From 7eccff7abc957a377170f34a121f3cfc2654112a Mon Sep 17 00:00:00 2001
From: Morris Jencen Chavez <hello@morcen.com>
Date: Tue, 22 Sep 2026 19:30:27 +0000
Subject: [PATCH] fix: cap unbounded endpoint picker queries in
 DashboardController

DashboardController::events() and editEvent() loaded a user's entire
endpoint list with no limit to populate the endpoint picker on the
Events index and Event edit pages. For accounts with a large number
of endpoints, this serialized the full unbounded set into every
Inertia response instead of the paginate(15) used elsewhere in the
same controller.

Cap both queries to the columns the picker actually needs, ordered by
name, with a reasonable limit(500), consistent with the rest of the
controller's pagination conventions.

Fixes #87

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018ZQTyApiuWdFJ4CGMGPgD2
---
 app/Http/Controllers/DashboardController.php  | 12 ++++-
 ...ashboardEventsEndpointsPickerLimitTest.php | 47 +++++++++++++++++++
 2 files changed, 57 insertions(+), 2 deletions(-)
 create mode 100644 tests/Feature/DashboardEventsEndpointsPickerLimitTest.php

diff --git a/app/Http/Controllers/DashboardController.php b/app/Http/Controllers/DashboardController.php
index 5f1f3fc..3ae9712 100644
--- a/app/Http/Controllers/DashboardController.php
+++ b/app/Http/Controllers/DashboardController.php
@@ -88,7 +88,11 @@ public function events(Request $request): Response
 
         return Inertia::render('Events/Index', [
             'events' => $events,
-            'endpoints' => $request->user()->endpoints()->get(['id', 'name', 'url', 'description', 'is_active']),
+            'endpoints' => $request->user()->endpoints()
+                ->select(['id', 'name', 'url', 'description', 'is_active'])
+                ->orderBy('name')
+                ->limit(500)
+                ->get(),
             'eventTypes' => $eventTypes,
             'filters' => $request->only(['search', 'type']),
         ]);
@@ -99,7 +103,11 @@ public function editEvent(Request $request, Event $event): Response
         abort_if($event->user_id !== $request->user()->id, 404);
 
         $event->load('endpoints');
-        $endpoints = $request->user()->endpoints()->get();
+        $endpoints = $request->user()->endpoints()
+            ->select(['id', 'name', 'url', 'description', 'is_active'])
+            ->orderBy('name')
+            ->limit(500)
+            ->get();
 
         return Inertia::render('Events/Edit', [
             'event' => $event,
diff --git a/tests/Feature/DashboardEventsEndpointsPickerLimitTest.php b/tests/Feature/DashboardEventsEndpointsPickerLimitTest.php
new file mode 100644
index 0000000..ca7e94c
--- /dev/null
+++ b/tests/Feature/DashboardEventsEndpointsPickerLimitTest.php
@@ -0,0 +1,47 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\Endpoint;
+use App\Models\Event;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class DashboardEventsEndpointsPickerLimitTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_events_index_caps_the_endpoint_picker_list(): void
+    {
+        $user = User::factory()->withPersonalTeam()->create();
+
+        Endpoint::factory()->for($user)->count(501)->create();
+
+        $response = $this->actingAs($user)->get(route('events'));
+
+        $response->assertOk();
+        $response->assertInertia(
+            fn ($page) => $page
+                ->component('Events/Index')
+                ->has('endpoints', 500)
+        );
+    }
+
+    public function test_edit_event_caps_the_endpoint_picker_list(): void
+    {
+        $user = User::factory()->withPersonalTeam()->create();
+        $event = Event::factory()->for($user)->create();
+
+        Endpoint::factory()->for($user)->count(501)->create();
+
+        $response = $this->actingAs($user)->get(route('events.edit', $event));
+
+        $response->assertOk();
+        $response->assertInertia(
+            fn ($page) => $page
+                ->component('Events/Edit')
+                ->has('endpoints', 500)
+        );
+    }
+}