BE-636-api | Various improvements

pkg/api/v1beta1/sort.go

@@ -1,16 +1,26 @@
 package v1beta1
 
 import (
+	fmt "fmt"
 	"strings"
 
 	"github.com/labstack/echo/v4"
 )
 
+var (
+	ErrSortFieldTooLong = fmt.Errorf("too many sort fields")
+)
+
+const (
+	// MaxSortLength is the maximum length of the sort query parameter.
+	MaxSortLength = 1000
+)
+
 const (
 	querySort = "sort"
 )
 
-// IsPresent checks if the pagination request is present in the HTTP request.
+// IsPresent checks if the sort request is present in the HTTP request.
 func (r *SortRequest) IsPresent(c echo.Context) bool {
 	return c.QueryParam(querySort) != ""
 }
@@ -23,6 +33,11 @@ func (r *SortRequest) UnmarshalHTTPRequest(c echo.Context) error {
 		return nil // No sort parameter provided, return early
 	}
 
+	// Prevent extremely long input
+	if len(sortParam) > MaxSortLength {
+		return ErrSortFieldTooLong
+	}
+
 	// Split the `sort` parameter by commas to get individual fields
 	fields := strings.Split(sortParam, ",")
 

pkg/api/v1beta1/sort_test.go

@@ -2,6 +2,7 @@ package v1beta1
 
 import (
 	"net/http/httptest"
+	"strings"
 	"testing"
 
 	"github.com/labstack/echo/v4"
@@ -14,6 +15,7 @@ func TestSortRequestUnmarshalHTTPRequest(t *testing.T) {
 		queryParams    map[string]string
 		expectedFields []*SortField
 		wantErr        bool
+		expectedError  error
 	}{
 		{
 			name:           "No sort parameter",
@@ -47,6 +49,13 @@ func TestSortRequestUnmarshalHTTPRequest(t *testing.T) {
 			},
 			wantErr: false,
 		},
+		{
+			name:           "Sort parameter exceeds maximum length",
+			queryParams:    map[string]string{"sort": strings.Repeat("a", MaxSortLength+1)},
+			expectedFields: nil,
+			wantErr:        true,
+			expectedError:  ErrSortFieldTooLong,
+		},
 	}
 
 	for _, tt := range tests {
@@ -67,6 +76,9 @@ func TestSortRequestUnmarshalHTTPRequest(t *testing.T) {
 
 			if tt.wantErr {
 				assert.Error(t, err)
+				if tt.expectedError != nil {
+					assert.Equal(t, tt.expectedError, err)
+				}
 				return
 			}
 

proto/sqs/query/v1beta1/sort.proto

@@ -18,8 +18,18 @@ message SortField {
   SortDirection direction = 2;
 }
 
-// Sort represents multiple sort fields.
+// SortRequest allows sorting by multiple fields with specified precedence.
+// The sort is applied in the order fields are specified - the first field
+// is the primary sort key, the second field is used for ties, and so on.
+// Example:
+// {
+//   "fields": [
+//     {"field": "liquidity", "direction": "DESCENDING"},
+//     {"field": "volume_24h", "direction": "ASCENDING"}
+//   ]
+// }
 message SortRequest {
   // fields represents list of fields to sort by.
+  // The order of fields determines the sort precedence.
   repeated SortField fields = 1;
 }