kobotoolbox / kpi / 29431514116 / 6

81%

master: 76%

push

github

feat(search): switch relational-lookup validation from blacklist to allowlist for q search DEV-2417 (#7243)

### 📣 Summary
Implemented the allowlist approach for the q search endpoint to replace
the old blacklist method plus super users bypass the allowlist

### 📖 Description
Changes included in this PR:
* Added `ALLOWED_LOOKUP_FIELDS` and `DENIED_LOOKUP_FIELDS` to
`kpi/constants.py` mapping out which explicitly allowed fields are
available per model (used Gemini to find this list and included the
prompt used)
* Updated `QueryParseActions._validate_field` inside
`kpi/utils/query_parser/query_parser.py` to stop using the previous
blacklist and solely rely on the new allowlist mapping
* Kept the native JSONField validation and Django transform parsing,
meaning validation stops appropriately at a JSONField (leaving nested
keys unprocessed for relation logic) and implicit lookup filters like
`__icontains` bypass relationship checks
* Extended the `parse()` method to accept a `user` argument and updated
`kpi/filters.py` to pass `request.user` downstream to allow superusers
to bypass the allowlist checks

### 👀 Preview steps
Covered in unit tests, no need to test blocked queries

---------

Co-authored-by: Olivier Léger <olivierleger@gmail.com>

4544 of 12472 branches covered (36.43%)

18887 of 37083 relevant lines covered (50.93%)

0.51 hits per line