feat: harden analytics dashboard

lib/api-params.test.ts

@@ -0,0 +1,45 @@
+import { describe, expect, test } from "bun:test";
+import {
+  parseOptionalInt,
+  parsePositiveInt,
+  parseTimestampRange,
+} from "./api-params";
+
+describe("API parameter parsing", () => {
+  test("uses defaults and clamps positive integer ranges", () => {
+    expect(parsePositiveInt(null, { field: "limit", defaultValue: 50, min: 1, max: 100 })).toEqual({
+      ok: true,
+      value: 50,
+    });
+    expect(parsePositiveInt("500", { field: "limit", defaultValue: 50, min: 1, max: 100 })).toEqual({
+      ok: true,
+      value: 100,
+    });
+    expect(parsePositiveInt("0", { field: "page", defaultValue: 1, min: 1 })).toEqual({
+      ok: true,
+      value: 1,
+    });
+  });
+
+  test("rejects NaN, decimals, and negative values", () => {
+    expect(parseOptionalInt("abc", "start")).toEqual({
+      ok: false,
+      field: "start",
+    });
+    expect(parsePositiveInt("1.5", { field: "page", defaultValue: 1, min: 1 })).toEqual({
+      ok: false,
+      field: "page",
+    });
+    expect(parsePositiveInt("-2", { field: "page", defaultValue: 1, min: 1 })).toEqual({
+      ok: false,
+      field: "page",
+    });
+  });
+
+  test("rejects reversed timestamp ranges", () => {
+    expect(parseTimestampRange(new URLSearchParams("start=200&end=100"))).toEqual({
+      ok: false,
+      field: "range",
+    });
+  });
+});