fix: don't treat all possible query values as strings

Cargo.toml

@@ -44,6 +44,7 @@ hex = "0.4.3"
 http = "0.2.9"
 humantime = "2"
 humantime-serde = "1"
+human-date-parser = "0.1"
 indicatif = "0.17.8"
 indicatif-log-bridge = "0.2"
 jsonpath-rust = "0.5"

modules/search/Cargo.toml

@@ -11,6 +11,7 @@ trustify-entity = { path = "../../entity" }
 actix-web = { workspace = true }
 anyhow = { workspace = true }
 csaf = { workspace = true }
+human-date-parser = { workspace = true }
 log = { workspace = true }
 regex = { workspace = true }
 reqwest = { workspace = true }
@@ -23,5 +24,6 @@ tokio = { workspace = true, features = ["full"] }
 utoipa = { workspace = true, features = ["actix_extras"] }
 
 [dev-dependencies]
+chrono = { workspace = true }
 test-log = { workspace = true, features = ["env_logger", "trace"] }
 url-escape = { workspace = true }

modules/search/src/query.rs

@@ -1,9 +1,14 @@
 use crate::service::Error;
+use human_date_parser::{from_human_time, ParseResult};
 use regex::Regex;
 use sea_orm::sea_query::IntoCondition;
-use sea_orm::{ColumnTrait, ColumnType, Condition, EntityTrait, Iterable, Order};
+use sea_orm::{ColumnTrait, ColumnType, Condition, EntityTrait, Iterable, Order, Value};
+use std::fmt::Display;
 use std::str::FromStr;
 use std::sync::OnceLock;
+use time::format_description::well_known::Rfc3339;
+use time::macros::format_description;
+use time::{Date, OffsetDateTime};
 
 /////////////////////////////////////////////////////////////////////////
 // Public interface
@@ -20,13 +25,16 @@ pub struct Sort<T: EntityTrait> {
 }
 
 impl<T: EntityTrait> Filter<T> {
-    pub fn into_condition(&self) -> Condition {
-        match &self.operands {
+    pub fn into_condition(self) -> Condition {
+        match self.operands {
             Operand::Simple(col, v) => match self.operator {
                 Operator::Equal => col.eq(v).into_condition(),
                 Operator::NotEqual => col.ne(v).into_condition(),
                 op @ (Operator::Like | Operator::NotLike) => {
-                    let v = format!("%{}%", v.replace('%', r"\%").replace('_', r"\_"));
+                    let v = format!(
+                        "%{}%",
+                        v.unwrap::<String>().replace('%', r"\%").replace('_', r"\_")
+                    );
                     if op == Operator::Like {
                         col.like(v)
                     } else {
@@ -42,10 +50,10 @@ impl<T: EntityTrait> Filter<T> {
             },
             Operand::Composite(v) => match self.operator {
                 Operator::And => v
-                    .iter()
+                    .into_iter()
                     .fold(Condition::all(), |and, f| and.add(f.into_condition())),
                 Operator::Or => v
-                    .iter()
+                    .into_iter()
                     .fold(Condition::any(), |or, f| or.add(f.into_condition())),
                 _ => unreachable!(),
             },
@@ -105,6 +113,7 @@ impl<T: EntityTrait> FromStr for Filter<T> {
             let col = T::Column::from_str(field).map_err(|_| {
                 Error::SearchSyntax(format!("Invalid field name for filter: '{field}'"))
             })?;
+            let def = col.def();
             let operator = Operator::from_str(&caps["op"])?;
             Ok(Filter {
                 operator: match operator {
@@ -114,8 +123,12 @@ impl<T: EntityTrait> FromStr for Filter<T> {
                 operands: Operand::Composite(
                     caps["value"]
                         .split('|')
-                        .map(|s| Filter {
-                            operands: Operand::Simple(col, decode(s)),
+                        .map(decode)
+                        .map(|s| envalue(&s, def.get_column_type()))
+                        .collect::<Result<Vec<_>, _>>()?
+                        .into_iter()
+                        .map(|v| Filter {
+                            operands: Operand::Simple(col, v),
                             operator,
                         })
                         .collect(),
@@ -131,7 +144,7 @@ impl<T: EntityTrait> FromStr for Filter<T> {
                         .flat_map(|s| {
                             T::Column::iter().filter_map(|col| match col.def().get_column_type() {
                                 ColumnType::String(_) | ColumnType::Text => Some(Filter {
-                                    operands: Operand::<T>::Simple(col, decode(s)),
+                                    operands: Operand::<T>::Simple(col, decode(s).into()),
                                     operator: Operator::Like,
                                 }),
                                 _ => None,
@@ -188,7 +201,7 @@ impl FromStr for Operator {
 /////////////////////////////////////////////////////////////////////////
 
 enum Operand<T: EntityTrait> {
-    Simple(T::Column, String),
+    Simple(T::Column, Value),
     Composite(Vec<Filter<T>>),
 }
 
@@ -214,13 +227,39 @@ fn decode(s: &str) -> String {
     s.replace('\x07', "&").replace('\x08', "|")
 }
 
+fn envalue(s: &str, ct: &ColumnType) -> Result<Value, Error> {
+    fn err(e: impl Display) -> Error {
+        Error::SearchSyntax(format!(r#"conversion error: "{e}""#))
+    }
+    Ok(match ct {
+        ColumnType::Integer => s.parse::<i32>().map_err(err)?.into(),
+        ColumnType::TimestampWithTimeZone => {
+            if let Ok(odt) = OffsetDateTime::parse(s, &Rfc3339) {
+                odt.into()
+            } else if let Ok(d) = Date::parse(s, &format_description!("[year]-[month]-[day]")) {
+                d.into()
+            } else if let Ok(human) = from_human_time(s) {
+                match human {
+                    ParseResult::DateTime(dt) => dt.into(),
+                    ParseResult::Date(d) => d.into(),
+                    ParseResult::Time(t) => t.into(),
+                }
+            } else {
+                s.into()
+            }
+        }
+        _ => s.into(),
+    })
+}
+
 /////////////////////////////////////////////////////////////////////////
 // Tests
 /////////////////////////////////////////////////////////////////////////
 
 #[cfg(test)]
 mod tests {
     use super::*;
+    use chrono::{Local, TimeDelta};
     use sea_orm::{QueryFilter, QuerySelect, QueryTrait};
     use test_log::test;
     use trustify_entity::advisory;
@@ -343,8 +382,8 @@ mod tests {
             r#"("advisory"."identifier" LIKE '%foo%' OR "advisory"."location" LIKE '%foo%' OR "advisory"."sha256" LIKE '%foo%' OR "advisory"."title" LIKE '%foo%') AND "advisory"."location" = 'bar'"#
         );
         assert_eq!(
-            where_clause(r"m\&m's&location=f\&oo&id=ba\&r")?,
-            r#"("advisory"."identifier" LIKE E'%m&m\'s%' OR "advisory"."location" LIKE E'%m&m\'s%' OR "advisory"."sha256" LIKE E'%m&m\'s%' OR "advisory"."title" LIKE E'%m&m\'s%') AND "advisory"."location" = 'f&oo' AND "advisory"."id" = 'ba&r'"#
+            where_clause(r"m\&m's&location=f\&oo&id=13")?,
+            r#"("advisory"."identifier" LIKE E'%m&m\'s%' OR "advisory"."location" LIKE E'%m&m\'s%' OR "advisory"."sha256" LIKE E'%m&m\'s%' OR "advisory"."title" LIKE E'%m&m\'s%') AND "advisory"."location" = 'f&oo' AND "advisory"."id" = 13"#
         );
         assert_eq!(
             where_clause("location=a|b|c")?,
@@ -364,7 +403,7 @@ mod tests {
         );
         assert_eq!(
             where_clause("a|b&id=1")?,
-            r#"("advisory"."identifier" LIKE '%a%' OR "advisory"."location" LIKE '%a%' OR "advisory"."sha256" LIKE '%a%' OR "advisory"."title" LIKE '%a%' OR "advisory"."identifier" LIKE '%b%' OR "advisory"."location" LIKE '%b%' OR "advisory"."sha256" LIKE '%b%' OR "advisory"."title" LIKE '%b%') AND "advisory"."id" = '1'"#
+            r#"("advisory"."identifier" LIKE '%a%' OR "advisory"."location" LIKE '%a%' OR "advisory"."sha256" LIKE '%a%' OR "advisory"."title" LIKE '%a%' OR "advisory"."identifier" LIKE '%b%' OR "advisory"."location" LIKE '%b%' OR "advisory"."sha256" LIKE '%b%' OR "advisory"."title" LIKE '%b%') AND "advisory"."id" = 1"#
         );
         assert_eq!(
             where_clause("a&b")?,
@@ -374,6 +413,79 @@ mod tests {
             where_clause("here&location!~there|hereford")?,
             r#"("advisory"."identifier" LIKE '%here%' OR "advisory"."location" LIKE '%here%' OR "advisory"."sha256" LIKE '%here%' OR "advisory"."title" LIKE '%here%') AND ("advisory"."location" NOT LIKE '%there%' AND "advisory"."location" NOT LIKE '%hereford%')"#
         );
+        assert_eq!(
+            where_clause("published>2023-11-03T23:20:50.52Z")?,
+            r#""advisory"."published" > '2023-11-03 23:20:50.520000 +00:00'"#
+        );
+        assert_eq!(
+            where_clause("published>2023-11-03T23:20:51-04:00")?,
+            r#""advisory"."published" > '2023-11-03 23:20:51.000000 -04:00'"#
+        );
+        assert_eq!(
+            where_clause("published>2023-11-03")?,
+            r#""advisory"."published" > '2023-11-03'"#
+        );
+
+        Ok(())
+    }
+
+    #[test(tokio::test)]
+    async fn human_time() -> Result<(), anyhow::Error> {
+        let now = Local::now();
+        let yesterday = (now - TimeDelta::try_days(1).unwrap()).format("%Y-%m-%d");
+        let last_week = (now - TimeDelta::try_days(7).unwrap()).format("%Y-%m-%d");
+        let three_days_ago = (now - TimeDelta::try_days(3).unwrap()).format("%Y-%m-%d");
+        assert_eq!(
+            where_clause("published<yesterday")?,
+            format!(r#""advisory"."published" < '{yesterday}'"#)
+        );
+        assert_eq!(
+            where_clause("published>last week")?,
+            format!(r#""advisory"."published" > '{last_week}'"#)
+        );
+        let wc = where_clause("published=3 days ago")?;
+        let expected = &format!(r#""advisory"."published" = '{three_days_ago} "#);
+        assert!(
+            wc.starts_with(expected),
+            "expected '{wc}' to start with '{expected}'"
+        );
+
+        // Other possibilities, assuming it's New Year's day, 2010
+        //
+        // "Today 18:30" = "2010-01-01 18:30:00",
+        // "Yesterday 18:30" = "2009-12-31 18:30:00",
+        // "Tomorrow 18:30" = "2010-01-02 18:30:00",
+        // "Overmorrow 18:30" = "2010-01-03 18:30:00",
+        // "2022-11-07 13:25:30" = "2022-11-07 13:25:30",
+        // "15:20 Friday" = "2010-01-08 15:20:00",
+        // "This Friday 17:00" = "2010-01-08 17:00:00",
+        // "13:25, Next Tuesday" = "2010-01-12 13:25:00",
+        // "Last Friday at 19:45" = "2009-12-25 19:45:00",
+        // "Next week" = "2010-01-08 00:00:00",
+        // "This week" = "2010-01-01 00:00:00",
+        // "Last week" = "2009-12-25 00:00:00",
+        // "Next week Monday" = "2010-01-04 00:00:00",
+        // "This week Friday" = "2010-01-01 00:00:00",
+        // "This week Monday" = "2009-12-28 00:00:00",
+        // "Last week Tuesday" = "2009-12-22 00:00:00",
+        // "In 3 days" = "2010-01-04 00:00:00",
+        // "In 2 hours" = "2010-01-01 02:00:00",
+        // "In 5 minutes and 30 seconds" = "2010-01-01 00:05:30",
+        // "10 seconds ago" = "2009-12-31 23:59:50",
+        // "10 hours and 5 minutes ago" = "2009-12-31 13:55:00",
+        // "2 hours, 32 minutes and 7 seconds ago" = "2009-12-31 21:27:53",
+        // "1 years, 2 months, 3 weeks, 5 days, 8 hours, 17 minutes and 45 seconds ago" =
+        //     "2008-10-07 16:42:15",
+        // "1 year, 1 month, 1 week, 1 day, 1 hour, 1 minute and 1 second ago" = "2008-11-23 22:58:59",
+        // "A year ago" = "2009-01-01 00:00:00",
+        // "A month ago" = "2009-12-01 00:00:00",
+        // "A week ago" = "2009-12-25 00:00:00",
+        // "A day ago" = "2009-12-31 00:00:00",
+        // "An hour ago" = "2009-12-31 23:00:00",
+        // "A minute ago" = "2009-12-31 23:59:00",
+        // "A second ago" = "2009-12-31 23:59:59",
+        // "now" = "2010-01-01 00:00:00",
+        // "Overmorrow" = "2010-01-03 00:00:00"
 
         Ok(())
     }