Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

fix(admin): batch param is unclamped and batch=0 spins 50 no-op batches in all=true mode

未关闭 适合新手
  • 哪里不对？
#28 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
2/5
预计耗时
1-3 小时
新手友好度
76/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
活跃
技术栈
typescript
领域
api, backend

调研方向

从 apps/web/app/routes/api.admin.recompute.ts 中的 parseIntSafe、batchSize 赋值和 all=true 循环开始；将验证逻辑与 recompute-all-skills.ts:177 中描述的行为进行比较。使用提供的 ADMIN_SECRET curl 复现步骤，并提供所需的 D1 和 KV bindings，然后验证 batch 值受到限制，且 batch=0 不再产生 50 个 no-op batch。

由索引模型根据 Issue 内容生成。

描述

bug

Summary

The batch query parameter is neither clamped nor range-checked on POST /api/admin/recompute. parseIntSafe rejects only NaN and negative values, so batch=0 is accepted and there is no upper bound either. With all=true, batch=0 makes one request burn all 50 permitted batch iterations while processing nothing.

Current behavior

  • apps/web/app/routes/api.admin.recompute.ts:28-32 — the only validation, which lets 0 through and caps nothing: 
    function parseIntSafe(value: string | null, fallback: number): number {
  if (value == null) return fallback;
  const n = parseInt(value, 10);
  return Number.isNaN(n) || n < 0 ? fallback : n;
}
  • apps/web/app/routes/api.admin.recompute.ts:58 — that value becomes batchSize and reaches .limit(batchSize) in the query builder, so batch=0 becomes LIMIT 0.
  • apps/web/app/lib/leaderboard/recompute-all-skills.ts:177 — with an empty batch the completion test is 0 < 0, which is false: 
    const isComplete = batch.length < batchSize;
    The batch is reported as incomplete, and nextOffset is set to offset unchanged, so the all=true loop at apps/web/app/routes/api.admin.recompute.ts:81 keeps calling with the same offset until MAX_BATCHES_PER_REQUEST (50) is reached, then returns "Paused after 50 batches" with nothing processed.
  • There is also no upper bound: batch=100000 is accepted and would defeat the guard added at line 21 to keep the Worker under its CPU limit.

Expected behavior

Clamp the value to a sane range, as the review recommended, and reject nonsense input explicitly:

const batchSize = Math.min(Math.max(parseIntSafe(batch, 100), 1), 500);

Reproduction

  1. Set batch to 0 and select all-at-once mode: 
    ADMIN_SECRET=... curl -sS -X POST "https://skillx.sh/api/admin/recompute?all=true&batch=0"
  2. The response reports batches: 50, totalProcessed: 0, and the "Paused after 50 batches" message, while GET /api/admin/recompute shows the checkpoint unchanged.

Conditions: requires ADMIN_SECRET plus the D1 and KV bindings; admin-only endpoint. Behavior read from main at 9d0f9e9; the exact request was not executed against production.

Flow

flowchart LR
  A["batch=0"] --> B[parseIntSafe returns 0]
  B --> C["LIMIT 0 -> empty batch"]
  C --> D{{"isComplete = 0 < 0 = false"}}
  D -->|nextOffset unchanged| E[all=true loop retries same offset]
  E --> F[50 no-op batches, then Paused]

Evidence

  • Affected code: apps/web/app/routes/api.admin.recompute.ts:28, apps/web/app/routes/api.admin.recompute.ts:58, apps/web/app/routes/api.admin.recompute.ts:81, apps/web/app/lib/leaderboard/recompute-all-skills.ts:177
  • Introduced by: 88a5bff, shipped on main via 9d0f9e9 (PR #9)
  • Related: plans/reports/code-reviewer-260306-1531-admin-recompute-endpoint.md, section "8. Input validation for batch and offset params"

Open questions

  • Upper bound: 500 as suggested in the review, or align it with the existing default of 100?
  • Should batch=0 return HTTP 400 instead of being silently clamped to 1?

Notes

  • offset has the same missing upper clamp, but an out-of-range offset only yields an empty batch and a correct completion, so it is far less harmful than batch=0.
  • MAX_BATCHES_PER_REQUEST at line 21 already handles the Worker-timeout risk from the review; the missing piece is bounding the work each iteration can request.
主要语言
TypeScript
星标
189
派生
40
平均合并
7 小时 38 分钟
30 天内合并 PR
30

环境准备

这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

nextlevelbuilder/skillx 的其他 Issue

查看 nextlevelbuilder/skillx 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。