Skip to content

PR_NOTES.md

Latest commit

 

History

History
24 lines (21 loc) · 2.11 KB

PR_NOTES.md

File metadata and controls

24 lines (21 loc) · 2.11 KB

PR Notes: Pagination Defaults and Max Limits Enforcement

Changes

  • Updated src/lib/pagination.ts to support both offset/limit and page/limit pagination.
  • Enforced a DEFAULT_LIMIT of 20 and a MAX_LIMIT of 100 across all endpoints.
  • Normalized invalid inputs (NaN, negative, zero) to safe defaults.
  • Refactored src/app.ts to use the shared parsePagination helper consistently, replacing ad-hoc parsing.
  • Improved consistency of API responses by using paginatedResponse for /api/apis and /api/developers/apis.
  • Implemented full public API listing in GET /api/apis (previously returned empty array).
  • Updated UsageEventsRepository (both In-Memory and PG implementations) to support pagination (limit and offset).
  • Updated developerRoutes.ts to support page parameter in revenue analytics.
  • Updated admin.ts to support page parameter in user listing.
  • Added comprehensive unit tests in src/lib/__tests__/pagination.test.ts covering edge cases and new functionality.

Security & Data Integrity Assumptions

  • DoS Protection: By enforcing a MAX_LIMIT of 100, we prevent potentially expensive database queries that could return thousands of rows, which could be used as a DoS vector.
  • Input Sanitization: All pagination parameters are parsed as integers and clamped to safe ranges (limit 1-100, offset >= 0). This prevents SQL injection through pagination parameters (especially in the PG repository where they are passed as parameters anyway).
  • Consistency: Using a single source of truth (parsePagination) ensures that all list endpoints behave identically regarding pagination, reducing developer error when adding new endpoints.
  • Default Behavior: If no pagination parameters are provided, the system defaults to the first page (offset 0) with a limit of 20, ensuring stable and predictable API responses.

Verification Results

  • Ran unit tests for pagination logic: 32 tests passed.
  • Verified type safety (ignoring environment-specific missing type definitions for jest/node).
  • Manually reviewed all modified routes to ensure they correctly use the returned limit and offset.