[ARVADOS] updated: 2.1.0-1224-gced698936

[Git user]

Summary of changes:
 services/api/lib/record_filters.rb                 | 17 +++++++++
 .../arvados/v1/collections_controller_test.rb      | 44 ++++++++++++++++++++++
 2 files changed, 61 insertions(+)

       via  ced698936d8c6dcd75477de2ef184112567362fe (commit)
      from  402e69f6e55dce4e11d354c3ca708b8e536c124b (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.


commit ced698936d8c6dcd75477de2ef184112567362fe
Author: Tom Clegg <tom at curii.com>
Date:   Thu Aug 26 16:34:42 2021 -0400

    17994: Accept a few very specific expressions as filters.
    
    Arvados-DCO-1.1-Signed-off-by: Tom Clegg <tom at curii.com>

diff --git a/services/api/lib/record_filters.rb b/services/api/lib/record_filters.rb
index 8f4244f5b..635e9c1aa 100644
--- a/services/api/lib/record_filters.rb
+++ b/services/api/lib/record_filters.rb
@@ -155,6 +155,23 @@ module RecordFilters
 
           cond_out << "jsonb_exists(#{attr_table_name}.#{attr}, ?)"
           param_out << operand
+        elsif expr = /^ *\( *(\w+) *(<=?|>=?|=) *(\w+) *\) *$/.match(attr)
+          if operator != '=' || ![true,"true"].index(operand)
+            raise ArgumentError.new("Invalid expression filter '#{attr}': subsequent elements must be [\"=\", true]")
+          end
+          operator = expr[2]
+          attr1, attr2 = expr[1], expr[3]
+          allowed = attr_model_class.searchable_columns(operator)
+          [attr1, attr2].each do |tok|
+            if !allowed.index(tok)
+              raise ArgumentError.new("Invalid attribute in expression: '#{tok}'")
+            end
+            col = attr_model_class.columns.select { |c| c.name == tok }.first
+            if col.type != :integer
+              raise ArgumentError.new("Non-numeric attribute in expression: '#{tok}'")
+            end
+          end
+          cond_out << "#{attr1} #{operator} #{attr2}"
         else
           if !attr_model_class.searchable_columns(operator).index(attr) &&
              !(col.andand.type == :jsonb && ['contains', '=', '<>', '!='].index(operator))
diff --git a/services/api/test/functional/arvados/v1/collections_controller_test.rb b/services/api/test/functional/arvados/v1/collections_controller_test.rb
index 5b77a544e..fbee80d5a 100644
--- a/services/api/test/functional/arvados/v1/collections_controller_test.rb
+++ b/services/api/test/functional/arvados/v1/collections_controller_test.rb
@@ -1469,4 +1469,48 @@ EOS
       end
     end
   end
+
+  [['<', :<],
+   ['<=', :<=],
+   ['>', :>],
+   ['>=', :>=],
+   ['=', :==]].each do |op, rubyop|
+    test "filter collections by replication_desired #{op} replication_confirmed" do
+      authorize_with(:active)
+      get :index, params: {
+            filters: [["(replication_desired #{op} replication_confirmed)", "=", true]],
+          }
+      assert_response :success
+      json_response["items"].each do |c|
+        assert_operator(c["replication_desired"], rubyop, c["replication_confirmed"])
+      end
+    end
+  end
+
+  ["(replication_desired < bogus)",
+   "replication_desired < replication_confirmed",
+   "(replication_desired < replication_confirmed",
+   "(replication_desired ! replication_confirmed)",
+   "(replication_desired <)",
+   "(replication_desired < manifest_text)",
+   "(manifest_text < manifest_text)", # currently only numeric attrs are supported
+   "(replication_desired < 2)", # currently only attrs are supported, not literals
+   "(1 < 2)",
+  ].each do |expr|
+    test "invalid filter expression #{expr}" do
+      authorize_with(:active)
+      get :index, params: {
+            filters: [[expr, "=", true]],
+          }
+      assert_response 422
+    end
+  end
+
+  test "invalid op/arg with filter expression" do
+    authorize_with(:active)
+    get :index, params: {
+          filters: [["replication_desired < replication_confirmed", "!=", false]],
+        }
+    assert_response 422
+  end
 end

-----------------------------------------------------------------------


hooks/post-receive
--