Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro

components/webui/server/src/routes/api/presto-search/index.ts (4)

184-201: Use a path param instead of a DELETE body for RESTfulness and intermediary compatibility

DELETE requests with bodies can be dropped or mishandled by proxies. Model the resource with a path param and switch schema to params.

Apply this diff:

-    fastify.delete(
-        "/results",
+    fastify.delete<{ Params: { searchJobId: string } }>(
+        "/results/:searchJobId",
         {
             schema: {
-                body: PrestoQueryJobSchema,
+                params: Type.Object({ searchJobId: Type.String() }),
                 response: {
                     [StatusCodes.NO_CONTENT]: Type.Null(),
+                    [StatusCodes.BAD_REQUEST]: ErrorSchema,
                     [StatusCodes.INTERNAL_SERVER_ERROR]: ErrorSchema,
                 },
                 tags: ["Presto Search"],
             },
         },
-        async (request, reply) => {
-            const {searchJobId} = request.body;
+        async (request, reply) => {
+            const {searchJobId} = request.params;

---

187-193: Add 400 BAD_REQUEST mapping to document validation failures

You’ll be adding input validation (see next comment). Reflect that in the OpenAPI response schema.

Apply this diff:

                 response: {
                     [StatusCodes.NO_CONTENT]: Type.Null(),
+                    [StatusCodes.BAD_REQUEST]: ErrorSchema,
                     [StatusCodes.INTERNAL_SERVER_ERROR]: ErrorSchema,
                 },

---

197-203: Validate/sanitise searchJobId to prevent arbitrary collection drops

Right now any collection name can be dropped. Allowlist to alnum/underscore/hyphen and return 400 on failure.

Apply this diff:

         async (request, reply) => {
-            const {searchJobId} = request.body;
+            const {searchJobId} = request.params;
 
             request.log.info({
                 searchJobId,
             }, "api/presto-search/results args");
 
+            // Validate collection name (allow only alnum, underscore, hyphen)
+            if (false === /^[A-Za-z0-9_-]+$/.test(searchJobId)) {
+                request.log.warn({searchJobId}, "Invalid searchJobId for results deletion");
+                reply.code(StatusCodes.BAD_REQUEST);
+                return {
+                    message: "Invalid searchJobId",
+                } as never;
+            }

---

203-207: Make deletion idempotent; ignore “not found” errors

Dropping a non-existent collection can throw (e.g., code 26), which should not produce a 500. Wrap and ignore NamespaceNotFound.

Apply this diff:

-            await mongoDb.collection(searchJobId).drop();
+            try {
+                const dropped = await mongoDb.collection(searchJobId).drop();
+                request.log.info({searchJobId, dropped}, "Dropped Presto results collection");
+            } catch (err: unknown) {
+                const {code, codeName} = err as {code?: number; codeName?: string};
+                // Ignore "namespace not found" (collection does not exist)
+                if (26 === code || "NamespaceNotFound" === codeName) {
+                    request.log.info({searchJobId}, "Results collection not found; nothing to delete");
+                } else {
+                    request.log.error(err, "Failed to drop Presto results collection");
+                    throw err;
+                }
+            }

Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro