"Cannot resolve keyword..." query error

A user this afternoon repeatedly attempted to query events using gracedb-client for (what I assume was supposed to be) FAR > 1e-20 gpstime: 899999000.0 .. 999999999.9, but accidentally (?) put the gpstime: .... query in the orderby= keyword argument. I'll paste the traceback at the end of this post.

Turns out if i put any value in the orderby= field that doesn't correspond to a valid db column, then it throws up an error. We should add some error trapping to catch that and return a 400 error.

Internal Server Error: /api/events/

FieldError at /api/events/
Cannot resolve keyword 'gpstime: 899999000.0 .. 999999999.9' into field. Choices are: coincinspiralevent, created, embbeventlog, emobservation, eventlog, far, gpstime, graceid, grbevent, group, group_id, id, instruments, labelling, labels, lalinferenceburstevent, likelihood, mlyburstevent, multiburstevent, nevents, offline, perms, pipeline, pipeline_id, pipeline_preferred, pipeline_preferred_id, reporting_latency, search, search_id, signoff, siminspiralevent, singleinspiral, submitter, submitter_id, superevent, superevent_id, superevent_preferred_for, voevent

Request Method: GET
Request URL: http://gracedb-dev1.ligo.org/api/events/?query=FAR+%3E+1e-20&sort=gpstime%3A+899999000.0+..+999999999.9
Django Version: 3.2.16
Python Executable: /usr/bin/python3
Python Version: 3.7.3
Python Path: ['/usr/local/bin', '/usr/local/lib/python3.7/dist-packages', '/app/gracedb_project', '/usr/lib/python37.zip', '/usr/lib/python3.7', '/usr/lib/python3.7/lib-dynload', '/usr/lib/python3/dist-packages', '/app/gracedb_project', '/app/gracedb_project/gracedb', '/usr/local/lib/python3.7/dist-packages/IPython/extensions']
Server time: Wed, 15 Feb 2023 21:07:00 +0000
Installed Applications:
['django.contrib.auth',
 'django.contrib.admin',
 'django_ses',
 'django.contrib.contenttypes',
 'user_sessions',
 'django.contrib.sites',
 'django.contrib.staticfiles',
 'django.contrib.messages',
 'alerts',
 'annotations',
 'api',
 'core',
 'events',
 'ligoauth',
 'search',
 'superevents',
 'rest_framework',
 'guardian',
 'django_twilio',
 'django_extensions',
 'django.contrib.sessions',
 'computedfields',
 'django_postgres_vacuum']
Installed Middleware:
['django.middleware.cache.UpdateCacheMiddleware',
 'core.middleware.maintenance.MaintenanceModeMiddleware',
 'events.middleware.PerformanceMiddleware',
 'core.middleware.accept.AcceptMiddleware',
 'core.middleware.api.ClientVersionMiddleware',
 'core.middleware.api.CliExceptionMiddleware',
 'django.middleware.common.CommonMiddleware',
 'core.middleware.proxy.XForwardedForMiddleware',
 'django.contrib.sessions.middleware.SessionMiddleware',
 'user_sessions.middleware.SessionMiddleware',
 'django.contrib.messages.middleware.MessageMiddleware',
 'django.contrib.auth.middleware.AuthenticationMiddleware',
 'ligoauth.middleware.ShibbolethWebAuthMiddleware',
 'ligoauth.middleware.ControlRoomMiddleware',
 'django.middleware.cache.FetchFromCacheMiddleware']


Traceback (most recent call last):
  File "/usr/local/lib/python3.7/dist-packages/django/core/handlers/exception.py", line 47, in inner
    response = get_response(request)
  File "/usr/local/lib/python3.7/dist-packages/django/core/handlers/base.py", line 181, in _get_response
    response = wrapped_callback(request, *callback_args, **callback_kwargs)
  File "/usr/local/lib/python3.7/dist-packages/django/views/decorators/cache.py", line 44, in _wrapped_view_func
    response = view_func(request, *args, **kwargs)
  File "/usr/local/lib/python3.7/dist-packages/django/views/decorators/csrf.py", line 54, in wrapped_view
    return view_func(*args, **kwargs)
  File "/usr/local/lib/python3.7/dist-packages/django/views/generic/base.py", line 70, in view
    return self.dispatch(request, *args, **kwargs)
  File "/usr/local/lib/python3.7/dist-packages/rest_framework/views.py", line 509, in dispatch
    response = self.handle_exception(exc)
  File "/usr/local/lib/python3.7/dist-packages/rest_framework/views.py", line 469, in handle_exception
    self.raise_uncaught_exception(exc)
  File "/usr/local/lib/python3.7/dist-packages/rest_framework/views.py", line 480, in raise_uncaught_exception
    raise exc
  File "/usr/local/lib/python3.7/dist-packages/rest_framework/views.py", line 506, in dispatch
    response = handler(request, *args, **kwargs)
  File "/app/gracedb_project/gracedb/api/v1/events/views.py", line 402, in get
    events = events.order_by(sort).select_subclasses()
  File "/usr/local/lib/python3.7/dist-packages/django/db/models/query.py", line 1149, in order_by
    obj.query.add_ordering(*field_names)
  File "/usr/local/lib/python3.7/dist-packages/django/db/models/sql/query.py", line 2016, in add_ordering
    self.names_to_path(item.split(LOOKUP_SEP), self.model._meta)
  File "/usr/local/lib/python3.7/dist-packages/django/db/models/sql/query.py", line 1563, in names_to_path
    "Choices are: %s" % (name, ", ".join(available)))

Exception Type: FieldError at /api/events/
Exception Value: Cannot resolve keyword 'gpstime: 899999000.0 .. 999999999.9' into field. Choices are: coincinspiralevent, created, embbeventlog, emobservation, eventlog, far, gpstime, graceid, grbevent, group, group_id, id, instruments, labelling, labels, lalinferenceburstevent, likelihood, mlyburstevent, multiburstevent, nevents, offline, perms, pipeline, pipeline_id, pipeline_preferred, pipeline_preferred_id, reporting_latency, search, search_id, signoff, siminspiralevent, singleinspiral, submitter, submitter_id, superevent, superevent_id, superevent_preferred_for, voevent
Request information:
USER: lorena.magana-zertuche@ligo.org

GET:
query = 'FAR > 1e-20'
sort = 'gpstime: 899999000.0 .. 999999999.9'

POST: No POST data

FILES: No FILES data

Note I changed gracedb--> gracedb-dev1 to prevent error emails if someone clicks the link.

Edit: in the client code, the kwarg is orderby=, but when the form is submitted, it's sort= and that's the variable on the server-side.