databuddy-analytics / databuddy-analytics/Databuddy
fix(api): query pagination accepts non-integer limit/page → fractional OFFSET/LIMIT
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 1.2k
- Forks
- 216
- Avg merge
- 14h 53m
- Merged PRs (30d)
- 154
Description
Describe the bug
POST /v1/query DynamicQueryRequest accepts non-integer limit/page without validation and produces fractional LIMIT/OFFSET that fail ClickHouse Int32 binding.
Affected code:
apps/api/src/schemas/query-schemas.ts:49-50DynamicQueryRequestSchema: t.Optional(t.Number())— nominimum/integerconstraint.apps/api/src/routes/query.ts:294-308validatePaginationFieldsonly checks<1and>10000/<1forpage, notNumber.isInteger/isFinite.apps/api/src/routes/query.ts:1040-1041limit: request.limit || 100,offset: request.page ? (request.page-1)*(request.limit||100) :0→ withlimit=1.5, page=1.5yieldsoffset=0.75(fractional).packages/ai/src/query/simple-builder.ts:1148-1154buildLimitClause/buildOffsetClauseemitLIMIT 1.5 OFFSET 0.75vs. buildersLIMIT {limit:Int32} OFFSET {offset:Int32}(packages/ai/src/query/builders/pages.ts:182,sessions.ts:318, etc.).- Internal
packages/ai/src/query/index.ts:61-62QuerySchema: z.number().min(1).max(1000)also allows floats (missing.int()).
To Reproduce
- Authenticated request:
POST /v1/query?website_id=<id>&timezone=UTC
Content-Type: application/json
{
"parameters": ["top_pages"],
"startDate": "2026-01-01",
"endDate": "2026-01-02",
"limit": 1.5,
"page": 1.5
}
- Also try
{"limit": 0.5},{"page": 1.5},{"limit": 1.5, "page": 2.3}.
Expected behavior
400 VALIDATION_ERROR with details like:
{ "field":"limit", "message":"Limit must be an integer" }
{ "field":"page", "message":"Page must be an integer" }
limit/page should require finite integer, limit 1..10000, page 1...
Actual behavior
No validation error; request reaches ClickHouse with fractional values. Reproduced locally with copy of validatePaginationFields (D:\tmp\repro_pagination.js):
float limit {limit:1.5} => errors=[] limit=1.5 offset=0 BUG non-integer passed
float page {page:1.5} => errors=[] limit=100 offset=50 BUG
both float => offset 0.75 BUG not integer
Infinity/NaN similarly slip through (JSON NaN not encodable but Elysia coercion from query string can produce floats).
buildLimitClause(NaN) → '' (unbounded), buildLimitClause(0) → ''.
Screenshots
N/A
Environment
- OS: Windows, Bun 1.4.2 (
package.json:30bun@1.4.1pinned) - Commit:
92c15273d(origin/staging)
Additional context
limitdefault fallback|| 100masks0/NaNinapps/api/src/routes/query.ts:1040,simple-builder.ts:1149fallback similarly.limitmax mismatch: API allows10000(validatePaginationFields:301), internalQuerySchemaallows1000— not part of this bug but worth aligning.- No existing open issue covers this (checked
gh issue list). - Minimal fix proposal: tighten
DynamicQueryRequestSchema(TypeBoxminimum), addNumber.isInteger/isFiniteinvalidatePaginationFields, add.int()toQuerySchema(packages/ai/src/query/index.ts:61-62), add regression test.
AI disclosure
Issue drafted with assistance from Muse Spark (opencode/muse-spark-1.2-contributor-free) and human-verified via local reproduction (node D:\tmp\repro_pagination.js).
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with DynamicQueryRequestSchema and validatePaginationFields in apps/api/src/schemas/query-schemas.ts and apps/api/src/routes/query.ts, then inspect QuerySchema in packages/ai/src/query/index.ts and the limit/offset builders. Reproduce the fractional inputs described in the issue and add regression coverage. Done means non-finite or non-integer limit/page values receive the expected 400 validation response while valid pagination still builds integer-compatible clauses.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- api, backend, databases, testing-qa
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 76/100