From 758c7087660a9f51c2a370e158a1e039efe68652 Mon Sep 17 00:00:00 2001 From: Marcel Date: Mon, 20 Apr 2026 21:09:10 +0200 Subject: [PATCH] test(documents): lock /incomplete size cap at 200 Regression test proving the controller clamps client-supplied size values server-side, closing the unbounded-limit concern Markus flagged. Co-Authored-By: Claude Opus 4.7 (1M context) --- .../controller/DocumentControllerTest.java | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/backend/src/test/java/org/raddatz/familienarchiv/controller/DocumentControllerTest.java b/backend/src/test/java/org/raddatz/familienarchiv/controller/DocumentControllerTest.java index 4e6c9c04..f226f8f4 100644 --- a/backend/src/test/java/org/raddatz/familienarchiv/controller/DocumentControllerTest.java +++ b/backend/src/test/java/org/raddatz/familienarchiv/controller/DocumentControllerTest.java @@ -421,6 +421,17 @@ class DocumentControllerTest { .andExpect(status().isForbidden()); } + @Test + @WithMockUser(authorities = "WRITE_ALL") + void getIncomplete_capsSizeAt200() throws Exception { + when(documentService.findIncompleteDocuments(anyInt())).thenReturn(List.of()); + + mockMvc.perform(get("/api/documents/incomplete").param("size", "9999")) + .andExpect(status().isOk()); + + verify(documentService).findIncompleteDocuments(200); + } + // ─── GET /api/documents/incomplete/next ────────────────────────────────── @Test