fix(backend): validate pagination parameters in views endpoint

apps/backend/src/__tests__/analytics.test.ts

@@ -1,4 +1,4 @@
 import {
   describe,
   it,
   expect,
@@ -7,13 +7,13 @@
   vi,
 } from 'vitest';
 
 import Fastify, {
   type FastifyInstance,
 } from 'fastify';
 
 import type { PrismaClient } from '@prisma/client';
 
 import { analyticsRoutes } from '../routes/analytics';
 
 // ─── Shared mock data ────────────────────────────────────────────────────────
 
@@ -34,7 +34,7 @@
 
 // ─── App factory ─────────────────────────────────────────────────────────────
 
 let mockJwtVerify = vi.fn();
 
 async function buildApp(): Promise<FastifyInstance> {
   const app = Fastify({
@@ -188,7 +188,7 @@
 
             expect(
               res.statusCode
             ).toBe(200);
 
             const body =
               res.json();
@@ -427,6 +427,46 @@
           }
         );
 
+        it(
+          '200 — clamps non-numeric page to 1',
+          async () => {
+            prismaMock.cardView.count.mockResolvedValue(0);
+            prismaMock.cardView.findMany.mockResolvedValue([]);
+
+            const res = await app.inject({
+              method: 'GET',
+              url: '/api/analytics/views?page=abc',
+              headers: authHeader(),
+            });
+
+            expect(res.statusCode).toBe(200);
+            expect(
+              prismaMock.cardView.findMany.mock.calls[0][0]
+            ).toMatchObject({ skip: 0, take: 20 });
+            expect(res.json().meta.page).toBe(1);
+          }
+        );
+
+        it(
+          '200 — clamps negative page to 1',
+          async () => {
+            prismaMock.cardView.count.mockResolvedValue(0);
+            prismaMock.cardView.findMany.mockResolvedValue([]);
+
+            const res = await app.inject({
+              method: 'GET',
+              url: '/api/analytics/views?page=-5',
+              headers: authHeader(),
+            });
+
+            expect(res.statusCode).toBe(200);
+            expect(
+              prismaMock.cardView.findMany.mock.calls[0][0]
+            ).toMatchObject({ skip: 0, take: 20 });
+            expect(res.json().meta.page).toBe(1);
+          }
+        );
+
         it(
           '401 — rejects unauthenticated request',
           async () => {

apps/backend/src/routes/analytics.ts

@@ -111,7 +111,7 @@ export async function analyticsRoutes(
       _reply: FastifyReply
     ) => {
       const userId = request.user.id;
-      const page = parseInt(request.query.page || '1', 10);
+      const page = Math.max(1, parseInt(request.query.page || '1', 10) || 1);
       const limit = 20;
       const skip = (page - 1) * limit;