[sulimanbenhalim]

Summary

• the mobile app asks for 5 replies a page with limit=5 since Open replies from the replies button, five at a time NativePHP/dev-null-app#91 but the signed API's replies endpoint ignores it and sends 50 every time
• the web's replies endpoint already takes limit since feat: choose how many replies to show at a time #599 so this gives the API the same parameter

Changes

• ListApiCommitRepliesRequest takes limit (1 to 50) like ListCommitRepliesRequest and the API's CommitReplyController passes it to CommitRepliesQuery::paginate() with 50 when it's missing
• one clause in KNOWLEDGE_BASE.md under the signed API

Validation

• lint (pint rector oxlint) phpstan tsc type coverage JS tests and the full pest suite pass (4578 tests with 100% coverage)
• two tests in the API's CommitReplyControllerTest: 12 replies come back 5 a page with limit kept on links.next and a limit of 0 or 51 gets a 422
• the first fails when the controller drops limit or links.next loses it and the second when the rule is taken out

Independent review

• read-only Claude agent: CODE PASS on base 6b92c0fd head c50a7189 and its one note (the next page test passed with or without limit on it) is fixed in 40582f07

Limitations

• None

Summary by CodeRabbit

• New Features
  • API reply lists now support a configurable page size of 1–50 replies, with 50 as the default. Pagination links continue to the next set of replies.
• Documentation
  • Clarified the API’s default page size and limit option.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: ea2e1e99-0dab-4a4b-8e09-45a76096a148

Commits

Reviewing files that changed from the base of the PR and between 7f8f3a5 and 40582f0.

Files selected for processing: 4

• KNOWLEDGE_BASE.md
• app/Http/Controllers/Api/CommitReplyController.php
• app/Http/Requests/ListApiCommitRepliesRequest.php
• tests/Feature/Controllers/Api/CommitReplyControllerTest.php

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

Walkthrough

The signed API replies endpoint now accepts an optional limit from 1 through 50. It uses that value for pagination, or the default page size when omitted. Tests cover page size, next-link pagination, and invalid limits.

Changes: Signed API reply pagination

Layer / File(s)	Summary
Validate and apply reply limits app/Http/Requests/ListApiCommitRepliesRequest.php, app/Http/Controllers/Api/CommitReplyController.php, tests/Feature/Controllers/Api/CommitReplyControllerTest.php, KNOWLEDGE_BASE.md	The request validates limit as an integer from 1 through 50. The controller passes it to pagination, using the default when omitted. Tests cover five-reply pages, following the next link, and validation errors for limits 0 and 51. The signed API documentation states the page-size behavior.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Possibly related PRs

• dev-null-sh/dev-null.sh#1168: Changes visibility filtering for replies and signed API responses, which also affects replies returned by this API flow.

Suggested reviewers: simonhamp, paulinevos

Merge Risk: Minimal · up to 40582

The pagination change has no identified merge-blocking risk.

Security architecture risk: Minimal · up to 40582

The new page-size option is bounded to 1–50 replies and preserves the existing default of 50. Authentication, visibility controls, and reply selection remain unchanged. No material security risk introduced or worsened by this change was identified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The new parameter changes how many already-visible replies are returned per page, not which reply dataset the caller may access. Its maximum equals the previous fixed page size, so it does not increase per-response record exposure or caller authority.

Trust Boundaries and Controls

• observed — The replies route remains behind required signed-request authentication and API throttling. Authentication verifies an approved device, rejects banned users, and establishes the device owner's identity. The signed message includes the request path and query, while commit visibility authorization remains unchanged.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within surv…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly describes the main change: allowing the replies API to accept a page size that matches the web endpoint.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 2 functions across 3 files. (1 skipped: 1 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[sulimanbenhalim]

@simonhamp this is gonna help in the app, what do you think ?

[simonhamp]

Yeh definitely 👍🏼