fix: validate remaining pagination inputs before database access
Description
Remaining user, administration, social, and hardware queries accepted fractional pagination values or unsafe arithmetic that reached Prisma. Validate their actual integer skip/take arguments at the final Zod input boundaries, including four independent profile sections, the activity feed’s combined fetch count, and the risk-only moderation path’s direct offsets.
The mobile CPU/GPU catalogs also rejected nonpositive pages/page sizes only during output validation, after querying the database. They now return field-specific bad requests before database access.
Preserve existing caps, defaults, optional/null behavior, report coercion, page-versus-offset precedence, and supported legacy zero/reverse takes. Pagination remains compatible with safe integer values above Int32. Shared object bases stay composable; no repository, output, or database-schema change is included.
Type of change
- Bug fix
How Has This Been Tested?
- 378 focused and neighboring regression tests across 11 files
- 159 focused follow-up/neighbor tests for risk-only offsets and field-specific page errors
- Scoped lint for all 31 changed TypeScript files
- Full normal pre-push checks: lint, generated types, 3,786 tests across 305 files
- Generated existing API documentation and checked the four hardware contracts plus existing memory/performance contracts
Actual-router and HTTP cases check errors at the relevant input field before any database access, correct valid Prisma arguments, integer boundaries above Int32, safe arithmetic limits, pending-game defaults for omitted input versus an empty object, and supported offset/reverse-take behavior.
Checklist
- Follows project code style
- Self-reviewed
- Existing generated documentation updated
Summary by CodeRabbit
- Bug Fixes
- Pagination inputs across the API now consistently require whole-number values and reject unsafe or unsupported page and offset combinations.
- Invalid pagination requests are rejected before data is accessed, with clearer field-specific validation errors. Existing defaults and limits are preserved.
- Documentation
- Mobile CPU and GPU API documentation now reflects integer pagination inputs.