Summary
GET /api/chat/messages parses the limit and offset query params directly with parseInt and passes the results into the Supabase range call. Malformed values such as limit=abc can become NaN, partially numeric values such as limit=1abc are accepted as 1, and negative offsets can build negative ranges.
Impact
Invalid pagination input can produce unexpected message windows or database range errors instead of falling back to safe defaults.
Steps to reproduce
- Authenticate and request /api/chat/messages?conversation_id=&limit=abc&offset=-5
- The route computes invalid pagination values and passes them into .range(offset, offset + limit - 1).
Expected
The API should use safe pagination defaults for malformed values, clamp excessive limits, and never pass negative or NaN values into the database range.
Summary
GET /api/chat/messages parses the limit and offset query params directly with parseInt and passes the results into the Supabase range call. Malformed values such as limit=abc can become NaN, partially numeric values such as limit=1abc are accepted as 1, and negative offsets can build negative ranges.
Impact
Invalid pagination input can produce unexpected message windows or database range errors instead of falling back to safe defaults.
Steps to reproduce
Expected
The API should use safe pagination defaults for malformed values, clamp excessive limits, and never pass negative or NaN values into the database range.