Repository navigation
fix: apply access filter to samples findOne - #2885
Merged
omkar-ethz merged 5 commits intoAug 20, 2026
Merged
Conversation
Contributor
There was a problem hiding this comment.
Hey - I've found 1 issue, and left some high level feedback:
- Consider extracting the
queryFiltersparsing andupdateFiltersForListapplication into a shared helper so the list and findOne endpoints stay consistently aligned when filter/access logic changes.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Consider extracting the `queryFilters` parsing and `updateFiltersForList` application into a shared helper so the list and findOne endpoints stay consistently aligned when filter/access logic changes.
## Individual Comments
### Comment 1
<location path="src/samples/samples.controller.ts" line_range="604-607" />
<code_context>
- const jsonFilters: IFilters<SampleDocument, ISampleFields> = queryFilters
- ? JSON.parse(queryFilters)
- : {};
+ const jsonFilters: IFilters<SampleDocument, ISampleFields> =
+ this.updateFiltersForList(
+ request,
+ queryFilters ? JSON.parse(queryFilters) : {},
+ );
const whereFilters = jsonFilters.where ?? {};
</code_context>
<issue_to_address>
**issue:** Consider handling malformed JSON in `queryFilters` to avoid unexpected runtime errors.
Because `queryFilters` comes from user input, any invalid JSON passed to `JSON.parse` will throw and can surface as a 500. Consider wrapping the parse in try/catch (or similar defensive parsing) so you can return a controlled client error (e.g., 400) instead of an uncaught exception.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Comment on lines
+604
to
+607
| const jsonFilters: IFilters<SampleDocument, ISampleFields> = | ||
| this.updateFiltersForList( | ||
| request, | ||
| queryFilters ? JSON.parse(queryFilters) : {}, |
Contributor
There was a problem hiding this comment.
issue: Consider handling malformed JSON in queryFilters to avoid unexpected runtime errors.
Because queryFilters comes from user input, any invalid JSON passed to JSON.parse will throw and can surface as a 500. Consider wrapping the parse in try/catch (or similar defensive parsing) so you can return a controlled client error (e.g., 400) instead of an uncaught exception.
omkar-ethz
approved these changes
Aug 19, 2026
omkar-ethz
left a comment
Member
There was a problem hiding this comment.
LGTM! added missing e2e tests for findOne (similar to the list endpoint)
Junjiequan
approved these changes
Aug 20, 2026
omkar-ethz
enabled auto-merge (squash)
August 20, 2026 09:23
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The samples findOne endpoint ran the caller's filter with only a class level read guard, so any authenticated user could read any sample by crafting the filter. This applies the same access filter the list endpoint uses.
Summary by Sourcery
Enforce sample access controls when retrieving individual samples.
Bug Fixes:
Tests: