feat(layers): add layer search to the API - #73
Conversation
e2875ef to
b89ac00
Compare
5d10448 to
3e93f35
Compare
| WSS_API: Type.String(), | ||
| KONG_API: Type.Optional(Type.String()), | ||
| ADMIN_KEY: Type.Optional(Type.String()), | ||
| WSS_API: Type.Optional(Type.String()), |
There was a problem hiding this comment.
Ces changements sont inclus dans une autre PR
| ) | ||
| .orderBy(desc(rank)) | ||
| .limit(limit) | ||
| .offset(offset); |
There was a problem hiding this comment.
[COPILOT]: Pagination is applied before authorization filtering
The DB query fetches limit rows, then silently drops those the user can't access. This means a page can return fewer results than limit even when more valid rows exist, and results shift unpredictably across pages. Consider over-fetching or doing a two-phase approach (get IDs allowed for this profil first, then paginate).
| type: Type.Optional( | ||
| Type.Union([Type.Literal('layer'), Type.Literal('group')]) | ||
| ), | ||
| limit: Type.Optional(Type.Integer({ minimum: 1 })), |
There was a problem hiding this comment.
On devrait imposer un maximum, 100?
| 'simple', | ||
| coalesce(${layerModel.layerOptions}->>'title', ${layerModel.layers}, ''), | ||
| to_tsquery('simple', ${toTextSearchString(originalQuery)}), | ||
| 'StartSel=<strong>, StopSel=</strong>' |
There was a problem hiding this comment.
[Medium] XSS vector in highlight.title
ts_headline returns the document text with ... tags injected but does not HTML-escape the surrounding text. If a layer title contains <script>...</script>, it will appear unescaped in the response. Clients that render highlight.title as raw HTML are vulnerable. Consider HTML-escaping the document before passing it to ts_headline, or documenting explicitly that consumers must sanitize this field.
| type: layerModel.type, | ||
| url: layerModel.url, | ||
| layers: layerModel.layers, | ||
| global: layerModel.global, |
There was a problem hiding this comment.
global column is selected but never used
| return term | ||
| .split(' ') | ||
| .filter(Boolean) | ||
| .map((term) => `${term}:*`) |
There was a problem hiding this comment.
Rename the .map callback parameter (e.g. word) to avoid the shadowing.
|
|
||
| const result = response.json<ILayerSearchResult>(); | ||
| t.assert.equal(Array.isArray(result.items), true); | ||
| t.assert.equal(result.items.length > 0, true); |
There was a problem hiding this comment.
would give a poor failure message; consider using t.assert.ok(result.items.length > 0, 'expected at least one result').
| /** | ||
| * Prevent to add unaccent extension on DB backend. | ||
| */ | ||
| const sqlTranslateStripAccents = ( |
There was a problem hiding this comment.
J'irais avec ton idée initiale d'utiliser l'extension unaccent qui semble incluse dans la grand majorité des versions de PostgreSQL. On pourrait ajouter une migration pour l'activer par défaut et l'utiliser dans ce cas ci
CREATE EXTENSION IF NOT EXISTS unaccent;
2 participants
add layer search to the API