Skip to content

fix(admin): paginate admin_list_tokens to avoid 512 KB truncation - #36

Open
aelttil wants to merge 1 commit into
mainfrom
fix/admin-list-tokens-pagination
Open

fix(admin): paginate admin_list_tokens to avoid 512 KB truncation#36
aelttil wants to merge 1 commit into
mainfrom
fix/admin-list-tokens-pagination

Conversation

@aelttil

@aelttil aelttil commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

Without pagination, admin_list_tokens loads the entire token registry from S3 and returns it in a single JSON response. With large deployments (hundreds of tokens, each with long space_ids lists and full SHA-256 hashes), this easily exceeds the 512 KB ResponseLimitMiddleware threshold, causing the response to be replaced by {"_truncated": true, ...}.

Add limit (default 100, max 1000) and offset (default 0) parameters to both admin_list_tokens (tool) and TokenService.list_tokens (core).

The response now always includes total (count after filters, before pagination), limit, offset, and has_more so callers can iterate through large registries page by page.

Rétrocompat : default limit=100 covers all existing small-scale usages without any call-site changes. The total field semantics are unchanged (still reflects the filtered count), only the returned tokens slice is now bounded.

Fixes #XX

Without pagination, admin_list_tokens loads the entire token registry
from S3 and returns it in a single JSON response. With large deployments
(hundreds of tokens, each with long space_ids lists and full SHA-256
hashes), this easily exceeds the 512 KB ResponseLimitMiddleware threshold,
causing the response to be replaced by {"_truncated": true, ...}.

Add `limit` (default 100, max 1000) and `offset` (default 0) parameters
to both admin_list_tokens (tool) and TokenService.list_tokens (core).

The response now always includes `total` (count after filters, before
pagination), `limit`, `offset`, and `has_more` so callers can iterate
through large registries page by page.

Rétrocompat : default limit=100 covers all existing small-scale usages
without any call-site changes. The `total` field semantics are unchanged
(still reflects the filtered count), only the returned `tokens` slice is
now bounded.

Fixes #XX
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant