fix(admin): make content list search work across the whole collection#752
Open
edrpls wants to merge 3 commits into
Open
fix(admin): make content list search work across the whole collection#752edrpls wants to merge 3 commits into
edrpls wants to merge 3 commits into
Conversation
🦋 Changeset detectedLatest commit: 9f581b8 The changes in this PR will be included in the next version bump. This PR includes changesets to release 13 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Contributor
Scope checkThis PR changes 1,912 lines across 29 files. Large PRs are harder to review and more likely to be closed without review. If this scope is intentional, no action needed. A maintainer will review it. If not, please consider splitting this into smaller PRs. See CONTRIBUTING.md for contribution guidelines. |
Contributor
Lunaria Status Overview🌕 This pull request will trigger status changes. Learn moreBy default, every PR changing files present in the Lunaria configuration's You can change this by adding one of the keywords present in the Tracked Files
Warnings reference
|
@emdash-cms/admin
@emdash-cms/auth
@emdash-cms/blocks
@emdash-cms/cloudflare
emdash
create-emdash
@emdash-cms/gutenberg-to-portable-text
@emdash-cms/x402
@emdash-cms/plugin-ai-moderation
@emdash-cms/plugin-atproto
@emdash-cms/plugin-audit-log
@emdash-cms/plugin-color
@emdash-cms/plugin-embeds
@emdash-cms/plugin-forms
@emdash-cms/plugin-webhook-notifier
commit: |
Contributor
Overlapping PRsThis PR modifies files that are also changed by other open PRs:
This may cause merge conflicts or duplicated work. A maintainer will coordinate. |
This was referenced Apr 24, 2026
18 tasks
This was referenced May 5, 2026
Contributor
|
This PR has been inactive for 14 days. It will be closed automatically in 7 days if there is no further activity. If you're still working on this, please push an update or leave a comment. |
This was referenced May 11, 2026
edrpls
force-pushed
the
fix/content-list-search
branch
from
129448f to
08fca45
Compare
Contributor
Author
|
Rebased on upstream main ( Local test runs after rebase, on top of
Bumping out of stale-warning territory. |
The admin search input filtered `items` already in memory — so any entry
past the first 100-item API fetch was invisible to search until the
user paged forward enough to load it. From the user's perspective
typing "Bleeding" on a 143-entry `films` collection returned zero
results even when a published `Bleeding` film existed on page 2.
Changes:
- `GET /_emdash/api/content/{collection}` accepts a `q` query parameter.
Case-insensitive LIKE against whichever of `title`, `name`, `slug`
actually exist on the collection's table. Columns are introspected
at query time via `pragma_table_info` / `information_schema.columns`;
LIKE wildcards are escaped; input is trimmed and capped at 200 chars.
- Admin list debounces the input by 300ms and pushes `q` through the
infinite-query key so switching queries resets the cursor chain.
- `<ContentList>` gains a controlled-search API (`searchQuery` +
`onSearchChange`). Legacy callers that don't opt in keep the original
client-side filter.
- `ContentPickerModal` migrated to the same server-side search; uses
`keepPreviousData` so the dropdown doesn't flash to empty between
keystrokes.
- MCP `content_list` tool accepts `q` too, so agents don't have to
post-filter either.
Regression tests cover substring match, case insensitivity, slug-only
collections, LIKE escape, empty-input handling, pathological input
truncation, and an admin-level controlled-search callback assertion.
edrpls
force-pushed
the
fix/content-list-search
branch
from
b8f394c to
6704774
Compare
Contributor
Author
|
Rebased on upstream Conflicts resolved (all orthogonal to #751's now-landed total/pagination machinery — same files, adjacent additions):
Local verification against
|
17 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Fixes the admin content list search so it actually finds existing content. Steps to reproduce on
main:/_emdash/admin/content/{collection}for any collection with more entries than fit in a single API fetch (defaultlimit: 100).Root cause: the admin's search input filters
itemsalready in the client-side accumulator (items.filter(i => getItemTitle(i).toLowerCase().includes(q))). The API is called withlimit: 100and no search parameter, so any entry past the first 100-item fetch is invisible to search until the user manually pages forward enough to load it. From the user's perspective, "search is broken."Fix: server-side search via a new
qquery parameter.Split from the (now closed) #749 — this is the third of three independent PRs. The other two are #750 sortable headers and #751 stable pagination denominator.
Changes
GET /_emdash/api/content/{collection}acceptsq.ContentRepository.findManyintrospects the collection's table columns via a newlistTableColumnshelper (pragma_table_infoon SQLite,information_schema.columnson Postgres), intersects with a hardcoded["title", "name", "slug"]whitelist, and buildsLOWER(col) LIKE LOWER(?) ESCAPE '\\'.%,_, and\in the input are escaped; input is trimmed and capped at 200 chars.count()honors the same search filter, so if a later change (or fix(admin): stable pagination denominator via total on the list response #751) reads the count for a search UI, it matches.qin the infinite-query key so switching queries resets the cursor chain.<ContentList>now has a controlled-search contract (searchQuery+onSearchChange); legacy callers that don't opt in keep the original client-side filter.ContentPickerModalmigrated to the same server-side search — previously it had the identical client-side bug. AddedplaceholderData: keepPreviousDataso the dropdown doesn't flash to empty between keystrokes.content_listtool acceptsq, so agents don't have to post-filter either. Samecontent:readscope gate; no auth-boundary change.Security notes
pragma_table_info(?)on SQLite is parameterized by better-sqlite3 12.x (verified).validateIdentifier(tableName)is belt-and-braces.sql.ref(col)wraps columns from the compile-time constantSEARCHABLE_COLUMNS. No user-supplied strings reach identifier position.\\before%and_) is correct.count()call pattern.Type of change
Checklist
pnpm typecheckpasses (admin + core)pnpm lintpasses (no new findings)ContentListcomponent testspnpm formathas been runtitle/namecolumns), LIKE escape, empty-input handling, pathological input truncation, handler-levelq, and controlled-search callback assertionpatchfor both packages)AI-generated code disclosure
Produced in a Claude Code session. Reviewed by Code Reviewer, Security Engineer, and Accessibility Auditor sub-agents against the combined branch before splitting; Security Engineer specifically verified the
pragma_table_infoparameterization and LIKE escape correctness.