Merge remote-tracking branch 'origin/main'

Author: alexzarbn

src/Contracts/Paginator.php

@@ -6,7 +6,7 @@
 
 interface Paginator
 {
-    public function __construct(int $defaultLimit);
+    public function __construct(int $defaultLimit, int $maxLimit);
 
     public function resolvePaginationLimit(Request $request): int;
 }

src/Drivers/Standard/Paginator.php

@@ -2,6 +2,7 @@
 
 namespace Orion\Drivers\Standard;
 
+use Orion\Exceptions\MaxPaginationLimitExceededException;
 use Orion\Http\Requests\Request;
 
 class Paginator implements \Orion\Contracts\Paginator
@@ -11,14 +12,20 @@ class Paginator implements \Orion\Contracts\Paginator
      */
     protected $defaultLimit;
 
+    /**
+     * @var int $maxLimit
+     */
+    protected $maxLimit;
+
     /**
      * Paginator constructor.
      *
      * @param int $defaultLimit
      */
-    public function __construct(int $defaultLimit)
+    public function __construct(int $defaultLimit, int $maxLimit)
     {
         $this->defaultLimit = $defaultLimit;
+        $this->maxLimit = $maxLimit;
     }
 
     /**
@@ -29,7 +36,11 @@ public function __construct(int $defaultLimit)
      */
     public function resolvePaginationLimit(Request $request): int
     {
-        $limit = (int)$request->get('limit', $this->defaultLimit);
-        return $limit > 0 ? $limit : $this->defaultLimit;
+        $limit = (int)$request->get('limit');
+        return tap($limit > 0 ? $limit : $this->defaultLimit, function ($limit) {
+            if ($limit > $this->maxLimit) {
+                throw new MaxPaginationLimitExceededException(422, __("Pagination limit of :max is exceeded. Current: :limit", ['max' => $this->maxLimit, 'limit' => $limit]));
+            }
+        });
     }
 }

src/Drivers/Standard/ParamsValidator.php

@@ -119,9 +119,9 @@ public function validateAggregators(Request $request): void
                         'regex:/^[\w.\_\-\>]+$/',
                     ],
                     'aggregates.*.field' => [
-                        (float) app()->version() >= 8.32 ? 'prohibited_if:aggregate.*.type,count' : '',
-                        (float) app()->version() >= 8.32 ? 'prohibited_if:aggregate.*.type,exists' : '',
-                        'required_if:aggregate.*.type,avg,sum,min,max',
+                        (float) app()->version() >= 8.32 ? 'prohibited_if:aggregates.*.type,count' : '',
+                        (float) app()->version() >= 8.32 ? 'prohibited_if:aggregates.*.type,exists' : '',
+                        'required_if:aggregates.*.type,avg,sum,min,max',
                     ],
                     'aggregates.*.type' => [
                         'required',

src/Exceptions/MaxPaginationLimitExceededException.php

@@ -0,0 +1,10 @@
+<?php
+
+namespace Orion\Exceptions;
+
+use Symfony\Component\HttpKernel\Exception\HttpException;
+
+class MaxPaginationLimitExceededException extends HttpException
+{
+
+}

src/Http/Controllers/BaseController.php

@@ -127,6 +127,7 @@ public function __construct()
             Paginator::class,
             [
                 'defaultLimit' => $this->limit(),
+                'maxLimit' => $this->maxLimit()
             ]
         );
         $this->searchBuilder = App::makeWith(
@@ -245,6 +246,16 @@ public function limit(): int
         return 15;
     }
 
+    /**
+     * Max pagination limit.
+     *
+     * @return int
+     */
+    public function maxLimit(): int
+    {
+        return 500;
+    }
+
     /**
      * The attributes that are used for searching.
      *

tests/Feature/StandardIndexOperationsTest.php

@@ -5,6 +5,7 @@
 use Illuminate\Support\Facades\Gate;
 use Mockery;
 use Orion\Contracts\ComponentsResolver;
+use Orion\Exceptions\MaxPaginationLimitExceededException;
 use Orion\Tests\Fixtures\App\Http\Resources\SampleCollectionResource;
 use Orion\Tests\Fixtures\App\Http\Resources\SampleResource;
 use Orion\Tests\Fixtures\App\Models\Post;

tests/Unit/Drivers/Standard/PaginatorTest.php

@@ -2,24 +2,29 @@
 
 namespace Orion\Tests\Unit\Drivers\Standard;
 
+use Illuminate\Support\Facades\Gate;
 use Orion\Drivers\Standard\Paginator;
+use Orion\Exceptions\MaxPaginationLimitExceededException;
 use Orion\Http\Requests\Request;
+use Orion\Tests\Fixtures\App\Models\Post;
+use Orion\Tests\Fixtures\App\Models\User;
+use Orion\Tests\Fixtures\App\Policies\GreenPolicy;
 use Orion\Tests\Unit\TestCase;
 
 class PaginatorTest extends TestCase
 {
     /** @test */
     public function resolving_default_pagination_limit()
     {
-        $paginator = new Paginator(15);
+        $paginator = new Paginator(15, 500);
 
         $this->assertSame(15, $paginator->resolvePaginationLimit(Request::create('/api/posts')));
     }
 
     /** @test */
     public function resolving_pagination_limit_from_request()
     {
-        $paginator = new Paginator(15);
+        $paginator = new Paginator(15, 500);
         $request = Request::create('/api/posts');
         $request->query->set('limit', 30);
 
@@ -29,10 +34,22 @@ public function resolving_pagination_limit_from_request()
     /** @test */
     public function falling_back_to_default_pagination_limit()
     {
-        $paginator = new Paginator(15);
+        $paginator = new Paginator(15, 500);
         $request = Request::create('/api/posts');
         $request->query->set('limit', 0);
 
         $this->assertSame(15, $paginator->resolvePaginationLimit($request));
     }
+
+    /** @test */
+    public function getting_a_list_of_resources_with_exceeded_pagination_limit(): void
+    {
+        $paginator = new Paginator(15, 500);
+        $request = Request::create('/api/posts');
+        $request->query->set('limit', 501);
+
+        $this->expectException(MaxPaginationLimitExceededException::class);
+
+        $paginator->resolvePaginationLimit($request);
+    }
 }

tests/Unit/Http/Controllers/BaseControllerTest.php

@@ -41,7 +41,7 @@ public function dependencies_are_resolved_correctly()
         $fakeComponentsResolver = new ComponentsResolver(Post::class);
         $fakeParamsValidator = new ParamsValidator();
         $fakeRelationsResolver = new RelationsResolver([], []);
-        $fakePaginator = new Paginator(15);
+        $fakePaginator = new Paginator(15, 500);
         $fakeSearchBuilder = new SearchBuilder([]);
         $fakeQueryBuilder = new QueryBuilder(Post::class, $fakeParamsValidator, $fakeRelationsResolver, $fakeSearchBuilder);
 
@@ -75,6 +75,7 @@ public function dependencies_are_resolved_correctly()
             \Orion\Contracts\Paginator::class,
             [
                 'defaultLimit' => 15,
+                'maxLimit' => 500,
             ]
         )->once()->andReturn($fakePaginator);
 

tests/Unit/Http/Controllers/RelationControllerTest.php

@@ -34,7 +34,7 @@ public function dependencies_are_resolved_correctly()
         $fakeComponentsResolver = new ComponentsResolver(Post::class);
         $fakeParamsValidator = new ParamsValidator();
         $fakeRelationsResolver = new RelationsResolver([], []);
-        $fakePaginator = new Paginator(15);
+        $fakePaginator = new Paginator(15, 500);
         $fakeSearchBuilder = new SearchBuilder([]);
         $fakeQueryBuilder = new QueryBuilder(Post::class, $fakeParamsValidator, $fakeRelationsResolver, $fakeSearchBuilder);
         $fakeRelationQueryBuilder = new QueryBuilder(User::class, $fakeParamsValidator, $fakeRelationsResolver, $fakeSearchBuilder);
@@ -69,6 +69,7 @@ public function dependencies_are_resolved_correctly()
             \Orion\Contracts\Paginator::class,
             [
                 'defaultLimit' => 15,
+                'maxLimit' => 500,
             ]
         )->once()->andReturn($fakePaginator);