fix: a where with two fields filters on both

helpers/embed_test.go

@@ -33,3 +33,20 @@ func TestHelpersAreWhatTheSkillDescribes(t *testing.T) {
 		}
 	}
 }
+
+// A where with two fields has to send two where= parameters: the server and-s them, and one
+// parameter would match on the last field only and quietly return rows the caller filtered out.
+func TestWhereSendsOneParameterPerField(t *testing.T) {
+	if strings.Contains(Node, "q.set('where'") {
+		t.Error("nook-data.js overwrites where instead of appending")
+	}
+	if !strings.Contains(Node, "q.append('where'") {
+		t.Error("nook-data.js does not append where")
+	}
+	if strings.Contains(Python, `q["where"] =`) {
+		t.Error("nook_data.py overwrites where instead of appending")
+	}
+	if !strings.Contains(Python, "doseq=True") {
+		t.Error("nook_data.py does not encode repeated parameters")
+	}
+}

helpers/nook-data.js

@@ -41,7 +41,9 @@ class Nook {
     if (opts.limit) q.set('limit', opts.limit)
     if (opts.cursor) q.set('cursor', opts.cursor)
     if (opts.order) q.set('order', opts.order)
-    for (const [field, value] of Object.entries(opts.where || {})) q.set('where', `${field}:${value}`)
+    // append, not set: one where= per field is how the server reads them, and they are and-ed.
+    // Setting would quietly match on the last field only and return too much.
+    for (const [field, value] of Object.entries(opts.where || {})) q.append('where', `${field}:${value}`)
     const out = await this._call('GET', collection, null, q)
     return out.documents || []
   }

helpers/nook_data.py

@@ -44,15 +44,17 @@ def __init__(self, as_token=None, user=None):
 
     def list(self, collection, limit=None, cursor=None, order=None, where=None):
         """Documents in a collection, newest last unless order='desc'."""
-        q = {}
+        q = []
         if limit:
-            q["limit"] = limit
+            q.append(("limit", limit))
         if cursor:
-            q["cursor"] = cursor
+            q.append(("cursor", cursor))
         if order:
-            q["order"] = order
+            q.append(("order", order))
+        # One where= per field, which is how the server reads them: they are and-ed together.
+        # A single parameter would quietly match on the last field only and return too much.
         for field, value in (where or {}).items():
-            q["where"] = "%s:%s" % (field, value)
+            q.append(("where", "%s:%s" % (field, value)))
         return self._call("GET", collection, params=q).get("documents", [])
 
     def get(self, collection, id):
@@ -73,7 +75,7 @@ def _call(self, method, path, body=None, params=None):
             raise NookError(0, "NOOK_DATA_URL is not set: this is not running as a nook")
         url = self.base + urllib.parse.quote(path)
         if params:
-            url += "?" + urllib.parse.urlencode(params)
+            url += "?" + urllib.parse.urlencode(params, doseq=True)
         data = json.dumps(body).encode() if body is not None else None
         req = urllib.request.Request(url, method=method, data=data)
         req.add_header("Authorization", "Bearer " + self.token)