Filter obfuscation option

[fbacall]

Summary of changes

• Adds an option to obfuscate filter links from the initial page load - replacing them with spans with the href encoded via base64, that get turned into links via Javascript.
• Fixes some unrelated JS that was erroring on page load.

Motivation and context

Malicious crawlers were following every href on the page, trying every filter permutation.

Checklist

• I have read and followed the CONTRIBUTING guide.
• I confirm that I have the authority necessary to make this contribution on behalf of its copyright owner and agree to license it to the TeSS codebase under the BSD license.

[Copilot]

🟡 Changes recommended

The new JS rehydration currently targets spans without data-filter-link (causing runtime errors) and the Ruby helper introduces Base64 without requiring the stdlib, which can raise NameError when enabled.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds a configurable “filter link obfuscation” mechanism to reduce crawler-driven load by rendering facet filters as non-link elements in initial HTML and rehydrating them into links client-side, plus fixes a JS page-load error in the private groups toggle.

Changes:

• Add obfuscate_filters setting and controller coverage to verify facet links render as <a> vs obfuscated <span data-filter-link>.
• Update filter_link helper to optionally emit obfuscated spans containing a base64url-encoded URL.
• Add client-side logic to convert obfuscated facet spans back into <a> elements on page load; harden show_private_groups.js against missing DOM nodes.

File summaries

File	Description
test/controllers/materials_controller_test.rb	Adds coverage for obfuscated vs normal facet filter rendering.
config/tess.example.yml	Documents new obfuscate_filters config option.
app/helpers/search_helper.rb	Implements obfuscated rendering for facet filter links.
app/assets/javascripts/filters.js	Rehydrates obfuscated facet spans into real links on turbolinks:load.
app/assets/javascripts/show_private_groups.js	Prevents page-load errors when expected elements aren’t present.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.