fix(server): validate order_by on the sidebar-index route; tighten doc guard

The session-filter input struct is shared by the list and sidebar-index routes.
Dropping the order_by enum left the sidebar route accepting malformed specs like
?order_by=bogus (200, silently ignored) where the enum used to reject them.
Validate order_by in dbFilter() too so both routes return 400 on bad input.

Replace the substring-based doc guards with one test that parses the "Valid
keys:" clause into exact tokens and compares to db.SortKeys() in order, so a key
omitted from the clause can no longer be masked by the example text.

Author: mjacobs

internal/server/huma_routes_sessions.go

@@ -137,6 +137,12 @@ func (in *sessionFilterInput) dbFilter(includeChildren bool) (db.SessionFilter,
 	if err := validateDateFilterValues(in.Date, in.DateFrom, in.DateTo, in.ActiveSince); err != nil {
 		return db.SessionFilter{}, err
 	}
+	// The order_by param is shared with the list route via this struct; reject
+	// malformed specs here too (the dropped enum used to guard every route),
+	// even though the sidebar index applies its own ordering and ignores it.
+	if _, err := db.ParseSortSpec(in.OrderBy); err != nil {
+		return db.SessionFilter{}, apiError(http.StatusBadRequest, "invalid order_by: "+err.Error())
+	}
 	limit := 0
 	if in.Limit > 0 {
 		limit = clampLimit(in.Limit, db.DefaultSessionLimit, db.MaxSessionLimit)

internal/server/sort_http_multikey_test.go

@@ -103,3 +103,18 @@ func TestListSessions_OrderBy_Invalid(t *testing.T) {
 		})
 	}
 }
+
+// TestSidebarIndex_OrderByInvalid confirms the sidebar-index route, which shares
+// the session-filter input struct, also rejects a malformed order_by rather than
+// silently accepting and ignoring it (the dropped enum used to guard both routes).
+func TestSidebarIndex_OrderByInvalid(t *testing.T) {
+	te := setup(t)
+	te.seedSession(t, "s1", "p", 3)
+
+	w := te.get(t, "/api/v1/sessions/sidebar-index?order_by=bogus")
+	assertStatus(t, w, http.StatusBadRequest)
+
+	// A valid spec is still accepted even though the sidebar applies its own order.
+	w = te.get(t, "/api/v1/sessions/sidebar-index?order_by=messages:desc")
+	assertStatus(t, w, http.StatusOK)
+}

internal/server/sort_internal_test.go

@@ -11,35 +11,22 @@ import (
 	"go.kenn.io/agentsview/internal/db"
 )
 
-// TestSortKeysDocumented guards the order_by doc string against drift from the
-// shared sort registry: every accepted sort key must be named in the parameter
-// documentation so the OpenAPI surface lists the full allow-list (the enum tag
-// could no longer express the comma-separated key:dir spec).
-func TestSortKeysDocumented(t *testing.T) {
+// TestSortKeysMatchDoc guards the order_by doc string against drift from the
+// shared sort registry. It parses the "Valid keys:" clause into exact tokens and
+// requires them to equal db.SortKeys() in order, so a key omitted from the clause
+// cannot be masked by the example text earlier in the doc, and a stale key left
+// after a rename is caught too. This replaces the enum-sync guard that the dropped
+// order_by enum tag used to provide.
+func TestSortKeysMatchDoc(t *testing.T) {
 	field, ok := reflect.TypeFor[sessionFilterInput]().FieldByName("OrderBy")
 	require.True(t, ok, "sessionFilterInput.OrderBy field")
 	doc := field.Tag.Get("doc")
-	require.NotEmpty(t, doc, "order_by doc tag")
-	for _, key := range db.SortKeys() {
-		assert.Contains(t, doc, key, "order_by doc must mention sort key %q", key)
-	}
-}
-
-// TestSortKeysDocOmitsStaleKeys is the inverse guard: the "Valid keys:" clause
-// should not name a key that no longer exists in the registry (a stale entry
-// left after a rename).
-func TestSortKeysDocOmitsStaleKeys(t *testing.T) {
-	field, _ := reflect.TypeFor[sessionFilterInput]().FieldByName("OrderBy")
-	doc := field.Tag.Get("doc")
 	_, after, found := strings.Cut(doc, "Valid keys:")
-	require.True(t, found, "doc should enumerate valid keys")
-	valid := make(map[string]bool, len(db.SortKeys()))
-	for _, k := range db.SortKeys() {
-		valid[k] = true
-	}
-	for _, tok := range strings.FieldsFunc(after, func(r rune) bool {
+	require.True(t, found, "order_by doc must enumerate keys after 'Valid keys:'")
+
+	keys := strings.FieldsFunc(after, func(r rune) bool {
 		return r == ',' || r == ' ' || r == '.'
-	}) {
-		assert.True(t, valid[tok], "doc lists unknown sort key %q", tok)
-	}
+	})
+	assert.Equal(t, db.SortKeys(), keys,
+		"order_by 'Valid keys:' clause must list exactly db.SortKeys() in order")
 }