Fixes

Signed-off-by: AkramBitar <akram@il.ibm.com>

Author: AkramBitar

docs/configuration.md

@@ -604,9 +604,9 @@ token:
 
 ### Optional: token.storage.maxPageSize
 
-Maximum number of rows a single transaction-store read may return. It bounds the
+Maximum number of rows a single transaction-store read may return. It limits the
 pages accepted by transaction queries and caps token-request queries so an
-unbounded scan cannot monopolise database resources. When the key is absent, the
+unlimited scan cannot exhaust database resources. When the key is absent, the
 store default (1000) applies.
 
 ```yaml

docs/services/storage.md

@@ -329,7 +329,7 @@ off). `AddTokenRequest` measures the raw token request plus its metadata;
 transaction and movement records add up their field lengths instead, to keep the
 write path fast.
 
-**Read size limits.** `QueryTransactions` needs a bounded page argument (`nil` and
+**Read size limits.** `QueryTransactions` needs a page with a size limit (`nil` and
 `pagination.None()` are rejected; callers page through the full result set).
 `QueryTokenRequests` adds a hard `LIMIT` equal to `maxPageSize` (default 1000).
 `QueryMovements` is left uncapped on purpose: it feeds balance totals, and dropping

integration/token/fungible/views/history.go

@@ -23,12 +23,18 @@ import (
 	"github.com/hyperledger-labs/fabric-smart-client/platform/view/view"
 )
 
-// historyPageSize bounds each page when listing all transactions; the storage
-// layer rejects unbounded queries, so these views page through the full set.
+// historyPageSize is the number of rows fetched per page when listing all
+// transactions. It must stay <= the store's max page size.
 const historyPageSize = 100
 
 // collectAllTransactions pages through queryPage (one page per call) and returns
 // every record. queryPage runs the underlying query for the given pagination.
+//
+// The storage layer now rejects unlimited queries, so these trusted views can no
+// longer fetch everything in one call. This helper is only that adaptation: it
+// still accumulates the full result set in memory, so it is not itself a memory
+// safeguard. The actual DoS protection (rejecting unlimited scans, hard LIMITs)
+// lives in the storage layer; these views legitimately need the complete list.
 func collectAllTransactions(queryPage func(driver2.Pagination) (iterators.Iterator[*ttxdb.TransactionRecord], error)) ([]*ttxdb.TransactionRecord, error) {
 	var page driver2.Pagination
 	page, err := pagination.Offset(0, historyPageSize)

token/services/storage/db/common/checks.go

@@ -120,7 +120,7 @@ func (a *DefaultCheckers) CheckTransactions(ctx context.Context) ([]string, erro
 		return nil, errors.WithMessagef(err, "failed to get ledger [%s]", tms.ID())
 	}
 
-	// Iterate over transactions one bounded page at a time. A single unbounded
+	// Iterate over transactions one limited page at a time. A single unlimited
 	// query is rejected by the storage layer, so we page through the whole set
 	// using offset pagination and stop once a page comes back short.
 	var page driver2.Pagination

token/services/storage/db/sql/common/transactions.go

@@ -235,7 +235,7 @@ func (db *TransactionStore) QueryMovements(ctx context.Context, params dbdriver.
 }
 
 func (db *TransactionStore) QueryTransactions(ctx context.Context, params dbdriver.QueryTransactionsParams, pagination driver3.Pagination) (*driver3.PageIterator[*dbdriver.TransactionRecord], error) {
-	if err := paginationutil.ValidateBounded(pagination, db.maxPageSize); err != nil {
+	if err := paginationutil.ValidateLimited(pagination, db.maxPageSize); err != nil {
 		return nil, err
 	}
 	transactionsTable, requestsTable := q.Table(db.table.Transactions), q.Table(db.table.Requests)
@@ -314,7 +314,7 @@ func (db *TransactionStore) Notifier() (dbdriver.TransactionNotifier, error) {
 }
 
 // QueryTokenRequests returns an iterator over the token requests matching params,
-// capped at the store's max page size to bound the scan.
+// capped at the store's max page size to limit the scan.
 func (db *TransactionStore) QueryTokenRequests(ctx context.Context, params dbdriver.QueryTokenRequestsParams) (dbdriver.TokenRequestIterator, error) {
 	query, args := q.Select().
 		FieldsByName("tx_id", "request", "status").

…b/sql/common/transactions_bounds_test.go …b/sql/common/transactions_limits_test.gotoken/services/storage/db/sql/common/transactions_bounds_test.go renamed to token/services/storage/db/sql/common/transactions_limits_test.go token/services/storage/db/sql/common/transactions_bounds_test.go renamed to token/services/storage/db/sql/common/transactions_limits_test.go

@@ -19,7 +19,7 @@ import (
 	"github.com/onsi/gomega"
 )
 
-func boundsTestStore(db *sql.DB, opts ...TransactionStoreOption) *TransactionStore {
+func limitsTestStore(db *sql.DB, opts ...TransactionStoreOption) *TransactionStore {
 	store, _ := NewOwnerTransactionStore(db, db, TableNames{
 		Movements:             "MOVEMENTS",
 		Transactions:          "TRANSACTIONS",
@@ -37,7 +37,7 @@ func TestWritePayloadSizeLimit(t *testing.T) {
 	db, mockDB, err := sqlmock.New()
 	gomega.Expect(err).ToNot(gomega.HaveOccurred())
 
-	store := boundsTestStore(db, WithMaxPayloadSize(20))
+	store := limitsTestStore(db, WithMaxPayloadSize(20))
 	mockDB.ExpectBegin()
 	w, err := store.NewTransactionStoreTransaction()
 	gomega.Expect(err).ToNot(gomega.HaveOccurred())
@@ -73,7 +73,7 @@ func TestWritePayloadSizeDisabled(t *testing.T) {
 	db, mockDB, err := sqlmock.New()
 	gomega.Expect(err).ToNot(gomega.HaveOccurred())
 
-	store := boundsTestStore(db, WithMaxPayloadSize(0))
+	store := limitsTestStore(db, WithMaxPayloadSize(0))
 	mockDB.ExpectBegin()
 	mockDB.ExpectExec("INSERT INTO REQUESTS").WillReturnResult(sqlmock.NewResult(1, 1))
 	w, err := store.NewTransactionStoreTransaction()
@@ -84,18 +84,36 @@ func TestWritePayloadSizeDisabled(t *testing.T) {
 	gomega.Expect(mockDB.ExpectationsWereMet()).To(gomega.Succeed())
 }
 
-// TestQueryTransactionsRejectsUnbounded verifies the read guard rejects nil and
-// unbounded (None) pagination without querying the database.
-func TestQueryTransactionsRejectsUnbounded(t *testing.T) {
+// TestQueryTransactionsRejectsUnlimited verifies the read guard rejects nil and
+// unlimited (None) pagination without querying the database.
+func TestQueryTransactionsRejectsUnlimited(t *testing.T) {
 	gomega.RegisterTestingT(t)
 	db, _, err := sqlmock.New()
 	gomega.Expect(err).ToNot(gomega.HaveOccurred())
 
-	store := boundsTestStore(db)
+	store := limitsTestStore(db)
 
 	_, err = store.QueryTransactions(t.Context(), driver.QueryTransactionsParams{}, nil)
 	gomega.Expect(err).To(gomega.HaveOccurred())
 
 	_, err = store.QueryTransactions(t.Context(), driver.QueryTransactionsParams{}, pagination.None())
 	gomega.Expect(err).To(gomega.HaveOccurred())
 }
+
+// TestQueryTokenRequestsAppliesLimit verifies the token-request scan is capped at
+// the store's max page size via a LIMIT clause.
+func TestQueryTokenRequestsAppliesLimit(t *testing.T) {
+	gomega.RegisterTestingT(t)
+	db, mockDB, err := sqlmock.New()
+	gomega.Expect(err).ToNot(gomega.HaveOccurred())
+
+	store := limitsTestStore(db, WithMaxPageSize(500))
+	mockDB.ExpectQuery("SELECT .* FROM REQUESTS .*LIMIT").
+		WithArgs(500).
+		WillReturnRows(sqlmock.NewRows([]string{"tx_id", "request", "status"}))
+
+	it, err := store.QueryTokenRequests(t.Context(), driver.QueryTokenRequestsParams{})
+	gomega.Expect(err).ToNot(gomega.HaveOccurred())
+	it.Close()
+	gomega.Expect(mockDB.ExpectationsWereMet()).To(gomega.Succeed())
+}

token/services/storage/db/sql/query/pagination/validate.go

@@ -11,15 +11,15 @@ import (
 	"github.com/hyperledger-labs/fabric-smart-client/platform/common/driver"
 )
 
-// ValidateBounded rejects pagination that would run an unbounded scan: nil,
+// ValidateLimited rejects pagination that would run an unlimited scan: nil,
 // None(), or an offset whose page size is non-positive or exceeds maxPageSize
-// (capped only when maxPageSize > 0). Empty and keyset pagination are allowed.
-func ValidateBounded(p driver.Pagination, maxPageSize int) error {
+// (limited only when maxPageSize > 0). Empty and keyset pagination are allowed.
+func ValidateLimited(p driver.Pagination, maxPageSize int) error {
 	switch v := p.(type) {
 	case nil:
-		return errors.New("pagination is required: a bounded page must be provided")
+		return errors.New("pagination is required: a page-size limit must be provided")
 	case *none:
-		return errors.New("unbounded pagination (None) is not allowed")
+		return errors.New("unlimited pagination (None) is not allowed")
 	case *empty:
 		return nil
 	case *offset:

token/services/storage/db/sql/query/pagination/validate_test.go

@@ -8,7 +8,7 @@ package pagination
 
 import "testing"
 
-func TestValidateBounded(t *testing.T) {
+func TestValidateLimited(t *testing.T) {
 	off, err := Offset(0, 10)
 	if err != nil {
 		t.Fatalf("unexpected error building offset: %v", err)
@@ -27,13 +27,13 @@ func TestValidateBounded(t *testing.T) {
 		build   func() error
 		wantErr bool
 	}{
-		{"nil is rejected", func() error { return ValidateBounded(nil, 50) }, true},
-		{"None is rejected", func() error { return ValidateBounded(None(), 50) }, true},
-		{"Empty is allowed", func() error { return ValidateBounded(Empty(), 50) }, false},
-		{"bounded offset is allowed", func() error { return ValidateBounded(off, 50) }, false},
-		{"offset over max is rejected", func() error { return ValidateBounded(bigOff, 50) }, true},
-		{"zero page size is rejected", func() error { return ValidateBounded(zeroOff, 50) }, true},
-		{"no max disables the cap", func() error { return ValidateBounded(bigOff, 0) }, false},
+		{"nil is rejected", func() error { return ValidateLimited(nil, 50) }, true},
+		{"None is rejected", func() error { return ValidateLimited(None(), 50) }, true},
+		{"Empty is allowed", func() error { return ValidateLimited(Empty(), 50) }, false},
+		{"offset within the limit is allowed", func() error { return ValidateLimited(off, 50) }, false},
+		{"offset over max is rejected", func() error { return ValidateLimited(bigOff, 50) }, true},
+		{"zero page size is rejected", func() error { return ValidateLimited(zeroOff, 50) }, true},
+		{"no max disables the cap", func() error { return ValidateLimited(bigOff, 0) }, false},
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {