trails-cool/trails
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #445 from trails-cool/fix/planner-api-sessions-limit

Browse source 
fix(planner): bound /api/sessions listing (default 50, max 200)
This commit is contained in:
Ullrich Schäfer 2026-05-26 00:50:35 +02:00 • committed by GitHub
commit 6c5d4e6510
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 16 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

11
apps/planner/app/lib/sessions.ts
View file

@ -106,12 +106,19 @@ export function initializeSessionWithNoGoAreas(
});
}
export async function listSessions(): Promise<SessionMetadata[]> {
// Default page size for the listing API. Hard cap so an unbounded
// caller can't request thousands of rows (or trigger a full scan).
const DEFAULT_LIST_LIMIT = 50;
const MAX_LIST_LIMIT = 200;
export async function listSessions(limit: number = DEFAULT_LIST_LIMIT): Promise<SessionMetadata[]> {
const bounded = Math.min(Math.max(1, limit), MAX_LIST_LIMIT);
return getDb()
.select()
.from(sessions)
.where(eq(sessions.closed, false))
.orderBy(desc(sessions.lastActivity));
.orderBy(desc(sessions.lastActivity))
.limit(bounded);
}
export async function expireSessions(maxAgeDays: number = 7): Promise<number> {

9
apps/planner/app/routes/api.sessions.ts
View file

@ -42,9 +42,14 @@ export async function action({ request }: Route.ActionArgs) {
});
}
export async function loader(_args: Route.LoaderArgs) {
export async function loader({ request }: Route.LoaderArgs) {
return withDb(async () => {
const sessions = await listSessions();
const url = new URL(request.url);
// Accept an explicit `?limit=` but rely on listSessions to clamp
// it to a sane upper bound.
const limitParam = Number(url.searchParams.get("limit"));
const limit = Number.isFinite(limitParam) && limitParam > 0 ? limitParam : undefined;
const sessions = await listSessions(limit);
return data({ sessions });
});
}