Filter out response fields not matching the given response schema?

[m1212e]

I have a response form a database query:

const fromDB = {
  id: "123",
  name: "test",
  apiKeyHash: "argon..."
}

and a handler returning that value:

.get("/myHandler", () => fromDB,
{
  response: t.Object({
    id: t.String(),
    name: t.String()
  })
})

since the schema matches there is no error. But I pass sensitive data to the user which I want to prevent. Obviously I could just erase the field from the returned object. But in larger apps it might happen that this gets overlooked and the response schema would be a nice safety net to rely on for there cases. Can I somehow achieve an error or even automatic filtering of fields not contained inside the schema?

Thanks!

[m1212e]

After a response on Discord, this is my answer, since Discord has a max char limit:

Maybe this is because I simplified the example. I actually have this in a nested field:

This is the actual handler:

  .get(
    "/domain/:domainId/app/:appId/scope/:scopeIdOrName",
    async ({ params }) => {
      const queryResult = await db.scope.findFirstOrThrow({
        where: {
          OR: [
            {
              id: params.scopeIdOrName,
            },
            {
              name: params.scopeIdOrName,
            },
          ],
          domainId: params.domainId,
          appId: params.appId,
        },
        include: {
          domain: true,
          app: true,
          appAccesses: true,
          associatedResources: true,
        },
      });

      return {
        app: queryResult.app,
        appAccesses: queryResult.appAccesses,
        appId: queryResult.appId,
        associatedResources: queryResult.associatedResources,
        authProviderId: queryResult.authProviderId,
        domain: queryResult.domain,
        domainId: queryResult.domainId,
        id: queryResult.id,
        name: queryResult.name,
      };
    },
    {
      needsValidAppApiKey: true,
      response: Scope,
      detail: {
        description: "Get a scope by id. Also fetches related data.",
        tags: [openApiTag(import.meta.path)],
      },
    },
  )

While this is my schema:

import { Type, Static } from "@sinclair/typebox";

export const Scope = Type.Object(
  {
    id: Type.String(),
    app: Type.Object({
      id: Type.String(),
      name: Type.String(),
      authProviderId: Type.String(),
      domainId: Type.String(),
      allowedOrigins: Type.Array(Type.String()),
    }),
    appId: Type.String(),
    domain: Type.Object({
      id: Type.String(),
      name: Type.String(),
      authProviderId: Type.String(),
    }),
    domainId: Type.String(),
    authProviderId: Type.String(),
    associatedResources: Type.Array(
      Type.Object(
        {
          id: Type.String(),
          domainId: Type.String(),
          appId: Type.String(),
          authProviderId: Type.String(),
          name: Type.String(),
        }
      )
    ),
    name: Type.String(),
    appAccesses: Type.Array(
      Type.Object({
        id: Type.String(),
        domainId: Type.String(),
        appId: Type.String(),
        authProviderId: Type.String(),
      })
    ),
  }
);

export type ScopeType = Static<typeof Scope>;

This is the response:

{
  "app": {
    "id": "939a0976-1271-4fd7-b3df-61f3982a4e66",
    "name": "app1",
    "authProviderId": "6e58bd06-6acf-452d-b2e2-23bdbbf6e656",
    "domainId": "ee770f71-aa44-42fd-bd20-647f964774e8",
    "allowedOrigins": [
      "http://localhost:3000"
    ],
    "apiKeysHashes": [
      "$argon2id$v=19$m=65536,t=2,p=1$[.....]t0X1O32h8"
    ]
  },
  "appAccesses": [],
  "appId": "939a0976-1271-4fd7-b3df-61f3982a4e66",
  "associatedResources": [
    {
      "id": "cae559c6-f2da-4613-86b9-63ca18246135",
      "domainId": "ee770f71-aa44-42fd-bd20-647f964774e8",
      "appId": "939a0976-1271-4fd7-b3df-61f3982a4e66",
      "authProviderId": "f5fdc917-8162-4cbf-b032-c4d0436a3618",
      "name": "resource2"
    }
  ],
  "authProviderId": "1616c437-d18e-4595-ac74-67a975cd41f9",
  "domain": {
    "id": "ee770f71-aa44-42fd-bd20-647f964774e8",
    "name": "domain1",
    "authProviderId": "f5add9eb-efd0-446b-9bde-3150b4fa3b36",
    "apiKeysHashes": [
      "$argon2id$v=19$m=65536,t=2,p=1$H2fNycD[.....]VwfiIECyqw"
    ]
  },
  "domainId": "ee770f71-aa44-42fd-bd20-647f964774e8",
  "id": "7adcf723-5a5a-49a1-ba7f-5f00d012c82a",
  "name": "account:write"
}

Sorry for the unprecise info

[m1212e]

Using return Value.Clean(Scope, queryResult); is a nice workaround (https://github.com/sinclairzx81/typebox?tab=readme-ov-file#clean)

[m1212e]

Wrote a macro to do this:

import Elysia from "elysia";
import { Value } from "@sinclair/typebox/value";

export const responseCleaner = new Elysia({
  name: "responseCleaner",
}).macro(({ onAfterHandle }) => {
  return {
    cleanResponseWithSchema(schema: any) {
      onAfterHandle(async ({ body }) => {
        Value.Clean(schema, body);
      });
    },
  };
});

This allows for handler options to look like this:

      cleanResponseWithSchema: t.Object({
        scopes: t.Array(ScopeWithoutRelations),
      }),
      response: t.Object({
        scopes: t.Array(ScopeWithoutRelations),
      }),

which is a little non DRY. Would be cool to simplify this.

[mtt-artis]

Not sure I'm following

Typebox has an option additionalProperties
https://github.com/sinclairzx81/typebox/blob/master/src%2Ftype%2Fobject%2Fobject.ts#L72

If your response has a key that is not declared in your response type, shouldn't you have an error from Elysia (I think it's impossible to have a typescript error here)?

[m1212e]

I should have, indeed. But elysia is not raising an error in my scenario.

[m1212e]

Same for this schema:

body: TObject<{
    name: TString;
    associatedScopes: TOptional<TArray<TObject<{
        id: TString;
    }>>>;
}>

when I pass this object:

{
[0]           id: "a9f10990-2593-45cf-9876-95d75649afc6",
[0]           appId: "4baeb803-5779-437c-8e0b-0c2a5603bd83",
[0]           domainId: "ee770f71-aa44-42fd-bd20-647f964774e8",
[0]           authProviderId: "2455cf37-377b-47c6-91d7-7e09a71fe0cc",
[0]           name: "WRITE",
[0]           domain: {
[0]             id: "ee770f71-aa44-42fd-bd20-647f964774e8",
[0]             name: "domain1",
[0]             authProviderId: "f5add9eb-efd0-446b-9bde-3150b4fa3b36"
[0]           },
[0]           app: {
[0]             id: "4baeb803-5779-437c-8e0b-0c2a5603bd83",
[0]             name: "app2",
[0]             authProviderId: "ad393c9c-44b2-4478-a9c9-0566d3a0a313",
[0]             domainId: "ee770f71-aa44-42fd-bd20-647f964774e8",
[0]             allowedOrigins: [
[0]               "http://localhost:3000"
[0]             ]
[0]           },
[0]           appAccesses: [],
[0]           associatedResources: []
[0]         }

I don't get an error but prisma will fail, seems like my schema validation is not working at all

[m1212e]

Weirdly, this happens only when I call that stuff via the eden treaty. Not when I make a manual request. Im so confused.

[m1212e]

I made a small repro for anyone to test #482