fix: Server side validation for #3112

server/routes/api/documents.test.ts

@@ -1263,6 +1263,17 @@ describe("#documents.search", () => {
     expect(body.data.length).toEqual(0);
   });
 
+  it("should expect a query", async () => {
+    const { user } = await seed();
+    const res = await server.post("/api/documents.search", {
+      body: {
+        token: user.getJwtToken(),
+        query: "   ",
+      },
+    });
+    expect(res.status).toEqual(400);
+  });
+
   it("should not allow unknown dateFilter values", async () => {
     const { user } = await seed();
     const res = await server.post("/api/documents.search", {

server/routes/api/documents.ts

@@ -37,6 +37,7 @@ import {
   assertIn,
   assertPresent,
   assertPositiveInteger,
+  assertNotEmpty,
 } from "@server/validation";
 import env from "../../env";
 import pagination from "./middlewares/pagination";
@@ -812,7 +813,7 @@ router.post("documents.search", auth(), pagination(), async (ctx) => {
   const { offset, limit } = ctx.state.pagination;
   const { user } = ctx.state;
 
-  assertPresent(query, "query is required");
+  assertNotEmpty(query, "query is required");
 
   if (collectionId) {
     assertUuid(collectionId, "collectionId must be a UUID");

server/validation.ts

@@ -36,8 +36,10 @@ export const assertSort = (
   }
 };
 
-export const assertNotEmpty = (value: unknown, message?: string) => {
-  if (value === "") {
+export const assertNotEmpty = (value: unknown, message: string) => {
+  assertPresent(value, message);
+
+  if (typeof value === "string" && value.trim() === "") {
     throw ValidationError(message);
   }
 };