catalog-backend: ensure subqueries are isolated from one another

Ensures that independent calls to `parseFilter` are isolated from one
another, by always wrapping additional clauses to the query in
`andWhere`. I think that the bug in the previous incarnation is strictly
theoretical, as long as parseFilters is only called once for a given
filter (which today, it is). When authorization lands in catalog-backend
though, we'll need to call it multiple times - once to add the authz
filters, and once to add the filters requested by the caller, which
would expose this bug.

Signed-off-by: Mike Lewis <mtlewis@users.noreply.github.com>

This commit is contained in:

Mike Lewis

2021-11-12 15:10:26 +00:00

parent 0a66597793

commit 06934f2f52

2 changed files with 16 additions and 15 deletions

.changeset/orange-experts-approve.md

View File

@@ -0,0 +1,5 @@
 ---
 '@backstage/plugin-catalog-backend': patch
 ---
 Adjust entity query construction to ensure sub-queries are always isolated from one another.