address coderabbit review

Signed-off-by: Jordan Dubrick <jdubrick@redhat.com>

Author: Jdubrick

src/utils/saved_prompts.py

@@ -2,6 +2,7 @@
 
 from sqlalchemy.exc import IntegrityError
 
+import constants
 from app.database import get_session
 from log import get_logger
 from models.database.saved_prompts import SavedPrompt
@@ -142,7 +143,7 @@ def create_saved_prompt(
     Raises:
         SavedPromptLimitExceededError: If the user is already at the limit.
         SavedPromptConflictError: If insert violates a unique constraint
-            (typically duplicate ``(user_id, name)``).
+            (practically always duplicate ``(user_id, name)``).
     """
     with get_session() as session:
         current_count = session.query(SavedPrompt).filter_by(user_id=user_id).count()
@@ -177,6 +178,9 @@ def create_saved_prompt(
 def list_saved_prompts_by_user(user_id: str) -> list[SavedPrompt]:
     """List saved prompts for a user ordered by created_at descending.
 
+    Results are capped at ``SAVED_PROMPTS_MAX_PER_USER_UPPER_BOUND`` so a
+    misconfigured or out-of-band insert path cannot materialize unbounded rows.
+
     Parameters:
         user_id: Owner whose prompts should be returned.
 
@@ -189,6 +193,7 @@ def list_saved_prompts_by_user(user_id: str) -> list[SavedPrompt]:
             session.query(SavedPrompt)
             .filter_by(user_id=user_id)
             .order_by(SavedPrompt.created_at.desc())
+            .limit(constants.SAVED_PROMPTS_MAX_PER_USER_UPPER_BOUND)
             .all()
         )
 

tests/unit/utils/test_saved_prompts.py

@@ -25,6 +25,7 @@
     validate_saved_prompt_name,
     validate_saved_prompt_quota,
 )
+from utils.suid import get_suid
 
 
 @pytest.fixture(name="sqlite_engine")
@@ -60,6 +61,11 @@ def patch_saved_prompts_get_session_fixture(
     )
 
     def _get_session() -> Session:
+        """Create a Session bound to the in-memory test engine.
+
+        Returns:
+            Session: A new SQLAlchemy session for patched DAL calls.
+        """
         return session_factory()
 
     mocker.patch("utils.saved_prompts.get_session", side_effect=_get_session)
@@ -330,6 +336,32 @@ def test_list_returns_only_that_users_prompts_ordered_by_created_at_desc(
         assert [p.id for p in results] == [newer.id, older.id]
         assert all(p.user_id == "user-1" for p in results)
 
+    def test_list_caps_at_configured_upper_bound(
+        self, mocker: MockerFixture, sqlite_engine: Engine
+    ) -> None:
+        """Test list applies SAVED_PROMPTS_MAX_PER_USER_UPPER_BOUND as a hard cap."""
+        mocker.patch(
+            "utils.saved_prompts.constants.SAVED_PROMPTS_MAX_PER_USER_UPPER_BOUND",
+            2,
+        )
+        session_factory = sessionmaker(
+            autocommit=False, autoflush=False, bind=sqlite_engine
+        )
+        with session_factory() as session:
+            for index in range(3):
+                session.add(
+                    SavedPrompt(
+                        id=get_suid(),
+                        user_id="user-1",
+                        name=f"prompt-{index}",
+                        content=f"content-{index}",
+                    )
+                )
+            session.commit()
+
+        results = list_saved_prompts_by_user("user-1")
+        assert len(results) == 2
+
 
 @pytest.mark.usefixtures("patch_saved_prompts_get_session")
 class TestDeleteSavedPromptByIdAndUser: