fix(api): reject an undecodable offset cursor on v2 table rows

GET /api/v2/tables/{tableId}/rows coerced an undecodable pagination cursor to
offset 0 and re-served page one. A client paging forward reads that as a fresh
first page and can loop over it forever. Every sibling v2 cursor list — logs,
files, workflows, workflow runs, workflow versions, workspace members, tables,
knowledge documents — already rejects with a validation error instead.

Extracts the offset-cursor decode both offset-paginated v2 routes had inlined
into `decodeOffsetCursor`, next to the existing `decodeSortedCursor`, so the
reject-don't-restart rule has one home.

Author: waleedlatif1

apps/sim/app/api/v2/knowledge/[id]/documents/route.ts

@@ -30,7 +30,7 @@ import { uploadWorkspaceFile } from '@/lib/uploads/contexts/workspace'
 import { MAX_KNOWLEDGE_DOCUMENT_FILE_SIZE } from '@/lib/uploads/shared/types'
 import { validateFileType } from '@/lib/uploads/utils/validation'
 import { serializeDate } from '@/app/api/v1/knowledge/utils'
-import { decodeCursor, encodeCursor } from '@/app/api/v2/lib/response'
+import { decodeOffsetCursor, encodeCursor } from '@/app/api/v2/lib/response'
 
 export const dynamic = 'force-dynamic'
 export const revalidate = 0
@@ -72,25 +72,16 @@ export const GET = defineV2JsonRoute({
   operation: knowledgeOperations.listDocuments,
   rateLimit: v2RateLimits.publicApi,
   errorPolicy: v2KnowledgeErrorPolicies.concealKnowledgeBaseAuthorization,
-  mapInput: ({ params, query }) => {
-    const decodedCursor = query.cursor ? decodeCursor<{ offset: number }>(query.cursor) : null
-    if (
-      query.cursor &&
-      (!decodedCursor || !Number.isInteger(decodedCursor.offset) || decodedCursor.offset < 0)
-    ) {
-      throw new OrchestrationError('validation', 'Invalid cursor')
-    }
-    return {
-      knowledgeBaseId: params.id,
-      assertedWorkspaceId: query.workspaceId,
-      enabledFilter: query.enabledFilter,
-      search: query.search,
-      limit: query.limit,
-      offset: decodedCursor?.offset ?? 0,
-      sortBy: query.sortBy,
-      sortOrder: query.sortOrder,
-    }
-  },
+  mapInput: ({ params, query }) => ({
+    knowledgeBaseId: params.id,
+    assertedWorkspaceId: query.workspaceId,
+    enabledFilter: query.enabledFilter,
+    search: query.search,
+    limit: query.limit,
+    offset: decodeOffsetCursor(query.cursor),
+    sortBy: query.sortBy,
+    sortOrder: query.sortOrder,
+  }),
   useCase: listKnowledgeDocuments,
   present: ({ documents, pagination }) => ({
     data: documents.map(toV2DocumentSummary),

apps/sim/app/api/v2/lib/response.ts

@@ -2,7 +2,11 @@ import { NextResponse } from 'next/server'
 import type { ZodError } from 'zod'
 import { type CursorKey, INVALID_CURSOR_MESSAGE } from '@/lib/api/list-query'
 import { getValidationErrorMessage, serializeZodIssues } from '@/lib/api/server'
-import { asOrchestrationError, type OrchestrationErrorCode } from '@/lib/core/orchestration/types'
+import {
+  asOrchestrationError,
+  OrchestrationError,
+  type OrchestrationErrorCode,
+} from '@/lib/core/orchestration/types'
 import type { RateLimitResult, WorkspaceAccessError } from '@/app/api/v1/middleware'
 
 /**
@@ -158,6 +162,26 @@ export function decodeCursor<T = Record<string, unknown>>(cursor: string): T | n
   }
 }
 
+/**
+ * Reads back an offset cursor minted by `encodeCursor({ offset })`.
+ *
+ * An absent cursor means page one. A cursor that is not valid base64-JSON, or
+ * that does not carry a non-negative integer `offset`, is REJECTED rather than
+ * coerced to 0: silently restarting at page one while the caller believes it is
+ * paging forward makes a paging client loop over the first page forever.
+ *
+ * Throwing an `OrchestrationError('validation')` is what the other v2 cursor
+ * lists do, and the v2 error policies render it as the canonical 400.
+ */
+export function decodeOffsetCursor(cursor: string | undefined): number {
+  if (!cursor) return 0
+  const decoded = decodeCursor<{ offset?: unknown }>(cursor)
+  if (!decoded || !Number.isInteger(decoded.offset) || (decoded.offset as number) < 0) {
+    throw new OrchestrationError('validation', 'Invalid cursor')
+  }
+  return decoded.offset as number
+}
+
 /**
  * The sort a keyset cursor was minted under, as it is written into the cursor
  * payload. Comparing the whole string is what makes a mid-pagination sort

apps/sim/app/api/v2/tables/[tableId]/rows/route.test.ts

@@ -111,8 +111,36 @@ describe('/api/v2/tables/[tableId]/rows', () => {
     })
   })
 
-  it('retains malformed GET cursor fallback compatibility', async () => {
-    const req = request('GET', undefined, `?workspaceId=${WORKSPACE_ID}&limit=25&cursor=malformed`)
+  /**
+   * Coercing an undecodable cursor to offset 0 re-served page one while the
+   * client believed it was paging forward, which loops a paging client forever.
+   * Every sibling v2 cursor list rejects instead, so this one does too.
+   */
+  it.each([
+    ['undecodable base64-JSON', 'malformed'],
+    ['a payload with no offset', Buffer.from(JSON.stringify({ o: 5 })).toString('base64')],
+    ['a non-integer offset', Buffer.from(JSON.stringify({ offset: 1.5 })).toString('base64')],
+    ['a negative offset', Buffer.from(JSON.stringify({ offset: -1 })).toString('base64')],
+  ])('rejects a GET cursor with %s instead of restarting pagination', async (_label, cursor) => {
+    const req = request(
+      'GET',
+      undefined,
+      `?workspaceId=${WORKSPACE_ID}&limit=25&cursor=${encodeURIComponent(cursor)}`
+    )
+    const response = await GET(req, CONTEXT)
+
+    expect(response.status).toBe(400)
+    expect((await response.json()).error).toMatchObject({ message: 'Invalid cursor' })
+    expect(mocks.listRows).not.toHaveBeenCalled()
+  })
+
+  it('resumes at the encoded offset for a well-formed cursor', async () => {
+    const cursor = Buffer.from(JSON.stringify({ offset: 50 })).toString('base64')
+    const req = request(
+      'GET',
+      undefined,
+      `?workspaceId=${WORKSPACE_ID}&limit=25&cursor=${encodeURIComponent(cursor)}`
+    )
     const response = await GET(req, CONTEXT)
 
     expect(response.status).toBe(200)
@@ -122,7 +150,7 @@ describe('/api/v2/tables/[tableId]/rows', () => {
         tableId: 'table-1',
         assertedWorkspaceId: WORKSPACE_ID,
         limit: 25,
-        offset: 0,
+        offset: 50,
       },
       request: req,
     })

apps/sim/app/api/v2/tables/[tableId]/rows/route.ts

@@ -14,7 +14,7 @@ import {
   updateTableRows,
 } from '@/lib/table/application/rows'
 import { namedRowMapper } from '@/lib/table/cell-format'
-import { decodeCursor, encodeCursor } from '@/app/api/v2/lib/response'
+import { decodeOffsetCursor, encodeCursor } from '@/app/api/v2/lib/response'
 import { toApiRow } from '@/app/api/v2/tables/utils'
 
 export const dynamic = 'force-dynamic'
@@ -30,7 +30,7 @@ export const GET = defineV2JsonRoute({
     tableId: params.tableId,
     assertedWorkspaceId: query.workspaceId,
     limit: query.limit,
-    offset: query.cursor ? (decodeCursor<{ offset: number }>(query.cursor)?.offset ?? 0) : 0,
+    offset: decodeOffsetCursor(query.cursor),
   }),
   useCase: listTableRows,
   present: ({ table, rows, nextOffset }) => {