@basaltkit/search 1.1.0 → 1.3.0

package/dist/index.d.ts

@@ -103,6 +103,12 @@ declare class MeilisearchError extends BasaltError {
     readonly httpStatus: number;
     constructor(httpStatus: number, message: string);
 }
+declare class SearchFilterFieldError extends BasaltError {
+    constructor(field: string);
+}
+declare class SearchIndexNameError extends BasaltError {
+    constructor(name: string);
+}
 interface MeilisearchDriverOptions {
     host: string;
     apiKey?: string;
@@ -166,4 +172,4 @@ interface SearchPluginOptions {
 }
 declare function searchPlugin(options?: SearchPluginOptions): _basaltkit_core.BasaltPlugin<unknown>;
 
-export { type IndexDefinition, MeilisearchDriver, type MeilisearchDriverOptions, MeilisearchError, MemorySearchDriver, SEARCH, Search, type SearchDocument, type SearchDriver, type SearchHit, type SearchOptions, type SearchPluginOptions, type SearchQuery, type SearchResult, type SyncRule, TenantRequiredError, defineIndex, searchPlugin, syncRule };
+export { type IndexDefinition, MeilisearchDriver, type MeilisearchDriverOptions, MeilisearchError, MemorySearchDriver, SEARCH, Search, type SearchDocument, type SearchDriver, SearchFilterFieldError, type SearchHit, SearchIndexNameError, type SearchOptions, type SearchPluginOptions, type SearchQuery, type SearchResult, type SyncRule, TenantRequiredError, defineIndex, searchPlugin, syncRule };

package/dist/index.js

@@ -128,6 +128,22 @@ var MeilisearchError = class extends BasaltError2 {
   }
   httpStatus;
 };
+var SearchFilterFieldError = class extends BasaltError2 {
+  constructor(field) {
+    super("SEARCH_INVALID_FILTER_FIELD", `Invalid filter field name: ${JSON.stringify(field)}.`);
+  }
+};
+var SearchIndexNameError = class extends BasaltError2 {
+  constructor(name) {
+    super("SEARCH_INVALID_INDEX_NAME", `Invalid index name: ${JSON.stringify(name)}.`);
+  }
+};
+var SAFE_INDEX_NAME = /^[A-Za-z0-9_-]+$/;
+var assertValidIndexName = (name) => {
+  if (!SAFE_INDEX_NAME.test(name)) throw new SearchIndexNameError(name);
+  return name;
+};
+var SAFE_FILTER_FIELD = /^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)*$/;
 var primaryKey = (tenantId, id) => Buffer.from(`${tenantId}::${id}`).toString("base64url");
 var quote = (value) => JSON.stringify(value);
 var MeilisearchDriver = class {
@@ -138,6 +154,7 @@ var MeilisearchDriver = class {
   options;
   fetch;
   async register(index) {
+    assertValidIndexName(index.name);
     try {
       await this.request("POST", "/indexes", { uid: index.name, primaryKey: "_pk" });
     } catch {
@@ -151,16 +168,20 @@ var MeilisearchDriver = class {
     await this.bulk(indexName, [document]);
   }
   async bulk(indexName, documents) {
+    assertValidIndexName(indexName);
     const withPk = documents.map((d) => ({ ...d, _pk: primaryKey(d.tenantId, d.id) }));
     await this.request("PUT", `/indexes/${indexName}/documents`, withPk);
   }
   async remove(indexName, tenantId, id) {
+    assertValidIndexName(indexName);
     await this.request("DELETE", `/indexes/${indexName}/documents/${primaryKey(tenantId, id)}`);
   }
   async clear(indexName) {
+    assertValidIndexName(indexName);
     await this.request("DELETE", `/indexes/${indexName}/documents`);
   }
   async search(indexName, query) {
+    assertValidIndexName(indexName);
     const result = await this.request("POST", `/indexes/${indexName}/search`, {
       q: query.q,
       filter: this.buildFilter(query.tenantId, query.filters),
@@ -182,6 +203,7 @@ var MeilisearchDriver = class {
   buildFilter(tenantId, filters) {
     const parts = [`tenantId = ${quote(tenantId)}`];
     for (const [field, value] of Object.entries(filters ?? {})) {
+      if (!SAFE_FILTER_FIELD.test(field)) throw new SearchFilterFieldError(field);
       parts.push(Array.isArray(value) ? `${field} IN [${value.map(quote).join(", ")}]` : `${field} = ${quote(value)}`);
     }
     return parts.join(" AND ");
@@ -254,6 +276,8 @@ export {
   MemorySearchDriver,
   SEARCH,
   Search,
+  SearchFilterFieldError,
+  SearchIndexNameError,
   TenantRequiredError,
   defineIndex,
   searchPlugin,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@basaltkit/search",
-  "version": "1.1.0",
+  "version": "1.3.0",
   "description": "Full-text search for Basalt: tenant-scoped indexing and querying with a pluggable driver (in-memory for dev/test, Meilisearch for production) and automatic sync from domain events.",
   "license": "MIT",
   "type": "module",