ruby 47 lines · 8 steps

Building a safe filterable product index in Rails

A chainable query that whitelists filters, sorting, and pagination to turn untrusted params into a safe ActiveRecord relation.

Explained by highlit
Rails Intermediate query objects scopes strong parameters pagination dynamic queries
1class ProductsController < ApplicationController
2 def index
3 @products = Product
4 .includes(:category, :brand)
5 .filter_by(filter_params)
6 .order(sort_column => sort_direction)
7 .page(params[:page])
8 .per(25)
9 end
10 
11 private
12 
13 def filter_params
14 params.fetch(:q, {}).permit(
15 :name_cont, :category_id_eq, :brand_id_in,
16 :price_gteq, :price_lteq, :active_eq
17 )
18 end
19 
20 def sort_column
21 %w[name price created_at].include?(params[:sort]) ? params[:sort] : :created_at
22 end
23 
24 def sort_direction
25 %w[asc desc].include?(params[:direction]) ? params[:direction] : :desc
26 end
27end
28 
29class Product < ApplicationRecord
30 belongs_to :category
31 belongs_to :brand
32 
33 scope :filter_by, ->(filters) {
34 filters.compact_blank.reduce(all) do |relation, (key, value)|
35 attribute, predicate = key.to_s.rpartition("_").values_at(0, 2)
36 
37 case predicate
38 when "cont" then relation.where("#{attribute} ILIKE ?", "%#{value}%")
39 when "eq" then relation.where(attribute => value)
40 when "in" then relation.where(attribute => Array(value))
41 when "gteq" then relation.where("#{attribute} >= ?", value)
42 when "lteq" then relation.where("#{attribute} <= ?", value)
43 else relation
44 end
45 end
46 }
47end
01 / 01
STEP 01

Walkthrough

Space play ←→ step click any line
Three takeaways
  1. 1Whitelisting both attributes and predicates keeps user-driven queries safe from SQL injection.
  2. 2Reducing over filters lets you compose an arbitrary WHERE clause from a single permitted hash.
  3. 3Eager loading plus pagination keeps a flexible index endpoint fast and N+1-free.

Related explainers

ruby 
class ToastBroadcaster
  include ActionView::RecordIdentifier
 
  def self.broadcast_to(user, message:, type: :notice)

How Turbo Stream toasts broadcast in Rails

turbo-streams service-object real-time
Intermediate 6 steps
ruby 
class TemplateInterpolator
  PLACEHOLDER = /\{\{\s*([\w.]+)\s*\}\}/
 
  def initialize(strict: false)

Interpolating templates with dotted keys in Ruby

regex string-interpolation hash-traversal
Intermediate 6 steps
ruby 
class KeyTransformer
  def self.camelize(data)
    new.camelize(data)
  end

Recursively camelizing nested Ruby data

recursion data-transformation pattern-matching
Intermediate 7 steps
ruby 
module Paginatable
  extend ActiveSupport::Concern
 
  private

A reusable pagination concern in Rails

pagination concerns http-headers
Intermediate 8 steps
ruby 
class Api::MessagesController < ApiController
  before_action :authenticate_api_key!
 
  rate_limit to: 100,

Layered API rate limiting in Rails

rate-limiting api-authentication throttling
Intermediate 9 steps
ruby 
class Order < ApplicationRecord
  include AASM
 
  belongs_to :warehouse

Modeling an order lifecycle with AASM in Rails

state machine guards callbacks
Intermediate 10 steps

Share this explainer

Here's the card — post it anywhere.

Building a safe filterable product index in Rails — share card
Made with highlit — turn any snippet into a walkthrough like this in about a minute.
Explain your code