fix(gamification): validate leaderboard limit/offset before the SQLite bind (#11059)

⭐5 — LIMIT negativo = "sem limite" no SQLite: ?limit=-1 retornava a leaderboard inteira em endpoint management autenticado; ceil por Math.min só no upper. Duas camadas: route rejeita não-inteiro/fora de range com 400 (mesmo contrato de parseListLimit), getTopN clampeia como backstop defense-in-depth + exporta LEADERBOARD_MAX_LIMIT. TDD red→green, 5 casos novos, 84/84 suíte gamification. Fecha #11058.

src/app/api/gamification/federation/leaderboard/route.ts

@@ -38,7 +38,14 @@ export async function GET(request: NextRequest) {
 
   const url = new URL(request.url);
   const scope: LeaderboardScope = (url.searchParams.get("scope") || "global") as LeaderboardScope;
-  const limit = Number(url.searchParams.get("limit") || 100);
+  const rawLimit = url.searchParams.get("limit");
+  const limit = rawLimit === null ? 100 : Number(rawLimit);
+  if (!Number.isInteger(limit) || limit < 1 || limit > 200) {
+    return NextResponse.json(
+      { error: "'limit' must be an integer between 1 and 200" },
+      { status: 400, headers: CORS_HEADERS }
+    );
+  }
 
   const entries = await getTopN(scope, limit);
 

src/app/api/gamification/leaderboard/route.ts

@@ -18,10 +18,18 @@ export async function GET(request: NextRequest) {
 
   const url = new URL(request.url);
   const scope = (url.searchParams.get("scope") || "global") as LeaderboardScope;
-  const limit = Number(url.searchParams.get("limit") || 50);
+  const rawLimit = url.searchParams.get("limit");
+  const limit = rawLimit === null ? 50 : Number(rawLimit);
   const apiKeyId = url.searchParams.get("apiKeyId");
 
-  const entries = await getTopN(scope, Math.min(limit, 200));
+  if (!Number.isInteger(limit) || limit < 1 || limit > 200) {
+    return NextResponse.json(
+      { error: "'limit' must be an integer between 1 and 200" },
+      { status: 400, headers: CORS_HEADERS }
+    );
+  }
+
+  const entries = await getTopN(scope, limit);
   let myRank: number | null = null;
   let neighbors = null;
 

src/lib/db/gamification.ts

@@ -131,13 +131,24 @@ export function getRank(apiKeyId: string, scope: string): number {
   return rankRow.rank;
 }
 
+export const LEADERBOARD_MAX_LIMIT = 200;
+
 export function getTopN(scope: string, limit: number, offset: number = 0): LeaderboardRow[] {
+  // Guard the SQLite LIMIT/OFFSET bind. A negative LIMIT means "no limit" in
+  // SQLite (returns the whole table), and a non-integer throws a datatype
+  // mismatch, so an unvalidated `?limit` on a caller route (e.g. the leaderboard
+  // endpoints) could read the entire leaderboard or 500. Clamp to a coherent
+  // range here as a defense-in-depth backstop, independent of route validation.
+  const safeLimit = Number.isFinite(limit)
+    ? Math.min(Math.max(Math.trunc(limit), 0), LEADERBOARD_MAX_LIMIT)
+    : 0;
+  const safeOffset = Number.isFinite(offset) ? Math.max(Math.trunc(offset), 0) : 0;
   const rows = db()
     .prepare(
       `SELECT api_key_id, scope, score, updated_at FROM leaderboard
      WHERE scope = ? ORDER BY score DESC LIMIT ? OFFSET ?`
     )
-    .all(scope, limit, offset) as Array<{
+    .all(scope, safeLimit, safeOffset) as Array<{
     api_key_id: string;
     scope: string;
     score: number;