From c8ada180ce7648c956cdafdad45b1793ef070a5c Mon Sep 17 00:00:00 2001
From: biondizzle <biondizzle@gmail.com>
Date: Mon, 16 Feb 2026 06:45:55 -0500
Subject: [PATCH] fix filters

---
 main.odin | 36 +++++++++++++++++++++++++++---------
 1 file changed, 27 insertions(+), 9 deletions(-)

diff --git a/main.odin b/main.odin
index 3793e6b..29b2f2b 100644
--- a/main.odin
+++ b/main.odin
@@ -1197,7 +1197,11 @@ handle_query :: proc(engine: ^dynamodb.Storage_Engine, request: ^HTTP_Request, r
 		defer dynamodb.query_result_destroy(&result)
 
 		// Apply FilterExpression
-		filtered_items := apply_filter_to_items(request.body, result.items, attr_names, attr_values)
+		filtered_items, filter_ok := apply_filter_to_items(request.body, result.items, attr_names, attr_values)
+		if !filter_ok {
+			make_error_response(response, .ValidationException, "Invalid FilterExpression")
+			return
+		}
 		scanned_count := len(result.items)
 
 		// Apply ProjectionExpression
@@ -1245,7 +1249,11 @@ handle_query :: proc(engine: ^dynamodb.Storage_Engine, request: ^HTTP_Request, r
 	defer dynamodb.query_result_destroy(&result)
 
 	// ---- Apply FilterExpression (post-query filter) ----
-	filtered_items := apply_filter_to_items(request.body, result.items, attr_names, attr_values)
+	filtered_items, filter_ok := apply_filter_to_items(request.body, result.items, attr_names, attr_values)
+	if !filter_ok {
+		make_error_response(response, .ValidationException, "Invalid FilterExpression")
+		return
+	}
 	scanned_count := len(result.items)
 
 	// ---- Apply ProjectionExpression ----
@@ -1364,9 +1372,15 @@ handle_scan :: proc(engine: ^dynamodb.Storage_Engine, request: ^HTTP_Request, re
 		}
 		defer dynamodb.scan_result_destroy(&result)
 
-		filtered_items := apply_filter_to_items(request.body, result.items, attr_names, attr_values)
+		// Apply FilterExpression
+		filtered_items, filter_ok := apply_filter_to_items(request.body, result.items, attr_names, attr_values)
+		if !filter_ok {
+			make_error_response(response, .ValidationException, "Invalid FilterExpression")
+			return
+		}
 		scanned_count := len(result.items)
 
+		// Apply ProjectionExpression
 		projection, has_proj := dynamodb.parse_projection_expression(request.body, attr_names)
 		defer { // This block just frees the cloned string and projection slice
 			if has_proj && len(projection) > 0 {
@@ -1410,8 +1424,12 @@ handle_scan :: proc(engine: ^dynamodb.Storage_Engine, request: ^HTTP_Request, re
 	}
 	defer dynamodb.scan_result_destroy(&result)
 
-	// ---- Apply FilterExpression ----
-	filtered_items := apply_filter_to_items(request.body, result.items, attr_names, attr_values)
+	// ---- Apply FilterExpression (post-scan filter) ----
+	filtered_items, filter_ok := apply_filter_to_items(request.body, result.items, attr_names, attr_values)
+	if !filter_ok {
+		make_error_response(response, .ValidationException, "Invalid FilterExpression")
+		return
+	}
 	scanned_count := len(result.items)
 
 	// ---- Apply ProjectionExpression ----
@@ -1459,15 +1477,15 @@ apply_filter_to_items :: proc(
 	items: []dynamodb.Item,
 	attr_names: Maybe(map[string]string),
 	attr_values: map[string]dynamodb.Attribute_Value,
-) -> []dynamodb.Item {
+) -> (filtered_items: []dynamodb.Item, ok: bool) {
 	filter_expr, has_filter := dynamodb.parse_filter_expression_string(request_body)
 	if !has_filter {
-		return items // no filter, return as-is
+		return items, true
 	}
 
 	filter_node, filter_ok := dynamodb.parse_filter_expression(filter_expr, attr_names, attr_values)
 	if !filter_ok || filter_node == nil {
-		return items // failed to parse, return unfiltered
+		return nil, false
 	}
 	defer {
 		dynamodb.filter_node_destroy(filter_node)
@@ -1481,7 +1499,7 @@ apply_filter_to_items :: proc(
 		}
 	}
 
-	return filtered[:]
+	return filtered[:], true
 }
 
 // ============================================================================