feat: add resource param to enforce query limit

Author: 0xfede

src/mongo/operation/query.ts

@@ -96,6 +96,9 @@ export class QueryMongoOperation extends MongoOperation {
     if (typeof job.req.query.limit !== 'undefined') {
       job.opts.limit = job.req.query.limit;
     }
+    if ((this.resource.info.queryLimit || 0) > 0 && !(job.opts.limit < this.resource.info.queryLimit!)) {
+      job.opts.limit = this.resource.info.queryLimit;
+    }
     if (typeof job.req.query.skip !== 'undefined') {
       job.opts.skip = job.req.query.skip;
     }

src/mongo/resource.ts

@@ -37,6 +37,7 @@ export interface MongoResourceDefinition extends ResourceDefinition {
   idIsObjectId?: boolean;
   createIndexes?: boolean;
   escapeProperties?: boolean;
+  queryLimit?: number;
 }
 
 export class MongoResource extends Resource {

test/ts/mongo.test.ts

@@ -215,7 +215,7 @@ describe('mongo', function () {
     before(async function () {
       db = await MongoClient.connect('mongodb://localhost:27017/local').then((c) => c.db());
       r1 = new MongoResource(db, { name: 'Test', collection: collectionName });
-      r2 = new MongoResource(db, { name: 'Other', collection: collectionName, id: 'myid', idIsObjectId: false });
+      r2 = new MongoResource(db, { name: 'Other', collection: collectionName, id: 'myid', idIsObjectId: false, queryLimit: 5 });
       r3 = new MongoResource(db, { name: 'Fake', collection: collectionName }, { '/1': { get: FakeOp1 }, '/2': { get: FakeOp2 } });
       r4 = new MongoResource(db, { name: 'Oid', collection: collectionName + '_oid', id: 'myoid', idIsObjectId: true });
       r5 = new MongoResource(db, { name: 'Aggregation', collection: collectionName }, { '/': { get: Aggregation } });
@@ -350,7 +350,6 @@ describe('mongo', function () {
       });
 
       it('should create a record with a date preserving its type', function () {
-        debugger;
         return request
           .post('/dates')
           .send({ myid: 'ts', ts: new Date() })
@@ -716,6 +715,39 @@ describe('mongo', function () {
           });
       });
 
+      it('should return all objects in the collection (6), up to hardcoded limit', function () {
+        return request
+          .get('/others')
+          .expect(200)
+          .expect('Content-Type', /json/)
+          .expect('Results-Matching', '7')
+          .then(({ body: data }) => {
+            data.length.should.equal(5);
+          });
+      });
+
+      it('should return all objects in the collection (7), up to the lower of requested and hardcoded limits', function () {
+        return request
+          .get('/others?limit=6')
+          .expect(200)
+          .expect('Content-Type', /json/)
+          .expect('Results-Matching', '7')
+          .then(({ body: data }) => {
+            data.length.should.equal(5);
+          });
+      });
+
+      it('should return all objects in the collection (8), up to the lower of requested and hardcoded limits', function () {
+        return request
+          .get('/others?limit=4')
+          .expect(200)
+          .expect('Content-Type', /json/)
+          .expect('Results-Matching', '7')
+          .then(({ body: data }) => {
+            data.length.should.equal(4);
+          });
+      });
+
       it('should return a single attribute of all objects, in ascending order by id (1)', function () {
         return request
           .get('/tests?fields=y&sort=myid')