Simplify fields and includes prior to fetch

No Issue - allows comma separated include and field parameters to also have a space - allows capitals in include and field parameters
TryGhost · Oct 22, 2015 · 7a996ec · 7a996ec
1 parent d666fba
commit 7a996ec
Show file tree

Hide file tree

Showing 2 changed files with 58 additions and 11 deletions.
diff --git a/core/server/api/utils.js b/core/server/api/utils.js
@@ -113,7 +113,7 @@ utils = {
                 slug: {isSlug: true},
                 page: {matches: /^\d+$/},
                 limit: {matches: /^\d+|all$/},
-                fields: {matches: /^[a-z0-9_,]+$/},
+                fields: {matches: /^[\w, ]+$/},
                 name: {}
             },
             // these values are sanitised/validated separately
@@ -218,20 +218,23 @@ utils = {
         };
     },
 
-    prepareInclude: function prepareInclude(include, allowedIncludes) {
-        include = include || '';
-        include = _.intersection(include.split(','), allowedIncludes);
+    trimAndLowerCase: function trimAndLowerCase(params) {
+        params = params || '';
+        if (_.isString(params)) {
+            params = params.split(',');
+        }
 
-        return include;
+        return _.map(params, function (item) {
+            return item.trim().toLowerCase();
+        });
     },
 
-    prepareFields: function prepareFields(fields) {
-        fields = fields || '';
-        if (_.isString(fields)) {
-            fields = fields.split(',');
-        }
+    prepareInclude: function prepareInclude(include, allowedIncludes) {
+        return _.intersection(this.trimAndLowerCase(include), allowedIncludes);
+    },
 
-        return fields;
+    prepareFields: function prepareFields(fields) {
+        return this.trimAndLowerCase(fields);
     },
 
     /**

diff --git a/core/test/integration/api/api_posts_spec.js b/core/test/integration/api/api_posts_spec.js
@@ -210,6 +210,26 @@ describe('Post API', function () {
             }).catch(done);
         });
 
+        it('can include author and be case insensitive', function (done) {
+            PostAPI.browse({context: {user: 1}, status: 'all', include: 'Author'}).then(function (results) {
+                should.exist(results.posts);
+                should.exist(results.posts[0].author.name);
+                results.posts[0].author.name.should.eql('Joe Bloggs');
+
+                done();
+            }).catch(done);
+        });
+
+        it('can include author and ignore space in include', function (done) {
+            PostAPI.browse({context: {user: 1}, status: 'all', include: ' author'}).then(function (results) {
+                should.exist(results.posts);
+                should.exist(results.posts[0].author.name);
+                results.posts[0].author.name.should.eql('Joe Bloggs');
+
+                done();
+            }).catch(done);
+        });
+
         it('can fetch all posts for an author', function (done) {
             PostAPI.browse({context: {user: 1}, status: 'all', author: 'joe-bloggs'}).then(function (results) {
                 should.exist(results.posts);
@@ -265,6 +285,30 @@ describe('Post API', function () {
             }).catch(done);
         });
 
+        it('with context.user can fetch multiple fields and be case insensitive', function (done) {
+            PostAPI.browse({context: {user: 1}, status: 'all', limit: 5, fields: 'Slug,Published_At'}).then(function (results) {
+                should.exist(results.posts);
+
+                results.posts[0].published_at.should.exist;
+                results.posts[0].slug.should.exist;
+                should.not.exist(results.posts[0].title);
+
+                done();
+            }).catch(done);
+        });
+
+        it('with context.user can fetch multiple fields ignoring spaces', function (done) {
+            PostAPI.browse({context: {user: 1}, status: 'all', limit: 5, fields: ' slug , published_at  '}).then(function (results) {
+                should.exist(results.posts);
+
+                results.posts[0].published_at.should.exist;
+                results.posts[0].slug.should.exist;
+                should.not.exist(results.posts[0].title);
+
+                done();
+            }).catch(done);
+        });
+
         it('with context.user can fetch a field and not return invalid field', function (done) {
             PostAPI.browse({context: {user: 1}, status: 'all', limit: 5, fields: 'foo,title'}).then(function (results) {
                 var objectKeys;