kobotoolbox / kpi / 29431514116

81%

master: 76%

Build Type

push

github

Committed by web-flow

Commit Message

feat(search): switch relational-lookup validation from blacklist to allowlist for q search DEV-2417 (#7243)

### 📣 Summary
Implemented the allowlist approach for the q search endpoint to replace
the old blacklist method plus super users bypass the allowlist

### 📖 Description
Changes included in this PR:
* Added `ALLOWED_LOOKUP_FIELDS` and `DENIED_LOOKUP_FIELDS` to
`kpi/constants.py` mapping out which explicitly allowed fields are
available per model (used Gemini to find this list and included the
prompt used)
* Updated `QueryParseActions._validate_field` inside
`kpi/utils/query_parser/query_parser.py` to stop using the previous
blacklist and solely rely on the new allowlist mapping
* Kept the native JSONField validation and Django transform parsing,
meaning validation stops appropriately at a JSONField (leaving nested
keys unprocessed for relation logic) and implicit lookup filters like
`__icontains` bypass relationship checks
* Extended the `parse()` method to accept a `user` argument and updated
`kpi/filters.py` to pass `request.user` downstream to allow superusers
to bypass the allowlist checks

### 👀 Preview steps
Covered in unit tests, no need to test blocked queries

---------

Co-authored-by: Olivier Léger <olivierleger@gmail.com>

Coverage Stats

9272 of 12616 branches covered (73.49%)

22 of 22 new or added lines in 4 files covered. (100.0%)

649 existing lines in 26 files now uncovered.

30249 of 37166 relevant lines covered (81.39%)

5.52 hits per line