Skip to content

fix: validate limit/offset on webhook management routes with OffsetPaginationSchema - #1

Open
aojomo wants to merge 1 commit into
mainfrom
fix/webhook-pagination-validation-847
Open

fix: validate limit/offset on webhook management routes with OffsetPaginationSchema#1
aojomo wants to merge 1 commit into
mainfrom
fix/webhook-pagination-validation-847

Conversation

@aojomo

@aojomo aojomo commented Jul 26, 2026

Copy link
Copy Markdown
Owner

Summary

Add offset-based pagination validation to webhook management routes (GET /deliveries and GET /dlq) using a new OffsetPaginationSchema in the shared pagination validation module. Non-numeric, negative, zero, and excessively large limit/offset values now return a clear 400 INVALID_PAGINATION error instead of silently producing empty or wrong-sized pages.

Fixes Fluxora-Org#847

Changes

src/validation/paginationSchema.ts

  • Added OffsetPaginationSchema — a Zod schema for offset-based pagination with limit (1-100) and offset (>= 0) fields, both optional to allow route-specific defaults. Reuses the existing MAX_PAGE_LIMIT (100) constant for consistency with PaginationSchema and streamRepository.MAX_PAGE_SIZE.

src/routes/webhooks.ts

  • GET /deliveries: Validates limit and offset via OffsetPaginationSchema. Rejects invalid values with 400. Default limit: 100, default offset: 0.
  • GET /dlq: Validates limit via OffsetPaginationSchema. Rejects invalid values with 400. Default limit: 50.

tests/webhooks-pagination.test.ts (new)

21 tests covering:

  • Non-numeric limit/offset -> 400
  • Negative limit/offset -> 400
  • Zero limit -> 400
  • Decimal (non-integer) limit -> 400
  • Limit exceeding MAX_PAGE_LIMIT (100) -> 400
  • Valid values -> 200
  • Defaults when omitted
  • Offset beyond total -> empty array

Acceptance Criteria

  • Non-numeric limit/offset values return a clear 400 instead of silently empty/wrong page
  • A maximum page size is enforced server-side regardless of caller input
  • Tests cover the identified edge cases for both routes
  • Reuses existing pagination validation infrastructure from paginationSchema.ts
  • Negative values reject with clear 400
  • All 21 new tests pass (pre-existing failures are unrelated metrics counter issues)

…ginationSchema

Add OffsetPaginationSchema to paginationSchema.ts and apply it to GET /deliveries and GET /dlq webhook routes. Non-numeric, negative, zero, and excessively large limit/offset values now return a clear 400 error instead of silently producing empty/wrong-sized pages. Closes Fluxora-Org#847.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

GET /internal/webhooks/deliveries and GET /internal/webhooks/dlq accept unbounded/unvalidated limit and offset query params

1 participant