diff --git a/apps/api/src/dkv/dto/dkv-history.dto.ts b/apps/api/src/dkv/dto/dkv-history.dto.ts index d441f93..a693c7c 100644 --- a/apps/api/src/dkv/dto/dkv-history.dto.ts +++ b/apps/api/src/dkv/dto/dkv-history.dto.ts @@ -1,4 +1,5 @@ -import { IsInt, IsOptional, Min } from 'class-validator'; +import { Type } from 'class-transformer'; +import { IsInt, IsOptional, Max, Min } from 'class-validator'; /** * Query DTO for paginating the DKV invoice processing history. @@ -13,18 +14,25 @@ export class DkvHistoryQueryDto { /** * Page number (1-based). Defaults to 1 when omitted. * T-07-06: bounded integer prevents negative-page or non-integer injection. + * @Type(() => Number) coerces the query-string string to a number before + * validation — required because HTTP query params always arrive as strings. */ @IsOptional() @IsInt() @Min(1) + @Type(() => Number) page?: number; /** * Number of records per page. Defaults to 20 when omitted. * T-07-06: bounded integer mitigates oversized result-set DoS. + * @Type(() => Number) coerces the query-string string to a number before + * validation — required because HTTP query params always arrive as strings. */ @IsOptional() @IsInt() @Min(1) + @Max(100) + @Type(() => Number) limit?: number; }