How to sanitize data when using bookshelf directly in Strapi

Question

Since there seems to be no support in Strapi for an OR clause yet ( https://github.com/strapi/strapi/issues/3194 ), I'm using Bookshelf directly like:

const result = await strapi.query('friendship')
    .find({
        where: { user1: 1 },
        orWhere: { user2: 1 }
    })
    .fetchAll()

Now, usually you can sanitize your data using:

sanitizeEntity(entities, { model: strapi.models.friendship });

but that won't work here, since we basically left the abstraction of Strapi, right? Could I still somehow sanitize the data by comparing it to the model or something like that?

Answer 1

Since you're accessing bookshelf directly, you'll need to convert the result set to json. Bookshelf has a toJSON helper for this. sanitizeEntity as the name implies, can only be used on a single entity result.

const { sanitizeEntity } = require('strapi-utils');

module.exports = {
  async findFriends(){
    const entities = await strapi.query('friendship')
        .find({
            where: { user1: 1 },
            orWhere: { user2: 1 }
        })
        .fetchAll()
        .then(results => results.toJSON());

    return entities.map(entity => sanitizeEntity( { 
      model: strapi.models.friendship 
    } ))
  }
}

If you want to dig deeper, you can inspect your node_modules for this file node_modules/strapi/packages/strapi-connector-bookshelf/lib/queries.js. This is how strapi sets up the find service helper for your model.

  function find(params, populate, { transacting } = {}) {
    const filters = convertRestQueryParams(params);

    return model
      .query(buildQuery({ model, filters }))
      .fetchAll({
        withRelated: populate,
        transacting,
      })
      .then(results => results.toJSON());
  }