alphagov/rummager — pull request #209 by rboulton (2014-04-11 10:20:36+00:00)
Title: Validate unified_search parameters

Also, exposes a new parameter "fields" for the unified search endpoint,
which can be used to select which fields are returned in search
results. This isn't going to be used immediately, but its good to
encourage callers to ask for minimal information, since this puts less
load on elasticsearch and uses less network bandwidth.

We want to do validation at this level to ensure that elasticsearch
can't be called with bad requests that cause it to do things like use up
all its memory, or have surprising bad cache performance.

Create a new SearchParameterParser class which parses and validates the
parameters supplied to the unified search endpoint. Remove validation
code from app.rb and from UnifiedSearchBuilder.

Validation ensures that start and count are valid positive integers,
that no unexpected parameters are supplied, that only allowed fields are
used for filtering, sorting, faceting and return, and that facet
parameters are valid positive integers.

Return a 400 status code and an explanatory error body for such invalid
parameters. We're using 400 here instead of 422 because the existing
endpoint already uses that, and because there's controversy over whether
400 and 422 is the best status code to use, so inertia on this seems
the best way forward until a decision is made.