fix: validate catalog pagination at API boundaries

Merged
PR
2d ago
+334-102

Catalog queries reject fractional, non-positive and unsafe pagination values before database access. The schemas also check the calculated (page - 1) * limit offset. Existing result caps remain 100 games, 100 handheld reports and 50 PC reports; the redundant runtime helper is removed.

Games, Handheld and PC browser URL parsing now normalizes malformed or unsafe pages before querying, while preserving the largest safely representable offset. Defaults remain intact: report queries use page 1 and 10 results; games with no input use 20, and an empty first-page request retains its 50-result optimization.

The browser scrolling check relies on the Next button click’s built-in scrolling and locator reacquisition, so a successful startup refetch can replace pagination safely during the interaction.

Validation: 114 focused boundary and consumer tests pass, including real tRPC/repository paths and all three catalog URL consumers. Regression cases failed before the corresponding fixes. Normal lint, TypeScript and full unit hooks pass (2,933 tests).

Addresses the pagination item in #442. The remaining runtime guard cleanup stays open.

Summary by cubic

Validates catalog pagination at the Zod schema boundary so invalid page, limit, offset, and calculated offset values are rejected before any database query, fixing the pagination item in #442.

  • Games, handheld report, and PC report schemas reject fractional, non-positive, or unsafe page/limit values, invalid game offsets, and pages whose calculated offset exceeds the safe integer range.
  • Games, handheld, and PC catalog URL parsing normalizes malformed or unsafe pages before querying: fractional values are floored, invalid values fall back to page 1, and pages with unsafe calculated offsets fall back to page 1.
  • The redundant runtime validatePagination helper and its callers are removed; games falls back to the catalog default limit when none is provided.
  • Defaults and caps are unchanged: 20 default games with a 100 max, 10 handheld reports with 100 max, and 10 PC reports with 50 max.
  • Focused pagination tests cover schema validation, URL normalization, and real tRPC/repository paths.

Summary by CodeRabbit

  • Bug Fixes
    • Pagination now rejects invalid page and limit values—including fractions, negative numbers, unsafe integers, offsets beyond safe limits, and limits above catalog-specific maximums—across games and listing catalogs.
    • Invalid page numbers in listing URLs now return to the first page; valid pages with safe offsets remain available.
    • Games pagination now validates offsets and uses the default page size when no limit is provided.