Sign invoice pagination cursors against query changes

[mikewheeleer]

Summary

A cursor copied between filters or tenants can skip records or reveal ordering information.

Why this matters

This closes a correctness, security, or operability gap in the Liquifact backend and makes the behavior explicit, observable, and safe under failure.

Requirements

• Repository scope: Liquifact/Liquifact-backend only.
• Encode the tenant, normalized query, sort, and position in an integrity-protected cursor; reject mismatches with a safe client error.
• Preserve tenant isolation, structured errors, and existing API compatibility unless the issue explicitly requires a contract change.
• Add focused unit and integration coverage for the new behavior.

Technical guidance

• Follow the repository's existing middleware, service, persistence, logging, and error-envelope conventions.
• Keep side effects bounded and make retries, authorization, and failure handling explicit.
• Document non-obvious tradeoffs and include security notes in the PR.

Edge cases — each must have a test

• cursor reused with another filter
• tampered cursor
• expired cursor
• empty page after deletion
• maximum page size

Acceptance criteria

• Every requirement and edge case above is implemented and tested
• Unit and integration tests cover success, failure, retry, and authorization paths
• Existing tests pass with no regressions
• Errors are structured and do not leak secrets or internal stack details
• npm run lint, npm test, and npm run build passes locally
• Code follows existing conventions with no duplication or dead code
• Documentation or concise comments explain non-obvious decisions
• PR description explains the approach, includes test evidence and security notes, and references Closes #

Out of scope

• switching pagination frameworks

[devfoma]

@devfoma has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

i will love to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @devfoma to this issue.

[drips-wave]

@mikewheeleer devfoma could not be assigned to this issue because they have reached the maximum of 4 accepted assignments per organization in the current wave of the Stellar Wave Program.

The assignee has been removed. Please choose a different contributor.

[axeroofficialtournament-del]

@axeroofficialtournament-del has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hello Maintainer, I have gone through this issue documentation and i am interesting and would love to be assigned this particular issue.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @axeroofficialtournament-del to this issue.

[drips-wave]

Congratulations, @axeroofficialtournament-del! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @axeroofficialtournament-del: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊