pinakes-server: fix api key timing, notification scoping, and validate progress inputs

Signed-off-by: NotAShelf <raf@notashelf.dev>
Change-Id: Ieb342b4b48034de0a2184cdf89d068316a6a6964

crates/pinakes-server/src/routes/books.rs

@@ -131,11 +131,11 @@ pub struct SearchBooksQuery {
   pub limit:     u64,
 }
 
-fn default_offset() -> u64 {
+const fn default_offset() -> u64 {
   0
 }
 
-fn default_limit() -> u64 {
+const fn default_limit() -> u64 {
   50
 }
 
@@ -178,7 +178,7 @@ pub async fn list_books(
 ) -> Result<impl IntoResponse, ApiError> {
   let pagination = Pagination {
     offset: query.offset,
-    limit:  query.limit,
+    limit:  query.limit.min(1000),
     sort:   None,
   };
 
@@ -290,6 +290,9 @@ pub async fn update_reading_progress(
   Path(media_id): Path<Uuid>,
   Json(req): Json<UpdateProgressRequest>,
 ) -> Result<impl IntoResponse, ApiError> {
+  if req.current_page < 0 {
+    return Err(ApiError::bad_request("current_page must be non-negative"));
+  }
   let user_id = resolve_user_id(&state.storage, &username).await?;
   let media_id = MediaId(media_id);