More parameter checking and a custom not-found page.

lib/MyApp.pm

@@ -18,6 +18,11 @@ sub add_my_helpers ($self) {
    $self->helper(
       logname => sub ($self) { $self->session('logname'); }
    );
+   $self->helper(
+      max_rpp => sub ($self) {
+         return $self->config->{'maximum-rows-per-page'};
+      }
+   );
    $self->helper(
       rpp => sub ($self) {
          $self->session('rows_per_page') // $self->default_rpp;

lib/MyApp/Controller/Auth.pm

@@ -1,6 +1,6 @@
 package MyApp::Controller::Auth;
 use Mojo::Base 'Mojolicious::Controller', -signatures;
-
+use List::Util qw( min max );
 
 sub index ($self) {
    my $msg = $self->flash('err');
@@ -27,7 +27,11 @@ sub logout ($self) {
 }
 
 sub preferences ($self) {
-   $self->session(rows_per_page => $self->param('rows_per_page'));
+   $self->session(
+      rows_per_page => max(
+         1, min($self->max_rpp, $self->param('rows_per_page'))
+      )
+   );
    $self->flash(
       confirmation => sprintf("Updated rows per page to %s.", $self->rpp)
    );

lib/MyApp/Controller/Book.pm

@@ -5,39 +5,70 @@ use MyModel::Author;
 
 sub books ($self) {
    my $page_number = $self->param('page_number') // 1;
+   if ($page_number < 1) {
+      $self->redirect_to('not_found');
+      return;
+   }
    my $book_model = MyModel::Book->new(rows_per_page => $self->rpp);
    my $book_page = $book_model->get_page(
       $page_number,
       $self->param('title_like'),
    );
+   my $pager = $book_page->pager;
+   if ($page_number > $pager->last_page) {
+      $self->redirect_to('not_found');
+      return;
+   }
    $self->render(
       book_page => $book_page,
-      pager => $book_page->pager,
+      pager => $pager,
    );
 }
 
 sub authors ($self) {
    my $page_number = $self->param('page_number') // 1;
+   if ($page_number < 1) {
+      $self->redirect_to('not_found');
+      return;
+   }
    my $author_model = MyModel::Author->new(rows_per_page => $self->rpp);;
    my $author_page = $author_model->get_page(
       $page_number,
       $self->param('name_like'),
    );
+   my $pager = $author_page->pager;
+   if ($page_number > $pager->last_page) {
+      $self->redirect_to('not_found');
+      return;
+   }
    $self->render(
       author_page => $author_page,
-      pager => $author_page->pager,
+      pager => $pager,
    );
 }
 
 sub author ($self) {
    my ($id, $page_number) = ($self->param('id'), $self->param('page_number'));
+   if ($page_number < 1) {
+      $self->redirect_to('not_found');
+      return;
+   }
    my ($author, $book_page) = MyModel::Author->new(
       rows_per_page => $self->rpp
    )->find_by_id($id, $page_number);
+   if (!defined $author) {
+      $self->redirect_to('not_found');
+      return;
+   }
+   my $pager = $book_page->pager;
+   if ($page_number > $pager->last_page) {
+      $self->redirect_to('not_found');
+      return;
+   }
    $self->render(
       author => $author,
       book_page => $book_page,
-      pager => $book_page->pager,
+      pager => $pager,
    );
 }
 

lib/MyModel.pm

@@ -7,10 +7,10 @@ use Book::Schema;
 use List::Util qw( max min );
 no warnings qw( experimental::signatures );
 
-# Keep rows-per-page within a sane range.
+# Keep rows-per-page within a somewhat-sane range.
 subtype 'RowsPerPage',
    as 'Int',
-   where { 5 <= $_ && $_ <= 100 };
+   where { 1 <= $_ && $_ <= 1000 };
 
 has 'rows_per_page' => (
    is => 'rw',

lib/MyModel/Author.pm

@@ -21,6 +21,7 @@ sub get_page ($self, $page_number = 1, $name_like = undef) {
 
 sub find_by_id ($self, $id, $page_number = 1) {
    my $author = $self->schema->resultset('Author')->find({ id => $id });
+   return (undef, undef) if (!defined $author);
    my $book_page = $author->books_rs->search(
       undef,
       {  order_by => [ "me.title" ],

my_app.yml

@@ -2,3 +2,4 @@
 secrets:
   - 197b9b0060f3285c0909d83598e54f9ec0602151
 default-rows-per-page: 10
+maximum-rows-per-page: 100

t/notfound.t

@@ -0,0 +1,21 @@
+use Mojo::Base -strict;
+
+use Test2::V0;
+use Test::Mojo;
+
+my $t = Test::Mojo->new('MyApp');
+
+# Page zero gets a redirect.
+$t->get_ok('/books/0')->status_is(302);
+
+# Now follow redirects and verify it's a 404.
+$t->ua->max_redirects(10);
+$t->get_ok('/books/0')->status_is(404);
+
+# Likewise for a too-high page number.
+$t->get_ok('/books/999?title_like=qxqxqxqx')->status_is(404);
+
+# Or non-existent author.
+$t->get_ok('/author/0/1')->status_is(404);
+
+done_testing();

templates/auth/account.html.ep

@@ -5,7 +5,7 @@
 %= form_for preferences => begin
 %= label_for rows_per_page => 'Rows per page'
 <%= number_field rows_per_page => $c->rpp,
-   min => 5, max => 100, maxlength => 4, size => 4 %>
+   min => 1, max => max_rpp, maxlength => 4, size => 4 %>
 %= submit_button "Update"
 % end
 <p/>

templates/not_found.html.ep

@@ -0,0 +1,5 @@
+% layout 'default';
+% title "Not found";
+<h1><%= title %></h1>
+
+Sorry, no such page.