Add text search to the todo list endpoint

[HadesArchitect]

Summary

GET /api/todos accepts a new search query parameter. It returns todos whose title or description contains the given text, ignoring case. It combines with the existing completed and include_archived filters.

Details

• % and _ in the search term are escaped, so they match literally instead of acting as LIKE wildcards
• The term must be 1 to 100 characters
• Added the parameter and an example to the API reference

Testing

Added tests for title and description matches, no matches, literal wildcard characters, and combining with completed. Backend suite passes locally.

Summary by CodeRabbit

• New Features
  • Added todo search across titles and descriptions, with case-insensitive matching. Search terms can be combined with completion and archive filters.
  • Search terms are limited to 1–100 characters, and special characters are treated literally.
• Documentation
  • Updated the API reference with search parameter details and an example.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Central YAML (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Enterprise
• Run ID: e304ee83-82e1-4df5-9435-1c7cc2230905

---

📥 Commits

Reviewing files that changed from the base of the PR and between 0cdb0d0 and 68e6214.

---

📒 Files selected for processing (1)

• backend/app/routes/todos.py

---

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• coderabbitai/bitbucket (manual)

---

🚧 Files skipped from review as they are similar to previous changes (1)

• backend/app/routes/todos.py

---

Included review availability: This review used your included allowance. Your plan provides up to 100 included reviews per hour; 93 remain after this review.

---

📜 Recent review details

⏰ Context from checks skipped due to timeout. (2)

• GitHub Check: backend
• GitHub Check: frontend

---

---

---

📝 Walkthrough

Walkthrough

The GET /api/todos endpoint accepts an optional search parameter with a length of 1–100 characters. It matches the term without case sensitivity in todo titles or descriptions. Backslashes, percent signs, and underscores are escaped for literal matching. Search works with the existing completion and archive filters. Tests and the API reference cover the parameter.

---

Priority: ➖ Normal

Merge Risk

Merge Risk: ⚪ Minimal · up to 68e62

The identified search-matching concern does not block merging; normal checks can proceed.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 0cdb0

This is a small, additive API change that preserves existing data-access behavior and filters. No introduced access-control bypass was identified. Search-related database workload under large datasets or concurrent requests remains unverified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — A caller able to reach the endpoint can search the existing Todo dataset through the same database session authority. Search results are a subset of rows eligible under the other list filters, not a new source of records or cross-service access. Existing include_archived behavior remains caller-selectable rather than an authorization control.

Trust Boundaries and Controls

• inferred — The new caller-controlled value is supplied as an ORM expression value, not interpolated SQL syntax. Literal wildcard escaping limits matching semantics, while explicit predicate grouping prevents description matches from bypassing completion or archive filters.

Resilience and Maintainability Implications

• inferred — The input-length limit bounds the search term but not database work. Contains matching examines existing title and description values, and descriptions have no declared length limit. Whether concurrent searches materially affect shared database availability remains unverified; no demonstrated denial-of-service finding is established.

Hardening Proposals

• proposed — If this endpoint serves large datasets or untrusted concurrent callers, establish a search-workload budget and use measured results to select query timeouts, request limits, or a dedicated search strategy. This is prospective failure-containment guidance, not an observed vulnerability.

---

---

---

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: adding text search to the todo list endpoint.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Comment Severity Gate		No supplied CodeRabbit findings have Critical or Major severity. The current review reports zero actionable findings, and no posted review threads are listed.

---

---

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

✨ Simplify code

• Commit to this branch
• Create a new PR

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{A rabbit searches titles bright,
And descriptions by day and night.
Percent signs stay just as they are,
While matching todos hop from far.
The list returns what fits the query,
Then bounds away, content and cheery.}

_{Comment @coderabbitai help to get the list of available commands.}