fix: SoQL escaping, NY-timezone today, error detail - #7
Merged
Conversation
- Add soqlString() helper (quote-doubling) and use it in every $where builder: getNoticesByType, getNoticesByAgency, getNoticesByDateRange. - Validate notice_type with z.enum (mirrors the advertised tool enum, now derived from a single NOTICE_TYPES constant) and date params as YYYY-MM-DD. - getOpenSolicitations: compute "today" in America/New_York (nyToday()) instead of UTC, which dropped same-day deadlines after 8pm ET. - Include the (truncated, 300-char) Socrata error body in thrown errors. - Live-verified 2026-07-06: dataset's distinct type_of_notice_description values exactly match the hardcoded lists/enum (10 values, plus null rows); all start_date values are midnight, so the <= end bound is correct (documented in code). - Tests: escaping regressions, injected-clock NY-date checks (EDT/EST), error-body inclusion + truncation. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…refresh - Bump package.json/lockfile to 1.0.2. - Server reads its version from package.json via createRequire instead of a hardcoded string. - CHANGELOG: move Unreleased items into 1.0.2 (double-encoding fix #6, SoQL escaping + enum enforcement + NY-timezone today + error detail #7, hono bump #4, CI #3, release automation #8). - README: Claude Code config updated to .mcp.json / claude mcp add; add npm test instructions. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
noneck
force-pushed
the
fix/soql-escaping-and-timezone
branch
from
July 6, 2026 13:25
8bbb393 to
b9552cc
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
From the 2026-07-06 code review (follow-up to #6):
getNoticesByTypeandgetNoticesByDateRangeinterpolated user input into$whereclauses without escaping single quotes; no client-side validation of notice types or dates.getOpenSolicitationsusednew Date().toISOString(), so between 8pm and midnight ET the UTC date is already tomorrow and same-day solicitation deadlines were wrongly dropped.Fix
soqlString()helper (quote-doubling per SQL rules), used by every$wherebuilder.notice_typevalidated withz.enummirroring the advertised tool enum; both now derive from a single exportedNOTICE_TYPESconstant. Date-range params validated asYYYY-MM-DD.nyToday()computes today's date inAmerica/New_YorkviaIntl.DateTimeFormat('en-CA'); accepts an injected clock for testing.Live verification (read-only, 2026-07-06)
$group=type_of_notice_descriptionreturned exactly the 10 values already hardcoded in the enum and thein (...)lists (Award 52,880; Solicitation 45,031; … Intent to Negotiate 1), plus ~956k rows with a null type. No mismatches; list pinned in a dated code comment.start_datevalues are midnight (date_extract_hh/mm != 0→ 0 rows), so the<= endDateupper bound already includes the full end day. Documented in a code comment instead of changing the comparison.Test plan (already run, green)
npm run build— clean.npm test— 8/8 pass: quote-escaping regressions for type/agency/date-range (including an injection-shaped input),nyTodaywith injected clocks across EDT/EST boundaries, error-body inclusion + 300-char truncation, plus the existing fix: double-encoded SoQL wildcard broke agency search #6 encoding test.🤖 Generated with Claude Code