INNER CODE UNIT · TypeScript
handleSearch
harvard-edge/cs249r_book · interviews/staffml-vault-worker/src/index.ts:347
async function handleSearch(env: Env, req: Request, url: URL): Promise<Response> {
const origin = req.headers.get("Origin");
const qRaw = (url.searchParams.get("q") ?? "").trim();
const limit = Math.min(Number.parseInt(url.searchParams.get("limit") ?? "20", 10), 50);
if (!qRaw) {
return json({ error: "missing-query-q" }, { status: 400, headers: corsHeaders(env, origin) });
}
// Chip R4-C-1 hardening: cap query length (prevents NEAR/OR DoS).
if (qRaw.length > MAX_SEARCH_Q_CHARS) {
return json(
{ error: "query-too-long", max_chars: MAX_SEARCH_Q_CHARS },
{ status: 400, headers: corsHeaders(env, origin) },
);
}
// Chip R7-M-5 + Gemini R9: memoized FTS5 probe at module level.
// Previously probed sqlite_master on every /search request — 1 D1 row-read
// per search, directly undoing R5-H-1's manifest-memo cost fix.
// ftsProbed resets on release_id change (FTS5 presence only changes across