From 675935dc9591be4b4a1ea1e9f7eb1b0a41b5cac4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Celso=20In=C3=A1cio?= <celso.inacio@g.globo>
Date: Thu, 4 May 2023 15:29:10 -0300
Subject: [PATCH] hotfix: change protected fields to allow scoped fields

---
 lib/http/SchemaResponse.js | 15 ++++++++-------
 lib/support/config.js      |  2 +-
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/lib/http/SchemaResponse.js b/lib/http/SchemaResponse.js
index e9fad83..e46e183 100644
--- a/lib/http/SchemaResponse.js
+++ b/lib/http/SchemaResponse.js
@@ -5,17 +5,18 @@ class SchemaResponse {
     this.functionsRequest = functionsRequest;
     this.res = res;
     this.schemaName = schemaName;
-    this.protectedFields = config.responseProtectedFields;
+    this.allowedFields = config.responseAllowedFields;
   }
 
-  removeProtectedFields(data) {
-    for (const field of this.protectedFields) {
-      delete data[field];
-    };
-  };
+  removeNotAllowedFields(data) {
+    const fieldsToRemove = Object.keys(data.env.filter(field => !this.allowedFields.includes(field)));
+    for (const field of fieldsToRemove) {
+      delete data.env[field];
+    }
+  }
 
   json(data) {
-    this.removeProtectedFields(data);
+    this.removeNotAllowedFields(data);
     const schemeAndAuthority = this.functionsRequest.schemeAndAuthority();
     this.res.set('Content-Type', `application/json; charset=utf-8; profile=${schemeAndAuthority}/_schemas/${this.schemaName}`);
     this.res.end(JSON.stringify(data));
diff --git a/lib/support/config.js b/lib/support/config.js
index ed56c79..97c7afe 100644
--- a/lib/support/config.js
+++ b/lib/support/config.js
@@ -22,7 +22,7 @@ module.exports = {
   defaultGlobalModules: ConfigDiscovery.getList('DEFAULT_GLOBAL_MODULES', DEFAULT_GLOBAL_MODULES),
   bodyParserLimit: process.env.BODY_PARSER_LIMIT || '1mb',
   redisConnectionTimeout: ConfigDiscovery.getInt('REDIS_CONNECTION_TIMEOUT', 2000),
-  responseProtectedFields: ConfigDiscovery.getList('RESPONSE_PROTECTED_FIELDS', ['env']),
+  responseAllowedFields: ConfigDiscovery.getList('RESPONSE_ALLOWED_FIELDS', ['BACKSTAGE_CLIENT_ID']),
   metric: {
     client: process.env.METRIC_CLIENT,
     udpHost: process.env.METRIC_UDP_HOST,