fix(web): paginate admin table fetches to avoid 422 limits

src/mud_server/web/static/js/api.js

@@ -138,14 +138,49 @@ class ApiClient {
    */
   async getTableRows(sessionId, tableName, limit = 100, offset = 0) {
     const safeTableName = encodeURIComponent(tableName);
+    const requestedLimit = Number(limit);
+    const safeLimit = Number.isFinite(requestedLimit)
+      ? Math.min(Math.max(Math.trunc(requestedLimit), 1), 1000)
+      : 100;
+    const requestedOffset = Number(offset);
+    const safeOffset = Number.isFinite(requestedOffset) ? Math.max(Math.trunc(requestedOffset), 0) : 0;
     const params = new URLSearchParams({
       session_id: sessionId,
-      limit: `${limit}`,
-      offset: `${offset}`,
+      limit: `${safeLimit}`,
+      offset: `${safeOffset}`,
     });
     return this.fetcher(`/admin/database/table/${safeTableName}?${params.toString()}`);
   }
 
+  /**
+   * Fetch all rows for a table using paged requests.
+   */
+  async getAllTableRows(sessionId, tableName, pageSize = 1000) {
+    const boundedPageSize = Math.min(Math.max(Math.trunc(Number(pageSize) || 1000), 1), 1000);
+    const allRows = [];
+    let columns = [];
+    let offset = 0;
+
+    while (true) {
+      const response = await this.getTableRows(sessionId, tableName, boundedPageSize, offset);
+      if (!columns.length) {
+        columns = Array.isArray(response.columns) ? response.columns : [];
+      }
+      const pageRows = Array.isArray(response.rows) ? response.rows : [];
+      allRows.push(...pageRows);
+      if (pageRows.length < boundedPageSize) {
+        break;
+      }
+      offset += pageRows.length;
+    }
+
+    return {
+      table: tableName,
+      columns,
+      rows: allRows,
+    };
+  }
+
   /**
    * Fetch world operations rows (status + active character sessions).
    */

src/mud_server/web/static/js/pages/accounts.js

@@ -247,9 +247,9 @@ async function renderAccountsDashboard(root, { api, session }) {
     const [accountsResponse, charactersResponse, worldsResponse, worldPermsResponse] =
       await Promise.all([
         api.getPlayers(sessionId),
-        api.getTableRows(sessionId, 'characters', 2000),
+        api.getAllTableRows(sessionId, 'characters'),
         api.getTableRows(sessionId, 'worlds', 300),
-        api.getTableRows(sessionId, 'world_permissions', 2000),
+        api.getAllTableRows(sessionId, 'world_permissions'),
       ]);
 
     allAccounts = Array.isArray(accountsResponse.players) ? accountsResponse.players : [];

src/mud_server/web/static/js/pages/characters.js

@@ -385,10 +385,10 @@ async function renderCharactersDashboard(root, { api, session }) {
    */
   const load = async () => {
     const [charactersResponse, usersResponse, worldsResponse, locationsResponse] = await Promise.all([
-      api.getTableRows(sessionId, 'characters', 3000),
-      api.getTableRows(sessionId, 'users', 2000),
+      api.getAllTableRows(sessionId, 'characters'),
+      api.getAllTableRows(sessionId, 'users'),
       api.getTableRows(sessionId, 'worlds', 300),
-      api.getTableRows(sessionId, 'character_locations', 3000),
+      api.getAllTableRows(sessionId, 'character_locations'),
     ]);
 
     allCharacters = rowsToObjects(charactersResponse.columns, charactersResponse.rows).filter(

src/mud_server/web/static/js/pages/tombstones.js

@@ -132,8 +132,8 @@ async function renderTombstonesDashboard(root, { api, session }) {
    */
   const load = async () => {
     const [usersResponse, charactersResponse, worldsResponse] = await Promise.all([
-      api.getTableRows(sessionId, 'users', 4000),
-      api.getTableRows(sessionId, 'characters', 4000),
+      api.getAllTableRows(sessionId, 'users'),
+      api.getAllTableRows(sessionId, 'characters'),
       api.getTableRows(sessionId, 'worlds', 300),
     ]);
 

src/mud_server/web/static/js/pages/users_data.js

@@ -53,10 +53,10 @@ async function loadUsersList({ api, sessionId }) {
  */
 async function loadUsersMetadata({ api, sessionId }) {
   const [charactersResp, worldsResp, permissionsResp, locationsResp] = await Promise.all([
-    api.getTableRows(sessionId, 'characters', 1000),
+    api.getAllTableRows(sessionId, 'characters'),
     api.getTableRows(sessionId, 'worlds', 200),
-    api.getTableRows(sessionId, 'world_permissions', 1000),
-    api.getTableRows(sessionId, 'character_locations', 1000),
+    api.getAllTableRows(sessionId, 'world_permissions'),
+    api.getAllTableRows(sessionId, 'character_locations'),
   ]);
 
   const worldRows = rowsToObjects(worldsResp.columns, worldsResp.rows);