aj-geddes/api-filtering-sorting

API Filtering & Sorting

Table of Contents

• Overview
• When to Use
• Quick Start
• Reference Guides
• Best Practices

Overview

Build flexible filtering and sorting systems that handle complex queries efficiently with proper validation, security, and performance optimization.

When to Use

• Building search and filter interfaces
• Implementing advanced query capabilities
• Creating flexible data retrieval endpoints
• Optimizing query performance
• Validating user input for queries
• Supporting complex filtering logic

Quick Start

Minimal working example:

// Node.js filtering implementation
app.get("/api/products", async (req, res) => {
  const filters = {};
  const sortOptions = {};

  // Parse filtering parameters
  const allowedFilters = [
    "category",
    "minPrice",
    "maxPrice",
    "inStock",
    "rating",
  ];
  for (const key of allowedFilters) {
    if (req.query[key]) {
      filters[key] = req.query[key];
    }
  }

  // Build MongoDB query
  const mongoQuery = {};

  if (filters.category) {
    mongoQuery.category = filters.category;
  }
// ... (see reference guides for full implementation)

Reference Guides

Detailed implementations in the references/ directory:

| Guide | Contents | |---|---| | Query Parameter Filtering | Query Parameter Filtering | | Advanced Filter Parser | Advanced Filter Parser | | Filter Builder Pattern | Filter Builder Pattern | | Python Filtering (SQLAlchemy) | Python Filtering (SQLAlchemy) | | Elasticsearch Filtering | Elasticsearch Filtering | | Query Validation | Query Validation |

Best Practices

✅ DO

• Whitelist allowed filter fields
• Validate all input parameters
• Index fields used for filtering
• Support common operators
• Provide faceted navigation
• Cache filter options
• Limit filter complexity
• Document filter syntax
• Use database-native operators
• Optimize queries with indexes

❌ DON'T

• Allow arbitrary field filtering
• Support unlimited operators
• Ignore SQL injection risks
• Create complex filter logic
• Expose internal field names
• Filter on unindexed fields
• Allow deeply nested filters
• Skip input validation
• Combine all filters with OR
• Ignore performance impact