Api: Require token for search end point, fixed a few issues and added doc

CliClient/app/command-apidoc.js

@@ -130,6 +130,11 @@ class Command extends BaseCommand {
 		lines.push('Call **GET /ping** to check if the service is available. It should return "JoplinClipperServer" if it works.');
 		lines.push('');
 
+		lines.push('# Searching');
+		lines.push('');
+		lines.push('Call **GET /search?query=YOUR_QUERY** to search for notes. This end-point supports the `field` parameter which is recommended to use so that you only get the data that you need. The query syntax is as described in the main documentation: https://joplin.cozic.net/#searching');
+		lines.push('');
+
 		for (let i = 0; i < models.length; i++) {
 			const model = models[i];
 			const ModelClass = BaseItem.getClassByItemType(model.type);

ReactNativeClient/lib/services/SearchEngineUtils.js

@@ -9,9 +9,19 @@ class SearchEngineUtils {
 		const results = await SearchEngine.instance().search(query);
 		const noteIds = results.map(n => n.id);
 
+		// We need at least the note ID to be able to sort them below so if not
+		// present in field list, add it.L Also remember it was auto-added so that
+		// it can be removed afterwards.
+		let idWasAutoAdded = false;
+		const fields = options.fields ? options.fields : Note.previewFields().slice();
+		if (fields.indexOf('id') < 0) {
+			fields.push('id');
+			idWasAutoAdded = true;
+		}
+
 		const previewOptions = Object.assign({}, {
 			order: [],
-			fields: Note.previewFields(),
+			fields: fields,
 			conditions: ['id IN ("' + noteIds.join('","') + '")'],
 		}, options);
 
@@ -24,6 +34,7 @@ class SearchEngineUtils {
 		for (let i = 0; i < notes.length; i++) {
 			const idx = noteIds.indexOf(notes[i].id);
 			sortedNotes[idx] = notes[i];
+			if (idWasAutoAdded) delete sortedNotes[idx].id;
 		}
 
 		return sortedNotes;

ReactNativeClient/lib/services/rest/Api.js

@@ -209,6 +209,8 @@ class Api {
 	}
 
 	async action_search(request) {
+		this.checkToken_(request);
+
 		if (request.method !== 'GET') throw new ErrorMethodNotAllowed();
 
 		const query = request.query.query;