feat(api): add scan security verification endpoint and non-suspicious filters

convex/httpApi.handlers.test.ts

@@ -49,6 +49,7 @@ describe('httpApi handlers', () => {
       query: 'test',
       limit: 5,
       highlightedOnly: true,
+      nonSuspiciousOnly: undefined,
     })
     expect(response.status).toBe(200)
     const json = await response.json()
@@ -65,6 +66,7 @@ describe('httpApi handlers', () => {
       query: 'test',
       limit: undefined,
       highlightedOnly: true,
+      nonSuspiciousOnly: undefined,
     })
   })
 
@@ -78,6 +80,51 @@ describe('httpApi handlers', () => {
       query: 'test',
       limit: undefined,
       highlightedOnly: undefined,
+      nonSuspiciousOnly: undefined,
+    })
+  })
+
+  it('searchSkillsHttp forwards nonSuspiciousOnly', async () => {
+    const runAction = vi.fn().mockResolvedValue([])
+    await __handlers.searchSkillsHandler(
+      makeCtx({ runAction }),
+      new Request('https://example.com/api/search?q=test&nonSuspiciousOnly=1'),
+    )
+    expect(runAction).toHaveBeenCalledWith(expect.anything(), {
+      query: 'test',
+      limit: undefined,
+      highlightedOnly: undefined,
+      nonSuspiciousOnly: true,
+    })
+  })
+
+  it('searchSkillsHttp forwards legacy nonSuspicious alias', async () => {
+    const runAction = vi.fn().mockResolvedValue([])
+    await __handlers.searchSkillsHandler(
+      makeCtx({ runAction }),
+      new Request('https://example.com/api/search?q=test&nonSuspicious=1'),
+    )
+    expect(runAction).toHaveBeenCalledWith(expect.anything(), {
+      query: 'test',
+      limit: undefined,
+      highlightedOnly: undefined,
+      nonSuspiciousOnly: true,
+    })
+  })
+
+  it('searchSkillsHttp prefers canonical nonSuspiciousOnly over legacy alias', async () => {
+    const runAction = vi.fn().mockResolvedValue([])
+    await __handlers.searchSkillsHandler(
+      makeCtx({ runAction }),
+      new Request(
+        'https://example.com/api/search?q=test&nonSuspiciousOnly=false&nonSuspicious=1',
+      ),
+    )
+    expect(runAction).toHaveBeenCalledWith(expect.anything(), {
+      query: 'test',
+      limit: undefined,
+      highlightedOnly: undefined,
+      nonSuspiciousOnly: undefined,
     })
   })
 

convex/httpApi.ts

@@ -12,6 +12,7 @@ import type { ActionCtx } from './_generated/server'
 import { httpAction } from './functions'
 import { requireApiTokenUser } from './lib/apiTokenAuth'
 import { corsHeaders, mergeHeaders } from './lib/httpHeaders'
+import { parseBooleanQueryParam, resolveBooleanQueryParam } from './lib/httpUtils'
 import { publishVersionForUser } from './skills'
 
 type SearchSkillEntry = {
@@ -44,15 +45,20 @@ async function searchSkillsHandler(ctx: ActionCtx, request: Request) {
   const url = new URL(request.url)
   const query = url.searchParams.get('q')?.trim() ?? ''
   const limit = toOptionalNumber(url.searchParams.get('limit'))
-  const approvedOnly = url.searchParams.get('approvedOnly') === 'true'
-  const highlightedOnly = url.searchParams.get('highlightedOnly') === 'true' || approvedOnly
+  const approvedOnly = parseBooleanQueryParam(url.searchParams.get('approvedOnly'))
+  const highlightedOnly = parseBooleanQueryParam(url.searchParams.get('highlightedOnly')) || approvedOnly
+  const nonSuspiciousOnly = resolveBooleanQueryParam(
+    url.searchParams.get('nonSuspiciousOnly'),
+    url.searchParams.get('nonSuspicious'),
+  )
 
   if (!query) return json({ results: [] })
 
   const results = (await ctx.runAction(api.search.searchSkills, {
     query,
     limit,
     highlightedOnly: highlightedOnly || undefined,
+    nonSuspiciousOnly: nonSuspiciousOnly || undefined,
   })) as SearchSkillEntry[]
 
   return json({