fix(api): clamp postgres extrinsics pagination

tests/data-api.test.mjs

@@ -584,6 +584,17 @@ test("GET /api/v1/extrinsics uses a composite cursor seek instead of OFFSET", as
   expect(text).not.toContain("OFFSET");
 });
 
+test("GET /api/v1/extrinsics clamps page size and offset before querying Postgres", async () => {
+  mockRows.current = [EXTRINSIC_ROW];
+  await req("/api/v1/extrinsics?limit=999999&offset=999999999");
+
+  const queryValues = sqlCalls.flatMap((call) => call.values);
+  expect(queryValues).toContain(BLOCK_PAGINATION.maxLimit);
+  expect(queryValues).toContain(MAX_OFFSET);
+  expect(queryValues).not.toContain(999999);
+  expect(queryValues).not.toContain(999999999);
+});
+
 test("GET /api/v1/extrinsics/:ref resolves a hash ref with embedded account_events", async () => {
   const eventRow = {
     block_number: "8586300",

workers/data-api.mjs

@@ -257,7 +257,7 @@ export default {
         // cover the same access patterns D1's INDEXED BY hints targeted) --
         // Postgres has no INDEXED BY equivalent.
         if (url.pathname === "/api/v1/extrinsics") {
-          const limit = clampLimit(url.searchParams.get("limit"));
+          const limit = clampBlockLimit(url.searchParams.get("limit"));
           const offset = clampOffset(url.searchParams.get("offset"));
           const cursor = decodeCursor(url.searchParams.get("cursor"), 2);
           const block = nonNegativeIntegerParam(url.searchParams, "block");