fix(svc): clamp client list limits to a server ceiling #24

Merged

nalum merged 1 commit from fix/list-limit-ceiling into main

2026-08-13 11:38:29 +00:00

nalum commented

2026-08-13 10:08:12 +00:00

Owner

Client-supplied list limits passed straight through to the table layer, and limit 0 meant unbounded. All eight List RPCs now clamp to a server ceiling (svc.MaxListLimit = 500):

svc.List clamps every limit it receives; apikey and webhook handlers (which bypassed svc.List) clamp at the handler.
Internal everything-reads move to an explicit svc.ListAll (event occurrence expansion would otherwise silently cap at 500); Table.List(0) callers in hydrate/notify/dispatcher/export are untouched.
sqlmock tests pin the SQL: limit 0 → 500, above-ceiling → 500, small limits honoured, ListAll emits no LIMIT clause.

Fixes #18

🤖 Generated with Claude Code

Client-supplied list limits passed straight through to the table layer, and `limit 0` meant unbounded. All eight List RPCs now clamp to a server ceiling (`svc.MaxListLimit = 500`): - `svc.List` clamps every limit it receives; apikey and webhook handlers (which bypassed `svc.List`) clamp at the handler. - Internal everything-reads move to an explicit `svc.ListAll` (event occurrence expansion would otherwise silently cap at 500); `Table.List(0)` callers in hydrate/notify/dispatcher/export are untouched. - sqlmock tests pin the SQL: limit 0 → 500, above-ceiling → 500, small limits honoured, `ListAll` emits no LIMIT clause. Fixes #18 🤖 Generated with [Claude Code](https://claude.com/claude-code)

nalum added 1 commit

2026-08-13 10:08:12 +00:00

fix(svc): clamp client list limits to a server ceiling

check / go (push) Successful in 2m8s

Details

check / web (push) Successful in 1m23s

Details

8954569099

Every entity List RPC passed the client-supplied limit straight to the
table, where 0 means unbounded — any authenticated client could drag a
full table through the interceptors in one call. Only AuditLog clamped
server-side. This generalises that pattern at the svc seam: svc.List now
routes the limit through ClampListLimit (limit <= 0 or above
MaxListLimit, 500, becomes the ceiling), and the two handlers that hit
the table directly (api keys, webhooks) clamp the same way.

Internal everything-reads are deliberately untouched: occurrence
expansion moves to a new svc.ListAll that stays unbounded, and callers
of Table.List(0) (hydration, notify, webhook dispatch, export) keep the
table semantics — the ceiling applies only where a client-supplied
number enters.

Fixes #18

nalum force-pushed fix/list-limit-ceiling from 8954569099

check / go (push) Successful in 2m8s

Details

check / web (push) Successful in 1m23s

Details

to 3f1925a0ff

tag / tag (push) Has been cancelled

Details

check / go (push) Successful in 1m48s

Details

check / web (push) Successful in 1m24s

Details