hexclave
diff --git a/‎apps/backend/src/app/api/latest/permission-definitions-pagination.ts‎
Lines changed: 75 additions & 0 deletions b/‎apps/backend/src/app/api/latest/permission-definitions-pagination.ts‎
Lines changed: 75 additions & 0 deletions
diff --git a/‎apps/backend/src/app/api/latest/team-permission-definitions/crud.tsx‎
Lines changed: 8 additions & 8 deletions b/‎apps/backend/src/app/api/latest/team-permission-definitions/crud.tsx‎
Lines changed: 8 additions & 8 deletions
diff --git a/‎apps/backend/src/app/api/latest/users/crud.tsx‎
Lines changed: 9 additions & 5 deletions b/‎apps/backend/src/app/api/latest/users/crud.tsx‎
Lines changed: 9 additions & 5 deletions
@@ -0,0 +1,75 @@
+import { yupNumber, yupObject, yupString } from "@stackframe/stack-shared/dist/schema-fields";
+import { StatusError } from "@stackframe/stack-shared/dist/utils/errors";
+import { stringCompare } from "@stackframe/stack-shared/dist/utils/strings";
+
+// Binary search: index of the first item whose id > cursor, in an
+// array already sorted by `stringCompare(a.id, b.id)`.
+function firstIndexAfter<T extends { id: string }>(sorted: T[], cursor: string): number {
+  let lo = 0;
+  let hi = sorted.length;
+  while (lo < hi) {
+    const mid = (lo + hi) >>> 1;
+    if (stringCompare(sorted[mid].id, cursor) <= 0) lo = mid + 1;
+    else hi = mid;
+  }
+  return lo;
+}
+
+type PermissionDefinition = {
+  id: string,
+  description?: string,
+  contained_permission_ids: string[],
+};
+
+type ListQuery = {
+  limit?: number,
+  cursor?: string,
+  query?: string,
+};
+
+export const permissionDefinitionsListQuerySchema = yupObject({
+  limit: yupNumber().integer().min(1).max(200).optional().meta({ openapiField: { onlyShowInOperations: ['List'], description: "Maximum number of items to return (capped at 200). When set, the response is paginated via cursor." } }),
+  cursor: yupString().optional().meta({ openapiField: { onlyShowInOperations: ['List'], description: "Cursor (permission id) to start the next page from. Requires `limit` to also be set." } }),
+  query: yupString().optional().meta({ openapiField: { onlyShowInOperations: ['List'], description: "Free-text filter applied to permission id and description (case-insensitive)." } }),
+});
+
+export function paginatePermissionDefinitions(items: PermissionDefinition[], query: ListQuery) {
+  if (query.cursor != null && query.limit === undefined) {
+    throw new StatusError(StatusError.BadRequest, "`cursor` requires `limit` to also be set.");
+  }
+
+  const search = query.query?.trim().toLowerCase();
+  const filtered = (search
+    ? items.filter((p) =>
+      p.id.toLowerCase().includes(search)
+      || (p.description?.toLowerCase().includes(search) ?? false))
+    : items.slice()
+  ).sort((a, b) => stringCompare(a.id, b.id));
+
+  if (query.limit === undefined) {
+    return { items: filtered, is_paginated: false as const };
+  }
+
+  let startIdx = 0;
+  if (query.cursor != null) {
+    const cursorIdx = filtered.findIndex((p) => p.id === query.cursor);
+    // If the cursor row was deleted (or filtered out) between page
+    // requests, fall back to "first id strictly greater than the cursor"
+    // rather than 400'ing the client mid-scroll. Worst case the user
+    // sees a one-row gap; the alternative is a hard error on infinite
+    // scroll for any concurrent edit.
+    startIdx = cursorIdx === -1
+      ? firstIndexAfter(filtered, query.cursor)
+      : cursorIdx + 1;
+  }
+  const slice = filtered.slice(startIdx, startIdx + query.limit);
+  const hasMore = startIdx + query.limit < filtered.length;
+
+  return {
+    items: slice,
+    is_paginated: true as const,
+    pagination: {
+      next_cursor: hasMore && slice.length > 0 ? slice[slice.length - 1].id : null,
+    },
+  };
+}
@@ -4,11 +4,13 @@ import { createCrudHandlers } from "@/route-handlers/crud-handler";
 import { teamPermissionDefinitionsCrud } from '@stackframe/stack-shared/dist/interface/crud/team-permissions';
 import { permissionDefinitionIdSchema, yupObject } from "@stackframe/stack-shared/dist/schema-fields";
 import { createLazyProxy } from "@stackframe/stack-shared/dist/utils/proxies";
+import { paginatePermissionDefinitions, permissionDefinitionsListQuerySchema } from "../permission-definitions-pagination";
 
 export const teamPermissionDefinitionsCrudHandlers = createLazyProxy(() => createCrudHandlers(teamPermissionDefinitionsCrud, {
   paramsSchema: yupObject({
     permission_id: permissionDefinitionIdSchema.defined(),
   }),
+  querySchema: permissionDefinitionsListQuerySchema,
   async onCreate({ auth, data }) {
     return await createPermissionDefinition(
       globalPrismaClient,
@@ -48,13 +50,11 @@ export const teamPermissionDefinitionsCrudHandlers = createLazyProxy(() => creat
       }
     );
   },
-  async onList({ auth }) {
-    return {
-      items: await listPermissionDefinitions({
-        scope: "team",
-        tenancy: auth.tenancy,
-      }),
-      is_paginated: false,
-    };
+  async onList({ auth, query }) {
+    const all = await listPermissionDefinitions({
+      scope: "team",
+      tenancy: auth.tenancy,
+    });
+    return paginatePermissionDefinitions(all, query);
   },
 }));
@@ -629,9 +629,13 @@ export const usersCrudHandlers = createLazyProxy(() => createCrudHandlers(usersC
         },
         { projectUserId: sortDirection },
       ],
-      // +1 because we need to know if there is a next page
+      // +1 to detect whether a next page exists without a separate count.
       take: query.limit ? query.limit + 1 : undefined,
+      // Cursor convention (matches teams/crud.tsx): the client sends the
+      // id of the LAST row of the previous page; Prisma starts AT that id,
+      // and `skip: 1` drops it so we don't re-emit it.
       ...query.cursor ? {
+        skip: 1,
         cursor: {
           tenancyId_projectUserId: {
             tenancyId: auth.tenancy.id,
@@ -641,13 +645,13 @@ export const usersCrudHandlers = createLazyProxy(() => createCrudHandlers(usersC
       } : {},
     });
 
+    const items = db.slice(0, query.limit).map((user) => userPrismaToCrud(user, auth.tenancy.config));
+    const hasMore = query.limit != null && db.length > query.limit;
     return {
-      // remove the last item because it's the next cursor
-      items: db.map((user) => userPrismaToCrud(user, auth.tenancy.config)).slice(0, query.limit),
+      items,
       is_paginated: true,
       pagination: {
-        // if result is not full length, there is no next cursor
-        next_cursor: query.limit && db.length >= query.limit + 1 ? db[db.length - 1].projectUserId : null,
+        next_cursor: hasMore && items.length > 0 ? items[items.length - 1].id : null,
       },
     };
   },