Because relationship columns do not accept keysToReturn or excludeKeys

[catalunha]

New Issue Checklist

• I am not disclosing a vulnerability.
• I am not just asking a question.
• I have searched through existing issues.
• I can reproduce the issue with the latest version of Parse Server and the Parse Flutter SDK.

Issue Description

See that even specifying only
query.keysToReturn(['name']);
query.excludeKeys(['expertises']);
the response returns me the expertises column which is relational.

Steps to reproduce

any query

Actual Outcome

with expertises

Expected Outcome

without expertises

Environment

Parse Flutter SDK

• SDK version: parse_server_sdk_flutter: ^4.0.0
• Flutter version: 3.7.7
• Dart version: 2.19.4
• Operating system version: PopOS

Server

• Parse Server version: 5.2.3

Logs

I/flutter ( 5351): ╭-- Parse Request
I/flutter ( 5351): curl -X GET -H 'user-agent: Flutter Parse SDK 4.0.2' -H 'X-Parse-Application-Id: ' -H 'X-Parse-Session-Token: r:' -H 'X-Parse-Client-Key: ' https://parseapi.back4app.com/classes/Medical?where=%7B%22seller%22:%20%7B%22__type%22:%22Pointer%22,%22className%22:%22UserProfile%22,%22objectId%22:%22mwHolsSQ5U%22%7D,%22isDeleted%22:%20false%7D&keys=name&excludeKeys=expertises&order=-updatedAt&skip=0&limit=2&include=seller
I/flutter ( 5351):
I/flutter ( 5351):  https://parseapi.back4app.com/classes/Medical?where={"seller": {"__type":"Pointer","className":"UserProfile","objectId":"mwHolsSQ5U"},"isDeleted": false}&keys=name&excludeKeys=expertises&order=-updatedAt&skip=0&limit=2&include=seller
I/flutter ( 5351): ╰--
I/flutter ( 5351): ╭-- Parse Response
I/flutter ( 5351): Class: Medical
I/flutter ( 5351): Function: ParseApiRQ.query
I/flutter ( 5351): Status Code: 200
I/flutter ( 5351): Payload: [{"className":"Medical","objectId":"rOs5XoBa3o","createdAt":"2023-04-07T18:41:39.636Z","updatedAt":"2023-04-08T09:17:59.390Z","name":"def","expertises":{"__type":"Relation","className":"Expertise","objects":null}}, {"className":"Medical","objectId":"p5qwOVx2Ue","createdAt":"2023-04-06T09:16:06.559Z","updatedAt":"2023-04-08T09:17:48.076Z","name":"abc","expertises":{"__type":"Relation","className":"Expertise","objects":null}}]
I/flutter ( 5351): ╰--
I/flutter ( 5351): name: true
I/flutter ( 5351): crm: false
I/flutter ( 5351): expertises: true

[parse-github-assistant]

Thanks for opening this issue!

• 🚀 You can help us to fix this issue faster by opening a pull request with a failing test. See our Contribution Guide for how to make a pull request, or read our New Contributor's Guide if this is your first time contributing.

[Nidal-Bakir]

That is an expected behavior you can not operate on a relation column. You must create a separate query for it and then you can exclude/include keys.

[catalunha]

With respect to your constant contribution and knowledge I would like to continue the debate/learning.
But this column belongs to the current table.
And if I don't ask for this column by setting keysToReturn or excludeKeys, it shouldn't return this column.
It doesn't matter if it is relational or not.

[catalunha]

The parseObject.containsKey('expertises') test is always true.
Even if you didn't order the column or exclude it with keysToReturn or excludeKeys.
I have a hard time agreeing that she should come anyway.

[Nidal-Bakir]

I see I did not get your questions the first time, the 'expertises' column should not be present in the response. right?

[Nidal-Bakir]

And if I don't ask for this column by setting keysToReturn or excludeKeys, it shouldn't return this column.

All columns will be present in the result by default.

let me run some tests and come back to you.

[catalunha]

Yes. See an example
Table with:
name (String), age (Number), expertises (relational with Expertise).
If I do
Query.keysToReturn(['name']);
The answer is
name | expertise
And their respective data.
The test:
parseObject.containsKey('name'); // true
parseObject.containsKey('age'); //false
parseObject.containsKey('expertises') // true
But I didn't ask for expertise.

[catalunha]

All columns will be present in the result by default.

No. Just the ones I asked for. But the relation column comes anyway. And it shouldn't.

[catalunha]

But I didn't ask for expertise.

But I didn't ask for expertises.

[catalunha]

Today I do an unnecessary internal control because the Parse Serve SDK for Dart/Flutter does not fulfill what I ask in the query. In other words, do not send me to expertise.

[Nidal-Bakir]

I just tested this on Parse server 4.5.0 and 5.2.3 - Beta both give me the same result the expertise column will be present in the query result.

This has nothing to do with the SDK. I test it from the terminal using curl and the result is identical

curl -X GET \
  -H "X-Parse-Application-Id: {****} " \
  -H "X-Parse-REST-API-Key: {***} " \
  -G \
  --data-urlencode 'keys=name' \
  https://parseapi.back4app.com/classes/EMP

# output 

{"results":[{"objectId":"J3bGZTxriz","name":"some_emp_name","createdAt":"2023-04-08T15:32:48.559Z","updatedAt":"2023-04-08T15:37:27.388Z","expertise":{"__type":"Relation","className":"Expertise"}}]}%                                         

Unfortunately, I do not have any knowledge about the code base of the parse server itself

maybe @mtrezza can help here

[mtrezza]

Can you reproduce the issue with a REST API call? If so, could you post the REST API call here and the expected vs. actual return values?

[Nidal-Bakir]

If you do not mind I can tell you what is his problem/question

Can you reproduce the issue with a REST API call?

Yes, this has nothing to do with the SDK

Here is the REST call using curl

curl -X GET \
  -H "X-Parse-Application-Id: {***}" \
  -H "X-Parse-REST-API-Key: {***}" \
  -G \
  --data-urlencode 'keys=name' \
  https://parseapi.back4app.com/classes/EMP

Where EMP is a class that holds three fields

The expertise field is a relation to the class Expertise

When querying the EMP class the expertise field is always present in the query result even when excluding its key from the result or when only selecting keys other than it to return for example only the name field to be returned. But the expertise field is always present no matter what we do.

Expected Outcome

{
  "results": [
    {
      "objectId": "J3bGZTxriz",
      "name": "some_emp_name",
      "createdAt": "2023-04-08T15:32:48.559Z",
      "updatedAt": "2023-04-08T15:37:27.388Z"
    }
  ]
}                   

Actual Outcome

{
  "results": [
    {
      "objectId": "J3bGZTxriz",
      "name": "some_emp_name",
      "createdAt": "2023-04-08T15:32:48.559Z",
      "updatedAt": "2023-04-08T15:37:27.388Z",
      "expertise": {
        "__type": "Relation",
        "className": "Expertise"
      }
    }
  ]
}

As you can see the expertise field present in the result but we do not ask for it.

So the question is:
Why the ParseServer returns the expertise field even when we do not select it?

[mtrezza]

Good question, it may be because it's a relation, but we should look into this, because it may expose a field involuntarily.

Moving this issue to Parse Server.