anti
a935bf2663
The other five query endpoints (/logs, /attackers, /attacker-commands,
/bounties, /topologies/{id}) already declared le=2147483647 on offset;
these two were inconsistently uncapped. Bring them in line to close
the F4/D deep-pagination row.
Also resolves F4/T (ORM sort injection — already mitigated by the
regex pattern on /attackers sort_by, no other route accepts a column
name) and F4/D (limit cap — already universal) with code pointers.
40 lines
1.3 KiB
Python
40 lines
1.3 KiB
Python
"""GET /topologies — paginated list of MazeNET topologies."""
|
|
from __future__ import annotations
|
|
|
|
from typing import Optional
|
|
|
|
from fastapi import APIRouter, Depends, Query
|
|
|
|
from decnet.telemetry import traced as _traced
|
|
from decnet.web.db.models import TopologyListResponse, TopologySummary
|
|
from decnet.web.dependencies import repo, require_viewer
|
|
|
|
router = APIRouter()
|
|
|
|
|
|
@router.get(
|
|
"/",
|
|
tags=["MazeNET Topologies"],
|
|
response_model=TopologyListResponse,
|
|
responses={
|
|
400: {"description": "Malformed query parameters"},
|
|
401: {"description": "Missing or invalid credentials"},
|
|
403: {"description": "Insufficient permissions"},
|
|
},
|
|
)
|
|
@_traced("api.topology.list")
|
|
async def api_list_topologies(
|
|
status: Optional[str] = Query(default=None, description="Filter by topology status"),
|
|
limit: int = Query(default=50, ge=1, le=500),
|
|
offset: int = Query(default=0, ge=0, le=2147483647),
|
|
_viewer: dict = Depends(require_viewer),
|
|
) -> TopologyListResponse:
|
|
total = await repo.count_topologies(status=status)
|
|
rows = await repo.list_topologies(status=status, limit=limit, offset=offset)
|
|
return TopologyListResponse(
|
|
total=total,
|
|
limit=limit,
|
|
offset=offset,
|
|
data=[TopologySummary(**r) for r in rows],
|
|
)
|