Wrong parsing requestBody and Where query.object

[peace195]

Here is the example code: https://github.com/strongloop/loopback4-example-shopping/blob/master/packages/shopping/src/controllers/user-order.controller.ts#L104

How to reproduce the issue:

1. Add @inject(SecurityBindings.USER) currentUserProfile: UserProfile
2. Call PATCH /users​/{userId}​/orders

Attachment is the code, its swagger and console.
I passed {"id": 1} as Where object. {"total": 100} as Order object of requestBody().
But in backend, it parsed { id: 1 } as Order object and { total: 100 } as Where filter.

I faced this issue in both loopback4-example-shopping project and my other project

[raymondfeng]

This is pretty weird. What curl command does the Swagger UI generate? I can investigate if you can create an simple app with just that route and share the git repo.

[peace195]

@raymondfeng Thank you very much.
Yes, it is:

http://localhost:3000/users/604dadaf126de4845d0eef3/orders?where={
  "id": 1
}

Here is my example repo: https://github.com/peace195/loopback-PATCH-example
The step to reproduce:

1. npm i
2. npm run docker:start
3. npm start
4. Go to http://localhost:3000/shoppy.html to register an account.
5. Go to http://localhost:3000/explorer/#/UserManagementController/UserManagementController.login to login and get token
6. Go to http://localhost:3000/explorer/#/UserManagementController/UserManagementController.printCurrentUser , authen with token, then get userId.
7. Go to http://localhost:3000/explorer/#/UserOrderController/UserOrderController.patchOrders to execute the PATCH and get the issue.

[peace195]

@raymondfeng FYI: when remove this line: https://github.com/peace195/loopback-PATCH-example/blob/master/src/controllers/user-order.controller.ts#L106 , everything will be good. But why adding this line give us wrong parsing?

Thank you very much 🙏

[raymondfeng]

I can reproduce the problem and confirm it's a bug in REST parameter parsing. A quick workaround is to move currentUserProfile to be the last argument.

[raymondfeng]

See a fix at #7251

[peace195]

@raymondfeng Thank you very much ✋