n8n-io/n8n · error · TypeORMError

SelectQueryBuilder.addOrderBy "order" can accept only "ASC"

Error message

SelectQueryBuilder.addOrderBy "order" can accept only "ASC" and "DESC" values.

What it means

SelectQueryBuilder.orderBy validates the order argument and throws TypeORMError if it is neither 'ASC' nor 'DESC' (and not undefined). The signature is typed as the union, but a runtime value (often from user input) that violates it is caught here rather than producing malformed SQL.

Source

Thrown at packages/@n8n/typeorm/src/query-builder/SelectQueryBuilder.ts:1273

	/**
	 * Sets ORDER BY condition in the query builder.
	 * If you had previously ORDER BY expression defined,
	 * calling this function will override previously set ORDER BY conditions.
	 */
	orderBy(order: OrderByCondition): this;

	/**
	 * Sets ORDER BY condition in the query builder.
	 * If you had previously ORDER BY expression defined,
	 * calling this function will override previously set ORDER BY conditions.
	 */
	orderBy(
		sort?: string | OrderByCondition,
		order: 'ASC' | 'DESC' = 'ASC',
		nulls?: 'NULLS FIRST' | 'NULLS LAST',
	): this {
		if (order !== undefined && order !== 'ASC' && order !== 'DESC')
			throw new TypeORMError(
				`SelectQueryBuilder.addOrderBy "order" can accept only "ASC" and "DESC" values.`,
			);
		if (nulls !== undefined && nulls !== 'NULLS FIRST' && nulls !== 'NULLS LAST')
			throw new TypeORMError(
				`SelectQueryBuilder.addOrderBy "nulls" can accept only "NULLS FIRST" and "NULLS LAST" values.`,
			);

		if (sort) {
			if (typeof sort === 'object') {
				this.expressionMap.orderBys = sort as OrderByCondition;
			} else {
				if (nulls) {
					this.expressionMap.orderBys = {
						[sort as string]: { order, nulls },
					};
				} else {
					this.expressionMap.orderBys = { [sort as string]: order };
				}

View on GitHub (pinned to 5ac6606e81)

Solutions

Normalize user input: const dir = String(req.query.sort).toUpperCase() === 'DESC' ? 'DESC' : 'ASC'; then qb.orderBy(field, dir).
Whitelist the value before passing: if (!['ASC','DESC'].includes(input)) throw new UserError('invalid sort').
Use zod/joi schema validation on the query string with an enum of ['asc','desc'].

Example fix

// before
qb.orderBy('user.name', req.query.dir as 'ASC'|'DESC');
// after
const dir = req.query.dir === 'desc' ? 'DESC' : 'ASC';
qb.orderBy('user.name', dir);

Defensive patterns

Strategy: validation

Validate before calling

const SORT_DIR = ['ASC', 'DESC'] as const;
type SortDir = typeof SORT_DIR[number];
function normalizeDir(input: unknown): SortDir {
  return String(input).toUpperCase() === 'DESC' ? 'DESC' : 'ASC';
}
// qb.orderBy(field, normalizeDir(req.query.dir));

Type guard

function isSortDir(value: unknown): value is 'ASC' | 'DESC' {
  return value === 'ASC' || value === 'DESC';
}

Prevention

Whitelist and upper-case sort direction at the controller boundary.
Validate the query string with a zod enum(['asc','desc']) schema.
Never cast user input to the union type without normalization.

When it happens

Trigger: qb.orderBy('user.name', req.query.sort as string) where req.query.sort is 'asc'/'Asc'/'ascending'/''; passing a lowercased or localized sort string from an HTTP API.

Common situations: Accepting sort direction from query params without normalization; copy-pasting 'ascending' from a UI dropdown value; locale-specific strings.

Related errors

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/63f279b75c7564c1. Report an issue: GitHub.