Skip to content

fix(validation): reject non-positive page/limit in pagination query schemas#1271

Open
abhay-codes07 wants to merge 1 commit into
supermemoryai:mainfrom
abhay-codes07:fix/pagination-schema-bounds
Open

fix(validation): reject non-positive page/limit in pagination query schemas#1271
abhay-codes07 wants to merge 1 commit into
supermemoryai:mainfrom
abhay-codes07:fix/pagination-schema-bounds

Conversation

@abhay-codes07

Copy link
Copy Markdown
Contributor

What

Both pagination query schemas in @repo/validation validate only the upper bound, so malformed pagination passes the API's source-of-truth validation and flows into the query layer instead of failing with a clean 400:

  • ListMemoriesQuerySchema guards its string branch with /^\d+$/ (which still admits "0"), but the z.number() branch accepts anything: { page: -1, limit: -5 } and fractional values like 2.5 all parse successfully. Only limit > 1100 is rejected.
  • DocumentsWithMemoriesQuerySchema — the input schema for POST /documents/documents, which the web app and MCP both use — has bare z.number() for page and limit with no bounds at all.

Fix

Require page and limit to be positive integers in both schemas:

  • ListMemoriesQuerySchema: a Number.isInteger(value) && value >= 1 refine on both fields, ahead of the existing 1100 cap
  • DocumentsWithMemoriesQuerySchema: .int().min(1) on both

Defaults (page: 1, limit: 10), the numeric-string branch, and the 1100 cap are unchanged. No new upper bound is added to the documents schema, since existing web flows legitimately request large pages.

Testing

  • New bun test cases in packages/validation/api.test.ts: defaults preserved, numeric and numeric-string acceptance, the 1100 cap, and rejection of zero/negative/fractional page/limit on both schemas — 27 pass
  • tsc --noEmit -p packages/validation — clean
  • biome check on both files — clean

…chemas

Both pagination query schemas validated only the upper bound, so
malformed pagination flowed straight through the API's source-of-truth
validation into the query layer instead of failing with a clean 400:

- ListMemoriesQuerySchema guards its string branch with /^\d+$/ (which
  still admits "0"), but the z.number() branch accepted any number:
  { page: -1, limit: -5 } and fractional values like 2.5 parsed
  successfully; only limit > 1100 was rejected
- DocumentsWithMemoriesQuerySchema (the input schema for
  POST /documents/documents) had bare z.number() for both page and
  limit with no bounds at all

Require page and limit to be positive integers in both schemas. The
1100 limit cap and all defaults are unchanged, and no new upper bound
is introduced for the documents schema since existing web flows
legitimately request large pages.

Covered with bun tests: defaults, numeric and numeric-string
acceptance, the 1100 cap, and rejection of zero/negative/fractional
values on both schemas.
Copilot AI review requested due to automatic review settings July 12, 2026 20:17

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants