From e8a0425cc3a46fa5a8eb77922db59136b5855249 Mon Sep 17 00:00:00 2001
From: Chirag Aggarwal <chiragaggarwal5k@gmail.com>
Date: Wed, 9 Apr 2025 13:03:56 +0000
Subject: [PATCH] chore: add allowed attributes to query

---
 .env                                          |  2 +-
 .../Modules/Projects/Http/DevKeys/XList.php   |  8 ++-----
 .../Database/Validator/Queries/DevKeys.php    | 21 +++++++++++++++++++
 .../e2e/Services/Projects/ProjectsDevKeys.php |  2 +-
 4 files changed, 25 insertions(+), 8 deletions(-)
 create mode 100644 src/Appwrite/Utopia/Database/Validator/Queries/DevKeys.php

diff --git a/.env b/.env
index d18e63c56e..c10c12613b 100644
--- a/.env
+++ b/.env
@@ -15,7 +15,7 @@ _APP_SYSTEM_TEAM_EMAIL=team@appwrite.io
 _APP_EMAIL_SECURITY=security@appwrite.io
 _APP_EMAIL_CERTIFICATES=certificates@appwrite.io
 _APP_SYSTEM_RESPONSE_FORMAT=
-_APP_OPTIONS_ABUSE=enabled
+_APP_OPTIONS_ABUSE=disabled
 _APP_OPTIONS_ROUTER_PROTECTION=disabled
 _APP_OPTIONS_FORCE_HTTPS=disabled
 _APP_OPTIONS_FUNCTIONS_FORCE_HTTPS=disabled
diff --git a/src/Appwrite/Platform/Modules/Projects/Http/DevKeys/XList.php b/src/Appwrite/Platform/Modules/Projects/Http/DevKeys/XList.php
index 71511488f5..36b63c721e 100644
--- a/src/Appwrite/Platform/Modules/Projects/Http/DevKeys/XList.php
+++ b/src/Appwrite/Platform/Modules/Projects/Http/DevKeys/XList.php
@@ -12,15 +12,11 @@ use Utopia\Database\Database;
 use Utopia\Database\Document;
 use Utopia\Database\Exception\Query as QueryException;
 use Utopia\Database\Query;
-use Utopia\Database\Validator\Queries;
-use Utopia\Database\Validator\Query\Cursor;
-use Utopia\Database\Validator\Query\Limit;
-use Utopia\Database\Validator\Query\Offset;
 use Utopia\Database\Validator\UID;
 use Utopia\Platform\Action;
 use Utopia\Platform\Scope\HTTP;
 use Utopia\Validator\Text;
-
+use Appwrite\Utopia\Database\Validator\Queries\DevKeys;
 class XList extends Action
 {
     use HTTP;
@@ -53,7 +49,7 @@ class XList extends Action
                 contentType: ContentType::JSON
             ))
             ->param('projectId', '', new UID(), 'Project unique ID.')
-            ->param('queries', [], new Queries([new Limit(), new Offset(), new Cursor()]), 'Array of query strings generated using the Query class provided by the SDK. [Learn more about queries](https://appwrite.io/docs/queries). Only supported methods are limit, offset and cursor', true)
+            ->param('queries', [], new DevKeys(), 'Array of query strings generated using the Query class provided by the SDK. [Learn more about queries](https://appwrite.io/docs/queries). Only supported methods are limit, offset and cursor', true)
             ->param('search', '', new Text(256), 'Search term to filter your list results. Max length: 256 chars.', true)
             ->inject('response')
             ->inject('dbForPlatform')
diff --git a/src/Appwrite/Utopia/Database/Validator/Queries/DevKeys.php b/src/Appwrite/Utopia/Database/Validator/Queries/DevKeys.php
new file mode 100644
index 0000000000..83d49ac2ae
--- /dev/null
+++ b/src/Appwrite/Utopia/Database/Validator/Queries/DevKeys.php
@@ -0,0 +1,21 @@
+<?php
+
+namespace Appwrite\Utopia\Database\Validator\Queries;
+
+class DevKeys extends Base
+{
+    public const ALLOWED_ATTRIBUTES = [
+        'name',
+        'accessedAt',
+        'expire'
+    ];
+
+    /**
+     * Expression constructor
+     *
+     */
+    public function __construct()
+    {
+        parent::__construct('devKeys', self::ALLOWED_ATTRIBUTES);
+    }
+}
diff --git a/tests/e2e/Services/Projects/ProjectsDevKeys.php b/tests/e2e/Services/Projects/ProjectsDevKeys.php
index 54a7e907a5..2e3532acc2 100644
--- a/tests/e2e/Services/Projects/ProjectsDevKeys.php
+++ b/tests/e2e/Services/Projects/ProjectsDevKeys.php
@@ -134,7 +134,7 @@ trait ProjectsDevKeys
         ]);
 
         $this->assertEquals(400, $response['headers']['status-code']);
-        $this->assertEquals('Invalid `queries` param: Invalid query method: search', $response['body']['message']);
+        $this->assertEquals('Searching by attribute "name" requires a fulltext index.', $response['body']['message']);
 
         return $data;
     }