Add text search to the todo list endpoint

[HadesArchitect]

Summary

GET /api/todos accepts a new search query parameter. It returns todos whose title or description contains the given text, ignoring case. It combines with the existing completed and include_archived filters.

Details

• % and _ in the search term are escaped, so they match literally instead of acting as LIKE wildcards
• The term must be 1 to 100 characters
• Added the parameter and an example to the API reference

Testing

Added tests for title and description matches, no matches, literal wildcard characters, and combining with completed. Backend suite passes locally.

Summary by CodeRabbit

• New Features
  • Search todos by text in their titles or descriptions, with case-insensitive matching. Searches can be combined with completion and archive filters, and existing ordering is preserved.
  • Search terms must be 1–100 characters. Backslashes, percent signs, and underscores are treated as literal characters; searches with no matches return an empty list.
• Documentation
  • Updated the API reference with search parameter details and an example.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Central YAML (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 1fd8c9c3-076d-47f1-b941-7fb6d1e0a77d

---

📥 Commits

Reviewing files that changed from the base of the PR and between 68e6214 and e5f028f.

---

📒 Files selected for processing (1)

• backend/app/routes/todos.py

---

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• coderabbitai/bitbucket (manual)

---

🚧 Files skipped from review as they are similar to previous changes (1)

• backend/app/routes/todos.py

---

Included review availability: This review used your included allowance. Your plan provides up to 100 included reviews per hour; 90 remain after this review.

---

---

📝 Walkthrough

Walkthrough

The GET /api/todos endpoint accepts an optional search parameter with a length of 1–100 characters. It matches the term without case sensitivity in todo titles or descriptions. Backslashes, percent signs, and underscores are escaped for literal matching. Search works with the existing completion and archive filters. Tests and the API reference cover the parameter.

---

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to e5f02

This adds an optional, bounded text search to the todo list endpoint. The visible changes show no concrete risk to existing behavior, and the author reports passing tests that cover the new behavior. The change looks ready to merge.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 0cdb0

This is a small, additive API change that preserves existing data-access behavior and filters. No introduced access-control bypass was identified. Search-related database workload under large datasets or concurrent requests remains unverified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — A caller able to reach the endpoint can search the existing Todo dataset through the same database session authority. Search results are a subset of rows eligible under the other list filters, not a new source of records or cross-service access. Existing include_archived behavior remains caller-selectable rather than an authorization control.

Trust Boundaries and Controls

• inferred — The new caller-controlled value is supplied as an ORM expression value, not interpolated SQL syntax. Literal wildcard escaping limits matching semantics, while explicit predicate grouping prevents description matches from bypassing completion or archive filters.

Resilience and Maintainability Implications

• inferred — The input-length limit bounds the search term but not database work. Contains matching examines existing title and description values, and descriptions have no declared length limit. Whether concurrent searches materially affect shared database availability remains unverified; no demonstrated denial-of-service finding is established.

Hardening Proposals

• proposed — If this endpoint serves large datasets or untrusted concurrent callers, establish a search-workload budget and use measured results to select query timeouts, request limits, or a dedicated search strategy. This is prospective failure-containment guidance, not an observed vulnerability.

---

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title is concise, descriptive, and accurately identifies the main change: adding text search to the todo list endpoint.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Comment Severity Gate		No supplied Critical or Major findings remain outstanding. The current review produced zero actionable findings, and no posted CodeRabbit review threads were returned.

---

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

✨ Simplify code

• Commit to this branch
• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{A rabbit searches, nose held high,
For words in titles passing by.
In descriptions, too, they gleam,
Escaped wildcards keep them clean.
Completed lists join the run,
Then documentation gets its bun.}

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

This pull request was merged because it matched the criteria for the rule Merge low-risk changes (Triage Settings).