API/Queries/Attributes.md

@@ -173,11 +173,15 @@ Use `+columns` to get all columns of the base table plus certain ones from joine
 # Select and As
 
 The "select" and "as" attribues allow even more flexibility to define exactly what should be returned than "columns" does. Other than renaming a column,
-functions may be used to select calculated values.
+[permitted functions](#permitted-functions) may be used to select calculated values.
+
+For each entry in "select" a corresponding entry in "as" must be present to name the result.
 
 ## Restrictions
 
-Keys and values may not contain spaces.
+Only [permitted functions](#permitted-functions) may be called. The value of the call might be itself a function call, like `{"max" : "coalesce(me.id,1)"}`.
+This function must again be in the list of permitted functions and it's parameters can only be column identifiers or values which match the regular expression
+used to check column names (`^[a-zA-Z0-9\.\_]+$`).
 
 ## Examples
 
@@ -247,6 +251,21 @@ Returns one row:
 }
 ```
 
+Use another function:
+
+```json
+{
+  "attrs": {
+    "select": [
+      {
+        "max": "coalesce(me.id,1)"
+       }
+    ],
+    "as": ["bla"]
+  }
+}
+```
+
 "+select" and "+as" are also available.
 
 <https://metacpan.org/pod/distribution/DBIx-Class/lib/DBIx/Class/ResultSet.pm#select>
@@ -430,6 +449,18 @@ Note that "prefetch" is a shortcut for "join", adding all columns from the joine
 
 https://metacpan.org/pod/distribution/DBIx-Class/lib/DBIx/Class/ResultSet.pm#collapse
 
+# Permitted functions
+
+For any attribute which allows to call a function, this function must be permitted. Apart from
+
+- coalesce
+- count
+- least
+- min
+- max
+
+other permitted functions may be listed for a project.
+
 # Naming Conventions
 
 When referencing to a column, the name without the table prefix can be used as long as it is unique within