When multiple CSW profiles share one repository table (each row tagged by its typename column), GetRecords scoped to a specific profile typename has two bugs:
Bug 1: typename filter not applied
repository.query() accepts a typenames argument but never applies it as a SQL filter. A request for typeNames="foo:RecordA" returns every row in the table, including rows belonging to other profiles.
Filter and CQL property names always resolve against queryables['_all'], a flat merge of all loaded profiles where the last-loaded profile wins. When two profiles define the same property name mapping to different database columns, queries against one profile silently hit the other profile's column.
Steps to reproduce
- Configure two profiles (A and B) sharing one table, each row tagged with its typename.
- Both profiles define a property with the same name but different
dbcol.
- Send GetRecords with
typeNames="A:Record" and a filter on that property.
- Observe: rows from profile B are returned, and the filter hits B's column instead of A's.
Expected behaviour
Only rows whose typename column matches the requested typename are returned, and property names resolve to the correct column for the requested profile.
Affected versions
Reproducible on current master. Both csw2.py (FES 1.0) and csw3.py (FES 2.0) are affected.
Notes
csw:Record / csw30:Record wildcards should continue returning all rows (single-profile and default behaviour must remain unchanged).
GetRecordById has no typeNames parameter in the spec, so cross-profile record-by-ID is a separate concern.
A fix is ready: https://github.com/lirantul123/pycsw/tree/fix/multiprofile-typename-scoping
When multiple CSW profiles share one repository table (each row tagged by its
typenamecolumn),GetRecordsscoped to a specific profile typename has two bugs:Bug 1: typename filter not applied
repository.query()accepts atypenamesargument but never applies it as a SQL filter. A request fortypeNames="foo:RecordA"returns every row in the table, including rows belonging to other profiles.Filter and CQL property names always resolve against
queryables['_all'], a flat merge of all loaded profiles where the last-loaded profile wins. When two profiles define the same property name mapping to different database columns, queries against one profile silently hit the other profile's column.Steps to reproduce
dbcol.typeNames="A:Record"and a filter on that property.Expected behaviour
Only rows whose
typenamecolumn matches the requested typename are returned, and property names resolve to the correct column for the requested profile.Affected versions
Reproducible on current master. Both
csw2.py(FES 1.0) andcsw3.py(FES 2.0) are affected.Notes
csw:Record/csw30:Recordwildcards should continue returning all rows (single-profile and default behaviour must remain unchanged).GetRecordByIdhas notypeNamesparameter in the spec, so cross-profile record-by-ID is a separate concern.A fix is ready: https://github.com/lirantul123/pycsw/tree/fix/multiprofile-typename-scoping