address comments

Author: pawelangelow

redisinsight/api/src/modules/browser/array/array.service.spec.ts

@@ -400,15 +400,11 @@ describe('ArrayService', () => {
       ).rejects.toThrow(NotFoundException);
     });
 
-    it('should reject when range exceeds the 1M cap', async () => {
-      await expect(
-        service.scan(mockBrowserClientMetadata, {
-          ...mockGetArrayScanDto,
-          start: '0',
-          end: String(ARRAY_RANGE_MAX_ELEMENTS),
-        }),
-      ).rejects.toThrow(BadRequestException);
-    });
+    // No span cap on scan: ARSCAN skips empty slots server-side and the
+    // sparse-array use case routinely spans far more indexes than it
+    // returns. The DTO caps `limit` at ARRAY_RANGE_MAX_ELEMENTS to keep
+    // result-set size bounded — exercised via DTO validation tests, not
+    // here (the service trusts the DTO).
 
     it('should forward reversed ranges (start > end) to Redis as-is', async () => {
       when(mockStandaloneRedisClient.sendCommand)

redisinsight/api/src/modules/browser/array/array.service.ts

@@ -169,8 +169,10 @@ export class ArrayService {
       this.logger.debug('Scanning array range.', clientMetadata);
       const { keyName, start, end, limit } = dto;
 
-      this.assertValidRange(start, end);
-
+      // No |end - start| span cap here (unlike ARGETRANGE): ARSCAN skips
+      // empty slots server-side and the sparse-array use case routinely
+      // spans far more indexes than it returns. LIMIT (capped on the DTO)
+      // is the natural backpressure on result-set size.
       const client =
         await this.databaseClientFactory.getOrCreateClient(clientMetadata);
       await checkIfKeyNotExists(keyName, client);

redisinsight/api/src/modules/browser/array/constants.ts

@@ -1,4 +1,6 @@
-// Hard cap on the |end - start| + 1 span for ARGETRANGE and ARSCAN, mirrored
-// from the server-side ARGETRANGE limit so callers get a clear 400.
+// Hard cap on result-set size shared by ARGETRANGE (applied as |end - start|
+// + 1 span, since the reply is dense), ARMGET (applied as @ArrayMaxSize on
+// the indexes list), and ARSCAN (applied as @Max on the optional LIMIT).
+// Mirrored from the server-side ARGETRANGE limit so callers get a clear 400.
 // https://redis.io/docs/latest/develop/data-types/arrays/#limits
 export const ARRAY_RANGE_MAX_ELEMENTS = 1_000_000;

redisinsight/api/src/modules/browser/array/dto/get.array-scan.dto.ts

@@ -1,8 +1,9 @@
 import { ApiPropertyOptional, ApiProperty } from '@nestjs/swagger';
 import { KeyDto } from 'src/modules/browser/keys/dto';
 import { IsArrayIndex } from 'src/common/decorators';
-import { IsInt, IsOptional, Min } from 'class-validator';
+import { IsInt, IsOptional, Max, Min } from 'class-validator';
 import { Type } from 'class-transformer';
+import { ARRAY_RANGE_MAX_ELEMENTS } from 'src/modules/browser/array/constants';
 
 export class GetArrayScanDto extends KeyDto {
   @ApiProperty({
@@ -26,14 +27,17 @@ export class GetArrayScanDto extends KeyDto {
 
   @ApiPropertyOptional({
     description:
-      'Maximum number of populated elements to return. ' +
+      'Maximum number of populated elements to return (1..' +
+      `${ARRAY_RANGE_MAX_ELEMENTS.toLocaleString('en-US')}). ` +
       'Maps to the ARSCAN LIMIT option.',
     type: Number,
     minimum: 1,
+    maximum: ARRAY_RANGE_MAX_ELEMENTS,
   })
   @IsOptional()
   @IsInt()
   @Min(1)
+  @Max(ARRAY_RANGE_MAX_ELEMENTS)
   @Type(() => Number)
   limit?: number;
 }