feat(website): allow restricting which fields are allowed to be referenced in the AdvancedQueryFilter

[fhennig]

resolves #1157, #1194

Summary

Adds an optional allowedFields config to the advancedQuery baseline filter. When set, the parsed LAPIS expression is walked client-side after successful validation, and any metadata column not in the allowed list causes an error with an informative message. Mutation-only queries (e.g. A123T) always pass regardless of allowedFields, since they reference sequence positions rather than metadata columns.

• New AdvancedQueryFilterConfig type exported from BaselineSelector.tsx with optional allowedFields?: string[]
• AdvancedQueryFilter component accepts and enforces allowedFields in its onSuccess handler via extractMetadataFields
• New extractMetadataFields utility in siloFilterExpression.ts recursively collects all column values from a SiloFilterExpression tree
• Three browser spec tests covering: disallowed field → error, allowed field → checkmark + callback, mutation-only → checkmark

The feature is fully opt-in: omitting allowedFields preserves existing behaviour (any field is allowed).

Test plan

• extractMetadataFields unit tests in siloFilterExpression.spec.ts
• Browser spec tests for the three allowedFields scenarios in AdvancedQueryFilter.browser.spec.tsx
• Manually tested by temporarily setting allowedFields: ['host'] on the COVID baseline config — queries on host passed, queries on other metadata fields showed the error, mutation queries passed

PR Checklist

• All necessary documentation has been adapted.
• The implemented feature is covered by an appropriate test.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dashboards	Ready	Preview, Comment	May 17, 2026 0:35am

[Copilot]

Pull request overview

Adds opt-in client-side enforcement for restricting which metadata fields can be referenced in the website’s Advanced Query (LAPIS) filter, enabling dashboards to constrain queries to an approved field set while keeping mutation-only queries unrestricted.

Changes:

• Introduces allowedFields?: string[] configuration for advancedQuery baseline filters and wires it through to the AdvancedQueryFilter component.
• Adds extractMetadataFields() to walk a parsed SiloFilterExpression and collect referenced metadata columns, enabling enforcement after successful LAPIS validation.
• Adds unit tests for extractMetadataFields and browser specs covering allowed/disallowed/mutation-only scenarios.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
website/src/lapis/siloFilterExpression.ts	Adds extractMetadataFields() to collect referenced metadata columns from parsed SILO filter expressions.
website/src/lapis/siloFilterExpression.spec.ts	Adds unit tests validating metadata field extraction behavior.
website/src/components/pageStateSelectors/BaselineSelector.tsx	Adds AdvancedQueryFilterConfig and passes allowedFields into the advanced query UI.
website/src/components/genspectrum/AdvancedQueryFilter.tsx	Enforces allowedFields in the parse success path and surfaces an error when disallowed fields are used.
website/src/components/genspectrum/AdvancedQueryFilter.browser.spec.tsx	Adds browser specs validating the new allowedFields behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[fengelniederhammer]

AI: Clean, well-scoped feature. Good test coverage. Minor nits inline.

Note: PR body says "resolves #1157, #1194" but #1194 is a dependabot astro bump PR — likely should be just "resolves #1157".