Skip to content

API 500: event_groups index accepts sort fields that are not event_groups columns #2225

Description

@moveson

Error

Scout error group 123484 (production, 2026-08-18 15:34 UTC, 1 occurrence):

ActiveRecord::StatementInvalid
PG::UndefinedColumn: ERROR: column "scheduled_start_time" does not exist

Request: GET https://www.opensplittime.org/api/v1/event_groups?filter[editable]=true&page[size]=100&sort=-scheduled_start_time

Cause

PreparedParams#sort allowlists sort fields against permitted_query (app/controllers/concerns/prepared_params.rb:66-69), but EventGroupParameters.permitted_query unions in EffortParameters.permitted_query and RawTimeParameters.permitted_query (app/parameters/event_group_parameters.rb:18-20) — presumably so effort and raw-time filter params work on event group nested queries. The side effect is that effort/event columns like scheduled_start_time pass the sort allowlist and land in an ORDER BY against event_groups, which has no such column, producing a 500 instead of a 4xx.

Expected behavior

Sorting by a field that is not sortable on the resource should either be ignored (consistent with how non-permitted sort fields are already silently dropped) or return a 400/422 — not a 500. Likely fix: check sort fields against the resource's own permitted list rather than the unioned permitted_query, without disturbing the filter behavior that the union exists to support.

🤖 Generated with Claude Code

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions