perf(webapp): clamp list-endpoint page size to 100

Several list endpoints accepted an unbounded page size. The schedules list
was the worst case: it runs two synchronous cron computations per schedule
while building the response (one .map, no await), so a large page became a
long synchronous stall on the event loop. Clamp perPage / per_page / pageSize
to 100 on the schedules, queues, versions, engine-report, and llm-models
endpoints, matching the existing cap on the runs and sessions endpoints.
Oversized requests now return up to 100 items and keep paginating instead of
pulling an unbounded page.

Author: ericallam

.server-changes/cap-list-endpoint-page-size.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: improvement
+---
+
+List API endpoints now clamp the page size to a maximum of 100. Requests asking for a larger page size return up to 100 items and keep paginating, rather than pulling an unbounded page.

apps/webapp/app/routes/admin.api.v1.environments.$environmentId.engine.report.ts

@@ -13,7 +13,12 @@ const ParamsSchema = z.object({
 const SearchParamsSchema = z.object({
   verbose: z.string().default("0"),
   page: z.coerce.number().optional(),
-  per_page: z.coerce.number().optional(),
+  per_page: z.coerce
+    .number()
+    .int()
+    .positive()
+    .transform((n) => Math.min(n, 100))
+    .optional(),
 });
 
 export async function loader({ request, params }: LoaderFunctionArgs) {

apps/webapp/app/routes/admin.api.v1.llm-models.ts

@@ -9,7 +9,10 @@ export async function loader({ request }: LoaderFunctionArgs) {
 
   const url = new URL(request.url);
   const page = parseInt(url.searchParams.get("page") ?? "1");
-  const pageSize = parseInt(url.searchParams.get("pageSize") ?? "50");
+  const pageSize = Math.max(
+    1,
+    Math.min(parseInt(url.searchParams.get("pageSize") ?? "50") || 50, 100)
+  );
 
   const [models, total] = await Promise.all([
     prisma.llmModel.findMany({

apps/webapp/app/routes/api.v1.queues.ts

@@ -12,7 +12,12 @@ import { ServiceValidationError } from "~/v3/services/baseService.server";
 
 const SearchParamsSchema = z.object({
   page: z.coerce.number().int().positive().optional(),
-  perPage: z.coerce.number().int().positive().optional(),
+  perPage: z.coerce
+    .number()
+    .int()
+    .positive()
+    .transform((n) => Math.min(n, 100))
+    .optional(),
 });
 
 export const loader = createLoaderApiRoute(

apps/webapp/app/routes/api.v1.schedules.ts

@@ -12,7 +12,12 @@ import { UpsertTaskScheduleService } from "~/v3/services/upsertTaskSchedule.serv
 
 const SearchParamsSchema = z.object({
   page: z.coerce.number().int().positive().optional(),
-  perPage: z.coerce.number().int().positive().optional(),
+  perPage: z.coerce
+    .number()
+    .int()
+    .positive()
+    .transform((n) => Math.min(n, 100))
+    .optional(),
 });
 
 export async function action({ request }: ActionFunctionArgs) {

apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.queues.ts

@@ -9,7 +9,11 @@ import { EnvironmentParamSchema } from "~/utils/pathBuilder";
 const SearchParamsSchema = z.object({
   query: z.string().optional(),
   page: z.coerce.number().min(1).default(1),
-  per_page: z.coerce.number().min(1).default(20),
+  per_page: z.coerce
+    .number()
+    .min(1)
+    .transform((n) => Math.min(n, 100))
+    .default(20),
   type: z.enum(["task", "custom"]).optional(),
 });
 

apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.versions.ts

@@ -8,7 +8,11 @@ import { EnvironmentParamSchema } from "~/utils/pathBuilder";
 
 const SearchParamsSchema = z.object({
   query: z.string().optional(),
-  per_page: z.coerce.number().min(1).default(25),
+  per_page: z.coerce
+    .number()
+    .min(1)
+    .transform((n) => Math.min(n, 100))
+    .default(25),
 });
 
 export async function loader({ request, params }: LoaderFunctionArgs) {