Harden Clip public browse pagination

Co-Authored-By: Paperclip <noreply@paperclip.ing>

server/src/__tests__/clips-routes.test.ts

@@ -5,6 +5,7 @@ import { clipRoutes } from "../routes/clips.js";
 import { errorHandler } from "../middleware/index.js";
 
 const mockClipService = vi.hoisted(() => ({
+  listPublic: vi.fn(),
   getPublicDetail: vi.fn(),
   getPublicRevision: vi.fn(),
   getCreatorPublicProfile: vi.fn(),
@@ -168,6 +169,21 @@ describe("clip routes", () => {
     vi.clearAllMocks();
   });
 
+  it("ignores non-finite public browse pagination params", async () => {
+    mockClipService.listPublic.mockResolvedValue([]);
+
+    const res = await request(createApp()).get("/api/public/clips?limit=abc&offset=NaN");
+
+    expect(res.status).toBe(200);
+    expect(mockClipService.listPublic).toHaveBeenCalledWith({
+      q: null,
+      type: null,
+      tag: null,
+      limit: undefined,
+      offset: undefined,
+    });
+  });
+
   it("normalizes public publish moderation and trust states before persistence", async () => {
     const companyId = "11111111-1111-4111-8111-111111111111";
     const clipId = "22222222-2222-4222-8222-222222222222";

server/src/routes/clips.ts

@@ -260,8 +260,10 @@ export function clipRoutes(db: Db, storage?: StorageService) {
     const q = typeof req.query.q === "string" ? req.query.q : null;
     const type = typeof req.query.type === "string" ? req.query.type : null;
     const tag = typeof req.query.tag === "string" ? req.query.tag : null;
-    const limit = typeof req.query.limit === "string" ? Number(req.query.limit) : undefined;
-    const offset = typeof req.query.offset === "string" ? Number(req.query.offset) : undefined;
+    const limitRaw = typeof req.query.limit === "string" ? Number(req.query.limit) : undefined;
+    const offsetRaw = typeof req.query.offset === "string" ? Number(req.query.offset) : undefined;
+    const limit = limitRaw !== undefined && Number.isFinite(limitRaw) ? limitRaw : undefined;
+    const offset = offsetRaw !== undefined && Number.isFinite(offsetRaw) ? offsetRaw : undefined;
     res.json(await svc.listPublic({ q, type, tag, limit, offset }));
   });