Skip to content

Reject $expand/$orderby/$top/$skip when combined with $count - #237

Open
Page- wants to merge 1 commit into
masterfrom
reject-invalid-count-options
Open

Page- wants to merge 1 commit into
masterfrom
reject-invalid-count-options

Conversation

@Page-

@Page- Page- commented Oct 22, 2026

Copy link
Copy Markdown
Contributor

/pilot/$count?$expand=licence selected the expanded licence subquery alongside COUNT(*), which is invalid sql as the subquery references an ungrouped column. The same happened for a nested $expand within an expanded $count, eg $expand=licence/$count($expand=is_of__pilot) or $expand=can_fly__plane/$count/plane.

$orderby, $top and $skip cannot affect a count either, and were silently dropped.

These are now all rejected with a SyntaxError rather than failing when the query is run or having part of the request silently ignored.

Change-type: patch

@Page-
Page- requested a review from a team October 22, 2026 22:11
@flowzone-app
flowzone-app Bot enabled auto-merge October 22, 2026 22:15
@Page-
Page- disabled auto-merge October 22, 2026 22:18
@Page-
Page- enabled auto-merge October 22, 2026 22:18
@Page-
Page- force-pushed the reject-invalid-count-options branch 4 times, most recently from 63146a3 to 90751eb Compare October 23, 2026 12:23
let addPathKey = true;

if (hasQueryOpts && path.options?.$expand) {
if (path.count) {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

shouldn't this explicitely be path.count == 0 || path.count != null ? because I can't say for sure which is the comparison you actually want (same follows for follow up new ifs)

`/pilot/$count?$expand=licence` selected the expanded licence subquery
alongside `COUNT(*)`, which is invalid sql as the subquery references an
ungrouped column. The same happened for a nested `$expand` within an
expanded `$count`, eg `$expand=licence/$count($expand=is_of__pilot)` or
`$expand=can_fly__plane/$count/plane`.

`$orderby`, `$top` and `$skip` cannot affect a count either, and were
silently dropped.

These are now all rejected with a `SyntaxError` rather than failing when
the query is run or having part of the request silently ignored.

Change-type: patch
@Page-
Page- force-pushed the reject-invalid-count-options branch from 90751eb to 1cfe7d4 Compare October 26, 2026 11:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants