fix: ignore items-per-page values below 1

packages/web-pkg/src/composables/pagination/usePagination.ts

@@ -105,8 +105,9 @@ function createPerPageRef<T>(options: PaginationOptions<T>): ComputedRef<number>
   return computed(() => {
     // the route query is populated asynchronously, so it can still be missing on
     // the first render. Falling back to the default keeps `items` from returning
-    // the whole (potentially huge) list for one render pass.
+    // the whole (potentially huge) list for one render pass. Values below 1 (e.g.
+    // from a manipulated URL) would break the page count, so they fall back too.
     const perPage = parseInt(queryItemAsString(unref(perPageQuery)))
-    return isNaN(perPage) ? parseInt(perPageDefault) : perPage
+    return isNaN(perPage) || perPage < 1 ? parseInt(perPageDefault) : perPage
   })
 }

packages/web-pkg/tests/unit/composables/pagination/usePagination.spec.ts

@@ -77,6 +77,34 @@ describe('usePagination', () => {
         { mocks, provide: mocks }
       )
     })
+    it.each(['0', '-1'])(
+      'falls back to the default for the invalid route query value %s',
+      async (itemsPerPage) => {
+        const router = createRouter({ routes: [{ path: '/', redirect: null }] })
+        router.push({ path: '/', query: { 'items-per-page': itemsPerPage } })
+        await router.isReady()
+
+        const mocks = { $router: router }
+        getComposableWrapper(
+          () => {
+            const {
+              items: paginatedItems,
+              perPage,
+              total
+            } = usePagination({
+              items: ref([1, 2, 3, 4, 5, 6]),
+              perPageDefault: '100',
+              perPageStoragePrefix: 'unit-tests'
+            })
+
+            expect(unref(perPage)).toBe(100)
+            expect(unref(total)).toBe(1)
+            expect(unref(paginatedItems)).toEqual([1, 2, 3, 4, 5, 6])
+          },
+          { mocks, provide: mocks }
+        )
+      }
+    )
   })
   describe('event bus subscription', () => {
     it('unsubscribes from the page navigation event on unmount', () => {