fix: apply access filter to samples findOne

[knQzx]

The samples findOne endpoint ran the caller's filter with only a class level read guard, so any authenticated user could read any sample by crafting the filter. This applies the same access filter the list endpoint uses.

Summary by Sourcery

Bug Fixes:

• Apply the list endpoint’s access filtering to sample lookups so users cannot retrieve unauthorized samples through crafted filters.

[sourcery-ai]

Hey - I've found 1 issue, and left some high level feedback:

• Consider extracting the queryFilters parsing and updateFiltersForList application into a shared helper so the list and findOne endpoints stay consistently aligned when filter/access logic changes.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Consider extracting the `queryFilters` parsing and `updateFiltersForList` application into a shared helper so the list and findOne endpoints stay consistently aligned when filter/access logic changes.

## Individual Comments

### Comment 1
<location path="src/samples/samples.controller.ts" line_range="604-607" />
<code_context>
-    const jsonFilters: IFilters<SampleDocument, ISampleFields> = queryFilters
-      ? JSON.parse(queryFilters)
-      : {};
+    const jsonFilters: IFilters<SampleDocument, ISampleFields> =
+      this.updateFiltersForList(
+        request,
+        queryFilters ? JSON.parse(queryFilters) : {},
+      );
     const whereFilters = jsonFilters.where ?? {};
</code_context>
<issue_to_address>
**issue:** Consider handling malformed JSON in `queryFilters` to avoid unexpected runtime errors.

Because `queryFilters` comes from user input, any invalid JSON passed to `JSON.parse` will throw and can surface as a 500. Consider wrapping the parse in try/catch (or similar defensive parsing) so you can return a controlled client error (e.g., 400) instead of an uncaught exception.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[sourcery-ai]

issue: Consider handling malformed JSON in queryFilters to avoid unexpected runtime errors.

Because queryFilters comes from user input, any invalid JSON passed to JSON.parse will throw and can surface as a 500. Consider wrapping the parse in try/catch (or similar defensive parsing) so you can return a controlled client error (e.g., 400) instead of an uncaught exception.