diff options
Diffstat (limited to 'packages/meshbay-hub/src/meshbay_hub/api/notifications.py')
| -rw-r--r-- | packages/meshbay-hub/src/meshbay_hub/api/notifications.py | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/notifications.py b/packages/meshbay-hub/src/meshbay_hub/api/notifications.py index 9d5c125..b5783ab 100644 --- a/packages/meshbay-hub/src/meshbay_hub/api/notifications.py +++ b/packages/meshbay-hub/src/meshbay_hub/api/notifications.py @@ -19,7 +19,7 @@ migration for no gain, and `unread_only` stays because it is what an older interface asks for and it still answers correctly — every row is unread. """ -from fastapi import APIRouter, Depends, HTTPException +from fastapi import APIRouter, Depends, HTTPException, Query from datetime import datetime, timezone from sqlalchemy import delete, func, select @@ -36,8 +36,11 @@ router = APIRouter(prefix="/v1/notifications", tags=["notifications"]) async def list_notifications( current_user: User = Depends(get_current_user), db: AsyncSession = Depends(get_db), - limit: int = 50, - offset: int = 0, + # Bounded like every list in admin.py. These two were not, so one caller + # could ask for the whole table in one query — and a negative limit is a + # 500 on PostgreSQL rather than an empty page. + limit: int = Query(default=50, ge=1, le=200), + offset: int = Query(default=0, ge=0), unread_only: bool = False, ): query = select(Notification).where(Notification.user_id == current_user.id) |