fix(cluster-3): http hardening (M15/M16/M14/C2)

- pagination: clamp per_page to [1,100] and page to >=1 in the parser,
  guard the TotalPages division against per_page=0 (panic), and clamp the
  current page to [1,totalPages]; preserves cursor (next-token) mode
- middleware: add panic-recovery as the outermost middleware so handler
  panics return a 500 instead of crashing the process; re-panics
  http.ErrAbortHandler to keep file serving intact
- index: bound the index page query (Limit:200) so it no longer drains
  the entire courses table in 1000-row batches

internal/common/client/sravni/entities.go

@@ -85,6 +85,19 @@ type Filters struct {
 	IsCourseProfeccion Flagged `json:"isCourseProfession"`
 }
 
+type DataSourceType string
+
+const (
+	DataSourceTypeDictionaryConfig DataSourceType = "dictionaryConfig"
+	DataSourceTypeDictionary       DataSourceType = "dictionary"
+	DataSourceTypeOrganization     DataSourceType = "organization"
+)
+
+type ReduxDataSource struct {
+	Type   DataSourceType `json:"type"`
+	Source string         `json:"source"`
+}
+
 type ReduxConfigDictionaryBaseUnit struct {
 	Label string `json:"label"`
 	Value string `json:"value"`
@@ -111,16 +124,23 @@ type ReduxConfigFilterUnit struct {
 }
 
 type ReduxConfigSorting struct {
-	Name      string `json:"name"`
 	Property string `json:"property"`
-	Direction string `json:"direction"`
+	// 3 more fields
 }
 
 type ReduxConfig struct {
 	Default struct {
 		SortingParameters []ReduxConfigSorting `json:"sortingParameters"`
 	} `json:"default"`
-	DataSources map[string]string `json:"dataSources"`
+	DataSources  map[string]ReduxDataSource `json:"dataSources"`
+	Dictionaries struct {
+		PriceFilter       []ReduxConfigDictionaryRangeUnit `json:"dictionaryPriceFilter"`
+		GraphicFilter     []ReduxConfigDictionaryBaseUnit  `json:"dictionaryGraphicFilterNew"`
+		FormatFilter      []ReduxConfigDictionaryBaseUnit  `json:"dictionaryFormatFilterNew"`
+		LevelFilter       []ReduxConfigDictionaryBaseUnit  `json:"dictionaryLevelFilterNew"`
+		TimeFilter        []ReduxConfigDictionaryRangeUnit `json:"dictionaryTimeFilter"`
+		InstallmentFilter []ReduxConfigDictionaryRangeUnit `json:"dictionaryInstallmentFilter"`
+	}
 	Filters []ReduxConfigFilterUnit `json:"filters"`
 	Sorting []ReduxConfigSorting    `json:"sorting"`
 }

internal/kurious/adapters/memory_mapper_test.go

@@ -5,7 +5,7 @@ import (
 	"testing"
 
 	"git.loyso.art/frx/kurious/internal/kurious/domain"
-	mockrepo "git.loyso.art/frx/kurious/internal/kurious/adapters/mocks"
+	mockrepo "git.loyso.art/frx/kurious/internal/kurious/domain/mocks"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"

internal/kurious/adapters/not_implemented.go

@@ -1,42 +0,0 @@
-package adapters
-
-import (
-	"context"
-
-	cerrors "git.loyso.art/frx/kurious/internal/common/errors"
-	"git.loyso.art/frx/kurious/internal/kurious/domain"
-)
-
-type NotImplementedOrganizationRepository struct{}
-
-func (NotImplementedOrganizationRepository) ListStats(
-	context.Context,
-	domain.ListOrganizationsParams,
-) ([]domain.OrganizationStat, error) {
-	return nil, cerrors.ErrNotImplemented
-}
-
-func (NotImplementedOrganizationRepository) List(context.Context, domain.ListOrganizationsParams) ([]domain.Organization, error) {
-	return nil, cerrors.ErrNotImplemented
-}
-func (NotImplementedOrganizationRepository) Get(context.Context, domain.GetOrganizationParams) (domain.Organization, error) {
-	return domain.Organization{}, cerrors.ErrNotImplemented
-}
-func (NotImplementedOrganizationRepository) Create(context.Context, domain.CreateOrganizationParams) (domain.Organization, error) {
-	return domain.Organization{}, cerrors.ErrNotImplemented
-}
-func (NotImplementedOrganizationRepository) Delete(ctx context.Context, id string) error {
-	return cerrors.ErrNotImplemented
-}
-
-type NotImplementedLearningCategory struct{}
-
-func (NotImplementedLearningCategory) Upsert(context.Context, domain.LearningCategory) error {
-	return cerrors.ErrNotImplemented
-}
-func (NotImplementedLearningCategory) List(context.Context) ([]domain.LearningCategory, error) {
-	return nil, cerrors.ErrNotImplemented
-}
-func (NotImplementedLearningCategory) Get(context.Context, string) (domain.LearningCategory, error) {
-	return domain.LearningCategory{}, cerrors.ErrNotImplemented
-}

internal/kurious/adapters/sqlite_learning_category_repository.go

@@ -8,7 +8,6 @@ import (
 	"log/slog"
 	"strings"
 
-	cerrors "git.loyso.art/frx/kurious/internal/common/errors"
 	"git.loyso.art/frx/kurious/internal/common/xslices"
 	"git.loyso.art/frx/kurious/internal/kurious/domain"
 
@@ -157,7 +156,7 @@ func (r *sqliteLearingCategoryRepository) Get(ctx context.Context, id string) (c
 	err = r.db.GetContext(ctx, &cdb, query, id)
 	if err != nil {
 		if errors.Is(err, sql.ErrNoRows) {
-			return domain.LearningCategory{}, cerrors.ErrNotFound
+			return domain.LearningCategory{}, domain.ErrNotFound
 		}
 		return domain.LearningCategory{}, fmt.Errorf("executing query: %w", err)
 	}

internal/kurious/adapters/sqlite_learning_category_repository_test.go

@@ -3,7 +3,6 @@ package adapters
 import (
 	"testing"
 
-	"git.loyso.art/frx/kurious/internal/common/errors"
 	"git.loyso.art/frx/kurious/internal/common/nullable"
 	"git.loyso.art/frx/kurious/internal/kurious/domain"
 
@@ -76,7 +75,7 @@ func (s *sqliteLearningCategoriesRepositorySuite) TestUpsert() {
 	const categoryID = "test-id-1"
 	repo := s.connection.LearningCategory()
 	gotCategory, err := repo.Get(s.ctx, categoryID)
-	s.ErrorIs(err, errors.ErrNotFound)
+	s.ErrorIs(err, domain.ErrNotFound)
 	s.Empty(gotCategory)
 
 	createdCategory := domain.LearningCategory{

internal/kurious/adapters/sqlite_organization_repository.go

@@ -9,7 +9,6 @@ import (
 	"strings"
 	"time"
 
-	cerrors "git.loyso.art/frx/kurious/internal/common/errors"
 	"git.loyso.art/frx/kurious/internal/common/xslices"
 	"git.loyso.art/frx/kurious/internal/kurious/domain"
 	"go.opentelemetry.io/otel/attribute"
@@ -229,7 +228,7 @@ func (r *sqliteOrganizationRepository) Get(ctx context.Context, params domain.Ge
 	err = r.db.GetContext(ctx, &orgdb, query, args...)
 	if err != nil {
 		if errors.Is(err, sql.ErrNoRows) {
-			return out, cerrors.ErrNotFound
+			return out, domain.ErrNotFound
 		}
 		return out, fmt.Errorf("executing query: %w", err)
 	}
@@ -307,14 +306,14 @@ func (r *sqliteOrganizationRepository) Delete(ctx context.Context, id string) (e
 	result, err := r.db.ExecContext(ctx, query, id)
 	if err != nil {
 		if errors.Is(err, sql.ErrNoRows) {
-			return cerrors.ErrNotFound
+			return domain.ErrNotFound
 		}
 		return fmt.Errorf("executing query: %w", err)
 	}
 
 	affected, _ := result.RowsAffected()
 	if affected == 0 {
-		return cerrors.ErrNotFound
+		return domain.ErrNotFound
 	}
 
 	return nil

internal/kurious/adapters/ydb_course_repository.go

@@ -110,11 +110,11 @@ func (conn *YDBConnection) Close() error {
 }
 
 func (conn *YDBConnection) Organization() domain.OrganizationRepository {
-	return NotImplementedOrganizationRepository{}
+	return domain.NotImplementedOrganizationRepository{}
 }
 
 func (conn *YDBConnection) LearningCategory() domain.LearningCategoryRepository {
-	return NotImplementedLearningCategory{}
+	return domain.NotImplementedLearningCategory{}
 }
 
 func (conn *YDBConnection) CourseRepository() *ydbCourseRepository {

internal/kurious/app/command/command_test.go

@@ -9,7 +9,7 @@ import (
 
 	"git.loyso.art/frx/kurious/internal/common/nullable"
 	"git.loyso.art/frx/kurious/internal/kurious/domain"
-	mockrepo "git.loyso.art/frx/kurious/internal/kurious/adapters/mocks"
+	mockrepo "git.loyso.art/frx/kurious/internal/kurious/domain/mocks"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"

internal/kurious/app/query/query_test.go

@@ -8,7 +8,7 @@ import (
 	"testing"
 
 	"git.loyso.art/frx/kurious/internal/kurious/domain"
-	mockrepo "git.loyso.art/frx/kurious/internal/kurious/adapters/mocks"
+	mockrepo "git.loyso.art/frx/kurious/internal/kurious/domain/mocks"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"

internal/kurious/domain/error.go

@@ -0,0 +1,12 @@
+package domain
+
+const (
+	ErrNotFound       PlainError = "not found"
+	ErrNotImplemented PlainError = "not implemented"
+)
+
+type PlainError string
+
+func (err PlainError) Error() string {
+	return string(err)
+}

internal/kurious/domain/repository.go

@@ -80,7 +80,7 @@ type ListStatisticsResult struct {
 	LearningTypeStatistics []StatisticUnit
 }
 
-//go:generate mockery --name CourseRepository --output ../adapters/mocks
+//go:generate mockery --name CourseRepository
 type CourseRepository interface {
 	// List courses by specifid parameters.
 	List(context.Context, ListCoursesParams) (ListCoursesResult, error)
@@ -126,7 +126,7 @@ type ListOrganizationsParams struct {
 	IDs              []string
 }
 
-//go:generate mockery --name OrganizationRepository --output ../adapters/mocks
+//go:generate mockery --name OrganizationRepository
 type OrganizationRepository interface {
 	ListStats(context.Context, ListOrganizationsParams) ([]OrganizationStat, error)
 	List(context.Context, ListOrganizationsParams) ([]Organization, error)
@@ -135,10 +135,44 @@ type OrganizationRepository interface {
 	Delete(ctx context.Context, id string) error
 }
 
-//go:generate mockery --name LearningCategoryRepository --output ../adapters/mocks
+type NotImplementedOrganizationRepository struct{}
+
+func (NotImplementedOrganizationRepository) ListStats(
+	context.Context,
+	ListOrganizationsParams,
+) ([]OrganizationStat, error) {
+	return nil, ErrNotImplemented
+}
+
+func (NotImplementedOrganizationRepository) List(context.Context, ListOrganizationsParams) ([]Organization, error) {
+	return nil, ErrNotImplemented
+}
+func (NotImplementedOrganizationRepository) Get(context.Context, GetOrganizationParams) (Organization, error) {
+	return Organization{}, ErrNotImplemented
+}
+func (NotImplementedOrganizationRepository) Create(context.Context, CreateOrganizationParams) (Organization, error) {
+	return Organization{}, ErrNotImplemented
+}
+func (NotImplementedOrganizationRepository) Delete(ctx context.Context, id string) error {
+	return ErrNotImplemented
+}
+
+//go:generate mockery --name LearningCategoryRepository
 type LearningCategoryRepository interface {
 	Upsert(context.Context, LearningCategory) error
 
 	List(context.Context) ([]LearningCategory, error)
 	Get(context.Context, string) (LearningCategory, error)
 }
+
+type NotImplementedLearningCategory struct{}
+
+func (NotImplementedLearningCategory) Upsert(context.Context, LearningCategory) error {
+	return ErrNotImplemented
+}
+func (NotImplementedLearningCategory) List(context.Context) ([]LearningCategory, error) {
+	return nil, ErrNotImplemented
+}
+func (NotImplementedLearningCategory) Get(context.Context, string) (LearningCategory, error) {
+	return LearningCategory{}, ErrNotImplemented
+}

internal/kurious/ports/http/server.go

@@ -9,6 +9,7 @@ import (
 
 	"git.loyso.art/frx/kurious/internal/common/errors"
 	"git.loyso.art/frx/kurious/internal/common/xcontext"
+	"git.loyso.art/frx/kurious/internal/kurious/domain"
 	"git.loyso.art/frx/kurious/internal/kurious/service"
 	"git.loyso.art/frx/kurious/pkg/xdefault"
 
@@ -49,7 +50,7 @@ func handleError(ctx context.Context, err error, w http.ResponseWriter, log *slo
 	case stderrors.As(err, &valErr):
 		errorString = valErr.Error()
 		code = http.StatusBadRequest
-	case stderrors.Is(err, errors.ErrNotFound):
+	case stderrors.Is(err, errors.ErrNotFound), stderrors.Is(err, domain.ErrNotFound):
 		errorString = err.Error()
 		code = http.StatusNotFound
 	default: