fix #7328

app/Http/Controllers/Api/ApiV1Controller.php

@@ -802,7 +802,7 @@ class ApiV1Controller extends Controller
             'max_id' => 'nullable|integer|min:0|max:'.PHP_INT_MAX,
             'since_id' => 'nullable|integer|min:0|max:'.PHP_INT_MAX,
             'min_id' => 'nullable|integer|min:0|max:'.PHP_INT_MAX,
-            'limit' => 'nullable|integer|min:1|max:40',
+            'limit' => 'nullable|integer|min:1|max:100',
             'only_reposts' => 'nullable',
         ]);
 
@@ -827,7 +827,7 @@ class ApiV1Controller extends Controller
             }
         }
 
-        $limit = min((int) $request->input('limit', 20), 40);
+        $limit = min((int) $request->input('limit', 20), 100);
 
         $profileId = (int) $profile['id'];
         $viewerId = (int) $user->profile_id;

tests/Feature/Api/AccountTest.php

@@ -97,6 +97,41 @@ describe('GET /api/v1/accounts/{id}/statuses', function () {
         expect($pageTwoIds[0] ?? null)->not->toBe($lastId)
             ->and(array_intersect($pageOneIds, $pageTwoIds))->toBeEmpty();
     });
+
+    it('accepts limit=100 as requested by the Portfolio Curate page', function () {
+        // The Portfolio "Curate" page requests limit=100. A strict max:40
+        // validation rule 422'd that request and broke the page (#7328); the
+        // endpoint now allows up to 100.
+        $user = User::factory()->create();
+        $user->refresh();
+        $targetUser = User::factory()->create();
+        $targetUser->refresh();
+        Status::factory()->count(45)->create([
+            'profile_id' => $targetUser->profile_id,
+            'type' => 'photo',
+            'scope' => 'public',
+        ]);
+        Passport::actingAs($user, ['read']);
+
+        $body = $this->getJson("/api/v1/accounts/{$targetUser->profile_id}/statuses?only_media=1&limit=100")
+            ->assertOk()
+            ->assertJsonIsArray()
+            ->json();
+
+        // All 45 media statuses fit under the raised cap of 100.
+        expect(count($body))->toBe(45);
+    });
+
+    it('rejects a limit above the 100 maximum', function () {
+        $user = User::factory()->create();
+        $user->refresh();
+        $targetUser = User::factory()->create();
+        $targetUser->refresh();
+        Passport::actingAs($user, ['read']);
+
+        $this->getJson("/api/v1/accounts/{$targetUser->profile_id}/statuses?limit=101")
+            ->assertStatus(422);
+    });
 });
 
 describe('GET /api/v1/accounts/{id}/followers', function () {