fix: add pagination limit validation on trpc endpoints

Author: MohamedBassem

packages/api/middlewares/trpcAdapter.ts

@@ -1,41 +1,26 @@
 import { TRPCError } from "@trpc/server";
+import { getHTTPStatusCodeFromError } from "@trpc/server/http";
 import { createMiddleware } from "hono/factory";
 import { HTTPException } from "hono/http-exception";
 
-function trpcCodeToHttpCode(code: TRPCError["code"]) {
-  switch (code) {
-    case "BAD_REQUEST":
-    case "PARSE_ERROR":
-      return 400;
-    case "UNAUTHORIZED":
-      return 401;
-    case "FORBIDDEN":
-      return 403;
-    case "NOT_FOUND":
-      return 404;
-    case "METHOD_NOT_SUPPORTED":
-      return 405;
-    case "TIMEOUT":
-      return 408;
-    case "PAYLOAD_TOO_LARGE":
-      return 413;
-    case "TOO_MANY_REQUESTS":
-      return 429;
-    case "INTERNAL_SERVER_ERROR":
-      return 500;
-    default:
-      return 500;
-  }
+import type { ContentfulStatusCode } from "hono/utils/http-status";
+
+// trpc maps CLIENT_CLOSED_REQUEST to 499, which isn't part of hono's status
+// code union; everything else it emits is a standard contentful 4xx/5xx.
+function isContentfulStatusCode(
+  status: number,
+): status is ContentfulStatusCode {
+  return status >= 400 && status <= 511 && status !== 499;
 }
 
 const trpcAdapter = createMiddleware(async (c, next) => {
   await next();
   const e = c.error;
   if (e instanceof TRPCError) {
-    const code = trpcCodeToHttpCode(e.code);
+    const status = getHTTPStatusCodeFromError(e);
     const isInternalError = e.code === "INTERNAL_SERVER_ERROR";
     const isProd = process.env.NODE_ENV === "production";
-    throw new HTTPException(code, {
+    throw new HTTPException(isContentfulStatusCode(status) ? status : 500, {
       message: isInternalError && isProd ? "Internal server error" : e.message,
       cause: isInternalError && isProd ? undefined : e.cause,
     });

packages/api/utils/pagination.ts

@@ -4,7 +4,12 @@ import { MAX_NUM_BOOKMARKS_PER_PAGE } from "@karakeep/shared/types/bookmarks";
 import { zCursorV2 } from "@karakeep/shared/types/pagination";
 
 export const zPagination = z.object({
-  limit: z.coerce.number().max(MAX_NUM_BOOKMARKS_PER_PAGE).optional(),
+  limit: z.coerce
+    .number()
+    .int()
+    .min(1)
+    .max(MAX_NUM_BOOKMARKS_PER_PAGE)
+    .optional(),
   cursor: z
     .string()
     .refine((val) => val.includes("_"), "Must be a valid cursor")

packages/open-api/karakeep-openapi-spec.json

@@ -3120,8 +3120,8 @@
           },
           {
             "schema": {
-              "type": "number",
-              "nullable": true
+              "type": "integer",
+              "minimum": 1
             },
             "required": false,
             "name": "limit",

packages/shared/types/bookmarks.ts

@@ -291,7 +291,7 @@ export const zGetBookmarksRequestSchema = z.object({
   tagId: z.string().optional(),
   listId: z.string().optional(),
   rssFeedId: z.string().optional(),
-  limit: z.number().max(MAX_NUM_BOOKMARKS_PER_PAGE).optional(),
+  limit: z.number().int().min(1).max(MAX_NUM_BOOKMARKS_PER_PAGE).optional(),
   cursor: zCursorV2.nullish(),
   // TODO: This was done for backward comptability. At this point, all clients should be settings this to true.
   // The value is currently not being used, but keeping it so that client can still set it to true for older
@@ -361,7 +361,7 @@ export const zBookmarkSearchMode = z.enum(["fts", "semantic", "hybrid"]);
 export type ZBookmarkSearchMode = z.infer<typeof zBookmarkSearchMode>;
 export const zSearchBookmarksRequestSchema = z.object({
   text: z.string(),
-  limit: z.number().max(MAX_NUM_BOOKMARKS_PER_PAGE).optional(),
+  limit: z.number().int().min(1).max(MAX_NUM_BOOKMARKS_PER_PAGE).optional(),
   cursor: zSearchBookmarksCursor.nullish(),
   sortOrder: zSortOrder.optional().default("relevance"),
   searchMode: zBookmarkSearchMode.optional().default("fts"),

packages/shared/types/importSessions.ts

@@ -1,5 +1,8 @@
 import { z } from "zod";
 
+export const DEFAULT_NUM_IMPORT_SESSION_RESULTS_PER_PAGE = 50;
+export const MAX_NUM_IMPORT_SESSION_RESULTS_PER_PAGE = 100;
+
 export const zImportSessionStatusSchema = z.enum([
   "staging",
   "pending",

packages/shared/types/tags.ts

@@ -90,7 +90,7 @@ export const zTagListQueryParamsSchema = z.object({
     })
     .optional()
     .pipe(zTagListRequestSchema.shape.cursor),
-  limit: z.coerce.number().optional(),
+  limit: z.coerce.number().int().min(1).optional(),
 });
 
 export const zTagListApiResultSchema = z.object({

packages/trpc/routers/highlights.ts

@@ -79,7 +79,12 @@ export const highlightsAppRouter = router({
     .input(
       z.object({
         cursor: z.any().nullish(),
-        limit: z.number().optional().default(DEFAULT_NUM_HIGHLIGHTS_PER_PAGE),
+        limit: z
+          .number()
+          .int()
+          .min(1)
+          .optional()
+          .default(DEFAULT_NUM_HIGHLIGHTS_PER_PAGE),
       }),
     )
     .output(zGetAllHighlightsResponseSchema)
@@ -95,7 +100,12 @@ export const highlightsAppRouter = router({
       z.object({
         text: z.string(),
         cursor: zCursorV2.nullish(),
-        limit: z.number().optional().default(DEFAULT_NUM_HIGHLIGHTS_PER_PAGE),
+        limit: z
+          .number()
+          .int()
+          .min(1)
+          .optional()
+          .default(DEFAULT_NUM_HIGHLIGHTS_PER_PAGE),
       }),
     )
     .output(zGetAllHighlightsResponseSchema)

packages/trpc/routers/importSessions.ts

@@ -2,6 +2,8 @@ import { experimental_trpcMiddleware } from "@trpc/server";
 import { z } from "zod";
 
 import {
+  DEFAULT_NUM_IMPORT_SESSION_RESULTS_PER_PAGE,
+  MAX_NUM_IMPORT_SESSION_RESULTS_PER_PAGE,
   zCreateImportSessionRequestSchema,
   zDeleteImportSessionRequestSchema,
   zGetImportSessionStatsRequestSchema,
@@ -141,7 +143,12 @@ export const importSessionsRouter = router({
           .enum(["all", "accepted", "rejected", "skipped_duplicate", "pending"])
           .optional(),
         cursor: z.string().optional(),
-        limit: z.number().default(50),
+        limit: z
+          .number()
+          .int()
+          .min(1)
+          .max(MAX_NUM_IMPORT_SESSION_RESULTS_PER_PAGE)
+          .default(DEFAULT_NUM_IMPORT_SESSION_RESULTS_PER_PAGE),
       }),
     )
     .use(ensureImportSessionAccess)

packages/trpc/routers/publicBookmarks.ts

@@ -1,6 +1,7 @@
 import { z } from "zod";
 
 import {
+  DEFAULT_NUM_BOOKMARKS_PER_PAGE,
   MAX_NUM_BOOKMARKS_PER_PAGE,
   zPublicBookmarkSchema,
   zSortOrder,
@@ -39,7 +40,12 @@ export const publicBookmarks = router({
       z.object({
         listId: z.string(),
         cursor: zCursorV2.nullish(),
-        limit: z.number().max(MAX_NUM_BOOKMARKS_PER_PAGE).default(20),
+        limit: z
+          .number()
+          .int()
+          .min(1)
+          .max(MAX_NUM_BOOKMARKS_PER_PAGE)
+          .default(DEFAULT_NUM_BOOKMARKS_PER_PAGE),
         sortOrder: zSortOrder.exclude(["relevance"]).optional().default("desc"),
       }),
     )