Merge PR #1001

Author: greatest0fallt1me

src/routes/index.ts

@@ -30,6 +30,7 @@ import { createErrorsRouter } from "./errors.js";
 import { config } from "../config/index.js";
 import { createBillingRateLimitMiddleware } from "../middleware/rateLimit.js";
 import { createAuditRouter } from "./audit.js";
+import { createInvoicesRouter } from "./invoices.js";
 import type { AuditService } from "../services/auditService.js";
 
 const openApiPath = path.join(process.cwd(), "docs/openapi.json");
@@ -56,6 +57,7 @@ export function createApiRouter(deps: ApiRouterDeps = {}): Router {
   router.use("/spike", createSpikeRouter());
   router.use("/errors", createErrorsRouter({ auditService: deps.auditService }));
   router.use("/audit", createAuditRouter({ auditService: deps.auditService }));
+  router.use("/invoices", createInvoicesRouter());
 
   router.use(
     "/apis",

src/routes/invoices.test.ts

@@ -0,0 +1,129 @@
+import express from 'express';
+import request from 'supertest';
+
+// Mock the requireAuth middleware to pass a developerId
+jest.mock('../middleware/requireAuth.js', () => ({
+  requireAuth: (req: express.Request, _res: express.Response, next: express.NextFunction) => {
+    (req as any).developerId = 'dev-user-123';
+    next();
+  }
+}));
+
+import { createInvoicesRouter } from './invoices.js';
+import { errorHandler } from '../middleware/errorHandler.js';
+import prisma from '../lib/prisma.js';
+
+// Mock prisma.invoice.findMany
+jest.mock('../lib/prisma.js', () => ({
+  __esModule: true,
+  default: {
+    invoice: {
+      findMany: jest.fn(),
+    }
+  }
+}));
+
+describe('GET /api/invoices cursor pagination', () => {
+  let app: express.Express;
+  let findManyMock: jest.Mock;
+
+  beforeEach(() => {
+    findManyMock = prisma.invoice.findMany as jest.Mock;
+    findManyMock.mockReset();
+
+    app = express();
+    app.use(express.json());
+    app.use('/api/invoices', createInvoicesRouter());
+    app.use(errorHandler);
+  });
+
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('returns paginated data without cursor', async () => {
+    const mockInvoices = [
+      { id: 'uuid-1', created_at: new Date('2026-07-28T10:00:00Z') },
+      { id: 'uuid-2', created_at: new Date('2026-07-28T09:00:00Z') },
+    ];
+    findManyMock.mockResolvedValue(mockInvoices);
+
+    const res = await request(app).get('/api/invoices?limit=2');
+
+    expect(res.status).toBe(200);
+    expect(res.body.data).toHaveLength(2);
+    expect(res.body.meta.hasMore).toBe(false);
+    expect(res.body.meta.nextCursor).toBeNull();
+    
+    expect(findManyMock).toHaveBeenCalledWith(expect.objectContaining({
+      take: 3, // limit + 1
+      where: { user_id: 'dev-user-123' },
+      orderBy: [{ created_at: 'desc' }, { id: 'desc' }],
+      cursor: undefined,
+    }));
+  });
+
+  it('generates nextCursor when hasMore is true', async () => {
+    const mockInvoices = [
+      { id: 'uuid-1', created_at: new Date('2026-07-28T10:00:00Z') },
+      { id: 'uuid-2', created_at: new Date('2026-07-28T09:00:00Z') },
+      { id: 'uuid-3', created_at: new Date('2026-07-28T08:00:00Z') },
+    ];
+    findManyMock.mockResolvedValue(mockInvoices);
+
+    const res = await request(app).get('/api/invoices?limit=2');
+
+    expect(res.status).toBe(200);
+    expect(res.body.data).toHaveLength(2);
+    expect(res.body.meta.hasMore).toBe(true);
+    
+    // decoded cursor should contain the last item of the current page (uuid-2)
+    const decodedCursor = JSON.parse(Buffer.from(res.body.meta.nextCursor, 'base64').toString('utf-8'));
+    expect(decodedCursor.id).toBe('uuid-2');
+    expect(decodedCursor.created_at).toBe('2026-07-28T09:00:00.000Z');
+  });
+
+  it('queries using cursor when provided', async () => {
+    const cursorData = {
+      id: 'uuid-2',
+      created_at: '2026-07-28T09:00:00.000Z'
+    };
+    const cursorBase64 = Buffer.from(JSON.stringify(cursorData)).toString('base64');
+    findManyMock.mockResolvedValue([]);
+
+    const res = await request(app).get(`/api/invoices?limit=10&cursor=${cursorBase64}`);
+
+    expect(res.status).toBe(200);
+    expect(findManyMock).toHaveBeenCalledWith(expect.objectContaining({
+      cursor: { id: 'uuid-2' } // Should pass only id to prisma cursor
+    }));
+  });
+
+  it('rejects invalid cursor format (not base64 json)', async () => {
+    const res = await request(app).get(`/api/invoices?limit=10&cursor=invalid_base64`);
+    expect(res.status).toBe(400);
+    expect(res.body.message).toContain('Invalid cursor format');
+    expect(findManyMock).not.toHaveBeenCalled();
+  });
+
+  it('rejects valid base64 but invalid schema payload', async () => {
+    const cursorData = { id: 'not-a-uuid' }; // missing created_at and invalid uuid
+    const cursorBase64 = Buffer.from(JSON.stringify(cursorData)).toString('base64');
+
+    const res = await request(app).get(`/api/invoices?cursor=${cursorBase64}`);
+    expect(res.status).toBe(400);
+    expect(res.body.message).toContain('Invalid cursor format');
+  });
+
+  it('rejects invalid limit parameter', async () => {
+    const res = await request(app).get('/api/invoices?limit=500');
+    expect(res.status).toBe(400);
+    expect(res.body.message).toContain('limit must be between 1 and 100');
+  });
+
+  it('handles database errors gracefully', async () => {
+    findManyMock.mockRejectedValue(new Error('DB connection failed'));
+    const res = await request(app).get('/api/invoices');
+    expect(res.status).toBe(500); // Standard error handler should catch it
+  });
+});

src/routes/invoices.ts

@@ -0,0 +1,74 @@
+import { Router } from 'express';
+import { z } from 'zod';
+import prisma from '../lib/prisma.js';
+import { requireAuth } from '../middleware/requireAuth.js';
+import { BadRequestError } from '../errors/index.js';
+
+const cursorSchema = z.object({
+  id: z.string().uuid(),
+  created_at: z.string().datetime(),
+});
+
+export function createInvoicesRouter(): Router {
+  const router = Router();
+
+  router.get('/', requireAuth, async (req, res, next) => {
+    try {
+      const limit = parseInt(req.query.limit as string, 10) || 20;
+      if (limit < 1 || limit > 100) {
+        throw new BadRequestError('limit must be between 1 and 100');
+      }
+
+      let cursorObj: { id: string; created_at: Date } | undefined;
+      if (req.query.cursor && typeof req.query.cursor === 'string') {
+        try {
+          const decoded = Buffer.from(req.query.cursor, 'base64').toString('utf-8');
+          const parsed = cursorSchema.parse(JSON.parse(decoded));
+          cursorObj = { id: parsed.id, created_at: new Date(parsed.created_at) };
+        } catch (e) {
+          throw new BadRequestError('Invalid cursor format');
+        }
+      }
+
+      // Prisma keyset pagination uses the unique identifier `id` as the cursor
+      // but correctly orders by `created_at` and `id` if specified in `orderBy`.
+      const invoices = await prisma.invoice.findMany({
+        where: { user_id: req.developerId },
+        take: limit + 1,
+        orderBy: [
+          { created_at: 'desc' },
+          { id: 'desc' }
+        ],
+        cursor: cursorObj ? { id: cursorObj.id } : undefined,
+      });
+
+      const hasMore = invoices.length > limit;
+      const data = hasMore ? invoices.slice(0, limit) : invoices;
+
+      let nextCursor: string | null = null;
+      if (hasMore) {
+        const lastItem = data[data.length - 1];
+        const cursorData = {
+          created_at: lastItem.created_at.toISOString(),
+          id: lastItem.id,
+        };
+        nextCursor = Buffer.from(JSON.stringify(cursorData)).toString('base64');
+      }
+
+      res.json({
+        data,
+        meta: {
+          limit,
+          hasMore,
+          nextCursor,
+        }
+      });
+    } catch (error) {
+      next(error);
+    }
+  });
+
+  return router;
+}
+
+export default createInvoicesRouter;