yusufipek/OpenFrame
1
0
Fork 0
mirror of https://github.com/yusufipk/OpenFrame.git synced 2026-09-11 09:36:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: add pagination and strict query validation for workspace/project listings

Browse Source
This commit is contained in:
Yusuf İpek
2026-02-24 18:07:04 +03:00
parent 9f32aeafe6
commit 644b239ab3
6 changed files with 236 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/api/projects/[projectId]/route.ts
+16 -2
View File
@@ -12,11 +12,25 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
try {
const session = await auth();
const { projectId } = await params;
const MAX_LIMIT = 100;
const MAX_OFFSET = 10000;
// Parse pagination params
const searchParams = request.nextUrl.searchParams;
const limit = Math.min(parseInt(searchParams.get('limit') || '20'), 100);
const offset = Math.max(0, parseInt(searchParams.get('offset') || '0'));
const limitParam = searchParams.get('limit');
const offsetParam = searchParams.get('offset');
const limitRaw = limitParam === null ? 20 : Number(limitParam);
if (!Number.isSafeInteger(limitRaw) || limitRaw < 1 || limitRaw > MAX_LIMIT) {
return apiErrors.badRequest('Invalid limit. Must be a positive integer between 1 and 100.');
}
const offset = offsetParam === null ? 0 : Number(offsetParam);
if (!Number.isSafeInteger(offset) || offset < 0 || offset > MAX_OFFSET) {
return apiErrors.badRequest('Invalid offset. Must be a non-negative integer up to 10000.');
}
const limit = limitRaw;
const project = await db.project.findUnique({
where: { id: projectId },
app/api/projects/route.ts
+21 -2
View File
@@ -10,16 +10,35 @@ import { DEFAULT_COMMENT_TAGS } from '@/lib/comment-tags';
export async function GET(request: NextRequest) {
try {
const session = await auth();
const MAX_LIMIT = 100;
const MAX_PAGE = 1000;
const MAX_OFFSET = 10000;
if (!session?.user?.id) {
return apiErrors.unauthorized();
}
const { searchParams } = new URL(request.url);
const page = parseInt(searchParams.get('page') || '1');
const limit = parseInt(searchParams.get('limit') || '10');
const pageParam = searchParams.get('page');
const limitParam = searchParams.get('limit');
const workspaceId = searchParams.get('workspaceId');
const pageRaw = pageParam === null ? 1 : Number(pageParam);
if (!Number.isSafeInteger(pageRaw) || pageRaw < 1 || pageRaw > MAX_PAGE) {
return apiErrors.badRequest('Invalid page. Must be a positive integer.');
}
const limitRaw = limitParam === null ? 10 : Number(limitParam);
if (!Number.isSafeInteger(limitRaw) || limitRaw < 1 || limitRaw > MAX_LIMIT) {
return apiErrors.badRequest('Invalid limit. Must be a positive integer between 1 and 100.');
}
const page = pageRaw;
const limit = limitRaw;
const skip = (page - 1) * limit;
if (!Number.isSafeInteger(skip) || skip > MAX_OFFSET) {
return apiErrors.badRequest('Invalid page range. Offset must be 10000 or less.');
}
// Build base filter: user is owner OR a member
const baseFilter: Record<string, unknown> = {
app/api/workspaces/[workspaceId]/members/route.ts
+48 -8
View File
@@ -12,11 +12,35 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
try {
const session = await auth();
const { workspaceId } = await params;
const MAX_LIMIT = 100;
const MAX_PAGE = 1000;
const MAX_OFFSET = 10000;
if (!session?.user?.id) {
return apiErrors.unauthorized();
}
const searchParams = request.nextUrl.searchParams;
const pageParam = searchParams.get('page');
const limitParam = searchParams.get('limit');
const pageRaw = pageParam === null ? 1 : Number(pageParam);
if (!Number.isSafeInteger(pageRaw) || pageRaw < 1 || pageRaw > MAX_PAGE) {
return apiErrors.badRequest('Invalid page. Must be a positive integer.');
}
const limitRaw = limitParam === null ? 20 : Number(limitParam);
if (!Number.isSafeInteger(limitRaw) || limitRaw < 1 || limitRaw > MAX_LIMIT) {
return apiErrors.badRequest('Invalid limit. Must be a positive integer between 1 and 100.');
}
const page = pageRaw;
const limit = limitRaw;
const skip = (page - 1) * limit;
if (!Number.isSafeInteger(skip) || skip > MAX_OFFSET) {
return apiErrors.badRequest('Invalid page range. Offset must be 10000 or less.');
}
const workspace = await db.workspace.findUnique({
where: { id: workspaceId },
include: {
@@ -35,13 +59,20 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
return apiErrors.forbidden('Access denied');
}
const members = await db.workspaceMember.findMany({
where: { workspaceId },
include: {
user: { select: { id: true, name: true, email: true, image: true } },
},
orderBy: { createdAt: 'asc' },
});
const [members, total] = await Promise.all([
db.workspaceMember.findMany({
where: { workspaceId },
include: {
user: { select: { id: true, name: true, email: true, image: true } },
},
orderBy: { createdAt: 'asc' },
skip,
take: limit,
}),
db.workspaceMember.count({
where: { workspaceId },
}),
]);
// Include the owner as well
const owner = await db.user.findUnique({
@@ -49,7 +80,16 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
select: { id: true, name: true, email: true, image: true },
});
const response = successResponse({ members, owner });
const response = successResponse(
{ members, owner },
200,
{
page,
limit,
total,
totalPages: Math.ceil(total / limit),
}
);
return withCacheControl(response, 'private, max-age=60, stale-while-revalidate=120');
} catch (error) {
console.error('Error fetching workspace members:', error);
app/api/workspaces/[workspaceId]/route.ts
+20
View File
@@ -35,11 +35,29 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
try {
const session = await auth();
const { workspaceId } = await params;
const MAX_LIMIT = 100;
const MAX_OFFSET = 10000;
if (!session?.user?.id) {
return apiErrors.unauthorized();
}
const searchParams = request.nextUrl.searchParams;
const limitParam = searchParams.get('limit');
const offsetParam = searchParams.get('offset');
const limitRaw = limitParam === null ? 20 : Number(limitParam);
if (!Number.isSafeInteger(limitRaw) || limitRaw < 1 || limitRaw > MAX_LIMIT) {
return apiErrors.badRequest('Invalid limit. Must be a positive integer between 1 and 100.');
}
const offset = offsetParam === null ? 0 : Number(offsetParam);
if (!Number.isSafeInteger(offset) || offset < 0 || offset > MAX_OFFSET) {
return apiErrors.badRequest('Invalid offset. Must be a non-negative integer up to 10000.');
}
const limit = limitRaw;
const workspace = await db.workspace.findUnique({
where: { id: workspaceId },
include: {
@@ -51,6 +69,8 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
},
projects: {
orderBy: { updatedAt: 'desc' },
skip: offset,
take: limit,
include: {
_count: { select: { videos: true, members: true } },
},
app/api/workspaces/route.ts
+56 -16
View File
@@ -5,30 +5,70 @@ import { rateLimit } from '@/lib/rate-limit';
import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
// GET /api/workspaces - List all workspaces for the authenticated user
export async function GET() {
export async function GET(request: NextRequest) {
try {
const session = await auth();
const MAX_LIMIT = 100;
const MAX_PAGE = 1000;
const MAX_OFFSET = 10000;
if (!session?.user?.id) {
return apiErrors.unauthorized();
}
// Get workspaces where user is owner OR a member
const workspaces = await db.workspace.findMany({
where: {
OR: [
{ ownerId: session.user.id },
{ members: { some: { userId: session.user.id } } },
],
},
include: {
owner: { select: { id: true, name: true, image: true } },
_count: { select: { projects: true, members: true } },
},
orderBy: { updatedAt: 'desc' },
});
const searchParams = request.nextUrl.searchParams;
const pageParam = searchParams.get('page');
const limitParam = searchParams.get('limit');
const response = successResponse({ workspaces });
const pageRaw = pageParam === null ? 1 : Number(pageParam);
if (!Number.isSafeInteger(pageRaw) || pageRaw < 1 || pageRaw > MAX_PAGE) {
return apiErrors.badRequest('Invalid page. Must be a positive integer.');
}
const limitRaw = limitParam === null ? 20 : Number(limitParam);
if (!Number.isSafeInteger(limitRaw) || limitRaw < 1 || limitRaw > MAX_LIMIT) {
return apiErrors.badRequest('Invalid limit. Must be a positive integer between 1 and 100.');
}
const page = pageRaw;
const limit = limitRaw;
const skip = (page - 1) * limit;
if (!Number.isSafeInteger(skip) || skip > MAX_OFFSET) {
return apiErrors.badRequest('Invalid page range. Offset must be 10000 or less.');
}
const where = {
OR: [
{ ownerId: session.user.id },
{ members: { some: { userId: session.user.id } } },
],
};
// Get workspaces where user is owner OR a member
const [workspaces, total] = await Promise.all([
db.workspace.findMany({
where,
include: {
owner: { select: { id: true, name: true, image: true } },
_count: { select: { projects: true, members: true } },
},
orderBy: { updatedAt: 'desc' },
skip,
take: limit,
}),
db.workspace.count({ where }),
]);
const response = successResponse(
{ workspaces },
200,
{
page,
limit,
total,
totalPages: Math.ceil(total / limit),
}
);
return withCacheControl(response, 'private, max-age=60, stale-while-revalidate=120');
} catch (error) {
console.error('Error fetching workspaces:', error);