Legal Opinion Search

inside Moodle Workplace 5.0. Also handles two * student-facing features backed by our own local sidecar database (never * Moodle's): saving cases for later, and requesting a physical print from * staff. See schema.sql / lib.php for the data layer, and config.php for * the student-identity trust model (USERNAME_TRUST_MODE). * * DESIGN NOTES -- read before deploying * -------------------------------------------------------------------------- * This tool will be used by incarcerated individuals doing their own legal * research, often over restricted facility networks and shared/kiosk * hardware. That changed several defaults from what a typical "modern web * app" brief would produce: * * - NO external requests of any kind (no CDN CSS/JS, no Google Fonts, no * icon fonts, no analytics/tracking pixels). Correctional-facility * networks are usually a locked-down allowlist; anything not self-hosted * is likely to simply fail to load. It also means nothing about a * person's search terms is ever leaked to a third-party host via * referrer headers. * - Works with JavaScript OFF for search, filters, pagination, saving * cases, and requesting prints -- all plain GET/POST forms and links. * A little vanilla JS is included only as a progressive-enhancement * convenience; nothing depends on it. * - No PHP session for the student-facing flow (see config.php re: the * USERNAME_TRUST_MODE tradeoffs this implies). Save/Request-Print POST * actions are CSRF-protected via a non-identifying double-submit cookie * instead of a session -- see lib.php. * - Opinion text is rendered as escaped plain text everywhere (never as * raw HTML), and is already stripped of all tags/links/images at * ingestion time -- so an embedded Wikimedia image or citation link in * source HTML can never load or become clickable here. See * strip_external_references() in lib.php and clean_html() in * ingest_courtlistener.py. * - Large base font size, high contrast, visible focus outlines, big tap * targets, . * - Does NOT send X-Frame-Options (would break the Moodle iframe embed). * Restrict embedding via a CSP frame-ancestors directive scoped to your * Moodle origin instead -- see TODO below. * * SETUP * -------------------------------------------------------------------------- * 1. composer require meilisearch/meilisearch-php * 2. Fill in config.php. * 3. Make sure meilisearch_index_settings.json has been applied to your * index (see ingest_courtlistener.py --apply-settings). */ require_once __DIR__ . '/config.php'; require_once __DIR__ . '/lib.php'; // TODO: once you know the exact Moodle Workplace origin this will be framed // from, lock the embed down, e.g.: // header("Content-Security-Policy: frame-ancestors 'self' https://moodle.yourfacility.example"); // header("Content-Security-Policy: frame-ancestors 'self' https://YOUR-MOODLE-DOMAIN;"); header('X-Content-Type-Options: nosniff'); header('Referrer-Policy: no-referrer'); header('Content-Type: text/html; charset=UTF-8'); error_reporting(E_ALL); ini_set('display_errors', '0'); // never leak stack traces / server paths to the browser if (!file_exists(VENDOR_AUTOLOAD)) { http_response_code(500); echo '

Search is temporarily unavailable. ' . '(Composer dependencies are not installed on the server.)

'; exit; } require_once VENDOR_AUTOLOAD; use Meilisearch\Client; /** Helper for filter checkbox rendering. */ function is_checked(array $selected, string $value): bool { return in_array($value, $selected, true); } /** * Safely render Meilisearch highlighting in plain text. * * Escape the entire value first, then restore only the exact tags * inserted by the search options below. All source text remains escaped. */ function highlighted_text(string $text): string { return str_replace( ['<mark>', '</mark>'], ['', ''], h($text) ); } // --------------------------------------------------------------------------- // Identity + CSRF (must happen before any output -- setcookie() needs that) // --------------------------------------------------------------------------- $username = resolve_student_identity(); $csrfToken = ensure_csrf_cookie_token(); // --------------------------------------------------------------------------- // Handle POST actions: Save Case / Unsave Case / Request Print // --------------------------------------------------------------------------- if ($_SERVER['REQUEST_METHOD'] === 'POST') { $csrfOk = verify_csrf_cookie_token(); $action = is_string($_POST['action'] ?? null) ? $_POST['action'] : ''; $opinionId = is_string($_POST['opinion_id'] ?? null) ? $_POST['opinion_id'] : ''; if ($csrfOk && $username !== null && preg_match('/^[A-Za-z0-9_-]{1,64}$/', $opinionId)) { $caseName = mb_substr(trim((string) ($_POST['case_name'] ?? '')), 0, 500) ?: null; $courtName = mb_substr(trim((string) ($_POST['court_name'] ?? '')), 0, 255) ?: null; $dateFiled = mb_substr(trim((string) ($_POST['date_filed'] ?? '')), 0, 32) ?: null; switch ($action) { case 'save_case': save_case($username, $opinionId, $caseName, $courtName, $dateFiled); break; case 'unsave_case': unsave_case($username, $opinionId); break; case 'request_print': create_print_request($username, $opinionId, $caseName, $courtName, $dateFiled); break; } } // Post/Redirect/Get: bounce back to the same page (same $_GET context, // e.g. q/page/filters/view) as a plain GET so refreshing never // re-submits the action. Intentionally NOT built from any user-supplied // URL -- only from the already-validated $_GET superglobal -- so this // can't be turned into an open redirect. $returnQuery = http_build_query($_GET); header('Location: https://lawlibrary.maxxlms.com/search.php' . ($returnQuery !== '' ? '?' . $returnQuery : '')); exit; } // --------------------------------------------------------------------------- // Read + validate GET input // --------------------------------------------------------------------------- $query = trim($_GET['q'] ?? ''); $page = (int)($_GET['page'] ?? 1); $selectedCourts = $_POST['courts'] ?? $_GET['courts'] ?? []; $selectedStatus = $_POST['status'] ?? $_GET['status'] ?? []; if (!is_array($selectedCourts)) { $selectedCourts = []; } if (!is_array($selectedStatus)) { $selectedStatus = []; } $currentYear = (int) date('Y'); $yearFrom = (int)($_POST['year_from'] ?? $_GET['year_from'] ?? 0); $yearTo = (int)($_POST['year_to'] ?? $_GET['year_to'] ?? 0); $isSavedView = isset($_GET['saved']) && $_GET['saved'] === '1'; $viewId = (!$isSavedView && isset($_GET['view']) && is_string($_GET['view']) && preg_match('/^[A-Za-z0-9_-]{1,64}$/', $_GET['view'])) ? $_GET['view'] : null; // --------------------------------------------------------------------------- // Meilisearch client // --------------------------------------------------------------------------- $client = new Client(MEILI_HOST, MEILI_API_KEY !== '' ? MEILI_API_KEY : null); $index = $client->index(MEILI_INDEX); $errorMessage = null; // --------------------------------------------------------------------------- // Detail view: a single opinion, full text // --------------------------------------------------------------------------- $viewDoc = null; if ($viewId !== null) { try { $viewDoc = $index->getDocument($viewId); } catch (\Throwable $e) { // Covers both a genuine "not found" and a Meilisearch/network outage -- // either way we show the same friendly not-found message below rather // than leaking internal error detail. $viewDoc = null; error_log('[search.php] getDocument error: ' . $e->getMessage()); } } // --------------------------------------------------------------------------- // Saved-cases view // --------------------------------------------------------------------------- $savedCases = []; if ($isSavedView && $username !== null) { $savedCases = list_saved_cases($username); } // --------------------------------------------------------------------------- // Search: build filter expression from validated/whitelisted input // --------------------------------------------------------------------------- $results = null; $facetDistribution = []; $totalHits = 0; $totalPages = 1; if ($viewId === null && !$isSavedView) { $filterParts = []; if (!empty($selectedCourts) && is_array($selectedCourts)) { $courtFilters = []; foreach ($selectedCourts as $court) { $courtFilters[] = "court_name = \"" . addslashes((string)$court) . "\""; } if (!empty($courtFilters)) { $filterParts[] = '(' . implode(' OR ', $courtFilters) . ')'; } } if (!empty($selectedStatus) && is_array($selectedStatus)) { $statusFilters = []; foreach ($selectedStatus as $status) { $statusFilters[] = "precedential_status = \"" . addslashes((string)$status) . "\""; } if (!empty($statusFilters)) { $filterParts[] = '(' . implode(' OR ', $statusFilters) . ')'; } } if ($yearFrom > 0) { $filterParts[] = 'year >= ' . $yearFrom; } if ($yearTo > 0) { $filterParts[] = 'year <= ' . $yearTo; } $filterExpression = implode(' AND ', $filterParts); // Build search options as a plain array. Note: the Meilisearch PHP SDK's // SearchQuery::setFilter() is NOT nullable -- passing 'filter' => null // here (instead of omitting the key entirely) throws a TypeError, so we // only add the key when we actually have a filter expression. $searchOptions = [ 'page' => $page, 'hitsPerPage' => RESULTS_PER_PAGE, 'facets' => ['court_name', 'precedential_status'], 'attributesToHighlight' => ['case_name', 'text'], 'attributesToCrop' => ['text'], 'cropLength' => SNIPPET_CROP_WORDS, 'highlightPreTag' => '', 'highlightPostTag' => '', 'attributesToRetrieve' => ['id', 'case_name', 'court_name', 'date_filed', 'year', 'precedential_status'], ]; if ($filterExpression !== '') { $searchOptions['filter'] = $filterExpression; } try { $searchResult = $index->search($query !== '' ? $query : null, $searchOptions); $raw = $searchResult->toArray(); $results = $raw['hits'] ?? []; $facetDistribution = $raw['facetDistribution'] ?? []; $totalHits = (int) ($raw['totalHits'] ?? 0); $totalPages = max(1, (int) ($raw['totalPages'] ?? 1)); } catch (\Throwable $e) { // Broad catch on purpose: covers Meilisearch API errors (ApiException), // the server being unreachable (CommunicationException), and anything // else unexpected. In every case we degrade to the same friendly // message rather than leaking server/config details to the browser. $errorMessage = 'Search is temporarily unavailable. Please try again in a moment.'; error_log('[search.php] Meilisearch error: ' . $e->getMessage()); } } ?> Legal Opinion Search

' . '' . '' . '' . ''; $postQuery = http_build_query($_GET); $postTarget = h('https://lawlibrary.maxxlms.com/search.php' . ($postQuery !== '' ? '?' . $postQuery : '')); ?>

← Back to search

My Saved Cases

Sign-in info not detected -- open this page from your course to see saved cases.

You haven't saved any cases yet. Use "Save Case" on a search result to add one here.

Case	Court	Date filed	Saved
				View

← Back to results

That opinion could not be found. It may have been removed or the link may be incorrect.

Court: Date filed: Status: Docket:

Citations:

No opinions matched your search.

Try fewer or different keywords, or clear your filters.

result — page of

300) ? substr(strip_tags($rawSnippet), 0, 300) . '...' : strip_tags($rawSnippet); ?>

Court: Date filed: Status:

……

View full opinion

1): ?>

Enter a search term above, or use the filters to browse opinions.