prefer-allow-fields-middleware - ESLint plugin rules

This rule suggests using the allowFields middleware instead of writing to req.allowed directly.

Severity#

warn. This rule is enabled in the recommended preset.

What it Targets#

This rule targets the src/api/middlewares.ts file. It reports inline middleware functions inside defineMiddlewares that mutate req.allowed, whether by assignment or by calling .push().

The following code is reported by the rule:

src/api/middlewares.ts
1export default defineMiddlewares({2  routes: [3    {4      matcher: "/store/customers/me",5      middlewares: [6        (req, res, next) => {7          req.allowed.push("b2b_company")8          next()9        },10      ],11    },12  ],13})

Instead, use the allowFields middleware from @medusajs/framework/http:

src/api/middlewares.ts
1import { allowFields, defineMiddlewares } from "@medusajs/framework/http"2
3export default defineMiddlewares({4  routes: [5    {6      matcher: "/store/customers/me",7      middlewares: [allowFields("b2b_company")],8    },9  ],10})

Why it's Important#

The allowFields middleware is the idiomatic way to expand the allowed fields on a route. It is more concise, self-documenting, and composable: several plugins or middlewares can each call allowFields on the same route without overwriting one another.

Learn more in the Allowed Fields in API Routes documentation.

Fixable#

This rule isn't auto-fixable.

Turn it Off#

To turn off this rule, set it to off in your ESLint configuration:

eslint.config.ts
1import { defineConfig } from "eslint/config"2import medusa from "@medusajs/eslint-plugin"3
4export default defineConfig([5  ...medusa.configs.recommended,6  {7    rules: {8      "@medusajs/prefer-allow-fields-middleware": "off",9    },10  },11])

Or disable it for a single line using an inline comment:

Code
1// eslint-disable-next-line @medusajs/prefer-allow-fields-middleware2req.allowed.push("b2b_company")