MushroomObserver / mushroom-observer / 27115988207

98%

main: 98%

Pull #4477

github

Query: validate `order_by` against model's available scopes

Closes the silent-fallback hole noted in
[[project-query-order-by-validation]]. Before this commit,
`Query` accepted any string for `order_by` and the dispatcher
in `AbstractModel::OrderingScopes#order_by` silently fell back
to `id: :desc` whenever the supplied key had no matching
`order_by_<key>` private scope on the model. A typo in a
controller's `index_sort_options` rendered a sort dropdown
whose options secretly did nothing — looked plausible, failed
silently, escaped CI.

Adds `Query::Modules::Validation#validate_order_by!` which
runs from `clean_and_validate_params` (the existing
`before_validation` hook). Mirrors the dispatcher's special
cases exactly:
  - blank / nil → skip (Query::Foo.default_order takes over)
  - "none" → skip (dispatcher returns `all` unconditionally)
  - "reverse_X" or "X" → require `Model.order_by_X` (private)

Unknown keys land in `@validation_errors`, propagate to
`query.errors[:base]` via `Query::Validator`, and bubble up
through `lookup_and_save` as save failures (or surface
through `query.valid?` for callers that check).

Test-side: `GeneralExtensions#assert_each_sort_key_resolves`
now drives the same validator (calls `Query.lookup` per key,
checks `query.errors[:base]`) instead of duplicating the
model-private-method introspection. Single source of truth.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

60 of 61 new or added lines in 20 files covered. (98.36%)

45040 of 46167 relevant lines covered (97.56%)

755.74 hits per line