The add-member search needs two letters, and its refusals are tested (#702) #1006

Merged
claude-bot merged 2 commits from fix/702-member-search into main 2026-10-01 20:47:26 +00:00
Collaborator

Closes #702. The setting and the server filter were already built; these are the last items.

  • Two letters. GET /campaigns/{id}/members/search strips the query and answers [] for fewer than two characters, in both scopes; a missing query does the same. It answers 200 with nothing rather than 422, because the page turns any non-200 into "The search did not answer", which would be an error for typing one letter. The "attach to an account" search is this same route, so it follows.
  • % and _ are literal. The query went straight into an ILIKE pattern, so %% or __ matched every account and got round the floor. They are escaped now.
  • The page (Members.jsx, FindSomeone) doesn't ask until two letters are typed, and shows nothing before that. No new text on the page (D20).
  • Tests: a plain player is refused (403), a non-member is refused (403), an unauthenticated caller is refused (401); too-short and wildcard queries find nobody in both scopes; two letters are enough; surrounding spaces don't count.
  • docs/API.md gains the route.

Left for the owner, noted on the issue: whether a hosted server should default to "people you have played with" (it belongs with #642).

Checked

  • Full backend suite: 6627 passed, 14 skipped. Full vitest: 3572 passed; eslint 0 errors. After merging main: the search tests, tests/wiki and the Redis tests, 645 passed.
  • No journey types into this search.
  • ruff 0.4.4 clean; changelog check OK (a security fragment). No migration, no bot API change.

🤖 Generated with Claude Code

Closes #702. The setting and the server filter were already built; these are the last items. - **Two letters.** `GET /campaigns/{id}/members/search` strips the query and answers `[]` for fewer than two characters, in both scopes; a missing query does the same. It answers 200 with nothing rather than 422, because the page turns any non-200 into "The search did not answer", which would be an error for typing one letter. The "attach to an account" search is this same route, so it follows. - **`%` and `_` are literal.** The query went straight into an `ILIKE` pattern, so `%%` or `__` matched every account and got round the floor. They are escaped now. - **The page** (`Members.jsx`, `FindSomeone`) doesn't ask until two letters are typed, and shows nothing before that. No new text on the page (D20). - **Tests:** a plain player is refused (403), a non-member is refused (403), an unauthenticated caller is refused (401); too-short and wildcard queries find nobody in both scopes; two letters are enough; surrounding spaces don't count. - `docs/API.md` gains the route. Left for the owner, noted on the issue: whether a hosted server should default to "people you have played with" (it belongs with #642). ## Checked - Full backend suite: 6627 passed, 14 skipped. Full vitest: 3572 passed; eslint 0 errors. After merging main: the search tests, `tests/wiki` and the Redis tests, 645 passed. - No journey types into this search. - ruff 0.4.4 clean; changelog check OK (a `security` fragment). No migration, no bot API change. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Merge remote-tracking branch 'origin/main' into fix/702-member-search
All checks were successful
CI / Bot tests and audit (pull_request) Successful in 2m1s
CI / Summarisation accuracy eval harness (stub provider) (pull_request) Successful in 2m13s
CI / Bot/backend version sync (pull_request) Successful in 35s
CI / Backend lint (ruff) (pull_request) Successful in 39s
CI / Docker image build (pull_request) Successful in 37s
CI / Does this change touch the recording path? (pull_request) Successful in 41s
CI / Synthetic session harness (no GPU, no LLM) (pull_request) Has been skipped
CI / Feedback site tests (pull_request) Successful in 1m34s
CI / Frontend (shard 2/2) (pull_request) Successful in 6m57s
CI / Frontend (shard 1/2) (pull_request) Successful in 9m6s
CI / End-to-end journeys (phone) (pull_request) Successful in 8m48s
CI / End-to-end journeys (desktop) (pull_request) Successful in 10m11s
CI / End-to-end journeys (keyboard) (pull_request) Successful in 17m23s
CI / Backend migration, tests, and audit (pull_request) Successful in 22m30s
2437c91c14
Sign in to join this conversation.
No description provided.