fix: Validate every paginated request like the original request - #1009
Open
razor-x wants to merge 5 commits into
Open
fix: Validate every paginated request like the original request#1009razor-x wants to merge 5 commits into
razor-x wants to merge 5 commits into
Conversation
The paginator rebuilt each page request with only the pathname, method, response key, and data, dropping the request parameters and validation configuration, so required parameter checks were skipped for every paginated fetch including the first page. A cursor was also dropped entirely when the original request had no params or body. Build each page through a new SeamHttpRequest.withPageCursor, which copies the entire request configuration and merges the page cursor into the params or body chosen by the request method. New configuration fields now travel to page requests automatically instead of being hand-copied in the paginator. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01B8xeJm2Hd923k8uo6eoFd2
razor-x
commented
Aug 24, 2026
…lidation Resolves the conflict with the malformed response guards and completes the removal of the unused paginator constructor parameter: the generated createPaginator methods now construct SeamPaginator with the request only, and the unused parent interface is gone. The fake does not return a pagination object for /access_codes/list, so the valid parameters test now pins that endpoint with a mock. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01B8xeJm2Hd923k8uo6eoFd2
Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01B8xeJm2Hd923k8uo6eoFd2
…x115l-m11a-paginator-validation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
SDK audit finding M11a (medium):
SeamPaginatorrebuilt each page request with onlypathname,method,responseKey, and the data — droppingparameters,hasRequiredParameters, andrequiredParameterNames. Every paginated fetch, including the first page, skipped the required-parameter validation that the direct call performs, so an invalid paginated request fired a wasted real network request instead of failing locally. The field-by-field copy is also exactly the hand-copied-signature drift trap the PHP audit notes warn about — any new request-config field would be silently dropped by the paginator.Fix
Add
SeamHttpRequest.withPageCursor(pageCursor): returns a copy of the request with the entire configuration carried over and the page cursor merged into the params or body chosen by the request method. The paginator builds every page through it. New config fields now travel to page requests automatically.Note: because
withPageCursorbuilds the request data unconditionally, this also covers the no-arguments cursor-drop fixed minimally in #1003 — the two branches overlap onSeamPaginator.#fetchand whichever merges second is a trivial rebase (this version is a superset).Tests
accessCodes.list({})rejects locally withAt least one parameter is required for /access_codes/listand zero requests hit the wire (on reverted source, the request goes to the network — the audit's symptom)accessCodes.list({ device_id })fetches normallyFull suite (127 tests), lint, typecheck green.
Part of applying the rev-3 SDK audit (one PR per finding). Related: #1002–#1008, overlaps #1003.
🤖 Generated with Claude Code
https://claude.ai/code/session_01B8xeJm2Hd923k8uo6eoFd2
Generated by Claude Code