fix(knowledge): validate tag-filter type against the slot, not the client claim

Greptile P1: operator validation trusted the client-supplied fieldType, so a
numeric slot could be sent with fieldType 'text' + 'contains' and slip through
to build a text LIKE on a numeric column. Validate against the slot's inherent
type via getFieldTypeForSlot (the source of truth): reject unknown slots and
fieldType/slot mismatches at the boundary before checking the operator.

Author: waleedlatif1

apps/sim/lib/api/contracts/knowledge/documents.test.ts

@@ -60,4 +60,23 @@ describe('parseDocumentTagFiltersParam', () => {
       )
     ).toThrow()
   })
+
+  it('rejects a fieldType that does not match the tag slot', () => {
+    // number1 is a numeric column; claiming it is text must fail
+    expect(() =>
+      parseDocumentTagFiltersParam(
+        JSON.stringify([
+          { tagSlot: 'number1', fieldType: 'text', operator: 'contains', value: 'x' },
+        ])
+      )
+    ).toThrow()
+  })
+
+  it('rejects an unknown tag slot', () => {
+    expect(() =>
+      parseDocumentTagFiltersParam(
+        JSON.stringify([{ tagSlot: 'tag99', fieldType: 'text', operator: 'eq', value: 'x' }])
+      )
+    ).toThrow()
+  })
 })

apps/sim/lib/api/contracts/knowledge/documents.ts

@@ -13,6 +13,7 @@ import {
   wireDateSchema,
 } from '@/lib/api/contracts/knowledge/shared'
 import { defineRouteContract } from '@/lib/api/contracts/types'
+import { getFieldTypeForSlot } from '@/lib/knowledge/constants'
 import { getOperatorsForFieldType } from '@/lib/knowledge/filters/types'
 
 export const documentTagFilterSchema = z
@@ -24,8 +25,28 @@ export const documentTagFilterSchema = z
     valueTo: z.unknown().optional(),
   })
   .superRefine((filter, ctx) => {
-    // Reject operators that aren't valid for the field type so a bad operator
-    // returns a 400 instead of being silently dropped by the query builder.
+    // The tag slot determines the column type, so validate against the slot
+    // (the source of truth) — not just the client-supplied fieldType. Rejecting
+    // unknown slots, type mismatches, and bad operators at the boundary returns
+    // a 400 instead of the query builder silently dropping or mis-handling the
+    // filter (e.g. a text `contains` aimed at a numeric column).
+    const slotFieldType = getFieldTypeForSlot(filter.tagSlot)
+    if (slotFieldType === null) {
+      ctx.addIssue({
+        code: 'custom',
+        path: ['tagSlot'],
+        message: `Unknown tag slot "${filter.tagSlot}"`,
+      })
+      return
+    }
+    if (slotFieldType !== filter.fieldType) {
+      ctx.addIssue({
+        code: 'custom',
+        path: ['fieldType'],
+        message: `fieldType "${filter.fieldType}" does not match tag slot "${filter.tagSlot}" (expected "${slotFieldType}")`,
+      })
+      return
+    }
     const validOperators = getOperatorsForFieldType(filter.fieldType).map((op) => op.value)
     if (!validOperators.includes(filter.operator)) {
       ctx.addIssue({