From 330dd360e86cea2ac5a2ae773a0b457e22d7f472 Mon Sep 17 00:00:00 2001
From: Alex Coleman <77301670+alex-statsig@users.noreply.github.com>
Date: Fri, 26 Jul 2024 15:47:33 -0700
Subject: [PATCH] Refine query selector to highlight unexpected query keys

Previously, there was a catch-all case in RootQuerySelector which would accept any key with type "any". This still allows nice IDE typehints, but can lead to bugs where the incorrect key is used for a filter with no warning that the key is clearly wrong.

With this PR, only keys that contain a "." are unsafely typed as any, which should reduce the blast radius of the hacky types dramatically.
---
 types/query.d.ts | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/types/query.d.ts b/types/query.d.ts
index 44d9a71062f..5784987882d 100644
--- a/types/query.d.ts
+++ b/types/query.d.ts
@@ -115,8 +115,9 @@ declare module 'mongoose' {
     /** @see https://www.mongodb.com/docs/manual/reference/operator/query/comment/#op._S_comment */
     $comment?: string;
     // we could not find a proper TypeScript generic to support nested queries e.g. 'user.friends.name'
-    // this will mark all unrecognized properties as any (including nested queries)
-    [key: string]: any;
+    // this will mark all unrecognized properties as any (including nested queries) only if
+    // they include a "." (to avoid generically allowing any unexpected keys)
+    [nestedSelector: `${string}.${string}`]: any;
   };
 
   interface QueryTimestampsConfig {