improvements

Author: nikgraf

packages/hypergraph/src/space/find-many-public.ts

@@ -3,6 +3,7 @@ import { Config } from '@graphprotocol/hypergraph';
 import * as Either from 'effect/Either';
 import * as EffectSchema from 'effect/Schema';
 import { request } from 'graphql-request';
+import { parseGeoId } from '../utils/geo-id.js';
 
 const spaceFields = `
   id
@@ -127,19 +128,33 @@ export type FindManyPublicParams = Readonly<{
   filter?: FindManyPublicFilter;
 }>;
 
-const buildFilterString = (filter?: FindManyPublicFilter): string | undefined => {
+const validateSpaceType = (spaceType: SpaceType): SpaceType => {
+  const result = EffectSchema.decodeUnknownEither(SpaceTypeSchema)(spaceType);
+  if (Either.isLeft(result)) {
+    throw new Error(`Invalid spaceType: ${spaceType}. Must be 'PERSONAL' or 'DAO'.`);
+  }
+  return result.right;
+};
+
+export const buildFilterString = (filter?: FindManyPublicFilter): string | undefined => {
   const conditions: string[] = [];
 
   if (filter?.memberId) {
-    conditions.push(`members: {some: {memberSpaceId: {is: "${filter.memberId}"}}}`);
+    // Validate memberId is a valid GeoId to prevent injection attacks
+    const validatedMemberId = parseGeoId(filter.memberId);
+    conditions.push(`members: {some: {memberSpaceId: {is: "${validatedMemberId}"}}}`);
   }
 
   if (filter?.editorId) {
-    conditions.push(`editors: {some: {memberSpaceId: {is: "${filter.editorId}"}}}`);
+    // Validate editorId is a valid GeoId to prevent injection attacks
+    const validatedEditorId = parseGeoId(filter.editorId);
+    conditions.push(`editors: {some: {memberSpaceId: {is: "${validatedEditorId}"}}}`);
   }
 
   if (filter?.spaceType) {
-    conditions.push(`type: {is: ${filter.spaceType}}`);
+    // Validate spaceType at runtime to ensure it's a valid value
+    const validatedSpaceType = validateSpaceType(filter.spaceType);
+    conditions.push(`type: {is: ${validatedSpaceType}}`);
   }
 
   if (conditions.length === 0) {
@@ -149,7 +164,7 @@ const buildFilterString = (filter?: FindManyPublicFilter): string | undefined =>
   return `filter: {${conditions.join(', ')}}`;
 };
 
-const buildSpacesQuery = (filter?: FindManyPublicFilter): string => {
+export const buildSpacesQuery = (filter?: FindManyPublicFilter): string => {
   const filterString = buildFilterString(filter);
   const filterClause = filterString ? `(${filterString})` : '';
 

packages/hypergraph/test/space/find-many-public.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest';
-import { parseSpacesQueryResult } from '../../src/space/find-many-public.js';
+import { buildFilterString, buildSpacesQuery, parseSpacesQueryResult } from '../../src/space/find-many-public.js';
 
 const buildQuerySpace = ({
   id = 'space-id',
@@ -141,3 +141,109 @@ describe('parseSpacesQueryResult', () => {
     ]);
   });
 });
+
+describe('buildFilterString', () => {
+  it('returns undefined when no filter is provided', () => {
+    expect(buildFilterString()).toBeUndefined();
+    expect(buildFilterString({})).toBeUndefined();
+  });
+
+  it('builds filter string with memberId', () => {
+    const result = buildFilterString({ memberId: '1e5e39daa00d4fd8b53b98095337112f' });
+    expect(result).toBe('filter: {members: {some: {memberSpaceId: {is: "1e5e39daa00d4fd8b53b98095337112f"}}}}');
+  });
+
+  it('builds filter string with editorId', () => {
+    const result = buildFilterString({ editorId: '1e5e39daa00d4fd8b53b98095337112f' });
+    expect(result).toBe('filter: {editors: {some: {memberSpaceId: {is: "1e5e39daa00d4fd8b53b98095337112f"}}}}');
+  });
+
+  it('builds filter string with spaceType PERSONAL', () => {
+    const result = buildFilterString({ spaceType: 'PERSONAL' });
+    expect(result).toBe('filter: {type: {is: PERSONAL}}');
+  });
+
+  it('builds filter string with spaceType DAO', () => {
+    const result = buildFilterString({ spaceType: 'DAO' });
+    expect(result).toBe('filter: {type: {is: DAO}}');
+  });
+
+  it('builds filter string with memberId and spaceType', () => {
+    const result = buildFilterString({ memberId: '1e5e39daa00d4fd8b53b98095337112f', spaceType: 'PERSONAL' });
+    expect(result).toBe(
+      'filter: {members: {some: {memberSpaceId: {is: "1e5e39daa00d4fd8b53b98095337112f"}}}, type: {is: PERSONAL}}',
+    );
+  });
+
+  it('builds filter string with editorId and spaceType', () => {
+    const result = buildFilterString({ editorId: '1e5e39daa00d4fd8b53b98095337112f', spaceType: 'DAO' });
+    expect(result).toBe(
+      'filter: {editors: {some: {memberSpaceId: {is: "1e5e39daa00d4fd8b53b98095337112f"}}}, type: {is: DAO}}',
+    );
+  });
+
+  it('normalizes UUID with dashes to dashless format', () => {
+    const result = buildFilterString({ memberId: '1e5e39da-a00d-4fd8-b53b-98095337112f' });
+    expect(result).toBe('filter: {members: {some: {memberSpaceId: {is: "1e5e39daa00d4fd8b53b98095337112f"}}}}');
+  });
+
+  it('throws error for invalid memberId', () => {
+    expect(() => buildFilterString({ memberId: 'invalid-id' })).toThrow('Invalid Geo ID');
+  });
+
+  it('throws error for invalid editorId', () => {
+    expect(() => buildFilterString({ editorId: 'invalid"; DROP TABLE spaces; --' })).toThrow('Invalid Geo ID');
+  });
+
+  it('throws error for invalid spaceType', () => {
+    // @ts-expect-error - testing runtime validation with invalid value
+    expect(() => buildFilterString({ spaceType: 'INVALID' })).toThrow(
+      "Invalid spaceType: INVALID. Must be 'PERSONAL' or 'DAO'.",
+    );
+  });
+});
+
+describe('buildSpacesQuery', () => {
+  it('builds query without filter', () => {
+    const query = buildSpacesQuery();
+    expect(query).toContain('query spaces {');
+    // Check that the top-level spaces query doesn't have a filter (spaces { not spaces(filter:)
+    expect(query).toMatch(/spaces\s*\{/);
+    expect(query).not.toMatch(/spaces\s*\(filter:/);
+  });
+
+  it('builds query with memberId filter', () => {
+    const query = buildSpacesQuery({ memberId: '1e5e39daa00d4fd8b53b98095337112f' });
+    expect(query).toContain(
+      'spaces(filter: {members: {some: {memberSpaceId: {is: "1e5e39daa00d4fd8b53b98095337112f"}}}})',
+    );
+  });
+
+  it('builds query with editorId filter', () => {
+    const query = buildSpacesQuery({ editorId: '1e5e39daa00d4fd8b53b98095337112f' });
+    expect(query).toContain(
+      'spaces(filter: {editors: {some: {memberSpaceId: {is: "1e5e39daa00d4fd8b53b98095337112f"}}}})',
+    );
+  });
+
+  it('builds query with spaceType filter only', () => {
+    const query = buildSpacesQuery({ spaceType: 'DAO' });
+    expect(query).toContain('spaces(filter: {type: {is: DAO}})');
+  });
+
+  it('builds query with combined filters', () => {
+    const query = buildSpacesQuery({ memberId: '1e5e39daa00d4fd8b53b98095337112f', spaceType: 'PERSONAL' });
+    expect(query).toContain(
+      'spaces(filter: {members: {some: {memberSpaceId: {is: "1e5e39daa00d4fd8b53b98095337112f"}}}, type: {is: PERSONAL}})',
+    );
+  });
+
+  it('includes required space fields in query', () => {
+    const query = buildSpacesQuery();
+    expect(query).toContain('id');
+    expect(query).toContain('type');
+    expect(query).toContain('page {');
+    expect(query).toContain('editorsList {');
+    expect(query).toContain('membersList {');
+  });
+});