Configurable filter limit for anonymous users

[fbacall]

Summary of changes

• Adds a configurable filter limit that applies to anonymous users, which limits the number of filter values they can apply (does not apply to API requests).
• Displays a warning message when this limit is hit.
• Returns a 400 error code and does not filter at all if limit is exceeded.

Motivation and context

Crawlers were hammering production instances by trying every possibly permutation of filters.

Screenshots

Checklist

• I have read and followed the CONTRIBUTING guide.
• I confirm that I have the authority necessary to make this contribution on behalf of its copyright owner and agree to license it to the TeSS codebase under the BSD license.

[Copilot]

Pull request overview

Adds a configurable “filter value” limit for anonymous HTML requests to reduce crawler-driven load, with UI feedback when the limit is reached and a 400 error when it’s exceeded (while exempting API/JSON:API requests).

Changes:

• Enforces an anonymous-user facet/value limit in the shared searchable index concern and renders a 400 error when exceeded (HTML only).
• Updates search UI helpers/views/styles to show a warning and disable further filter application when the limit is reached.
• Adds i18n messaging, example configuration, and controller tests covering anonymous vs logged-in vs API behavior.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
test/controllers/materials_controller_test.rb	Adds coverage for warning + 400 behavior across anonymous/logged-in/API requests.
config/tess.example.yml	Documents the new filter_limit setting in the example config.
config/locales/en.yml	Adds the translated warning/error message for filter-limit enforcement.
app/views/search/common/_search_panel.html.erb	Displays an informational alert when the filter limit is reached.
app/views/search/common/_facet_sidebar_boolean_filter.html.erb	Disables boolean facet checkbox interaction when the limit is reached.
app/helpers/search_helper.rb	Prevents generating filter links when the limit is reached; adds filter_limit_reached?.
app/controllers/concerns/searchable_index.rb	Introduces a before_action to reject over-limit anonymous HTML requests.
app/assets/stylesheets/base/_facets.scss	Styles .nav-item > span to match existing facet link styling.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.