mongodbdjango-rest-frameworkaggregation-frameworkrestangularrestheart

Restheart aggregations: send dynamic $match query using $var

Can i send JSON in avars to dynamically create $match filter query as shown below:

    {
        "type": "pipeline",
        "uri": "myaggr",
        "stages": [{
                "$match": {"$var":"n"}
            }......}

I have to pass JSON in place of {"$var":"n"}

please tell me if we have this option in Restheart or not...

Solution

  • Having defined `{"$var": "n"} in your aggregation, you can pass the variable via query parameter

    GET /db/coll/_aggrs/myaggr?n={"all":{"the":{"json":"you want"}}}

    However, in order to avoid query injection, you cannot pass MongoDB operators via aggregation variables unless you explicitly allow it by setting the following option in the configuration file:

    ### Security

# Check if aggregation variables use operators. allowing operators in aggregation variables 
# is risky. requester can inject operators modifying the query

aggregation-check-operators: true

    You can find all documentation about passing variables to aggregation at https://restheart.org/learn/aggregations/#passing-variables-to-aggregation-operations