feat(api): reject reversed array ranges (RI-8219)

ARGETRANGE / ARSCAN require start <= end. Match that contract at the
API boundary: validate the order in the service and return 400 if
reversed, instead of silently normalizing. Aligns with how every other
Redis range command behaves and removes ambiguity about how a reversed
reply would be ordered or paginated.

Author: pawelangelow

redisinsight/api/.tscheck.rec.json

@@ -370,6 +370,7 @@
     "TS2322": 2
   },
   "src/modules/browser/utils/clusterCursor.ts": {
+    "TS2488": 1,
     "TS7005": 1,
     "TS7034": 1
   },
@@ -1206,9 +1207,6 @@
   "src/modules/redis-sentinel/redis-sentinel.analytics.ts": {
     "TS18048": 1
   },
-  "src/modules/redis/client/ioredis/cluster.ioredis.client.ts": {
-    "TS2488": 1
-  },
   "src/modules/redis/client/ioredis/ioredis.client.ts": {
     "TS2345": 2,
     "TS2532": 1

redisinsight/api/src/constants/error-messages.ts

@@ -80,6 +80,7 @@ export default {
   INCORRECT_CLUSTER_CURSOR_FORMAT: 'Incorrect cluster cursor format.',
   ARRAY_RANGE_TOO_LARGE: (max: number) =>
     `Requested range exceeds the maximum of ${numberWithSpaces(max)} elements per call. Narrow the range and try again.`,
+  ARRAY_RANGE_REVERSED: 'Start index must be less than or equal to end index.',
   REMOVING_MULTIPLE_ELEMENTS_NOT_SUPPORT: () =>
     'Removing multiple elements is available for Redis databases v. 6.2 or later.',
   SCAN_PER_KEY_TYPE_NOT_SUPPORT: () =>

redisinsight/api/src/modules/browser/array/array.service.spec.ts

@@ -212,11 +212,11 @@ describe('ArrayService', () => {
       ).rejects.toThrow(BadRequestException);
     });
 
-    it('should reject when reversed range exceeds the 1M cap', async () => {
+    it('should reject reversed ranges (start > end)', async () => {
       await expect(
         service.getRange(mockBrowserClientMetadata, {
           ...mockGetArrayRangeDto,
-          start: String(ARRAY_RANGE_MAX_ELEMENTS),
+          start: '5',
           end: '0',
         }),
       ).rejects.toThrow(BadRequestException);
@@ -378,11 +378,11 @@ describe('ArrayService', () => {
       ).rejects.toThrow(BadRequestException);
     });
 
-    it('should reject when reversed range exceeds the 1M cap', async () => {
+    it('should reject reversed ranges (start > end)', async () => {
       await expect(
         service.scan(mockBrowserClientMetadata, {
           ...mockGetArrayScanDto,
-          start: String(ARRAY_RANGE_MAX_ELEMENTS),
+          start: '5',
           end: '0',
         }),
       ).rejects.toThrow(BadRequestException);

redisinsight/api/src/modules/browser/array/array.service.ts

@@ -84,15 +84,18 @@ export class ArrayService {
   }
 
   // Inputs are validated as canonical decimal strings ≤ 2^64-1, so BigInt()
-  // is safe. Ranges are reversible (start > end).
-  private assertRangeWithinCap(start: string, end: string): void {
+  // is safe. The contract is start ≤ end — matches every Redis range
+  // command and avoids any ambiguity about how a reversed reply would be
+  // ordered or paginated.
+  private assertValidRange(start: string, end: string): void {
     const startBig = BigInt(start);
     const endBig = BigInt(end);
-    const span =
-      startBig > endBig
-        ? startBig - endBig + BigInt(1)
-        : endBig - startBig + BigInt(1);
 
+    if (startBig > endBig) {
+      throw new BadRequestException(ERROR_MESSAGES.ARRAY_RANGE_REVERSED);
+    }
+
+    const span = endBig - startBig + BigInt(1);
     if (span > BigInt(ARRAY_RANGE_MAX_ELEMENTS)) {
       throw new BadRequestException(
         ERROR_MESSAGES.ARRAY_RANGE_TOO_LARGE(ARRAY_RANGE_MAX_ELEMENTS),
@@ -108,7 +111,7 @@ export class ArrayService {
       this.logger.debug('Getting array range.', clientMetadata);
       const { keyName, start, end } = dto;
 
-      this.assertRangeWithinCap(start, end);
+      this.assertValidRange(start, end);
 
       const client =
         await this.databaseClientFactory.getOrCreateClient(clientMetadata);
@@ -183,10 +186,11 @@ export class ArrayService {
       const { keyName, start, end, limit } = dto;
 
       // ARSCAN skips empty slots in the response but still walks the index
-      // range server-side (O(|end-start|+1)). Apply the same span cap as
-      // ARGETRANGE so an unbounded range cannot tie up Redis even when LIMIT
-      // is omitted; LIMIT remains a complementary result-set cap.
-      this.assertRangeWithinCap(start, end);
+      // range server-side (O(|end-start|+1)). Apply the same range checks
+      // as ARGETRANGE so an unbounded or malformed range cannot tie up
+      // Redis even when LIMIT is omitted; LIMIT remains a complementary
+      // result-set cap.
+      this.assertValidRange(start, end);
 
       const client =
         await this.databaseClientFactory.getOrCreateClient(clientMetadata);

redisinsight/api/src/modules/browser/array/dto/get.array-range.dto.ts

@@ -15,7 +15,7 @@ export class GetArrayRangeDto extends KeyDto {
   @ApiProperty({
     description:
       'End index of the range (inclusive). Unsigned 64-bit integer as string. ' +
-      'If start > end, the range is returned reversed.',
+      'Must be greater than or equal to start.',
     type: String,
     example: '99',
   })

redisinsight/api/src/modules/browser/array/dto/get.array-scan.dto.ts

@@ -16,7 +16,8 @@ export class GetArrayScanDto extends KeyDto {
 
   @ApiProperty({
     description:
-      'End index of the range (inclusive). Unsigned 64-bit integer as string.',
+      'End index of the range (inclusive). Unsigned 64-bit integer as string. ' +
+      'Must be greater than or equal to start.',
     type: String,
     example: '99',
   })