From 7325fe7f0ff545838887eec2b541204f640cfed9 Mon Sep 17 00:00:00 2001
From: Alqku <Alqku@users.noreply.github.com>
Date: Mon, 29 Jun 2026 09:06:24 +0000
Subject: [PATCH] fix: add pagination limits to unbounded findMany queries
 (#127)

---
 app/backend/src/campaigns/campaigns.service.ts |  6 +++++-
 app/backend/src/claims/claims.service.ts       | 11 +++++++----
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/app/backend/src/campaigns/campaigns.service.ts b/app/backend/src/campaigns/campaigns.service.ts
index 58062388..0b9239e4 100644
--- a/app/backend/src/campaigns/campaigns.service.ts
+++ b/app/backend/src/campaigns/campaigns.service.ts
@@ -53,16 +53,20 @@ export class CampaignsService {
     });
   }
 
-  async findAll(includeArchived = false, ngoId?: string | null) {
+  async findAll(includeArchived = false, ngoId?: string | null, page = 1, limit = 50) {
     const where: Prisma.CampaignWhereInput = {
       deletedAt: null,
       ...(includeArchived ? {} : { archivedAt: null }),
       ...(ngoId ? { ngoId } : {}),
     };
+    const take = Math.min(200, Math.max(1, limit));
+    const skip = (Math.max(1, page) - 1) * take;
 
     return this.prisma.campaign.findMany({
       where,
       orderBy: { createdAt: 'desc' },
+      skip,
+      take,
     });
   }
 
diff --git a/app/backend/src/claims/claims.service.ts b/app/backend/src/claims/claims.service.ts
index 990bc0e4..c7b74cd9 100644
--- a/app/backend/src/claims/claims.service.ts
+++ b/app/backend/src/claims/claims.service.ts
@@ -116,12 +116,15 @@ export class ClaimsService {
     return claim;
   }
 
-  async findAll() {
+  async findAll(page = 1, limit = 50) {
+    const take = Math.min(200, Math.max(1, limit));
+    const skip = (Math.max(1, page) - 1) * take;
     const claims = await this.prisma.claim.findMany({
       where: { deletedAt: null },
-      include: {
-        campaign: true,
-      },
+      include: { campaign: true },
+      orderBy: { createdAt: 'desc' },
+      skip,
+      take,
     });
     return claims.map(claim => ({
       ...claim,