From d061f44eda07dd1e08129da983edd5a5218299a7 Mon Sep 17 00:00:00 2001
From: Adria Navarro <adria@budibase.com>
Date: Tue, 17 Dec 2024 18:50:17 +0100
Subject: [PATCH] Fix external patches

---
 .../src/api/controllers/row/external.ts       | 20 +++++++++++++------
 .../src/api/controllers/row/utils/utils.ts    | 15 ++++++++++++++
 2 files changed, 29 insertions(+), 6 deletions(-)

diff --git a/packages/server/src/api/controllers/row/external.ts b/packages/server/src/api/controllers/row/external.ts
index 082d07283b..d56fb1a344 100644
--- a/packages/server/src/api/controllers/row/external.ts
+++ b/packages/server/src/api/controllers/row/external.ts
@@ -52,10 +52,22 @@ export async function patch(ctx: UserCtx<PatchRowRequest, PatchRowResponse>) {
   const table = await utils.getTableFromSource(source)
   const { _id, ...rowData } = ctx.request.body
 
-  const dataToUpdate = await inputProcessing(
+  const beforeRow = await sdk.rows.external.getRow(table._id!, _id, {
+    relationships: true,
+  })
+
+  let dataToUpdate = cloneDeep(beforeRow)
+  const allowedField = utils.getSourceFields(source)
+  for (const key of Object.keys(rowData)) {
+    if (!allowedField.includes(key)) continue
+
+    dataToUpdate[key] = rowData[key]
+  }
+
+  dataToUpdate = await inputProcessing(
     ctx.user?._id,
     cloneDeep(source),
-    rowData
+    dataToUpdate
   )
 
   const validateResult = await sdk.rows.utils.validate({
@@ -66,10 +78,6 @@ export async function patch(ctx: UserCtx<PatchRowRequest, PatchRowResponse>) {
     throw { validation: validateResult.errors }
   }
 
-  const beforeRow = await sdk.rows.external.getRow(table._id!, _id, {
-    relationships: true,
-  })
-
   const response = await handleRequest(Operation.UPDATE, source, {
     id: breakRowIdField(_id),
     row: dataToUpdate,
diff --git a/packages/server/src/api/controllers/row/utils/utils.ts b/packages/server/src/api/controllers/row/utils/utils.ts
index baa811fe90..9d1711d000 100644
--- a/packages/server/src/api/controllers/row/utils/utils.ts
+++ b/packages/server/src/api/controllers/row/utils/utils.ts
@@ -110,6 +110,21 @@ function fixBooleanFields(row: Row, table: Table) {
   return row
 }
 
+export function getSourceFields(source: Table | ViewV2): string[] {
+  const isView = sdk.views.isView(source)
+  if (isView) {
+    const fields = Object.keys(
+      helpers.views.basicFields(source, { visible: true })
+    )
+    return fields
+  }
+
+  const fields = Object.entries(source.schema)
+    .filter(([_, field]) => field.visible !== false)
+    .map(([columnName]) => columnName)
+  return fields
+}
+
 export async function sqlOutputProcessing(
   rows: DatasourcePlusQueryResponse,
   source: Table | ViewV2,