From 3f47728463341a1b84a70ca546fae398cd74d324 Mon Sep 17 00:00:00 2001
From: timonrieger <mail@timonrieger.de>
Date: Sun, 26 Jul 2026 17:15:58 +0200
Subject: [PATCH] strict only on filter and branches

---
 open-api/immich-openapi-specs.json               | 4 ----
 server/src/controllers/search.controller.spec.ts | 7 -------
 server/src/dtos/search.dto.ts                    | 8 ++++----
 3 files changed, 4 insertions(+), 15 deletions(-)

diff --git a/open-api/immich-openapi-specs.json b/open-api/immich-openapi-specs.json
index 269b09d75c..acfb986387 100644
--- a/open-api/immich-openapi-specs.json
+++ b/open-api/immich-openapi-specs.json
@@ -20717,7 +20717,6 @@
         "type": "object"
       },
       "MetadataSearchDto": {
-        "additionalProperties": false,
         "properties": {
           "albumIds": {
             "deprecated": true,
@@ -23152,7 +23151,6 @@
         "type": "object"
       },
       "RandomSearchDto": {
-        "additionalProperties": false,
         "properties": {
           "albumIds": {
             "deprecated": true,
@@ -25341,7 +25339,6 @@
         "type": "object"
       },
       "SmartSearchDto": {
-        "additionalProperties": false,
         "properties": {
           "albumIds": {
             "deprecated": true,
@@ -26090,7 +26087,6 @@
         "type": "object"
       },
       "StatisticsSearchDto": {
-        "additionalProperties": false,
         "properties": {
           "albumIds": {
             "deprecated": true,
diff --git a/server/src/controllers/search.controller.spec.ts b/server/src/controllers/search.controller.spec.ts
index a7aa495b48..26d4d7e8eb 100644
--- a/server/src/controllers/search.controller.spec.ts
+++ b/server/src/controllers/search.controller.spec.ts
@@ -130,13 +130,6 @@ describe(SearchController.name, () => {
       );
     });
 
-    it('should reject an unknown field on the request body', async () => {
-      const { status, body } = await request(ctx.getHttpServer())
-        .post('/search/metadata')
-        .send({ filter: {}, oderBy: { field: 'rating' } });
-      expect(status).toBe(400);
-      expect(body).toEqual(errorDto.validationError([{ path: [], message: 'Unrecognized key: "oderBy"' }]));
-    });
 
     it('should reject an unknown key in the filter', async () => {
       const { status, body } = await request(ctx.getHttpServer())
diff --git a/server/src/dtos/search.dto.ts b/server/src/dtos/search.dto.ts
index b1f2422468..a8b5d54f14 100644
--- a/server/src/dtos/search.dto.ts
+++ b/server/src/dtos/search.dto.ts
@@ -353,7 +353,7 @@ const RandomSearchBaseSchema = BaseSearchWithResultsSchema.extend({
   filter: filterField,
 });
 
-const RandomSearchSchema = withShapeExclusivity(RandomSearchBaseSchema.strict()).meta({ id: 'RandomSearchDto' });
+const RandomSearchSchema = withShapeExclusivity(RandomSearchBaseSchema).meta({ id: 'RandomSearchDto' });
 
 const MetadataSearchSchema = withShapeExclusivity(
   RandomSearchBaseSchema.extend({
@@ -369,14 +369,14 @@ const MetadataSearchSchema = withShapeExclusivity(
     page: z.int().min(1).optional().describe('Page number').meta(DEPRECATED_FLAT_FIELD),
     orderBy: SearchOrderSchema.optional().meta(ADDED_V3_1),
     cursor: cursorField,
-  }).strict(),
+  }),
 ).meta({ id: 'MetadataSearchDto' });
 
 const StatisticsSearchSchema = withShapeExclusivity(
   BaseSearchSchema.extend({
     description: z.string().trim().optional().describe('Filter by description text').meta(DEPRECATED_FLAT_FIELD),
     filter: filterField,
-  }).strict(),
+  }),
 ).meta({ id: 'StatisticsSearchDto' });
 
 const SmartSearchSchema = withShapeExclusivity(
@@ -387,7 +387,7 @@ const SmartSearchSchema = withShapeExclusivity(
     language: z.string().optional().describe('Search language code'),
     page: z.int().min(1).optional().describe('Page number').meta(DEPRECATED_FLAT_FIELD),
     filter: filterField,
-  }).strict(),
+  }),
 ).meta({ id: 'SmartSearchDto' });
 
 export class RandomSearchDto extends createZodDto(RandomSearchSchema) {}