Fix bounded OneDrive search pagination

[biglandy71]

Summary

Follow Microsoft Graph continuation pages during OneDrive search while preserving the caller's requested result bound.

What changed

• Send the requested page size to the initial Graph search.
• Follow validated Graph continuation URLs without rewriting their opaque query data.
• Enforce the requested result bound while collecting pages.
• Reject unsafe continuation hosts and collection paths.
• Reject duplicate item IDs, repeated URLs, missing IDs, and pages that make no progress.
• Add focused pagination and continuation validation tests.

Verification

• PATH=/tmp/go1.26.4/bin:$PATH make test
• PATH=/tmp/go1.26.4/bin:$PATH go test ./internal/graphapi

This supports the person-scoped OneDrive document ingestion work in PlanMonster NanoClaw.

[coderabbitai]

📝 Walkthrough

Walkthrough

Changes

Drive search pagination

Layer / File(s)	Summary
Continuation route support internal/graphapi/mail_pages.go	Drive search continuation routes now include the drive ID and query. The parser validates the route syntax, drive ID, and non-empty OData-decoded query.
Bounded search pagination and validation internal/graphapi/drive.go, internal/graphapi/drive_search_test.go	SearchDrive now follows continuations up to top, updates $top with the remaining count, preserves opaque parameters, validates scope and item IDs, and rejects duplicate or non-progressing pages. Tests cover these behaviors.

Sequence Diagram(s)

sequenceDiagram
  participant SearchDrive
  participant MicrosoftGraph
  participant graphCollectionRoute
  SearchDrive->>MicrosoftGraph: Request drive search page
  MicrosoftGraph-->>SearchDrive: Return items and continuation URL
  SearchDrive->>graphCollectionRoute: Validate continuation scope
  graphCollectionRoute-->>SearchDrive: Return validated drive search route
  SearchDrive->>MicrosoftGraph: Request continuation with remaining $top
  MicrosoftGraph-->>SearchDrive: Return next page items

Loading

Merge Risk: 🔵 Low · up to 823ad

Update the continuation expectation before merge so regressions that request more results than remain are caught.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: 6688888a-0c95-4eb0-88ad-2e48331c30f8

📥 Commits

Reviewing files that changed from the base of the PR and between badf96d and f78fb0b.

📒 Files selected for processing (3)

• internal/graphapi/drive.go
• internal/graphapi/drive_search_test.go
• internal/graphapi/mail_pages.go

Included review availability: 4 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: 26f9a429-b4c0-4898-8627-b1fef287679e

📥 Commits

Reviewing files that changed from the base of the PR and between f78fb0b and 823adc7.

📒 Files selected for processing (2)

• internal/graphapi/drive.go
• internal/graphapi/drive_search_test.go

Included review availability: 3 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Use the remaining result limit in the continuation expectation.

After the first page returns two items, SearchDrive needs one more item. This test currently requires $top=3, so it accepts a continuation request that exceeds the caller's remaining limit. Preserve $skiptoken and foo, but expect $top=1.

Proposed test update

-			const wantQuery = "$skiptoken=opaque%20cursor&foo=a%2Bb&$top=3"
+			const wantQuery = "$skiptoken=opaque%20cursor&foo=a%2Bb&$top=1"

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	const wantQuery = "$skiptoken=opaque%20cursor&foo=a%2Bb&$top=3"
	if got := req.URL.RawQuery; got != wantQuery {
	const wantQuery = "$skiptoken=opaque%20cursor&foo=a%2Bb&$top=1"
	if got := req.URL.RawQuery; got != wantQuery {

[biglandy71]

Not changing this. Microsoft Graph documents @odata.nextLink as opaque, so replacing $top=3 with $top=1 would reintroduce the exact issue fixed from the prior review. SearchDrive enforces the remaining bound locally and returns after collecting the third item.

The requested change was implemented in 823adc7. Graph continuation URLs are now validated and followed without query rewriting, with a regression test for percent-escaped opaque parameters.