fix: parse JSON string where query param (#15745)

### What?

Support `where` sent as a JSON string in REST API requests (e.g.
`?where={"read":{"equals":false}}`). Previously the filter was silently
ignored; now it's parsed correctly.

### Why?

GET query params are always strings. `parseParams` parsed `data` this
way already but skipped `where`, so string-encoded filters had no
effect.

### How?

After the `data` block in `parseParams`: if `where` is a non-empty
string, `JSON.parse` it. If it's already an object (e.g. from bracket
notation), leave it alone.

---------

Co-authored-by: Patrik Kozak <35232443+PatrikKozak@users.noreply.github.com>

Author: hugomeduarte

packages/payload/src/utilities/parseParams/index.spec.ts

@@ -220,6 +220,23 @@ describe('parseParams', () => {
       const result = parseParams({ where })
       expect(result.where).toBe(where)
     })
+
+    it('should parse where when it is a JSON string', () => {
+      const where = { read: { equals: false } }
+      const result = parseParams({ where: JSON.stringify(where) })
+      expect(result.where).toEqual(where)
+    })
+
+    it('should not process empty string where', () => {
+      const result = parseParams({ where: '' })
+      expect(result.where).toBe('')
+    })
+
+    it('should throw error for invalid JSON where', () => {
+      expect(() => {
+        parseParams({ where: 'invalid-json' })
+      }).toThrow()
+    })
   })
 
   describe('edge cases', () => {

packages/payload/src/utilities/parseParams/index.ts

@@ -29,7 +29,7 @@ type RawParams = {
   sort?: string | string[]
   trash?: string
   unpublishAllLocales?: string
-  where?: Where
+  where?: string | Where
 }
 
 type ParsedParams = {
@@ -111,5 +111,9 @@ export const parseParams = (params: RawParams): ParsedParams => {
     parsedParams.data = JSON.parse(params.data)
   }
 
+  if ('where' in params && typeof params.where === 'string' && params.where.length > 0) {
+    parsedParams.where = JSON.parse(params.where) as Where
+  }
+
   return parsedParams
 }