forked from codacy-security/juice-shop
-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathnoUpdate.ts
56 lines (43 loc) · 1.69 KB
/
noUpdate.ts
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
// Credit for the implementation in JS: https://github.com/daviddossantos/sequelize-notupdate-attributes
import { Model, ValidationErrorItemType } from 'sequelize/types'
import { ValidationOptions } from 'sequelize/types/instance-validator'
interface ExtendedValidationOptions extends ValidationOptions{
validate: boolean
}
interface ExtendedModel extends Model{
_changed: Iterable<string> | ArrayLike<string>
rawAttributes: { [x: string]: any }
_previousDataValues: { [x: string]: null }
}
const {
ValidationError,
ValidationErrorItem
} = require('sequelize/lib/errors')
export const makeKeyNonUpdatable = (model: Model, column: string) => {
model.addHook('beforeValidate', (instance: ExtendedModel, options: ExtendedValidationOptions) => {
if (!options.validate) return
if (instance.isNewRecord) return
const changedKeys: unknown[] = []
const instanceChanged = Array.from(instance._changed)
instanceChanged.forEach((value) => changedKeys.push(value))
if (!changedKeys.length) return
const validationErrors: ValidationErrorItemType[] = []
changedKeys.forEach((fieldName: any) => {
const fieldDefinition = instance.rawAttributes[fieldName]
if (
instance._previousDataValues[fieldName] !== undefined &&
instance._previousDataValues[fieldName] !== null &&
(fieldDefinition.fieldName === column)
) {
validationErrors.push(
new ValidationErrorItem(
`\`${fieldName}\` cannot be updated due \`noUpdate\` constraint`,
'noUpdate Violation',
fieldName
)
)
}
})
if (validationErrors.length) { throw new ValidationError(null, validationErrors) }
})
}