fix(zaps): clamp history pagination ranges

[Jorel97]

Fixes #293.

This clamps limit and offset before passing them into Supabase .range(...):

• invalid or non-positive limit falls back into a safe 1..100 range
• invalid or negative offset falls back to 0
• empty zap result sets now return immediately without doing a profile lookup for an empty id list

Verification: inspected the route and kept the change scoped to query parsing plus the empty-results guard. Full test suite was not run because this workspace does not have a full dependency checkout.

[greptile-apps]

Greptile Summary

This PR hardens the zap history pagination endpoint by clamping user-supplied limit and offset query parameters to safe ranges and fixing an early-return path that previously discarded the real count on empty result pages.

• Input validation: limit is now parsed with radix 10, guarded against NaN/non-finite values, and clamped to [1, 100]; offset is clamped to [0, ∞), preventing invalid .range() calls to Supabase.
• Empty-results guard: The condition broadens from !zaps (null only) to !zaps || zaps.length === 0, and the response now returns the real count value instead of a hard-coded 0, so pagination UIs correctly know the total row count even when a given page is empty.
• Short-circuit optimization: Skips the unnecessary profile lookup when the zap result set is empty, avoiding a potentially problematic .in("id", []) call against Supabase.

Confidence Score: 5/5

Safe to merge — changes are narrowly scoped to input clamping and an empty-results guard with no behavioral regressions on the happy path.

All touched logic is defensive: the parseInt radix fix, Number.isFinite guards, Math.min/max clamping, and the corrected empty-page early return are all straightforward and correct. No auth changes, no schema changes, and no new external calls are introduced.

No files require special attention.

Important Files Changed

Filename	Overview
src/app/api/zaps/history/route.ts	Adds radix-10 parseInt, NaN/negative guards for limit/offset, clamps limit to [1,100], and short-circuits on empty results while preserving the real count from Supabase.

Sequence Diagram

sequenceDiagram
    participant Client
    participant Route as GET /api/zaps/history
    participant Supabase

    Client->>Route: "?limit=X&offset=Y&direction=Z"
    Route->>Route: "parse & clamp limit → [1,100]"
    Route->>Route: "parse & clamp offset → [0,∞)"
    Route->>Supabase: "SELECT zaps WHERE user_id=... RANGE(offset, offset+limit-1) COUNT exact"
    Supabase-->>Route: "{ data, count }"
    alt data is null or empty
        Route-->>Client: "{ zaps: [], total: count || 0 }"
    else data has rows
        Route->>Supabase: SELECT profiles WHERE id IN (otherIds)
        Supabase-->>Route: profiles[]
        Route->>Route: enrich zaps with profile info
        Route-->>Client: "{ zaps: enriched[], total: count || 0 }"
    end

Loading

_{Reviews (2): Last reviewed commit: "fix(zaps): preserve count for empty hist..." | Re-trigger Greptile}