Skip to content

API 500: event_groups index accepts sort fields that are not event_groups columns #2225

Description

@moveson

Error

Scout error group 123484 (production, 2026-08-18 15:34 UTC, 1 occurrence):

ActiveRecord::StatementInvalid
PG::UndefinedColumn: ERROR: column "scheduled_start_time" does not exist

Request: GET https://www.opensplittime.org/api/v1/event_groups?filter[editable]=true&page[size]=100&sort=-scheduled_start_time

Cause

PreparedParams#sort allowlists sort fields against permitted_query (app/controllers/concerns/prepared_params.rb:66-69), but EventGroupParameters.permitted_query unions in EffortParameters.permitted_query and RawTimeParameters.permitted_query (app/parameters/event_group_parameters.rb:18-20) — presumably so effort and raw-time filter params work on event group nested queries. The side effect is that effort/event columns like scheduled_start_time pass the sort allowlist and land in an ORDER BY against event_groups, which has no such column, producing a 500 instead of a 4xx.

Expected behavior

Sorting by a field that is not sortable on the resource should either be ignored (consistent with how non-permitted sort fields are already silently dropped) or return a 400/422 — not a 500. Likely fix: check sort fields against the resource's own permitted list rather than the unioned permitted_query, without disturbing the filter behavior that the union exists to support.

🤖 Generated with Claude Code

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions