feat: add filter_by parameter to conversation search with variables s…

[ViaSocket-Git]

…upport

[windsurf-bot]

💡 To request another review, post a new comment with "/windsurf-review".

[windsurf-bot]

The SQL query is vulnerable to SQL injection. Even though you're escaping single quotes with replace(/'/g, "''"), this is not sufficient protection. Consider using parameterized queries with Sequelize's built-in mechanisms instead of string interpolation in Sequelize.literal().

Suggested change

	Sequelize.literal(
	`EXISTS (SELECT 1 FROM jsonb_each_text("conversation_logs"."variables") AS kv WHERE kv.value ILIKE '%${escapedKeyword}%')`
	)
	Sequelize.literal(
	'EXISTS (SELECT 1 FROM jsonb_each_text("conversation_logs"."variables") AS kv WHERE kv.value ILIKE ?)',
	[`%${filters.keyword}%`]
	)

Or better yet, use Sequelize's built-in JSON operators if available for your database.

[Husainbw786]

Found 2 issues to address before merging:

1. The new jsonb_each_text(conversation_logs.variables) predicate can fail when variables is NULL or not a JSON object. Please wrap it with COALESCE(..., {}::jsonb) (and ideally guard for non-object JSON) before expanding it.\n\n2. When a search hit comes only from variables, the response builder still falls back to msg.user || msg.llm_message || msg.chatbot_message, so the API does not show the matched variable value/snippet. That makes filter_by=variables look broken from the client side even though the SQL matched a row. Consider extracting the matched variable text (or at least returning an explicit matched_in: "variables").\n\nOptional optimization: formattedThreads.forEach(... matchedMessages.filter(...)) is O(T*M). Group matchedMessages by thread_id once before the loop to reduce repeated scans.