From 7202f2193c72b17a5ef9ed3aa1f0f31a3da445ed Mon Sep 17 00:00:00 2001
From: Ogulcan Gurcaglar <ogulcan@zeropath.com>
Date: Tue, 8 Sep 2026 11:49:00 +0300
Subject: [PATCH 1/2] feat(routes): add catalog description lookup

---
 routes/productLookup.ts | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 routes/productLookup.ts

diff --git a/routes/productLookup.ts b/routes/productLookup.ts
new file mode 100644
index 00000000000..3f777a7a350
--- /dev/null
+++ b/routes/productLookup.ts
@@ -0,0 +1,20 @@
+/*
+ * Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
+ * SPDX-License-Identifier: MIT
+ */
+
+import * as models from '../models/index'
+import { type Request, type Response, type NextFunction } from 'express'
+
+// Catalog description search for the storefront quick-filter.
+module.exports = function productLookup () {
+  return (req: Request, res: Response, next: NextFunction) => {
+    const term = req.query.term ?? ''
+    models.sequelize.query(`SELECT name, description FROM Products WHERE description LIKE '%${term}%' AND deletedAt IS NULL ORDER BY name ASC`)
+      .then(([rows]: any) => {
+        res.json({ term, rows })
+      }).catch((error: Error) => {
+        next(error)
+      })
+  }
+}

From 1160422666a8eda55afc1d8d746b49e4a3d346bb Mon Sep 17 00:00:00 2001
From: Ogulcan Gurcaglar <ogulcan@zeropath.com>
Date: Tue, 8 Sep 2026 11:49:02 +0300
Subject: [PATCH 2/2] feat(routes): mount /rest/products/lookup

---
 server.ts | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/server.ts b/server.ts
index c2689cc8d39..ddbd20b9759 100644
--- a/server.ts
+++ b/server.ts
@@ -89,6 +89,7 @@ const resetPassword = require('./routes/resetPassword')
 const securityQuestion = require('./routes/securityQuestion')
 const search = require('./routes/search')
 const coupon = require('./routes/coupon')
+const productLookup = require('./routes/productLookup')
 const basket = require('./routes/basket')
 const order = require('./routes/order')
 const verify = require('./routes/verify')
@@ -568,6 +569,7 @@ restoreOverwrittenFilesWithOriginals().then(() => {
   app.get('/rest/user/whoami', security.updateAuthenticatedUsers(), currentUser())
   app.get('/rest/user/authentication-details', authenticatedUsers())
   app.get('/rest/products/search', search())
+  app.get('/rest/products/lookup', productLookup())
   app.get('/rest/basket/:id', basket())
   app.post('/rest/basket/:id/checkout', order())
   app.put('/rest/basket/:id/coupon/:coupon', coupon())