security(CASA-36): implement HPP testing and validation

backend/airweave/api/v1/endpoints/admin.py

@@ -62,11 +62,13 @@ def _require_admin(ctx: ApiContext) -> None:
 
 
 @router.get("/organizations", response_model=List[schemas.OrganizationMetrics])
-async def list_all_organizations(
+async def list_all_organizations(  # noqa: C901
     db: AsyncSession = Depends(deps.get_db),
     ctx: ApiContext = Depends(deps.get_context),
-    skip: int = 0,
-    limit: int = Query(1000, le=10000, description="Maximum number of organizations to return"),
+    skip: int = Query(0, ge=0, description="Number of organizations to skip for pagination"),
+    limit: int = Query(
+        1000, ge=1, le=10000, description="Maximum number of organizations to return"
+    ),
     search: Optional[str] = Query(None, description="Search by organization name"),
     sort_by: str = Query("created_at", description="Field to sort by"),
     sort_order: str = Query("desc", description="Sort order (asc or desc)"),

backend/airweave/api/v1/endpoints/api_keys.py

@@ -2,7 +2,7 @@
 
 from uuid import UUID
 
-from fastapi import Body, Depends
+from fastapi import Body, Depends, Query
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from airweave import crud, schemas
@@ -105,8 +105,8 @@ async def read_api_key(
 async def read_api_keys(
     *,
     db: AsyncSession = Depends(deps.get_db),
-    skip: int = 0,
-    limit: int = 100,
+    skip: int = Query(0, ge=0, description="Number of API keys to skip for pagination"),
+    limit: int = Query(100, ge=1, le=1000, description="Maximum number of API keys to return"),
     ctx: ApiContext = Depends(deps.get_context),
 ) -> list[schemas.APIKey]:
     """Retrieve all API keys for the current user.

backend/airweave/api/v1/endpoints/auth_providers.py

@@ -2,7 +2,7 @@
 
 from typing import Any, Dict, List, Optional
 
-from fastapi import Depends, HTTPException
+from fastapi import Depends, HTTPException, Query
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from airweave import crud, schemas
@@ -158,8 +158,10 @@ async def list_auth_providers(
     *,
     db: AsyncSession = Depends(deps.get_db),
     ctx: ApiContext = Depends(deps.get_context),
-    skip: int = 0,
-    limit: int = 100,
+    skip: int = Query(0, ge=0, description="Number of auth providers to skip for pagination"),
+    limit: int = Query(
+        100, ge=1, le=1000, description="Maximum number of auth providers to return"
+    ),
 ) -> List[schemas.AuthProvider]:
     """Get all available auth providers.
 
@@ -226,8 +228,8 @@ async def list_auth_provider_connections(
     *,
     db: AsyncSession = Depends(deps.get_db),
     ctx: ApiContext = Depends(deps.get_context),
-    skip: int = 0,
-    limit: int = 100,
+    skip: int = Query(0, ge=0, description="Number of connections to skip for pagination"),
+    limit: int = Query(100, ge=1, le=1000, description="Maximum number of connections to return"),
 ) -> List[schemas.AuthProviderConnection]:
     """Get all auth provider connections for the current organization.
 

backend/airweave/api/v1/endpoints/collections.py

@@ -34,7 +34,7 @@
     ),
 )
 async def list(
-    skip: int = Query(0, description="Number of collections to skip for pagination"),
+    skip: int = Query(0, ge=0, description="Number of collections to skip for pagination"),
     limit: int = Query(
         100, description="Maximum number of collections to return (1-1000)", le=1000, ge=1
     ),

backend/airweave/api/v1/endpoints/sync.py

@@ -24,8 +24,8 @@
 async def list_syncs(
     *,
     db: AsyncSession = Depends(deps.get_db),
-    skip: int = 0,
-    limit: int = 100,
+    skip: int = Query(0, ge=0, description="Number of syncs to skip for pagination"),
+    limit: int = Query(100, ge=1, le=1000, description="Maximum number of syncs to return"),
     with_source_connection: bool = False,
     ctx: ApiContext = Depends(deps.get_context),
 ) -> list[schemas.Sync] | list[schemas.SyncWithSourceConnection]:
@@ -56,8 +56,8 @@ async def list_syncs(
 async def list_all_jobs(
     *,
     db: AsyncSession = Depends(deps.get_db),
-    skip: int = 0,
-    limit: int = 100,
+    skip: int = Query(0, ge=0, description="Number of jobs to skip for pagination"),
+    limit: int = Query(100, ge=1, le=1000, description="Maximum number of jobs to return"),
     status: Optional[List[str]] = Query(None, description="Filter by job status"),
     ctx: ApiContext = Depends(deps.get_context),
 ) -> list[schemas.SyncJob]: