Skip to content

API to pull your potato history #449

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cleptric merged 4 commits into from
Jul 15, 2026
Merged

API to pull your potato history #449

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a968bf5
feat(api): add paginated potato history endpoint
HazAT Jul 10, 2026
18cfc12
fix(api): add id tiebreaker to potato history ordering
HazAT Jul 10, 2026
6191785
wip
cleptric Jul 13, 2026
d6d216f
Merge branch 'main' into potato-history-api
cleptric Jul 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions config/routes.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,8 @@
$builder->scope('/api', function (RouteBuilder $builder): void {
$builder->get('/leaderboard', ['prefix' => 'Api', 'controller' => 'LeaderBoard', 'action' => 'get']);

$builder->get('/potatoes', ['prefix' => 'Api', 'controller' => 'Potatoes', 'action' => 'list']);

$builder->get('/users', ['prefix' => 'Api', 'controller' => 'Users', 'action' => 'list']);
$builder->get('/user', ['prefix' => 'Api', 'controller' => 'Users', 'action' => 'get']);
$builder->patch('/user', ['prefix' => 'Api', 'controller' => 'Users', 'action' => 'edit']);
Expand Down
50 changes: 50 additions & 0 deletions src/Controller/Api/PotatoesController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
<?php
declare(strict_types=1);

namespace App\Controller\Api;

use Cake\Http\Response;

/**
* @property \Authentication\Controller\Component\AuthenticationComponent $Authentication
*/
class PotatoesController extends ApiController
{
/**
* @return \Cake\Http\Response
*/
public function list(): Response
{
$messagesTable = $this->fetchTable('Messages');

$sent = $messagesTable->find()
->select([
'amount' => 'Messages.amount',
'recipient' => 'Messages.receiver_user_id',
'created' => 'Messages.created',
])
->where(['Messages.sender_user_id' => $this->Authentication->getIdentity()->getIdentifier()])
->orderBy(['Messages.created' => 'DESC'])
->disableHydration()
->all();

$received = $messagesTable->find()
->select([
'amount' => 'Messages.amount',
'sender' => 'Messages.sender_user_id',
'created' => 'Messages.created',
])
->where(['Messages.receiver_user_id' => $this->Authentication->getIdentity()->getIdentifier()])
->orderBy(['Messages.created' => 'DESC'])
->disableHydration()
->all();

@cursor cursor Bot Jul 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing promised history pagination

Medium Severity

The PR describes /api/potatoes as paginated potato history, but list loads every matching sent and received row with no limit, page parameter, or paging metadata. For long-lived accounts that can mean two full unbounded result sets in one response, which undercuts the export/dashboard use case and risks slow or heavy replies as history grows.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 6191785. Configure here.

@cleptric cleptric Jul 13, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

broken promises


return $this->response
->withStatus(200)
->withType('json')
->withStringBody(json_encode([
'sent' => $sent,
'received' => $received,
]));
}
}
Loading