initial commit on Federted servers

internal/http/pagination_test.go

@@ -0,0 +1,63 @@
+package http
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/url"
+	"testing"
+)
+
+func TestBookmarkPaginationPreservesCollectionAndOwnership(t *testing.T) {
+	srv, d := testServerDB(t)
+	owner, uid := accountClient(t, srv.URL, "owner@computer.test")
+	other, oid := accountClient(t, srv.URL, "other@computer.test")
+	for _, user := range []string{uid, oid} {
+		if _, err := d.Exec(`INSERT INTO "Bookmark"(id,url,title,"ownerId","updatedAt") SELECT $1||'-'||lpad(n::text,4,'0'),'https://127.0.0.1/test','Match '||n,$1,'2026-10-07T12:00:00Z' FROM generate_series(1,205) n`, user); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for _, c := range []apiClient{owner, other} {
+		seen := map[string]bool{}
+		cursor := ""
+		for {
+			res, err := c.c.Get(srv.URL + "/api/bookmarks?limit=100&search=Match&cursor=" + url.QueryEscape(cursor))
+			if err != nil {
+				t.Fatal(err)
+			}
+			var records []map[string]any
+			if err := json.NewDecoder(res.Body).Decode(&records); err != nil {
+				t.Fatal(err)
+			}
+			res.Body.Close()
+			if res.StatusCode != 200 || len(records) > 100 {
+				t.Fatal("invalid page", res.StatusCode, len(records))
+			}
+			for _, row := range records {
+				id := row["id"].(string)
+				if seen[id] {
+					t.Fatal("duplicate bookmark across pages", id)
+				}
+				seen[id] = true
+			}
+			cursor = res.Header.Get("X-Next-Cursor")
+			if cursor == "" {
+				break
+			}
+		}
+		if len(seen) != 205 {
+			t.Fatalf("wanted 205 bookmarks, got %d", len(seen))
+		}
+		expected := uid
+		if c.c == other.c {
+			expected = oid
+		}
+		for i := 1; i <= 205; i++ {
+			if !seen[fmt.Sprintf("%s-%04d", expected, i)] {
+				t.Fatal("bookmark missing or foreign collection included")
+			}
+		}
+	}
+	owner.request("GET", "/api/bookmarks?limit=201", nil, 400)
+	owner.request("GET", "/api/bookmarks?limit=0", nil, 400)
+	owner.request("GET", "/api/bookmarks?cursor=invalid", nil, 400)
+}