fix(admin): add DTO validation to getUsers pagination params (#1910)

[shogun444]

Closes #1910

---

Description

Adds DTO-based validation for AdminController.getUsers pagination parameters to prevent invalid or unbounded pagination requests from reaching the service layer.

What changed?

• Added a new GetUsersQueryDto using class-validator and class-transformer.
• Updated AdminController.getUsers to accept the validated query DTO.
• Applied validated pagination values with defaults (page = 1, limit = 20) before calling the service.
• Added comprehensive validation tests covering valid, invalid, boundary, and default pagination scenarios.

Why was it changed?

Previously, pagination parameters were converted using Number() without validation, allowing invalid, negative, non-integer, or excessively large values. This change ensures invalid requests are rejected with a 400 Bad Request response and enforces a maximum page size.

How was it implemented?

• Introduced GetUsersQueryDto with @IsInt, @Min, @Max, @IsOptional, and @Type(() => Number) decorators.
• Updated the controller to consume the DTO and use validated values when invoking adminService.getUsers.
• Relied on the existing global ValidationPipe for query transformation and validation.
• Added focused controller tests covering type transformation, validation failures, boundary values, and default behavior.

---

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to break)
• Security fix
• Refactor (no functional change)
• Documentation update
• Tests only
• Configuration / DevOps change

---

Test Evidence

Unit Tests

• New unit tests added for changed logic
• All existing unit tests pass

Test output / screenshot:

PASS src/modules/admin/admin.controller.spec.ts
Tests: 13 passed, 13 total

PASS src/modules/admin/admin.service.spec.ts
Tests: 5 passed, 5 total

E2E / Integration Tests

• Tested manually against a local environment

Endpoints tested:

Method	Endpoint	Expected	Result
GET	/admin/users?page=2&limit=50	200 OK	[x]
GET	/admin/users?page=abc	400 Bad Request	[x]
GET	/admin/users?page=0	400 Bad Request	[x]
GET	/admin/users?limit=101	400 Bad Request	[x]

---

Swagger / API Documentation

• Updated DTO validation reflected by the endpoint.
• No breaking API contract changes.

---

Additional Notes for Reviewer

• Pagination query parameters are now validated before reaching the service layer.
• Invalid, non-integer, negative, zero, NaN, and oversized limit values are rejected with 400 Bad Request.
• Existing behavior for valid requests is preserved, with defaults of page = 1 and limit = 20 when parameters are omitted.

[drips-wave]

@shogun444 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[RUKAYAT-CODER]

Thank you for contributing to the project