api/api.go (1)

526-531: Count query may return incorrect results with GROUP BY.

When orderBy == "last_settled_transaction", the query has a GROUP BY apps.id clause. Calling .Model(&db.App{}).Count(&totalCount) on this grouped query may not return the correct total count of apps—it could count the number of groups or behave unexpectedly depending on the database driver.

Consider computing the count before applying the grouping/aggregation for the last_settled_transaction case, or use a separate unmodified query for counting.

🔧 Suggested approach

+	// Count before applying aggregation for last_settled_transaction
+	countQuery := api.db
+	if filters.Name != "" {
+		if api.db.Dialector.Name() == "postgres" {
+			countQuery = countQuery.Where("name ILIKE ?", filters.Name+"%")
+		} else {
+			countQuery = countQuery.Where("name LIKE ?", filters.Name+"%")
+		}
+	}
+	// ... apply other filters to countQuery ...
+
 	var totalCount int64
-	result := query.Model(&db.App{}).Count(&totalCount)
+	result := countQuery.Model(&db.App{}).Count(&totalCount)

Alternatively, you could clone the query before adding the SELECT/JOIN/GROUP BY clauses and use the clone for counting.

api/api.go (1)

528-543: ⚠️ Potential issue | 🔴 Critical

Reject unknown orderBy values before building the SQL clause.

orderBy still comes from request input, and Line 543 concatenates it directly into Order(...). The new frontend literal union does not protect this endpoint from crafted calls, so please whitelist the supported values and build the full order clause server-side.

🔒 Safer pattern

+	var orderClause string
+
 	if orderBy == "" {
 		orderBy = "last_used_at"
 	}
-	if orderBy == "last_used_at" {
-		// when ordering by last used at, apps with last_used_at is NULL should be ordered last
-		orderBy = "last_used_at IS NULL, " + orderBy
-	}
-
-	if orderBy == "last_settled_transaction" {
+
+	switch orderBy {
+	case "last_used_at":
+		orderClause = "last_used_at IS NULL, last_used_at DESC"
+	case "created_at":
+		orderClause = "created_at DESC"
+	case "last_settled_transaction":
 		query = query.Select("apps.*, MAX(transactions.created_at) as last_transaction_at").
 			Joins("LEFT JOIN transactions ON transactions.app_id = apps.id AND transactions.state = ?", constants.TRANSACTION_STATE_SETTLED).
 			Group("apps.id")
-		orderBy = "last_transaction_at IS NULL, last_transaction_at DESC, apps.last_used_at"
+		orderClause = "last_transaction_at IS NULL, last_transaction_at DESC, apps.last_used_at DESC"
+	default:
+		return nil, fmt.Errorf("invalid orderBy: %s", orderBy)
 	}
 
-	query = query.Order(orderBy + " DESC")
+	query = query.Order(orderClause)

As per coding guidelines, `{api,http}/**/*.go`: Validate all user input at system boundaries; trust internal service calls.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@api/api.go` around lines 528 - 543, Reject/whitelist untrusted orderBy values
before using them in the SQL ORDER clause: validate the incoming orderBy
variable against an allowed set (e.g., "", "last_used_at",
"last_settled_transaction", any other supported keys) and map each allowed key
to a fully formed, safe SQL ordering expression (e.g., "last_used_at IS NULL,
last_used_at DESC" and for "last_settled_transaction" ensure you build the
JOIN/Group and use "last_transaction_at IS NULL, last_transaction_at DESC,
apps.last_used_at"); if the value is not in the whitelist, fall back to the
default ordering, and only then call query.Order(...). Reference the orderBy
variable, the query builder block that sets MAX(transactions.created_at) with
constants.TRANSACTION_STATE_SETTLED, and ensure no raw request string is
concatenated into Order().

api/api.go (1)

532-547: ⚠️ Potential issue | 🟠 Major

Whitelist orderBy values before building the SQL ORDER BY clause.

Line 547 still concatenates orderBy directly into the query. Unsupported/tainted values can break ordering behavior and weaken query safety at an API boundary.

🔧 Suggested fix

-	if orderBy == "" {
-		orderBy = "last_used_at"
-	}
-	if orderBy == "last_used_at" {
-		// when ordering by last used at, apps with last_used_at is NULL should be ordered last
-		orderBy = "last_used_at IS NULL, " + orderBy
-	}
-
-	if orderBy == "last_settled_transaction" {
-		query = query.Select("apps.*, MAX(transactions.settled_at) as last_transaction_at").
-			Joins("LEFT JOIN transactions ON transactions.app_id = apps.id AND transactions.state = ?", constants.TRANSACTION_STATE_SETTLED).
-			Group("apps.id")
-		orderBy = "last_transaction_at IS NULL, last_transaction_at DESC, apps.last_used_at"
-	}
-
-	query = query.Order(orderBy + " DESC")
+	switch orderBy {
+	case "", "last_used_at":
+		// NULLS last for primary sort key
+		orderBy = "last_used_at IS NULL, last_used_at DESC"
+	case "created_at":
+		orderBy = "created_at DESC"
+	case "last_settled_transaction":
+		query = query.Select("apps.*, MAX(transactions.settled_at) as last_transaction_at").
+			Joins("LEFT JOIN transactions ON transactions.app_id = apps.id AND transactions.state = ?", constants.TRANSACTION_STATE_SETTLED).
+			Group("apps.id")
+		orderBy = "last_transaction_at IS NULL, last_transaction_at DESC, apps.last_used_at IS NULL, apps.last_used_at DESC"
+	default:
+		return nil, fmt.Errorf("invalid orderBy: %s", orderBy)
+	}
+
+	query = query.Order(orderBy)

As per coding guidelines {api,http}/**/*.go: "Validate all user input at system boundaries; trust internal service calls".

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@api/api.go` around lines 532 - 547, The orderBy value used in the SQL ORDER
BY clause is currently concatenated directly, which risks SQL injection or
invalid queries. To fix it, implement a whitelist of allowed orderBy values
before building the SQL clause in the relevant function. Validate the orderBy
variable to only accept predefined safe column names like "last_used_at" or
"last_settled_transaction" before it is used in query.Order. Reject or default
unsupported or tainted values to ensure query safety as demonstrated in the
conditional logic surrounding orderBy in the code snippet.