Restrict Wildcard and Pattern matching Filter

[mohsinchoudhary]

Hi Everyone,
I have a scenario where we wants to restrict searching all the data and increase load on database. Is it possible to restrict wildcard search while doing API Call.
For e.g. i would like to restrict O* and P* or Pattern Matching searches.
GET /people?last_name=like(any).{O*,P*}

[laurenceisla]

Hey! There's no way to do that yet. It's related to this issue: #2442, in which it asks to disallow certain operators.

I'm not sure, but maybe this could be done by a reverse proxy like Nginx and return an error (or redirect to a function returning an error) when the $query_string matches some operators or characters.

[steve-chavez]

Hey @mohsinchoudhary, as Laurence mentions that's currently not possible.

I feel the closest solution we have to doing this is #2805.

So we could do something like:

select set_config('pgrst.query_grammar.<table_oid>.op.like.allowed_values', 'O*,P*', true);

WDYT? What would be the ideal interface?

[steve-chavez]

GET /people?last_name=like(any).{O*,P*}

@mohsinchoudhary Just to clarify, you don't want to allow users to search the O* and P* prefixes right?

[mohsinchoudhary]

Hi @steve-chavez I dont want to allow users to perform any wildcard search on any of the tables.
We are using AWS RDS PostgreSQL. Should i execute set_config query via PGAdmin.

[steve-chavez]

Got it, so then you want to ban the like operator.

Right now there's no native solution but I'll have a look at that next release. Subscribe on #2805 for updates.

For now you'll need a proxy like Laurence mentioned.

[mohsinchoudhary]

@steve-chavez Noted. Thank you.