adapt-authoring-api 1.3.6 → 1.4.0

package/lib/AbstractApiModule.js

@@ -410,6 +410,37 @@ class AbstractApiModule extends AbstractModule {
             opts[key] = val
           }
         })
+        // handle search parameter
+        const search = req.apiData.query.search
+        if (search) {
+          delete req.apiData.query.search
+          try {
+            const schema = await this.getSchema(req.apiData.schemaName)
+            if (schema && schema.built && schema.built.properties) {
+              const searchableFields = Object.keys(schema.built.properties).filter(
+                field => schema.built.properties[field].isSearchable === true
+              )
+              if (searchableFields.length) {
+                // escape special regex characters to prevent ReDoS attacks
+                const escapedSearch = search.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+                const regex = { $regex: escapedSearch, $options: 'i' }
+                const searchConditions = searchableFields.map(f => ({ [f]: regex }))
+                // merge with existing $or if present
+                if (req.apiData.query.$or) {
+                  req.apiData.query.$and = [
+                    { $or: req.apiData.query.$or },
+                    { $or: searchConditions }
+                  ]
+                  delete req.apiData.query.$or
+                } else {
+                  req.apiData.query.$or = searchConditions
+                }
+              }
+            }
+          } catch (e) {
+            this.log('warn', `failed to process search parameter, ${e.message}`)
+          }
+        }
         req.apiData.query = await this.parseQuery(req.apiData.schemaName, req.body, mongoOpts)
         // remove any valid query keys from the options
         Object.keys(req.apiData.query).forEach(key => delete opts[key])

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "adapt-authoring-api",
-  "version": "1.3.6",
+  "version": "1.4.0",
   "description": "Abstract module for creating APIs",
   "homepage": "https://github.com/adapt-security/adapt-authoring-api",
   "license": "GPL-3.0",
@@ -8,11 +8,11 @@
   "main": "index.js",
   "repository": "github:adapt-security/adapt-authoring-api",
   "dependencies": {
+    "adapt-authoring-core": "^1.7.0",
     "lodash": "^4.17.21"
   },
   "peerDependencies": {
-    "adapt-authoring-auth": "^1.0.5",
-    "adapt-authoring-core": "^1.7.0",
+    "adapt-authoring-auth": "^1.0.6",
     "adapt-authoring-jsonschema": "^1.2.0",
     "adapt-authoring-mongodb": "^1.1.3",
     "adapt-authoring-server": "^1.2.1"
@@ -21,9 +21,6 @@
     "adapt-authoring-auth": {
       "optional": true
     },
-    "adapt-authoring-core": {
-      "optional": true
-    },
     "adapt-authoring-jsonschema": {
       "optional": true
     },