@@ -2,27 +2,26 @@ import { getAllowedQueryForRequest } from '../get-allowed-query';
22import { mergeQueries } from '../merge' ;
33
44const allowedQueries = {
5- 'FindMyTalentJobApplications.findJobApplications ' : `query FindMyTalentJobApplications {
6- data: findJobApplications {
5+ 'FindMyJobs.findJobs ' : `query FindMyJobs {
6+ data: findJobs {
77 id
88 createdAt
99 deletedAt
10- jobAd {
10+ job {
1111 id
12- location
1312 title
14- publisherCompany {
13+ company {
1514 name
1615 }
1716 workMode
1817 }
1918 }
2019 }` ,
21- 'FindMyCompanyTalentJobApplications.findJobApplications ' : `query FindMyCompanyTalentJobApplications($where: TalentJobApplicationWhereInput, $orderBy: [TalentJobApplicationOrderByWithRelationInput!]) {
22- data: findJobApplications (where: $where, orderBy: $orderBy) {
20+ 'FindMyCompanyTalentJobApplications.findJobs ' : `query FindMyCompanyTalentJobApplications($where: TalentJobApplicationWhereInput, $orderBy: [TalentJobApplicationOrderByWithRelationInput!]) {
21+ data: findJobs (where: $where, orderBy: $orderBy) {
2322 createdAt
2423 id
25- jobAd {
24+ job {
2625 title
2726 }
2827 talentProfile {
@@ -33,17 +32,16 @@ const allowedQueries = {
3332} ;
3433
3534describe ( 'aliases' , ( ) => {
36- test ( 'FindMyTalentJobApplications should handle aliases (request talentProfile when it is not allowed)' , ( ) => {
37- const requestQuery = `query FindMyTalentJobApplications {
38- data: findJobApplications {
35+ test ( 'FindMyJobs should handle aliases (request talentProfile when it is not allowed)' , ( ) => {
36+ const requestQuery = `query FindMyJobs {
37+ data: findJobs {
3938 id
4039 createdAt
4140 deletedAt
42- jobAd {
41+ job {
4342 id
44- location
4543 title
46- publisherCompany {
44+ company {
4745 name
4846 }
4947 workMode
@@ -54,16 +52,15 @@ describe('aliases', () => {
5452 }
5553 }` ;
5654
57- const expected = `query FindMyTalentJobApplications {
58- data: findJobApplications {
55+ const expected = `query FindMyJobs {
56+ data: findJobs {
5957 id
6058 createdAt
6159 deletedAt
62- jobAd {
60+ job {
6361 id
64- location
6562 title
66- publisherCompany {
63+ company {
6764 name
6865 }
6966 workMode
@@ -79,10 +76,10 @@ describe('aliases', () => {
7976
8077 test ( 'FindMyCompanyTalentJobApplications should handle aliases2 (request workMode when it is not allowed)' , ( ) => {
8178 const requestQuery = `query FindMyCompanyTalentJobApplications($where: TalentJobApplicationWhereInput, $orderBy: [TalentJobApplicationOrderByWithRelationInput!]) {
82- data: findJobApplications (where: $where, orderBy: $orderBy) {
79+ data: findJobs (where: $where, orderBy: $orderBy) {
8380 createdAt
8481 id
85- jobAd {
82+ job {
8683 title
8784 __typename
8885 }
@@ -95,10 +92,10 @@ describe('aliases', () => {
9592 }
9693 }` ;
9794 const expected = `query FindMyCompanyTalentJobApplications($where: TalentJobApplicationWhereInput, $orderBy: [TalentJobApplicationOrderByWithRelationInput!]) {
98- data: findJobApplications (where: $where, orderBy: $orderBy) {
95+ data: findJobs (where: $where, orderBy: $orderBy) {
9996 createdAt
10097 id
101- jobAd {
98+ job {
10299 title
103100 }
104101 talentProfile {
@@ -115,23 +112,21 @@ describe('aliases', () => {
115112 } ) ;
116113
117114 test ( 'Exploit with Aliased Fields to bypass restrictions' , ( ) => {
118- const requestQuery = `query FindMyTalentJobApplications {
119- data: findJobApplications {
115+ const requestQuery = `query FindMyJobs {
116+ data: findJobs {
120117 id
121- jobAd {
118+ job {
122119 id
123- location
124120 secretTitle: secret
125121 workMode
126122 }
127123 }
128124 }` ;
129- const expected = `query FindMyTalentJobApplications {
130- data: findJobApplications {
125+ const expected = `query FindMyJobs {
126+ data: findJobs {
131127 id
132- jobAd {
128+ job {
133129 id
134- location
135130 workMode
136131 }
137132 }
0 commit comments