improve query validation (#49)

* better query validation

* bugfix

* add test

Author: geospatial-jeff

stac_api/models/schemas.py

@@ -12,7 +12,8 @@
 from shapely.geometry import shape
 
 from geojson_pydantic.geometries import Polygon
-from pydantic import Field, root_validator
+from pydantic import Field, ValidationError, root_validator
+from pydantic.error_wrappers import ErrorWrapper
 from stac_api import config
 from stac_api.models.decompose import CollectionGetter, ItemGetter
 from stac_pydantic import Collection as CollectionBase
@@ -177,12 +178,30 @@ class STACSearch(Search):
     query: Optional[Dict[Queryables, Dict[Operator, Any]]]
     token: Optional[str] = None
 
+    @root_validator(pre=True)
+    def validate_query_fields(cls, values: Dict) -> Dict:
+        """validate query fields"""
+        if "query" in values and values["query"]:
+            queryable_fields = Queryables.__members__.values()
+            for field_name in values["query"]:
+                if field_name not in queryable_fields:
+                    raise ValidationError(
+                        [
+                            ErrorWrapper(
+                                ValueError(f"Cannot search on field: {field_name}"),
+                                "STACSearch",
+                            )
+                        ],
+                        STACSearch,
+                    )
+        return values
+
     @root_validator
     def include_query_fields(cls, values: Dict) -> Dict:
         """
         Root validator to ensure query fields are included in the API response
         """
-        if values["query"]:
+        if "query" in values and values["query"]:
             query_include = set(
                 [
                     k.value

tests/resources/test_item.py

@@ -696,3 +696,9 @@ def test_get_missing_item(app_client, load_test_data):
     test_coll = load_test_data("test_collection.json")
     resp = app_client.get(f"/collections/{test_coll['id']}/items/invalid-item")
     assert resp.status_code == 404
+
+
+def test_search_invalid_query_field(app_client):
+    body = {"query": {"gsd": {"lt": 100}, "invalid-field": {"eq": 50}}}
+    resp = app_client.post("/search", json=body)
+    assert resp.status_code == 422