add-query-action

Add a Query (list) action

A Query action returns many records with pagination, sorting, and filtering. First define and get sign-off on authorization, filters, sort fields, pagination limits, response shape, and tests. Confirm complete structure with yarn repair <Feature> --dry-run, then yarn repair <Feature>. Use the add-action skill and yarn gen <Feature> -a V1Query to scaffold the action/test; never hand-create it. This skill covers the Query-specific body using helpers/cruqd.js.

The helpers (import from helpers/cruqd.js)

• getOffset(page, limit) → Sequelize offset.
• getOrdering(cols) → order array. Comma-separated; prefix - for DESC ('-createdAt,name').
• getOrderingWithModel(cols, models) → ordering by associated-model columns ('user.lastName').
• convertStringListToWhereStmt(whereStmt, args, [{ name, col, isInt }]) → turns '1,2,3' arg into { col: { [Op.in]: [...] } } and deletes the arg.
• parseUrlQueryFilter(args) → converts bracket operators (createdAt[gte]) to Sequelize ops. Already run on req.args by middleware/args.js for every request — so range filters arrive pre-converted; just pass req.args (or a subset) into where.
• convertToSequelizeOps(obj) → convert a Joi-validated { gte, lte } object to Sequelize ops manually.
• numberComparisonSchema() (from helpers/schemas.js) → Joi for an exact number OR { gte, lte, ... }.

Body pattern

async function V1QueryByUser(req, res) {
  const schema = joi.object({
    page:  joi.number().integer().min(1).default(1),
    limit: joi.number().integer().min(1).max(100).default(25),
    sort:  joi.string().default('-createdAt'),
    status: joi.string().valid(...POST_STATUSES).optional(),
    createdAt: numberComparisonSchema().optional(), // supports createdAt[gte] etc.
    // ...other filterable fields
  });
  const { error, value } = schema.validate(req.args);
  if (error) return errorResponse(req, ERROR_CODES.BAD_REQUEST_INVALID_ARGUMENTS, joiErrorsMessage(error));
  req.args = value;

  try {
    // SECURITY: always scope the query to the owner — never return another user's rows
    const whereStmt = { userId: req.user.id };
    if (req.args.status) whereStmt.status = req.args.status;
    if (req.args.createdAt) whereStmt.createdAt = convertToSequelizeOps(req.args.createdAt);

    const { count, rows } = await models.post.findAndCountAll({
      where: whereStmt,
      order: getOrdering(req.args.sort),
      limit: req.args.limit,
      offset: getOffset(req.args.page, req.args.limit),
      attributes: { exclude: models.post.getSensitiveData?.() || [] }
    });

    return { status: 200, success: true, posts: rows, total: count, page: req.args.page, limit: req.args.limit };
  } catch (error) { throw error; }
}