/deleteUserPreferences.js'
@@ -107,6 +108,8 @@ export const deleteOperation = async <
 
 constfullWhere=combineQueries(where,accessResult!)
 
+sanitizeWhereQuery({fields: collectionConfig.flattenedFields, payload,where: fullWhere})
+
 constselect=sanitizeSelect({
 fields: collectionConfig.flattenedFields,
 forceSelect: collectionConfig.forceSelect,

packages/payload/src/collections/operations/find.ts

@@ -19,6 +19,7 @@ import executeAccess from '../../auth/executeAccess.js'
 import{combineQueries}from'../../database/combineQueries.js'
 import{validateQueryPaths}from'../../database/queryValidation/validateQueryPaths.js'
 import{sanitizeJoinQuery}from'../../database/sanitizeJoinQuery.js'
+import{sanitizeWhereQuery}from'../../database/sanitizeWhereQuery.js'
 import{afterRead}from'../../fields/hooks/afterRead/index.js'
 import{lockedDocumentsCollectionSlug}from'../../locked-documents/config.js'
 import{killTransaction}from'../../utilities/killTransaction.js'
@@ -144,6 +145,7 @@ export const findOperation = async <
 letresult: PaginatedDocs<DataFromCollectionSlug<TSlug>>
 
 letfullWhere=combineQueries(where!,accessResult!)
+sanitizeWhereQuery({fields: collectionConfig.flattenedFields, payload,where: fullWhere})
 
 constsort=sanitizeSortQuery({
 fields: collection.config.flattenedFields,

packages/payload/src/collections/operations/findByID.ts

@@ -18,6 +18,7 @@ import type {
 importexecuteAccessfrom'../../auth/executeAccess.js'
 import{combineQueries}from'../../database/combineQueries.js'
 import{sanitizeJoinQuery}from'../../database/sanitizeJoinQuery.js'
+import{sanitizeWhereQuery}from'../../database/sanitizeWhereQuery.js'
 import{NotFound}from'../../errors/index.js'
 import{afterRead}from'../../fields/hooks/afterRead/index.js'
 import{validateQueryPaths}from'../../index.js'
@@ -110,6 +111,12 @@ export const findByIDOperation = async <
 
 constfullWhere=combineQueries(where,accessResult)
 
+sanitizeWhereQuery({
+fields: collectionConfig.flattenedFields,
+payload: args.req.payload,
+where: fullWhere,
+})
+
 constsanitizedJoins=awaitsanitizeJoinQuery({
  collectionConfig,
  joins,

packages/payload/src/collections/operations/findVersions.ts

@@ -7,6 +7,7 @@ import type { Collection } from '../config/types.js'
 importexecuteAccessfrom'../../auth/executeAccess.js'
 import{combineQueries}from'../../database/combineQueries.js'
 import{validateQueryPaths}from'../../database/queryValidation/validateQueryPaths.js'
+import{sanitizeWhereQuery}from'../../database/sanitizeWhereQuery.js'
 import{afterRead}from'../../fields/hooks/afterRead/index.js'
 import{killTransaction}from'../../utilities/killTransaction.js'
 import{sanitizeInternalFields}from'../../utilities/sanitizeInternalFields.js'
@@ -71,9 +72,10 @@ export const findVersionsOperation = async <TData extends TypeWithVersion<TData>
 })
 
 constfullWhere=combineQueries(where!,accessResults)
+sanitizeWhereQuery({fields: versionFields, payload,where: fullWhere})
 
 constselect=sanitizeSelect({
-fields: buildVersionCollectionFields(payload.config,collectionConfig,true),
+fields: versionFields,
 forceSelect: getQueryDraftsSelect({select: collectionConfig.forceSelect}),
 select: incomingSelect,
 versions: true,

packages/payload/src/collections/operations/update.ts

@@ -15,7 +15,8 @@ import type {
 importexecuteAccessfrom'../../auth/executeAccess.js'
 import{combineQueries}from'../../database/combineQueries.js'
 import{validateQueryPaths}from'../../database/queryValidation/validateQueryPaths.js'
-import{APIError,Forbidden}from'../../errors/index.js'
+import{sanitizeWhereQuery}from'../../database/sanitizeWhereQuery.js'
+import{APIError}from'../../errors/index.js'
 import{typeCollectionSlug,deepCopyObjectSimple}from'../../index.js'
 import{generateFileData}from'../../uploads/generateFileData.js'
 import{unlinkTempFiles}from'../../uploads/unlinkTempFiles.js'
@@ -140,6 +141,8 @@ export const updateOperation = async <
 
 constfullWhere=combineQueries(where,accessResult!)
 
+sanitizeWhereQuery({fields: collectionConfig.flattenedFields, payload,where: fullWhere})
+
 constsort=sanitizeSortQuery({
 fields: collection.config.flattenedFields,
 sort: incomingSort,

packages/payload/src/database/queryValidation/validateSearchParams.ts

@@ -113,9 +113,6 @@ export async function validateSearchParam({
 if('virtual'infield&&field.virtual){
 if(field.virtual===true){
 errors.push({ path })
-}else{
-constraint[`${field.virtual}`askeyofWhereField]=constraint[pathaskeyofWhereField]
-deleteconstraint[pathaskeyofWhereField]
 }
 }
 

packages/payload/src/database/sanitizeWhereQuery.ts

@@ -0,0 +1,64 @@
+importtype{FlattenedField}from'../fields/config/types.js'
+importtype{Payload,Where}from'../types/index.js'
+
+/**
+ * Currently used only for virtual fields linked with relationships
+ */
+exportconstsanitizeWhereQuery=({
+ fields,
+ payload,
+ where,
+}: {
+fields: FlattenedField[]
+payload: Payload
+where: Where
+})=>{
+for(constkeyinwhere){
+constvalue=where[key]
+
+if(['and','or'].includes(key.toLowerCase())&&Array.isArray(value)){
+for(constwhereofvalue){
+sanitizeWhereQuery({ fields, payload, where })
+}
+continue
+}
+
+constpaths=key.split('.')
+letpathHasChanged=false
+
+letcurrentFields=fields
+
+for(leti=0;i<paths.length;i++){
+constpath=paths[i]!
+constfield=currentFields.find((each)=>each.name===path)
+
+if(!field){
+break
+}
+
+if('virtual'infield&&field.virtual&&typeoffield.virtual==='string'){
+paths[i]=field.virtual
+pathHasChanged=true
+}
+
+if('flattenedFields'infield){
+currentFields=field.flattenedFields
+}
+
+if(
+(field.type==='relationship'||field.type==='upload')&&
+typeoffield.relationTo==='string'
+){
+constrelatedCollection=payload.collections[field.relationTo]
+if(relatedCollection){
+currentFields=relatedCollection.config.flattenedFields
+}
+}
+}
+
+if(pathHasChanged){
+where[paths.join('.')]=where[key]!
+deletewhere[key]
+}
+}
+}

test/database/config.ts

@@ -38,6 +38,7 @@ export default buildConfigWithDefaults({
 collections: [
 {
 slug: 'categories',
+versions: {drafts: true},
 fields: [
 {
 type: 'text',