OGC Filter Or Precedence Issue with Repository Filters

[nirolevy]

When a CSW request utilizes an OGC Filter with a top-level <Or> logical operator, the generated SQL incorrectly combines the custom filter with the mandatory repository filter (repo filter) configured in pycsw.

---

Problem Description

The issue stems from the SQL construction logic, which fails to enclose the SQL generated from the custom OGC Filter in parentheses before appending the repo filter condition using the AND operator. This structural error can lead to the repository filter being bypassed, returning records that should have been excluded.

The resulting incorrect SQL structure is:

WHERE (Custom Condition 1) OR (Custom Condition 2) AND (Repo Filter Condition)

Due to standard SQL precedence rules (where AND binds tighter than OR), this is interpreted as:

WHERE (Custom Condition 1) OR [ (Custom Condition 2) AND (Repo Filter Condition) ]

Consequently, the first part of the OR statement (Custom Condition 1) is exempt from the repo filter, allowing records that should have been filtered out to be included in the result set.