fix(search): enforce pagination bounds on search list endpoints

src/search/dto/pagination.dto.ts

@@ -0,0 +1,20 @@
+import { Type } from 'class-transformer';
+import { IsInt, IsOptional, Max, Min } from 'class-validator';
+import { ApiPropertyOptional } from '@nestjs/swagger';
+
+export class PaginationDto {
+  @ApiPropertyOptional({ description: 'The page number', default: 1, minimum: 1 })
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  page?: number = 1;
+
+  @ApiPropertyOptional({ description: 'The maximum number of results (max 100)', default: 20, minimum: 1, maximum: 100 })
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  @Max(100)
+  limit?: number = 20;
+}

src/search/search.controller.ts

@@ -3,6 +3,7 @@
 import { Throttle } from '@nestjs/throttler';
 import { THROTTLE } from '../common/constants/throttle.constants';
 import { SearchService } from './search.service';
+import { PaginationDto } from './dto/pagination.dto';
 
 @ApiTags('Search')
 @Throttle({ default: THROTTLE.SEARCH })
@@ -29,8 +30,8 @@
     example: '{"category":"programming","level":"beginner"}',
   })
   @ApiQuery({ name: 'sort', required: false, example: 'relevance' })
-  @ApiQuery({ name: 'page', required: false, example: 1 })
-  @ApiQuery({ name: 'limit', required: false, example: 20 })
+  @ApiQuery({ name: 'page', required: false, description: 'The page number. Default is 1.', example: 1, type: Number })
+  @ApiQuery({ name: 'limit', required: false, description: 'The maximum number of results. Default is 20. Max is 100.', example: 20, type: Number })
   @ApiResponse({
     status: 200,
     description: 'Search results',
@@ -49,10 +50,9 @@
   @ApiResponse({ status: 503, description: 'Search is temporarily unavailable' })
   async search(
     @Query('q') query: string,
+    @Query() paginationDto: PaginationDto,
     @Query('filters') filters?: string,
     @Query('sort') sort?: string,
-    @Query('page') page?: string,
-    @Query('limit') limit?: string,
   ): Promise<any> {
     let parsedFilters: Record<string, any> = {};
     if (filters) {
@@ -63,8 +63,8 @@
       }
     }
 
-    const pageNum = page ? parseInt(page, 10) : 1;
-    const limitNum = limit ? parseInt(limit, 10) : 20;
+    const pageNum = paginationDto.page ?? 1;
+    const limitNum = paginationDto.limit ?? 20;
 
     return this.searchService.search(query, parsedFilters, sort, pageNum, limitNum);
   }