feat(filter): multi-column sort support

Replace sortBy/sortOrder with sorts: [SortFieldInput!] for
multi-column sorting. SQL injection safe — only valid column
names accepted via _valid_columns check.

GraphQL: sorts: [{field: "name", order: "asc"}, {field: "id", order: "desc"}]
Default: [{field: "id", order: "asc"}] when sorts is null.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: ImTotem

src/bcsd_api/filter/base.py

@@ -5,16 +5,20 @@
 T = TypeVar("T")
 
 
+class SortField(BaseModel):
+    field: str
+    order: str = "asc"
+
+
 class BaseFilter(BaseModel):
     page: int = Field(1, ge=1)
     size: int = Field(20, ge=1, le=100)
-    sort_by: str = "id"
-    sort_order: str = Field("asc", pattern="^(asc|desc)$")
+    sorts: list[SortField] = Field(default=[SortField(field="id")])
 
     search_fields: list[str] = Field(default=[], exclude=True)
 
     def filters(self) -> dict:
-        excluded = {"page", "size", "sort_by", "sort_order", "search_fields"}
+        excluded = {"page", "size", "sorts", "search_fields"}
         pairs = self.model_dump(exclude=excluded, exclude_none=True)
         return pairs
 
@@ -52,10 +56,14 @@ def _valid_columns(rows: list[dict]) -> set[str]:
 
 
 def _sort_rows(rows: list[dict], filt: BaseFilter) -> list[dict]:
-    if filt.sort_by not in _valid_columns(rows):
+    valid = _valid_columns(rows)
+    safe = [s for s in filt.sorts if s.field in valid]
+    if not safe:
         return rows
-    reverse = filt.sort_order == "desc"
-    return sorted(rows, key=lambda r: r.get(filt.sort_by, ""), reverse=reverse)
+    for s in reversed(safe):
+        reverse = s.order == "desc"
+        rows = sorted(rows, key=lambda r, f=s.field: r.get(f, ""), reverse=reverse)
+    return rows
 
 
 def apply_filter(rows: list[dict], filt: BaseFilter) -> PagedResponse:

src/bcsd_api/graphql/convert.py

@@ -1,5 +1,20 @@
+import strawberry
 from pydantic import BaseModel
 
+from bcsd_api.filter.base import SortField
+
+
+@strawberry.input
+class SortFieldInput:
+    field: str
+    order: str = "asc"
+
+
+def to_sorts(inputs: list[SortFieldInput] | None) -> list[SortField]:
+    if not inputs:
+        return [SortField(field="id")]
+    return [SortField(field=s.field, order=s.order) for s in inputs]
+
 
 def from_model(source: BaseModel, target_cls):
     return target_cls(**source.model_dump())

src/bcsd_api/member/resolvers.py

@@ -3,7 +3,7 @@
 
 from bcsd_api.filter.members import MemberFilter
 from bcsd_api.graphql.context import GqlContext, require_user
-from bcsd_api.graphql.convert import from_model, from_paged
+from bcsd_api.graphql.convert import from_model, from_paged, to_sorts
 
 from . import service
 from .types import (
@@ -19,7 +19,7 @@
 def _to_filter(inp: MemberFilterInput) -> MemberFilter:
     return MemberFilter(
         page=inp.page, size=inp.size,
-        sort_by=inp.sort_by, sort_order=inp.sort_order,
+        sorts=to_sorts(inp.sorts),
         status=inp.status, track=inp.track,
         team=inp.team, payment_status=inp.payment_status,
         name=inp.name,

src/bcsd_api/member/types.py

@@ -1,5 +1,7 @@
 import strawberry
 
+from bcsd_api.graphql.convert import SortFieldInput
+
 
 @strawberry.type
 class MemberType:
@@ -48,8 +50,7 @@ class PagedMembers:
 class MemberFilterInput:
     page: int = 1
     size: int = 20
-    sort_by: str = "id"
-    sort_order: str = "asc"
+    sorts: list[SortFieldInput] | None = None
     status: str | None = None
     track: str | None = None
     team: str | None = None

src/bcsd_api/shorten/resolvers.py

@@ -3,7 +3,7 @@
 
 from bcsd_api.filter.links import LinkFilter
 from bcsd_api.graphql.context import GqlContext, require_user
-from bcsd_api.graphql.convert import from_model, from_paged
+from bcsd_api.graphql.convert import from_model, from_paged, to_sorts
 
 from . import service
 from .schema import CreateRequest, UpdateRequest
@@ -22,7 +22,7 @@
 def _to_filter(inp: LinkFilterInput) -> LinkFilter:
     return LinkFilter(
         page=inp.page, size=inp.size,
-        sort_by=inp.sort_by, sort_order=inp.sort_order,
+        sorts=to_sorts(inp.sorts),
         creator_id=inp.creator_id, expired=inp.expired,
     )
 

src/bcsd_api/shorten/types.py

@@ -2,6 +2,8 @@
 
 import strawberry
 
+from bcsd_api.graphql.convert import SortFieldInput
+
 
 @strawberry.type
 class LinkType:
@@ -53,8 +55,7 @@ class PagedLinks:
 class LinkFilterInput:
     page: int = 1
     size: int = 20
-    sort_by: str = "id"
-    sort_order: str = "asc"
+    sorts: list[SortFieldInput] | None = None
     creator_id: str | None = None
     expired: str | None = None