Skip to content

fix(creators): paginate admin applications list and bound digit inputs - #948

Open
mopxam-art wants to merge 1 commit into
Heliobond:mainfrom
mopxam-art:fix/creator-admin-pagination-and-input-bounds
Open

mopxam-art wants to merge 1 commit into
Heliobond:mainfrom
mopxam-art:fix/creator-admin-pagination-and-input-bounds

Conversation

@mopxam-art

Copy link
Copy Markdown

Why

The admin applications review endpoint GET /v1/admin/creators/applications returned the entire collection with no pagination, causing performance degradation as application volume grew. Additionally, GET /v1/creators/applications/:id/create-project-tx accepted arbitrary-length digit strings for sequence and maturity_date without length or value bounds, causing large inputs (such as 400-digit numbers) to overflow Number(maturityRaw) to Infinity and trigger 500 crashes during XDR encoding.

What

  • Added limit (default 20, max 100) and offset (default 0) pagination parameters to GET /v1/admin/creators/applications returning { applications, total, limit, offset, has_more }.
  • Enforced digit length cap (<= 19 characters) on sequence, maturity_date, and whitelister_sequence to prevent overflow and reject invalid inputs with HTTP 400.
  • Validated maturity_date against u64::MAX and Number.MAX_SAFE_INTEGER, returning structured 400 bad request errors instead of 500 runtime exceptions.
  • Hardened buildCreateProjectTx and buildUnsigned in src/lib/creatorOnboarding.ts with explicit input validation throwing CreatorValidationError.
  • Authored comprehensive test suite covering pagination slicing, boundaries, combinatorial parameters, and rejection controls (src/__tests__/creator-admin-pagination-and-bounds.test.ts).

Verified

  • All 117 unit and integration tests pass cleanly (npx jest src/__tests__/creator-admin-pagination-and-bounds.test.ts).
  • Existing creator onboarding test suite passes cleanly (npx jest src/__tests__/creator-onboarding.test.ts).
  • TypeScript compiler clean (npx tsc --noEmit).
  • Codebase linter clean (npm run lint).
  • Production build succeeds (npm run build).

Closes #890

- Add limit and offset pagination parameters to GET /v1/admin/creators/applications with total and has_more
- Enforce length bound (<= 19 digits) and non-negative integer check on sequence and maturity_date strings
- Guard against numeric overflow to Infinity for maturityDate and enforce safe integer limits (400 instead of 500)
- Add comprehensive test matrix covering pagination boundaries, query combinations, and error controls

Closes Heliobond#890
USDC: 0x387c064ccf729a4846b62e95dc6b70e4d4c41e73

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Creator admin list is unbounded and create-project-tx accepts digit strings that overflow to Infinity

1 participant