Fix collection filter returning documents from all collections when no search query by Copilot · Pull Request #10775 · outline/outline

Copilot · 2025-12-03T23:34:02Z

When filtering search by collection without entering a search term, documents from all user-accessible collections were returned instead of only the specified collection.

Root Cause

In SearchHelper.buildWhere(), the collectionId filter was added to the Op.or array alongside membership conditions:

// Before: collectionId in OR clause allows documents from other collections
where[Op.or].push(
  { "$memberships.id$": { [Op.ne]: null } },
  { "$groupMemberships.id$": { [Op.ne]: null } },
  { collectionId: [specifiedCollection] }  // ← Wrong placement
);

This generated SQL where documents from any collection with user membership could match, even when a specific collection was requested.

Changes

server/models/helpers/SearchHelper.ts

Move explicit collectionId filter to Op.and clause
Keep user's accessible collections in Op.or when no specific collection requested

// After: explicit collectionId as AND condition restricts to that collection
if (options.collectionId) {
  where[Op.and].push({ collectionId: options.collectionId });
} else {
  const collectionIds = await model.collectionIds();
  if (collectionIds.length) {
    where[Op.or].push({ collectionId: collectionIds });
  }
}

Tests

Added unit test in SearchHelper.test.ts
Added API integration test in documents.test.ts

Affects searchForUser(), searchForTeam(), and searchTitlesForUser() methods.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

pkg.pr.new
- Triggering command: /usr/local/bin/node node /usr/local/bin/yarn install (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

This section details on the original issue you should resolve

<issue_title>Filtering search by collection without a search term returns results in all collections</issue_title>
<issue_description>- Go to search

Enter no text

Choose to filter by a collection

See results from other collections</issue_description>

Comments on the Issue (you are @copilot in this section)

Fixes Filtering search by collection without a search term returns results in all collections #10774

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Co-authored-by: tommoor <380914+tommoor@users.noreply.github.com>

CLAassistant · 2025-12-03T23:42:34Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

Co-authored-by: tommoor <380914+tommoor@users.noreply.github.com>

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [outlinewiki/outline](https://github.com/outline/outline) | minor | `1.1.0` → `1.2.0` | --- ### Release Notes <details> <summary>outline/outline (outlinewiki/outline)</summary> ### [`v1.2.0`](https://github.com/outline/outline/releases/tag/v1.2.0) [Compare Source](outline/outline@v1.1.0...v1.2.0) #### What's Changed ##### Highlights **Diagrams.net** diagrams are now fully supported, insert new diagrams through the block menu or by uploading an existing png that was created in Diagrams.net – the original diagram data will be preserved and can be edited by clicking the "Edit" button in the image toolbar. **Custom emoji** are now available – upload your own custom emoji in the admin settings and use them in your documents, comments, reactions, and icons. **Improved revision history** with the ability to download any revision as HTML or Markdown, toggle whether changes are visible, and an improved rendering engine that retains more of the original document's formatting and structure. **Authentication provider management** has been added to the settings, allowing admins to view and manage all configured authentication providers in one place. This includes the ability to disable providers, which will prevent users from signing in with that provider but will not delete any existing accounts. **Passkey support** has been added as an optional login method. You can now sign in with biometric authentication (TouchId, Windows Hello) or security keys instead of a password. Existing workspaces will need to enable this on the authentication providers screen. ##### Other improvements - The sidebar design was improved and refined in [#10684](outline/outline#10684) - It is now possible to upload and embed PDFs in [#10198](outline/outline#10198) - A "Popular" tab is now available for documents, popular docs are ranked higher in search in [#10721](outline/outline#10721) - A visual color palette is now available in the icon picker in [#10696](outline/outline#10696) - Avatar changes are now synced automatically from iDP in [#10718](outline/outline#10718) - User initials now supported in mention search in [#10797](outline/outline#10797) - New option to distribute table columns evenly in [#10645](outline/outline#10645) - Mermaid diagrams now have an explicit "Edit" option in the toolbar in [#11060](outline/outline#11060) - Added filtering to the notifications UI in [#10916](outline/outline#10916) - Added CSV export for member list in [#10803](outline/outline#10803) - Added CIDR range support to `ALLOWED_PRIVATE_IP_ADDRESSES` in [#10923](outline/outline#10923) - Add ContextMenu to RevisionListItem in [#10952](outline/outline#10952) - The GitHub integration now supports fetching details on public issues/PRs in [#10827](outline/outline#10827) - It is no longer required to use a public bucket for avatar images in [#10977](outline/outline#10977) - Implemented RFC 9700 hardening against refresh token reuse in [#10960](outline/outline#10960) - PKCE OAuth clients can now use refresh tokens in [#10769](outline/outline#10769) - Support for PostgreSQL multi-host connection URIs in `DATABASE_URL` in [#10754](outline/outline#10754) - Many internal performance improvements ##### Fixes - Fixed display issues in share dialog in [#10662](outline/outline#10662) - Incompatibility between path and query search terms in [#10667](outline/outline#10667) - Restored ability to resize shared sidebar in [#10669](outline/outline#10669) - UI does not update when deleting API key in [#10670](outline/outline#10670) - Invalid access of `firstChild` for mermaid diagrams in [#10668](outline/outline#10668) - Plain text copy-to-clipboard serializer no longer squashes blocks in [#10683](outline/outline#10683) - When TOC extends beyond window bounds ensure headings scroll in [#10687](outline/outline#10687) - Added missing drop cursor in top position in [#10689](outline/outline#10689) - `Empty trash` button is now hidden when missing permissions in [#10704](outline/outline#10704) - Fixed search popover on public pages in [#10717](outline/outline#10717) - Multiple improvements to sitemap generation for public shares in [#10716](outline/outline#10716) - Fixed in-document find fails with multiple escaped characters in [#10735](outline/outline#10735) - Improved validation of urls extracted from data transfer event in [#10740](outline/outline#10740) - Middle-mouse button on internal link in Firefox no longer opens multiple tabs in [#10748](outline/outline#10748) - Fixed collection filter returning documents from all collections when no search query in [#10775](outline/outline#10775) - Templates are now inserted at cursor position instead of document start in [#10783](outline/outline#10783) - Shift paste with selection no longer inserts next to selection in [#10799](outline/outline#10799) - Fixed an issue where some Mermaid diagrams can't be expanded in [#10807](outline/outline#10807) - Collection overview now respects the separeat editing mode setting in [#10816](outline/outline#10816) - Query strings not forwarded on internal links from editor in [#10854](outline/outline#10854) - Shutdown during migrations does not release mutex lock in [#10879](outline/outline#10879) - `profileId` extraction in OIDC does not fallback to `token.sub` in [#10882](outline/outline#10882) - Fixed an issue where custom rate limiters were ignored due to mountPath mismatch in [#10893](outline/outline#10893) - Viewer role now replaced correctly on downgrade to guest in [#10877](outline/outline#10877) - Validation of `SECRET_KEY` environment variable tightened in [#10897](outline/outline#10897) - Fixed double pagination in `documents.list` and `documents.archived` with `sort=index` in [#10895](outline/outline#10895) - Comment actions now reliably appear in mobile drawer in [#10904](outline/outline#10904) - Fixed extra newlines in pasted code blocks in [#10958](outline/outline#10958) - Parser crash when pasting inline code containing checkboxes by [@hdoo42](https://github.com/hdoo42) in [#10949](outline/outline#10949) - Fixed an issue where context menus could have context menus (menuception) in [#10974](outline/outline#10974) - Fixed invisible email buttons in iOS Mail dark mode in [#10976](outline/outline#10976) - Restored 'Create a doc' item in mention menu in [#10980](outline/outline#10980) - User with "can edit" permission on sub-document can now sort child documents in [#10990](outline/outline#10990) - Large base64 images pasted as HTML are now correctly handled in [#10982](outline/outline#10982) - Appending content via API no longer messes with existing document content in [#10998](outline/outline#10998) - Image warp exiting lightbox now correct in [#10999](outline/outline#10999) - Grips are now positioned correctly adjacent merged table cells in [#11003](outline/outline#11003) - Export no longer link to a non-accessible location for non-admins in [#11070](outline/outline#11070) #### New Contributors - [@nwleedev](https://github.com/nwleedev) made their first contribution in [#10759](outline/outline#10759) - [@hdoo42](https://github.com/hdoo42) made their first contribution in [#10949](outline/outline#10949) **Full Changelog**: <outline/outline@v1.1.0...v1.2.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/3075 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

Initial plan

755f8f8

Copilot AI assigned Copilot and tommoor Dec 3, 2025

Copilot started work on behalf of tommoor December 3, 2025 23:34 View session

Fix search filtering by collection to exclude other collections

70e1336

Co-authored-by: tommoor <380914+tommoor@users.noreply.github.com>

Add API-level test for collection filtering without search term

91f5c15

Co-authored-by: tommoor <380914+tommoor@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix filtering search by collection without search term~~ Fix collection filter returning documents from all collections when no search query Dec 3, 2025

Copilot AI requested a review from tommoor December 3, 2025 23:49

Copilot finished work on behalf of tommoor December 3, 2025 23:49

fix: Private collections

802f2f5

tommoor marked this pull request as ready for review December 4, 2025 01:17

refactor

31e1315

tommoor merged commit d02f35b into main Dec 4, 2025
13 of 14 checks passed

tommoor deleted the copilot/fix-filtering-search-results branch December 4, 2025 01:49

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fix collection filter returning documents from all collections when no search query#10775

Fix collection filter returning documents from all collections when no search query#10775
tommoor merged 5 commits into
mainfrom
copilot/fix-filtering-search-results

Copilot AI commented Dec 3, 2025 •

edited

Loading

Uh oh!

CLAassistant commented Dec 3, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Copilot AI commented Dec 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Root Cause

Changes

I tried to connect to the following addresses, but was blocked by firewall rules:

Comments on the Issue (you are @copilot in this section)

Uh oh!

CLAassistant commented Dec 3, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Dec 3, 2025 •

edited

Loading