API to pull your potato history#449
Merged
Merged
Conversation
Add GET /api/potatoes returning the authenticated user's individual potato transactions without message content — just id, amount, direction (sent/received), counterparty user_id, and created timestamp. Designed for exporting potato history into external systems for over-time analysis. Query parameters: - page: page number (CakePHP NumericPaginator) - per_page: page size, default 100, capped at 500 - direction: 'sent' or 'received' to filter; omit for both The response wraps items in a 'potatoes' array plus a 'pagination' object (page, per_page, total, total_pages, has_next) so consumers can walk all pages. Only 'page' is allowed as a paginator parameter; sorting is fixed to created DESC. Works with both session auth and the existing Bearer API token authenticator on the /api scope, so external systems can pull data using the token shown on the profile page.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Merged
Messages.created is a datetime without fractional seconds, so multi-recipient potato awards create several rows with identical timestamps. Ordering only by created made page boundaries non-deterministic between requests, which could produce duplicate or missing rows for consumers walking all pages. Flagged by Cursor Bugbot on PR #449.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 6191785. Configure here.
| ->where(['Messages.receiver_user_id' => $this->Authentication->getIdentity()->getIdentifier()]) | ||
| ->orderBy(['Messages.created' => 'DESC']) | ||
| ->disableHydration() | ||
| ->all(); |
There was a problem hiding this comment.
Missing promised history pagination
Medium Severity
The PR describes /api/potatoes as paginated potato history, but list loads every matching sent and received row with no limit, page parameter, or paging metadata. For long-lived accounts that can mean two full unbounded result sets in one response, which undercuts the export/dashboard use case and risks slow or heavy replies as history grows.
Reviewed by Cursor Bugbot for commit 6191785. Configure here.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You can see your potatoes in the app, but there's no way to get them out — say into a spreadsheet or dashboard to watch your potato empire grow over time.
New
/api/potatoesendpoint: every potato you sent or received,paginated(nope),no message content(never stored any) — just when, how many, and with whom. Works with your API token. 🥔📈