feat(api): cap the unpaginated template list at 5000 templates

GitOrigin-RevId: b1277f394e581b634dc9e65685b5ebb403b93650

Author: jakubno

packages/api/internal/api/api.gen.go

@@ -1,14 +1,20 @@
 package handlers
 
 import (
+	"fmt"
 	"net/http"
 
 	"github.com/gin-gonic/gin"
 
 	"github.com/e2b-dev/infra/packages/api/internal/api"
+	"github.com/e2b-dev/infra/packages/db/queries"
 	"github.com/e2b-dev/infra/packages/shared/pkg/telemetry"
 )
 
+// templatesUnboundedMaxCount caps GET /templates, which returns every template
+// in one response; larger teams must page through GET /v2/templates.
+const templatesUnboundedMaxCount = 5000
+
 // GetTemplates serves to list templates (e.g. in CLI)
 func (a *APIStore) GetTemplates(c *gin.Context, params api.GetTemplatesParams) {
 	ctx := c.Request.Context()
@@ -34,14 +40,24 @@ func (a *APIStore) GetTemplates(c *gin.Context, params api.GetTemplatesParams) {
 		telemetry.WithTeamID(team.ID.String()),
 	)
 
-	envs, err := a.sqlcDB.GetTeamTemplates(ctx, team.ID)
+	envs, err := a.sqlcDB.GetTeamTemplates(ctx, queries.GetTeamTemplatesParams{
+		TeamID:       team.ID,
+		LimitPlusOne: templatesUnboundedMaxCount + 1,
+	})
 	if err != nil {
 		a.sendAPIStoreError(c, http.StatusInternalServerError, "Error when getting templates")
 		telemetry.ReportCriticalError(ctx, "error when getting templates", err)
 
 		return
 	}
 
+	if len(envs) > templatesUnboundedMaxCount {
+		a.sendAPIStoreError(c, http.StatusBadRequest, fmt.Sprintf("Team has more than %d templates; update to the latest E2B SDK or list them with GET /v2/templates", templatesUnboundedMaxCount))
+		telemetry.ReportEvent(ctx, "template list exceeds the unbounded limit")
+
+		return
+	}
+
 	telemetry.ReportEvent(ctx, "listed environments")
 
 	a.posthog.IdentifyAnalyticsTeam(ctx, team.ID.String(), team.Name)

packages/api/internal/handlers/templates_list.go

@@ -1,12 +1,14 @@
 package handlers
 
 import (
+	"encoding/json"
 	"net/http"
 	"net/http/httptest"
 	"testing"
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	analyticscollector "github.com/e2b-dev/infra/packages/api/internal/analytics_collector"
@@ -63,3 +65,46 @@ func TestTemplateListsAcceptPublicProjectID(t *testing.T) {
 		})
 	}
 }
+
+func TestGetTemplatesRejectsTeamsAboveTheCap(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name      string
+		templates int
+		wantCode  int
+	}{
+		{name: "at the cap", templates: templatesUnboundedMaxCount, wantCode: http.StatusOK},
+		{name: "above the cap", templates: templatesUnboundedMaxCount + 1, wantCode: http.StatusBadRequest},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			db := testutils.SetupDatabase(t)
+			teamID := testutils.CreateTestTeam(t, db)
+			require.NoError(t, db.SqlcClient.TestsRawSQL(t.Context(),
+				`INSERT INTO public.envs (id, team_id, public, updated_at, source)
+				SELECT 'template-' || g, $1, false, NOW(), 'template' FROM generate_series(1, $2::int) AS g`,
+				teamID, tc.templates,
+			))
+
+			posthogClient, err := analyticscollector.NewPosthogClient(t.Context(), "")
+			require.NoError(t, err)
+			store := &APIStore{sqlcDB: db.SqlcClient, posthog: posthogClient}
+
+			recorder := httptest.NewRecorder()
+			c, _ := gin.CreateTestContext(recorder)
+			c.Request = httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/templates", nil)
+			auth.SetTeamInfoForTest(t, c, &types.Team{Team: &authqueries.Team{ID: teamID}})
+
+			store.GetTemplates(c, api.GetTemplatesParams{})
+
+			require.Equal(t, tc.wantCode, recorder.Code, recorder.Body.String())
+			if tc.wantCode == http.StatusOK {
+				var templates []api.Template
+				require.NoError(t, json.Unmarshal(recorder.Body.Bytes(), &templates))
+				assert.Len(t, templates, tc.templates)
+			}
+		})
+	}
+}

packages/api/internal/handlers/templates_list_test.go

@@ -51,7 +51,7 @@ func TestDeleteTemplate_SoftDeletesEnvAndPreservesStructure(t *testing.T) {
 	assert.True(t, testutils.GetEnvBuildByID(t, ctx, db, buildID), "build row must be preserved")
 	assert.NotEmpty(t, testutils.GetBuildAssignments(t, ctx, db, templateID), "build assignment must be preserved")
 
-	templates, err := db.SqlcClient.GetTeamTemplates(ctx, teamID)
+	templates, err := db.SqlcClient.GetTeamTemplates(ctx, queries.GetTeamTemplatesParams{TeamID: teamID, LimitPlusOne: 10})
 	require.NoError(t, err)
 	assert.Empty(t, templates, "soft-deleted template must not be listed")
 

packages/db/pkg/tests/templates/delete_template_test.go

@@ -163,7 +163,7 @@ func TestGetTeamTemplates_AssignmentOrderDifferentFromBuildOrder(t *testing.T) {
 	testutils.CreateTestBuildAssignment(t, ctx, db, templateID, build1ID, "default")
 
 	// GetTeamTemplates should return build1 (latest assignment)
-	results, err := db.SqlcClient.GetTeamTemplates(ctx, teamID)
+	results, err := db.SqlcClient.GetTeamTemplates(ctx, queries.GetTeamTemplatesParams{TeamID: teamID, LimitPlusOne: 10})
 	require.NoError(t, err)
 	require.Len(t, results, 1)
 

packages/db/pkg/tests/templates/template_assignment_ordering_test.go

@@ -35,6 +35,7 @@ LEFT JOIN LATERAL (
     LIMIT 1
 ) eb ON TRUE
 WHERE
-  e.team_id = $1
+  e.team_id = sqlc.arg(team_id)
   AND e.source = 'template'
-ORDER BY e.created_at ASC;
+ORDER BY e.created_at ASC
+LIMIT sqlc.arg(limit_plus_one)::int;

packages/db/queries/get_team_templates.sql

@@ -5008,7 +5008,7 @@ paths:
     get:
       summary: List templates
       x-api-group: list
-      description: List all templates
+      description: List all templates. Returns 400 when the team has more than 5000 templates; use /v2/templates to page through them.
       deprecated: true
       tags: [templates]
       security:
@@ -5035,6 +5035,8 @@ paths:
                 type: array
                 items:
                   $ref: "#/components/schemas/Template"
+        "400":
+          $ref: "#/components/responses/400"
         "401":
           $ref: "#/components/responses/401"
         "429":