Merge pull request #861 from gloskull/Add-cursor-pagination

Add cursor pagination

Author: greatest0fallt1me

src/routes/users.ts

@@ -238,69 +238,23 @@ usersRouter.get(
       (res.locals.correlationId as string | undefined) ?? getRequestId();
 
     try {
-      const userId = req.user!.id;
-      const result = await getCurrentUserProfile(userId);
-
-      if (!result.ok) {
-        throw result.error;
-      }
-
-      const profile = result.value;
-      logger.info(
-        {
-          correlationId,
-          userId,
-          stellarAddress: profile.stellarAddress,
-          ...profile.totals,
-        },
-        "user_me_profile_loaded",
-      );
-
-      // Strong ETag on the profile payload; 304 if client already has it.
-      const responsePayload = { data: profile };
-      if (conditionalGet(responsePayload, req, res)) return;
-      return res.json(responsePayload);
-    } catch (e) {
-      return next(e);
+      stellarAddressSchema.parse(address);
+    } catch {
+      return res.status(400).json({ error: { code: "invalid_address" } });
     }
   },
 );
 
-// ---------------------------------------------------------------------------
-// GET /api/users/:address/predictions
-// ---------------------------------------------------------------------------
+    const querySchema = z.object({
+      status: z.enum(["pending", "confirmed", "won", "lost", "claimed"]).optional(),
+      cursor: z
+        .string()
+        .regex(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z\|[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i)
+        .optional(),
+      limit: z.coerce.number().int().min(1).max(100),
+    });
 
-/**
- * Returns a cursor-paginated list of predictions for the given Stellar address.
- *
- * Path parameters:
- *   - :address — a valid 56-char Stellar G-address
- *
- * Query parameters:
- *   - status  (optional) — filter by prediction status enum
- *   - cursor  (optional) — opaque base64url token from the previous page's `nextCursor`
- *   - limit   (optional, default 20, max 100) — page size
- *
- * Response:
- *   { data: UserPredictionRow[], nextCursor: string | null }
- *
- * Caching:
- *   Strong ETag on the page payload; clients may revalidate with If-None-Match
- *   and receive 304 Not Modified when the page is unchanged.
- *
- * Errors:
- *   400 invalid_address  — path param is not a valid G… Stellar address
- *   400 validation_error — query params fail the zod schema
- *   404 not_found        — no user row for that address
- */
-usersRouter.get(
-  "/:address/predictions",
-  usersRateLimit,
-  async (req: Request, res: Response, next: NextFunction) => {
-    // Prefer the access-log correlation ID; fall back to ALS for non-route callers.
-    const correlationId =
-      (res.locals.correlationId as string | undefined) ?? getRequestId();
-    const reqId = correlationId;
+    const query = querySchema.parse({ status, cursor, limit });
 
     try {
       // Validate the path parameter :address at the route boundary before touching the DB.

src/services/userService.ts

@@ -1,6 +1,6 @@
 import { db } from "../db/client";
-import { users, predictions } from "../db/schema";
-import { and, eq, desc, count } from "drizzle-orm";
+import { users, predictions, markets, claims } from "../db/schema";
+import { and, eq, desc, lt, count, or } from "drizzle-orm";
 import { Result, ok, err } from "../errors/RouteError";
 import { encodeCursor, decodeCursor, clampLimit, DEFAULT_PAGE_SIZE } from "../utils/cursor";
 
@@ -161,29 +161,20 @@ export async function getUserPredictions(
 ): Promise<Page<UserPredictionRow>> {
   const { status, limit, cursor } = opts;
 
-  // Base conditions — always scope to this user.
-  const baseConditions = [eq(predictions.userId, userId)];
+  const whereConditions = [eq(predictions.userId, userId)];
 
   if (status) {
     baseConditions.push(eq(predictions.status, status));
   }
 
-  // Decode the opaque cursor.  An invalid or version-mismatched token is
-  // treated as absent so a tampered ?cursor= value never causes a 500.
-  const cursorKey = decodeCursor(cursor);
+  if (cursor) {
+    const [cursorTime, cursorId] = cursor.split("|");
+    const cursorCreatedAt = new Date(cursorTime);
 
-  if (cursorKey) {
-    const cursorTime = new Date(cursorKey.sortValue);
-    // Standard two-column keyset predicate for DESC (createdAt, id) ordering:
-    //   rows where createdAt is strictly earlier, OR same timestamp with a
-    //   lexicographically smaller UUID (which is also numerically earlier).
-    baseConditions.push(
+    whereConditions.push(
       or(
-        lt(predictions.createdAt, cursorTime),
-        and(
-          eq(predictions.createdAt, cursorTime),
-          lt(predictions.id, cursorKey.id),
-        ),
+        lt(predictions.createdAt, cursorCreatedAt),
+        and(eq(predictions.createdAt, cursorCreatedAt), lt(predictions.id, cursorId)),
       )!,
     );
   }

tests/users.test.ts

@@ -49,14 +49,17 @@ describe("GET /api/users/:address/predictions", () => {
       indexedLedger: 0,
     });
 
+    const baseTime = new Date("2026-01-01T00:00:00.000Z");
+
     for (let i = 0; i < 25; i++) {
       await db.insert(predictions).values({
+        id: `00000000-0000-4000-8000-${(i + 1).toString().padStart(12, "0")}`,
         marketId: "market-1",
         userId: user!.id,
         outcome: i % 2 === 0 ? "yes" : "no",
         amount: "100",
         status: i < 10 ? "pending" : i < 15 ? "confirmed" : "won",
-        createdAt: new Date(Date.now() - i * 60 * 60 * 1000),
+        createdAt: new Date(baseTime.getTime() - Math.floor(i / 2) * 60 * 60 * 1000),
       });
     }
   });
@@ -70,7 +73,7 @@ describe("GET /api/users/:address/predictions", () => {
 
   it("should return 404 for unknown address", async () => {
     const res = await request(createApp()).get(
-      "/api/users/GBUNKKNOWN000000000000000000000000000000000000000000000000/predictions"
+      `/api/users/${"G" + "A".repeat(55)}/predictions`
     );
     expect(res.status).toBe(404);
     expect(res.body.error.code).toBe("not_found");
@@ -108,6 +111,40 @@ describe("GET /api/users/:address/predictions", () => {
     expect(page2.body.data.length).toBeGreaterThan(0);
   });
 
+
+  it("should not skip predictions that share a cursor timestamp", async () => {
+    const seenIds = new Set<string>();
+    let cursor: string | null = null;
+
+    for (let page = 0; page < 9; page++) {
+      const res = await request(createApp()).get(
+        `/api/users/${testAddress}/predictions?limit=3${cursor ? `&cursor=${encodeURIComponent(cursor)}` : ""}`
+      );
+
+      expect(res.status).toBe(200);
+      for (const prediction of res.body.data) {
+        expect(seenIds.has(prediction.id)).toBe(false);
+        seenIds.add(prediction.id);
+      }
+
+      cursor = res.body.nextCursor;
+      if (!cursor) {
+        break;
+      }
+    }
+
+    expect(seenIds.size).toBe(25);
+  });
+
+  it("should reject malformed cursors", async () => {
+    const res = await request(createApp()).get(
+      `/api/users/${testAddress}/predictions?cursor=not-a-cursor`
+    );
+
+    expect(res.status).toBe(400);
+    expect(res.body.error.code).toBe("validation_error");
+  });
+
   it("should validate address format", async () => {
     const res = await request(createApp()).get(
       "/api/users/invalid-address/predictions"