update to override orderBy when it's not an accepted parameter

src/IIIFPresentation/API.Tests/Integration/GetCollectionTests.cs

@@ -375,4 +375,27 @@ public async Task Get_RootFlat_ReturnsFirstPageWithSecondItem_WhenCalledWithSmal
         collection.Items!.Count.Should().Be(1);
         collection.Items[0].Id.Should().Be("http://localhost/1/collections/NonPublic");
     }
+
+    [Fact]
+    public async Task Get_RootFlat_IgnoresOrderBy_WhenCalledWithInvalidOrderBy()
+    {
+        // Arrange
+        var requestMessage =
+            HttpRequestMessageBuilder.GetPrivateRequest(HttpMethod.Get,
+                $"1/collections/root?page=1&pageSize=1&orderByDescending=notValid");
+
+        // Act
+        var response = await httpClient.AsCustomer(1).SendAsync(requestMessage);
+
+        var collection = await response.ReadAsPresentationJsonAsync<FlatCollection>();
+
+        // Assert
+        collection.TotalItems.Should().Be(2);
+        collection.View!.PageSize.Should().Be(1);
+        collection.View.Id.Should().Be($"http://localhost/1/collections/RootStorage?page=1&pageSize=1");
+        collection.View.Page.Should().Be(1);
+        collection.View.TotalPages.Should().Be(2);
+        collection.Items!.Count.Should().Be(1);
+        collection.Items[0].Id.Should().Be("http://localhost/1/collections/FirstChildCollection");
+    }
 }

src/IIIFPresentation/API/Features/Storage/Helpers/OrderByHelper.cs

@@ -0,0 +1,11 @@
+namespace API.Features.Storage.Helpers;
+
+public static class OrderByHelper
+{
+    public static List<string> AllowedOrderByFields =>
+    [
+        "id",
+        "slug",
+        "created"
+    ];
+}

src/IIIFPresentation/API/Infrastructure/ControllerBaseX.cs

@@ -1,5 +1,6 @@
 using System.Net;
 using System.Runtime.InteropServices.JavaScript;
+using API.Features.Storage.Helpers;
 using API.Infrastructure.Requests;
 using Core;
 using Core.Helpers;
@@ -92,11 +93,11 @@ public static ObjectResult ValidationFailed(this ControllerBase controller, Vali
         {
             string? orderByField = null;
             descending = false;
-            if (orderBy.HasText())
+            if (orderBy.HasText() && OrderByHelper.AllowedOrderByFields.Contains(orderBy.ToLower()))
             {
                 orderByField = $"orderBy={orderBy}";
             }
-            else if (orderByDescending.HasText())
+            else if (orderByDescending.HasText() && OrderByHelper.AllowedOrderByFields.Contains(orderByDescending.ToLower()))
             {
                 orderByField = $"orderByDescending={orderByDescending}";
                 descending = true;