Feat/fuzzy search

[desireddymohithreddy0925]

feat: Implement Fuzzy Searching for Organizations

Fixes #1949

✨ Feature Description

Integrated Fuse.js into the main organization search bar to gracefully handle typos and misspellings, ensuring organizations can still be discovered if a user misspells a technology or name.

🛠️ Implementation Details

• Loaded fuse.js asynchronously utilizing the new centralized CDN fallback utility.
• Refactored app.js to utilize a Fuse instance with a 0.3 threshold applied to name, tags, and cat fields.
• Updated searchComparator to intelligently prioritize exact and prefix matches above fuzzy score-based results.
• Added explicit test coverage in filtering.test.js to validate the Fuse sorting integration.

✅ Acceptance Criteria Met

• Minor typos (e.g., "pyhton" instead of "python") now yield the correct organizations instead of empty states.
• Exact matches still reliably appear at the absolute top of the search results.
• Search speed and responsiveness are maintained.

[vercel]

Someone is attempting to deploy a commit to the s3dfx-cyber's projects Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

💬 Faster Reviews & Assignments

Hi @desireddymohithreddy0925, for faster coordination and smoother communication, consider joining our Discord community:

👉 https://discord.gg/MmZGG2ee

Useful Channels

• #issue-links-for-assignment → Share issue links for assignment help
• #pr-links-for-review → Share PR links for mentor/maintainer review

Please avoid spamming channels or repeatedly pinging mentors/maintainers.

[github-actions]

👋 Thanks for opening a PR, @desireddymohithreddy0925!

Your PR has entered the 🚦 PR Review Pipeline.

⚪ Standard PR detected — your PR will follow the standard repository review pipeline.

---

🔄 Review Flow

Stage	Reviewer	Purpose
Stage 1	🤖 Automation	Validation · Duplicate Detection · AI/Slop Checks · Formatting · PR Analysis
Stage 2	👥 Repository Reviewer	Code Review · Scope Validation · Quality Check
Stage 3	🔑 Project Admin / Maintainer	Final Approval & Merge Decision

The automated PR analysis system will verify issue linkage, PR relevance, and contribution quality.

A pipeline status comment may appear automatically as your PR progresses.

---

✅ Contributor Checklist

• Sign commits using git commit -s
• Link a valid issue (Closes #123)
• Keep changes focused and relevant
• Do not include unrelated modifications
• Ensure workflows/build/tests are passing
• Read the appropriate contributor guide:
  • GSSoC Guide
  • NSoC Guide
  • General Guide

---

⚠️ Important Notes

• Low-quality, spammy, or AI-generated PRs may be closed
• PRs without linked issues may fail automated checks
• Large unrelated PRs are likely to be rejected
• Review times may vary depending on mentor/reviewer availability

Happy contributing 🚀

This message is posted automatically and only once.

[github-actions]

⚠️ PR Validation Issues

Hi @desireddymohithreddy0925, your PR requires fixes before review.

Warnings

• ⚠️ Missing contribution program declaration (GSSOC or NSOC).
• ⚠️ Missing PR template section: related issue
• ⚠️ Missing PR template section: type of change
• ⚠️ Missing PR template section: checklist
• ⚠️ PR title must follow conventional commits. Example: feat: improve mobile navbar

Please push fixes after updating the PR.

[github-actions]

✅ DCO Sign-off Verified

Hi @desireddymohithreddy0925 👋

All commits in this PR contain valid Signed-off-by lines.

Thank you for following the DCO requirements 🚀

[github-actions]

⚠️ Suspicious Generated Code Detected

This PR contains patterns commonly associated with low-quality AI-generated submissions.

Detected Signals

• Excessive comments in .github/workflows/program-classification-validator.yml
• Generated-style separators detected
• Excessive comments in index.html

A maintainer or mentor should manually review this PR before merge.

This is not an automatic rejection.

[github-actions]

🚦 PR Review Pipeline

⚪ Standard PR

Stage	Status
Stage 1 — Automated Checks	✅ All automated checks passed
Stage 2 — Mentor/Reviewer	⏳ Awaiting reviewer approval
Stage 3 — Maintainer	🔒 Blocked until Stage 2 passes

No active issues

---

Last updated: Thu, 25 Jun 2026 20:18:56 GMT

[github-actions]

🤖 TENET Agent Review

📋 Summary

This PR introduces fuzzy search functionality for organizations, significantly enhancing the user experience by making search more resilient to typos and misspellings. It refactors the client-side script loading into a robust, centralized utility with CDN fallbacks and improves the theme management logic. While the feature implementation and code structure improvements are commendable, a critical security vulnerability is introduced by loading fuse.js without Subresource Integrity (SRI), posing a supply chain risk.

🔐 Security Findings

• [CRITICAL] index.html - The fuse.js library is loaded from a CDN without a Subresource Integrity (SRI) hash. This creates a critical supply chain vulnerability, as a compromise of the CDN could lead to arbitrary code execution in the user's browser. All third-party scripts loaded from CDNs, especially in a security-focused application like TENET AI, must include SRI.
  • Recommended Fix: Add the integrity attribute with the correct SHA hash for fuse.js@7.0.0 to its entry in the dependencies array within the loadDependencies utility.

🧹 Code Quality

• src/js/app.js - The use of globalThis.orgSearchScores and globalThis.orgSearchFuse introduces global state. While functional, encapsulating these within a more localized scope (e.g., a dedicated search module or object) could improve maintainability and prevent potential naming conflicts or unintended side effects in larger applications.

✅ What's Done Well

1. Centralized CDN Loading Utility: The new loadDependencies function in index.html is a significant improvement for managing third-party scripts, offering robustness with CDN fallbacks and cleaner code.
2. Improved Search Experience: The integration of Fuse.js with intelligent prioritization in searchComparator greatly enhances the search functionality, making it more forgiving and user-friendly.
3. Enhanced Theme Management: The updates to theme initialization and the addition of a prefers-color-scheme listener provide a more polished and responsive user experience for theme preferences.

📝 Overall Verdict

[REQUEST CHANGES] - Critical security issue with missing SRI for fuse.js must be addressed.

---

Review powered by TENET Agent 🛡️ | Triggered automatically on PR #1961

[coderabbitai]

Warning

Review limit reached

@desireddymohithreddy0925, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 33 minutes and 39 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: b464b476-3730-4ff3-9281-a0cbd0972080

📥 Commits

Reviewing files that changed from the base of the PR and between 65277c7 and 005ffdb.

📒 Files selected for processing (4)

• .github/workflows/program-classification-validator.yml
• index.html
• src/js/app.js
• tests/filtering.test.js

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cubic-dev-ai]

4 issues found across 4 files

Confidence score: 2/5

• index.html loads external Fuse.js without Subresource Integrity (integrity: ''), which creates a concrete supply-chain risk if CDN content is tampered with and could expose users to injected script behavior. Add valid SRI hashes (or pin/self-host the asset) before merging.
• .github/workflows/program-classification-validator.yml appears unrelated to the fuzzy-search scope, so merging as-is risks accidental CI/policy changes that are hard to notice during feature review. Split or revert this workflow edit so it can be reviewed independently.
• src/js/app.js mixes theme-behavior changes into this fuzzy-search PR and uses MediaQueryList.addEventListener without an addListener fallback, increasing regression risk and potentially breaking behavior in older Safari. Limit this PR to fuzzy-search logic and add the Safari-compatible listener fallback (or move theme changes to a separate PR) before merge.

Architecture diagram

sequenceDiagram
    participant Browser as Browser
    participant head as "<head>"
    participant CDN as "External CDN"
    participant fallback as "Fallback CDN"
    participant LS as "localStorage"
    participant app as "app.js"
    participant Fuse as "Fuse.js Library"
    participant UI as "Search UI"
    participant globalThis as "globalThis"

    Note over Browser,UI: Page Load & Dependency Loading

    Browser->>head: Parse HTML
    head->>head: NEW: loadDependencies() runs for fuse, marked, DOMPurify, html2pdf
    loop For each dependency
        head->>CDN: injectScript(primary URL)
        alt CDN loads successfully
            CDN-->>head: script loaded
            head->>head: dep.check() for Fuse
            alt check fails (e.g., Fuse undefined)
                head->>fallback: injectScript(fallback URL)
                fallback-->>head: script loaded
            end
        else CDN fails (onerror)
            CDN-->>head: error
            head->>fallback: injectScript(fallback URL)
            fallback-->>head: script loaded
        end
    end

    Browser->>LS: Read saved theme
    LS-->>Browser: theme value
    alt theme === 'dark'
        Browser->>Browser: add dark class
    else theme === 'light'
        Browser->>Browser: remove dark class
    else no theme saved && prefers-color-scheme: dark
        Browser->>Browser: add dark class
    end

    Note over Browser,UI: Search Flow

    UI->>app: applyFilters(search, sort)
    app->>app: CHANGED: Reset globalThis.orgSearchScores Map
    alt search string present
        app->>Fuse: orgSearchFuse.search(search)
        Note over Fuse: threshold: 0.3, keys: ['name','tags','cat']
        Fuse-->>app: results[{item, score}]
        app->>globalThis: Store scores in orgSearchScores
        app->>app: baseOrgs = results mapped to items
    else no search
        app->>app: baseOrgs = all ORGS
    end

    app->>app: baseOrgs.filter(matchesFilters)
    app->>UI: filteredOrgs

    alt search string present
        app->>app: sort filteredOrgs with searchComparator
        Note over app: searchComparator logic:
        alt exact match
            app->>app: exact match first (ignores score)
        else startsWith match
            app->>app: prefix match second (ignores score)
        else
            app->>globalThis: orgSearchScores to compare scores
            app->>app: lower score = better rank
        end
        app->>app: applySecondarySort for tiebreaker
    end

    app-->>UI: sorted, filtered orgs
    UI->>UI: Render results

    Note over Browser,UI: Theme Change Listener (CHANGED)

    Browser->>LS: NO theme saved (user cleared preference)
    LS-->>Browser: null
    Browser->>Browser: CHANGED: Listen for prefers-color-scheme change
    alt dark mode preferred
        Browser->>Browser: toggle dark class
    end

Loading

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[github-actions]

🤖 TENET Agent Review

📋 Summary

This pull request introduces fuzzy search capabilities to the organization search bar using Fuse.js. It refactors the script loading mechanism to include a robust CDN fallback utility, updates the theme initialization logic for better user experience, and modifies the search comparator to intelligently prioritize exact and prefix matches over fuzzy search scores. The changes are accompanied by new test cases to validate the fuzzy sorting integration. The overall approach is sound, enhancing search usability and improving dependency management.

🔐 Security Findings

• [SEVERITY: HIGH] index.html - The fuse.js script loaded via the new loadDependencies utility is missing a Subresource Integrity (SRI) hash. This means the browser cannot verify the integrity of the script, making the application vulnerable to supply chain attacks if the CDN hosting fuse.js is compromised.
  • Recommended fix: Add a sha384 or sha512 integrity hash for fuse.js to both the primary and fallback CDN URLs. For example, for https://cdn.jsdelivr.net/npm/fuse.js@7.0.0/dist/fuse.min.js, the integrity hash should be calculated and added.

🧹 Code Quality

• src/js/app.js - The use of globalThis.orgSearchScores to pass fuzzy search scores between applyFilters and searchComparator introduces a global state dependency. While functional, encapsulating this data more directly (e.g., by passing it as an argument or within a more localized scope) could improve maintainability and reduce potential side effects.

✅ What's Done Well

• Robust CDN Fallback: The new loadDependencies utility in index.html provides a centralized and resilient way to load third-party scripts, including primary and fallback CDN options, significantly improving reliability.
• Intelligent Search Comparator: The searchComparator is well-designed to prioritize exact and prefix matches over fuzzy scores, ensuring that precise searches still yield the most relevant results at the top.
• Improved Theme Initialization: The theme initialization logic in both index.html and src/js/app.js is enhanced to respect user preferences and system dark mode settings more robustly, improving user experience.

📝 Overall Verdict

REQUEST CHANGES - Missing Subresource Integrity for fuse.js is a critical security concern that needs to be addressed.

[sonarqubecloud]

Quality Gate passed

Issues
3 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

✅ Merge Conflicts Resolved

Thanks @desireddymohithreddy0925, this PR is mergeable again.