REST API - Filter by non existant tag returns all records

kimai / kimai

Kimai is a web-based multi-user time-tracking application. Works great for everyone: freelancers, companies, organizations - everyone can track their times, generate reports, create invoices and do so much more. SaaS version available at https://www.kimai.cloud

https://www.kimai.org

GNU Affero General Public License v3.0

3.01k stars 529 forks source link

REST API - Filter by non existant tag returns all records #4792

Open sinag opened 2 months ago

sinag commented 2 months ago

Describe the issue

We are planning to use tag field to integrate kimai records to another systems records. I am not sure if the original behaviour, when tag does not exist return all rows is meaningfull for other scenarios but generally when you filter for something which does not exist you expect to see zero records.

Is there a workaround for this?

I already tried

[X] I've read and searched the documentation.
[X] I've searched for similar issues in this repository.
[X] I've searched for similar issues in the discussions.

Kimai version

2.15.0

How do you run Kimai?

Docker

Which PHP version are you using?

Unknown

Logfile

No response

Screenshots

No response

sinag commented 2 months ago

Let me give you more details on my usage scenario;

1) user opens a record on external system with record.id = 1 3) external system is configured to show current record's related kimai timesheets 2) external system queries kimai api with tags[]=1, if tag has not been created before, kimai returns all timesheets, expectation was to see no timesheets

kevinpapst commented 2 months ago

when you filter for something which does not exist you expect to see zero records.

No. This behavior is unspecified. Kimai can't find a tag, so it queries without tag, which leads to all results. That's how tags currently work.

In the API it would be better if there was a validation, in that case your result would be a Bad request.