Allow admins to search unsearchable users

[mattbk]

Closes #3121.

[nobodxbodon]

Could you build the query in the block above (16-26) conditionally to avoid duplicated code?

[nobodxbodon]

I was in a hurry. In case it wasn't clear enough, something like (excuse my python grammar):

    if action in (None, 'search_usernames'):
         results['usernames'] = website.db.all("""
             SELECT username, avatar_url, similarity(username, %(q)s) AS rank
               FROM participants
              WHERE username %% %(q)s
                AND claimed_time IS NOT NULL
                """ 
               + (user.ADMIN ? "" : "AND is_searchable")
               + " AND NOT is_closed"
           ORDER BY rank DESC, username
              LIMIT 10
         """, locals())

[chadwhitacre]

Yay for Python from @nobodxbodon! 💃 🐍

[mattbk]

I get what you're saying, just hitting a learning curve on how to work your example in so it works.

[mattbk]

I was confused because I didn't realize the + signs were literal.

    if action in (None, 'search_usernames'):
         results['usernames'] = website.db.all("""
             SELECT username, avatar_url, similarity(username, %(q)s) AS rank
               FROM participants
              WHERE username %% %(q)s
                AND claimed_time IS NOT NULL
                """
                +("" if user.ADMIN else " AND is_searchable")
                +""" AND NOT is_closed
           ORDER BY rank DESC, username
              LIMIT 10
         """, locals())

[mattbk]

Something is still wrong with this, I need to look at it again.

[mattbk]

Okay @nobodxbodon, ready for review again with a simpler diff. Thanks for the help.

[chadwhitacre]

Also needs tests.

[chadwhitacre]

Why change the indentation here? It makes the diff harder to read.

[mattbk]

Accident.

[chadwhitacre]

Hmm ... could we find a way to do this without string interpolation? (Tbh this is the achilles heel of our db wiring; it's bad practice to construct SQL from strings because of the danger of SQL injection, but it's hard to avoid without a full-blown SQL model in Python, aka SQLAlchemy.)

[mattbk]

The first commit didn't work like that, FWIW.

[mattbk]

After thrashing about, I cleaned up the indents.

[mattbk]

This functionality seems to exist...investigating.

• String interpolation version introduced in 5ff5121
• Finessed in 888b96b
• Finalized in 52c02fb

There's a commit (6230342) in #4157 that is even called "Allow admins to search unsearchable users," but it doesn't have the string interpolation version--because it was introduced earlier, in a277c5d. I image this made it in there after I neglected to properly stash files when switching branches.

As such, I am closing this PR and the original ticket.

[chadwhitacre]

!m @mattbk