fix(webhooks): clamp delivery pagination ranges

[Jorel97]

Fixes #315.

Summary

• parse webhook delivery limit and offset query params through a bounded integer helper
• fall back from non-finite values and clamp negative offsets before Supabase .range()
• add route tests for defaults, invalid values, fractions, and over-large limits

Tests

• Not run locally; dependencies are not installed in this workspace checkout.

[greptile-apps]

Greptile Summary

This PR replaces ad-hoc parseInt(... || "50") pagination with a parsePaginationParam helper that handles null, empty-string, non-numeric, fractional, and out-of-range inputs, then clamps the results before passing them to Supabase's .range().

• route.ts: New parsePaginationParam(value, default, min, max) correctly falls back to the default for null/empty/non-finite inputs and uses Math.trunc + Math.min/max to clamp; limit is bounded to [1, 100] and offset to [0, 100_000].
• route.test.ts: New Vitest suite covers default pagination, invalid strings ("abc"), negative offsets, empty-string params (""), fractional values, and over-large limits — exercising all key branches of the helper.

Confidence Score: 5/5

Safe to merge — the pagination helper is correct for all tested and untested edge cases, and the test suite is comprehensive.

The parsePaginationParam helper correctly handles every edge case in the changed code path: null, empty string, whitespace, non-numeric, fractional, negative, and very large inputs all resolve to safe, bounded values. The ownership-check and Supabase query flow are unchanged.

No files require special attention.

Important Files Changed

Filename	Overview
src/app/api/webhooks/[id]/deliveries/route.ts	Introduces parsePaginationParam helper that correctly handles null, empty-string, non-numeric, fractional, and out-of-range inputs before calling .range(); clamps limit to [1,100] and offset to [0,100_000].
src/app/api/webhooks/[id]/deliveries/route.test.ts	Adds Vitest tests covering defaults, invalid/non-numeric params, empty strings, fractional values, and over-large limits; mock chain correctly mirrors the two-query (webhook ownership + deliveries) flow.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["GET /api/webhooks/[id]/deliveries"] --> B["getAuthContext"]
    B -- "null" --> C["401 Unauthorized"]
    B -- "user" --> D["supabase.from('webhooks').select().eq().single()"]
    D -- "not found" --> E["404 Not Found"]
    D -- "user_id mismatch" --> F["403 Forbidden"]
    D -- "ownership ok" --> G["parsePaginationParam(limit, 50, 1, 100)"]
    G --> H["parsePaginationParam(offset, 0, 0, 100_000)"]
    H --> I["supabase.from('webhook_deliveries').select().eq().order().range(offset, offset+limit-1)"]
    I -- "error" --> J["400 Bad Request"]
    I -- "success" --> K["200 {data, pagination}"]

Loading

_{Reviews (2): Last reviewed commit: "fix(webhooks): default empty delivery pa..." | Re-trigger Greptile}