feat: add pagination and strict query validation for workspace/project listings

app/(dashboard)/workspaces/[workspaceId]/page.tsx

@@ -44,16 +44,27 @@ function formatRelativeTime(date: Date): string {
 
 interface WorkspacePageProps {
   params: Promise<{ workspaceId: string }>;
+  searchParams: Promise<{ page?: string }>;
 }
 
-export default async function WorkspacePage({ params }: WorkspacePageProps) {
+export default async function WorkspacePage({ params, searchParams }: WorkspacePageProps) {
   const session = await auth();
   const { workspaceId } = await params;
+  const resolvedSearchParams = await searchParams;
+  const MAX_PAGE = 1000;
 
   if (!session?.user?.id) {
     redirect('/login');
   }
 
+  const pageParam = resolvedSearchParams?.page;
+  const parsedPage = pageParam ? Number(pageParam) : 1;
+  const page = Number.isSafeInteger(parsedPage) && parsedPage > 0 && parsedPage <= MAX_PAGE
+    ? parsedPage
+    : 1;
+  const pageSize = 20;
+  const skip = (page - 1) * pageSize;
+
   const workspace = await db.workspace.findUnique({
     where: { id: workspaceId },
     include: {
@@ -64,6 +75,8 @@ export default async function WorkspacePage({ params }: WorkspacePageProps) {
       },
       projects: {
         orderBy: { updatedAt: 'desc' },
+        skip,
+        take: pageSize,
         include: {
           _count: { select: { videos: true, members: true } },
         },
@@ -85,6 +98,8 @@ export default async function WorkspacePage({ params }: WorkspacePageProps) {
     redirect('/workspaces');
   }
 
+  const totalPages = Math.ceil(workspace._count.projects / pageSize);
+
   return (
     <div className="px-6 lg:px-8 py-8 w-full">
       {/* Back & Header */}
@@ -143,6 +158,7 @@ export default async function WorkspacePage({ params }: WorkspacePageProps) {
 
       {/* Projects Grid */}
       {workspace.projects.length > 0 ? (
+        <>
           <div className="grid gap-4 md:grid-cols-2 lg:grid-cols-3">
             {workspace.projects.map((project: (typeof workspace.projects)[number]) => (
               <Link key={project.id} href={`/projects/${project.id}`}>
@@ -179,6 +195,28 @@ export default async function WorkspacePage({ params }: WorkspacePageProps) {
               </Link>
             ))}
           </div>
+          {totalPages > 1 && (
+            <div className="mt-8 flex items-center justify-end space-x-2">
+              <Button variant="outline" size="sm" disabled={page <= 1} asChild={page > 1}>
+                {page > 1 ? (
+                  <Link href={`/workspaces/${workspaceId}?page=${page - 1}`}>Previous</Link>
+                ) : (
+                  'Previous'
+                )}
+              </Button>
+              <span className="text-sm font-medium">
+                Page {page} of {totalPages}
+              </span>
+              <Button variant="outline" size="sm" disabled={page >= totalPages} asChild={page < totalPages}>
+                {page < totalPages ? (
+                  <Link href={`/workspaces/${workspaceId}?page=${page + 1}`}>Next</Link>
+                ) : (
+                  'Next'
+                )}
+              </Button>
+            </div>
+          )}
+        </>
       ) : (
         <Card className="border-dashed">
           <CardContent className="flex flex-col items-center justify-center py-16">

app/api/projects/[projectId]/route.ts

@@ -12,11 +12,25 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
     try {
         const session = await auth();
         const { projectId } = await params;
+        const MAX_LIMIT = 100;
+        const MAX_OFFSET = 10000;
 
         // Parse pagination params
         const searchParams = request.nextUrl.searchParams;
-        const limit = Math.min(parseInt(searchParams.get('limit') || '20'), 100);
-        const offset = Math.max(0, parseInt(searchParams.get('offset') || '0'));
+        const limitParam = searchParams.get('limit');
+        const offsetParam = searchParams.get('offset');
+
+        const limitRaw = limitParam === null ? 20 : Number(limitParam);
+        if (!Number.isSafeInteger(limitRaw) || limitRaw < 1 || limitRaw > MAX_LIMIT) {
+            return apiErrors.badRequest('Invalid limit. Must be a positive integer between 1 and 100.');
+        }
+
+        const offset = offsetParam === null ? 0 : Number(offsetParam);
+        if (!Number.isSafeInteger(offset) || offset < 0 || offset > MAX_OFFSET) {
+            return apiErrors.badRequest('Invalid offset. Must be a non-negative integer up to 10000.');
+        }
+
+        const limit = limitRaw;
 
         const project = await db.project.findUnique({
             where: { id: projectId },

app/api/projects/route.ts

@@ -10,16 +10,35 @@ import { DEFAULT_COMMENT_TAGS } from '@/lib/comment-tags';
 export async function GET(request: NextRequest) {
     try {
         const session = await auth();
+        const MAX_LIMIT = 100;
+        const MAX_PAGE = 1000;
+        const MAX_OFFSET = 10000;
 
         if (!session?.user?.id) {
             return apiErrors.unauthorized();
         }
 
         const { searchParams } = new URL(request.url);
-        const page = parseInt(searchParams.get('page') || '1');
-        const limit = parseInt(searchParams.get('limit') || '10');
+        const pageParam = searchParams.get('page');
+        const limitParam = searchParams.get('limit');
         const workspaceId = searchParams.get('workspaceId');
+
+        const pageRaw = pageParam === null ? 1 : Number(pageParam);
+        if (!Number.isSafeInteger(pageRaw) || pageRaw < 1 || pageRaw > MAX_PAGE) {
+            return apiErrors.badRequest('Invalid page. Must be a positive integer.');
+        }
+
+        const limitRaw = limitParam === null ? 10 : Number(limitParam);
+        if (!Number.isSafeInteger(limitRaw) || limitRaw < 1 || limitRaw > MAX_LIMIT) {
+            return apiErrors.badRequest('Invalid limit. Must be a positive integer between 1 and 100.');
+        }
+
+        const page = pageRaw;
+        const limit = limitRaw;
         const skip = (page - 1) * limit;
+        if (!Number.isSafeInteger(skip) || skip > MAX_OFFSET) {
+            return apiErrors.badRequest('Invalid page range. Offset must be 10000 or less.');
+        }
 
         // Build base filter: user is owner OR a member
         const baseFilter: Record<string, unknown> = {

app/api/workspaces/[workspaceId]/members/route.ts

@@ -12,11 +12,35 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
     try {
         const session = await auth();
         const { workspaceId } = await params;
+        const MAX_LIMIT = 100;
+        const MAX_PAGE = 1000;
+        const MAX_OFFSET = 10000;
 
         if (!session?.user?.id) {
             return apiErrors.unauthorized();
         }
 
+        const searchParams = request.nextUrl.searchParams;
+        const pageParam = searchParams.get('page');
+        const limitParam = searchParams.get('limit');
+
+        const pageRaw = pageParam === null ? 1 : Number(pageParam);
+        if (!Number.isSafeInteger(pageRaw) || pageRaw < 1 || pageRaw > MAX_PAGE) {
+            return apiErrors.badRequest('Invalid page. Must be a positive integer.');
+        }
+
+        const limitRaw = limitParam === null ? 20 : Number(limitParam);
+        if (!Number.isSafeInteger(limitRaw) || limitRaw < 1 || limitRaw > MAX_LIMIT) {
+            return apiErrors.badRequest('Invalid limit. Must be a positive integer between 1 and 100.');
+        }
+
+        const page = pageRaw;
+        const limit = limitRaw;
+        const skip = (page - 1) * limit;
+        if (!Number.isSafeInteger(skip) || skip > MAX_OFFSET) {
+            return apiErrors.badRequest('Invalid page range. Offset must be 10000 or less.');
+        }
+
         const workspace = await db.workspace.findUnique({
             where: { id: workspaceId },
             include: {
@@ -35,13 +59,20 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
             return apiErrors.forbidden('Access denied');
         }
 
-        const members = await db.workspaceMember.findMany({
+        const [members, total] = await Promise.all([
+            db.workspaceMember.findMany({
                 where: { workspaceId },
                 include: {
                     user: { select: { id: true, name: true, email: true, image: true } },
                 },
                 orderBy: { createdAt: 'asc' },
-        });
+                skip,
+                take: limit,
+            }),
+            db.workspaceMember.count({
+                where: { workspaceId },
+            }),
+        ]);
 
         // Include the owner as well
         const owner = await db.user.findUnique({
@@ -49,7 +80,16 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
             select: { id: true, name: true, email: true, image: true },
         });
 
-        const response = successResponse({ members, owner });
+        const response = successResponse(
+            { members, owner },
+            200,
+            {
+                page,
+                limit,
+                total,
+                totalPages: Math.ceil(total / limit),
+            }
+        );
         return withCacheControl(response, 'private, max-age=60, stale-while-revalidate=120');
     } catch (error) {
         console.error('Error fetching workspace members:', error);

app/api/workspaces/[workspaceId]/route.ts

@@ -35,11 +35,29 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
     try {
         const session = await auth();
         const { workspaceId } = await params;
+        const MAX_LIMIT = 100;
+        const MAX_OFFSET = 10000;
 
         if (!session?.user?.id) {
             return apiErrors.unauthorized();
         }
 
+        const searchParams = request.nextUrl.searchParams;
+        const limitParam = searchParams.get('limit');
+        const offsetParam = searchParams.get('offset');
+
+        const limitRaw = limitParam === null ? 20 : Number(limitParam);
+        if (!Number.isSafeInteger(limitRaw) || limitRaw < 1 || limitRaw > MAX_LIMIT) {
+            return apiErrors.badRequest('Invalid limit. Must be a positive integer between 1 and 100.');
+        }
+
+        const offset = offsetParam === null ? 0 : Number(offsetParam);
+        if (!Number.isSafeInteger(offset) || offset < 0 || offset > MAX_OFFSET) {
+            return apiErrors.badRequest('Invalid offset. Must be a non-negative integer up to 10000.');
+        }
+
+        const limit = limitRaw;
+
         const workspace = await db.workspace.findUnique({
             where: { id: workspaceId },
             include: {
@@ -51,6 +69,8 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
                 },
                 projects: {
                     orderBy: { updatedAt: 'desc' },
+                    skip: offset,
+                    take: limit,
                     include: {
                         _count: { select: { videos: true, members: true } },
                     },

app/api/workspaces/route.ts

@@ -5,30 +5,70 @@ import { rateLimit } from '@/lib/rate-limit';
 import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
 
 // GET /api/workspaces - List all workspaces for the authenticated user
-export async function GET() {
+export async function GET(request: NextRequest) {
     try {
         const session = await auth();
+        const MAX_LIMIT = 100;
+        const MAX_PAGE = 1000;
+        const MAX_OFFSET = 10000;
 
         if (!session?.user?.id) {
             return apiErrors.unauthorized();
         }
 
-        // Get workspaces where user is owner OR a member
-        const workspaces = await db.workspace.findMany({
-            where: {
+        const searchParams = request.nextUrl.searchParams;
+        const pageParam = searchParams.get('page');
+        const limitParam = searchParams.get('limit');
+
+        const pageRaw = pageParam === null ? 1 : Number(pageParam);
+        if (!Number.isSafeInteger(pageRaw) || pageRaw < 1 || pageRaw > MAX_PAGE) {
+            return apiErrors.badRequest('Invalid page. Must be a positive integer.');
+        }
+
+        const limitRaw = limitParam === null ? 20 : Number(limitParam);
+        if (!Number.isSafeInteger(limitRaw) || limitRaw < 1 || limitRaw > MAX_LIMIT) {
+            return apiErrors.badRequest('Invalid limit. Must be a positive integer between 1 and 100.');
+        }
+
+        const page = pageRaw;
+        const limit = limitRaw;
+        const skip = (page - 1) * limit;
+        if (!Number.isSafeInteger(skip) || skip > MAX_OFFSET) {
+            return apiErrors.badRequest('Invalid page range. Offset must be 10000 or less.');
+        }
+
+        const where = {
             OR: [
                 { ownerId: session.user.id },
                 { members: { some: { userId: session.user.id } } },
             ],
-            },
+        };
+
+        // Get workspaces where user is owner OR a member
+        const [workspaces, total] = await Promise.all([
+            db.workspace.findMany({
+                where,
                 include: {
                     owner: { select: { id: true, name: true, image: true } },
                     _count: { select: { projects: true, members: true } },
                 },
                 orderBy: { updatedAt: 'desc' },
-        });
+                skip,
+                take: limit,
+            }),
+            db.workspace.count({ where }),
+        ]);
 
-        const response = successResponse({ workspaces });
+        const response = successResponse(
+            { workspaces },
+            200,
+            {
+                page,
+                limit,
+                total,
+                totalPages: Math.ceil(total / limit),
+            }
+        );
         return withCacheControl(response, 'private, max-age=60, stale-while-revalidate=120');
     } catch (error) {
         console.error('Error fetching workspaces:', error);