Validate a paged API request with bounded filters and server-owned context
Validate a small paging request at runtime, reject unsupported filters, and pass only reconstructed allowed fields to an SDK adapter. The actual API read needs a declared target endpoint.
In this guide
Define a narrow request shape
Start with one resource and an allowlist of filters. Validate page number and page size before making a request. The account, Store, or permission context should come from the server session or signed request, never from an arbitrary client-supplied identifier.
TypeScript types alone do not validate JSON received at runtime. This function accepts unknown input, rejects extra fields and unsupported status values, bounds safe integer paging values, and returns a new object. The sample caps are application choices, not platform limits.
pagedRead.ts typescript
type PageRequest = {
page: number;
pageSize: number;
status?: 'active' | 'archived';
};
export function normalizePage(input: unknown): PageRequest {
if (typeof input !== 'object' || input === null || Array.isArray(input)) {
throw new Error('A request object is required');
}
const value = input as Record<string, unknown>;
const allowed = new Set(['page', 'pageSize', 'status']);
if (Object.keys(value).some(key => !allowed.has(key))) {
throw new Error('Unsupported request field');
}
const { page, pageSize, status } = value;
if (typeof page !== 'number' || !Number.isSafeInteger(page) || page < 1 || page > 1000) {
throw new Error('page must be 1 through 1000');
}
if (typeof pageSize !== 'number' || !Number.isSafeInteger(pageSize) || pageSize < 1 || pageSize > 50) {
throw new Error('pageSize must be 1 through 50');
}
if (status !== undefined && status !== 'active' && status !== 'archived') {
throw new Error('Unsupported status filter');
}
return { page, pageSize, ...(status === undefined ? {} : { status }) };
}
// These caps are fictional application policy, not Znode limits.
// A verified SDK adapter maps this object to one declared endpoint.Keep filters typed and finite
Translate only approved filters into the endpoint's declared syntax. Escape or encode values using the official client or HTTP library, but do not expose a generic filter-expression parameter. Return an empty item list with paging metadata when no records match; it is not an authorization failure.
Verify page boundaries
Use synthetic fixtures that span more than one page. Confirm no duplicates or omissions across pages, the final short page, a no-results filter, invalid page bounds, and an unauthorized context. Then test the SDK adapter against the declared endpoint. A fixture test does not establish production permissions or endpoint semantics.
Test null, arrays, an unsupported status, extra fields, numeric strings, unsafe integers, and the upper page bound. This function only validates the request; it does not perform an API read or establish authorization.
References and further reading
Bring your next engineering question.
Need an integration read path scoped and tested?
Independent guidance from GCG. Znode is a trademark of its owner. Examples use fictional data and are not official platform documentation. Suggest a correction.