@basaltkit/search 1.1.0 → 1.2.0

package/dist/index.d.ts

@@ -103,6 +103,9 @@ declare class MeilisearchError extends BasaltError {
     readonly httpStatus: number;
     constructor(httpStatus: number, message: string);
 }
+declare class SearchFilterFieldError extends BasaltError {
+    constructor(field: string);
+}
 interface MeilisearchDriverOptions {
     host: string;
     apiKey?: string;
@@ -166,4 +169,4 @@ interface SearchPluginOptions {
 }
 declare function searchPlugin(options?: SearchPluginOptions): _basaltkit_core.BasaltPlugin<unknown>;
 
-export { type IndexDefinition, MeilisearchDriver, type MeilisearchDriverOptions, MeilisearchError, MemorySearchDriver, SEARCH, Search, type SearchDocument, type SearchDriver, type SearchHit, type SearchOptions, type SearchPluginOptions, type SearchQuery, type SearchResult, type SyncRule, TenantRequiredError, defineIndex, searchPlugin, syncRule };
+export { type IndexDefinition, MeilisearchDriver, type MeilisearchDriverOptions, MeilisearchError, MemorySearchDriver, SEARCH, Search, type SearchDocument, type SearchDriver, SearchFilterFieldError, type SearchHit, type SearchOptions, type SearchPluginOptions, type SearchQuery, type SearchResult, type SyncRule, TenantRequiredError, defineIndex, searchPlugin, syncRule };

package/dist/index.js

@@ -128,6 +128,12 @@ var MeilisearchError = class extends BasaltError2 {
   }
   httpStatus;
 };
+var SearchFilterFieldError = class extends BasaltError2 {
+  constructor(field) {
+    super("SEARCH_INVALID_FILTER_FIELD", `Invalid filter field name: ${JSON.stringify(field)}.`);
+  }
+};
+var SAFE_FILTER_FIELD = /^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)*$/;
 var primaryKey = (tenantId, id) => Buffer.from(`${tenantId}::${id}`).toString("base64url");
 var quote = (value) => JSON.stringify(value);
 var MeilisearchDriver = class {
@@ -182,6 +188,7 @@ var MeilisearchDriver = class {
   buildFilter(tenantId, filters) {
     const parts = [`tenantId = ${quote(tenantId)}`];
     for (const [field, value] of Object.entries(filters ?? {})) {
+      if (!SAFE_FILTER_FIELD.test(field)) throw new SearchFilterFieldError(field);
       parts.push(Array.isArray(value) ? `${field} IN [${value.map(quote).join(", ")}]` : `${field} = ${quote(value)}`);
     }
     return parts.join(" AND ");
@@ -254,6 +261,7 @@ export {
   MemorySearchDriver,
   SEARCH,
   Search,
+  SearchFilterFieldError,
   TenantRequiredError,
   defineIndex,
   searchPlugin,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@basaltkit/search",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Full-text search for Basalt: tenant-scoped indexing and querying with a pluggable driver (in-memory for dev/test, Meilisearch for production) and automatic sync from domain events.",
   "license": "MIT",
   "type": "module",