Fix/allow customer groups relation store api #14303
Conversation
🦋 Changeset detectedLatest commit: 02f42e4 The changes in this PR will be included in the next version bump. This PR includes changesets to release 75 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
@pepijn-vanvlaanderen is attempting to deploy a commit to the medusajs Team on Vercel. A member of the Team first needs to authorize it. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
This is the final PR Bugbot will review for you during this billing cycle
Your free Bugbot reviews will reset on December 17
Details
Your team is on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle for each member of your team.
To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.
| "orders", | ||
| "groups", | ||
| ], | ||
| isList: false, |
There was a problem hiding this comment.
Bug: Store API may expose group customer data
Adding groups to retrieveTransformQueryConfig.allowed can allow store clients to request nested group fields (for example groups.customers...) if the query-field validator permits prefixes. That risks leaking other customers’ data through the customer.groups relation in Store API responses.
There was a problem hiding this comment.
Requesting customer.groups is not allowed, so this does not seems to be an issue.
There was a problem hiding this comment.
here the problem is not customer.groups but group.customers have you tried to see if it makes it available?
There was a problem hiding this comment.
Ah sorry, I reversed it in my reply. But yes tried it on customer.groups and with customer.*
There was a problem hiding this comment.
have you tried customer.groups.customers?
2 participants
Summary
What — What changes are introduced in this PR?
Allow the relation selection in the Store API customer endpoints.
Why — Why are these changes relevant or necessary?
Now you need 2 queries in the frontend to retrieve the customer groups.
How — How have these changes been implemented?
Added the groups relation to the allowed fields.
Testing — How have these changes been tested, or how can the reviewer test the feature?
We run this in a patch on our projects.
Examples
Provide examples or code snippets that demonstrate how this feature works, or how it can be used in practice.
This helps with documentation and ensures maintainers can quickly understand and verify the change.
// Example usageChecklist
Please ensure the following before requesting a review:
yarn changesetand follow the promptsNote
Enable fetching customer groups in the Store Customers API by adding "groups" to the allowed retrieve fields.
Written by Cursor Bugbot for commit 02f42e4. This will update automatically on new commits. Configure here.