How to Paginate Whoosh Search Results with Offsets and Page Counts

·1 views

Whoosh, the pure-Python full-text search library, includes a built-in helper called search_page that simplifies paginating search results in web applications. The method returns a ResultsPage object carrying metadata such as total hit count, current page number, total page count, and a flag to determine when to hide the 'Next' button. Unlike manual slicing with results[20:30], search_page avoids common pitfalls like off-by-one errors and inaccurate totals, and it only computes enough of the result set to serve the requested page. If a user requests a page number beyond the available range, Whoosh automatically clamps it to the last valid page rather than returning an error or empty result. Developers are advised to render results inside the searcher context block, as hit data is tied to the active searcher instance.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

MCP OAuth Confirms Identity But Cannot Authorize Individual Tool Calls

The 2026-07-28 MCP specification strengthens authentication through issuer validation, CIMD direction, and Mcp-Method/Mcp-Name headers, but these advances address only identity verification. Authentication (AuthN) confirms who is making a request, while tool-call authorization is a separate decision determining whether that principal may execute a specific tool in a given context. Risk levels vary significantly across operations — a read action carries far less risk than a financial transaction or a destructive database command. A recommended architecture routes requests through an MCP client, gateway, and Policy Decision Point (PDP) before reaching the MCP server, with deny-by-default rules and step-up checks applied to high-risk operations.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How JWT Tokens Carry Identity and Permissions Across Microservices

In microservice architectures, every request requires context about who is making it and what they are allowed to do, which is handled through JWT access tokens created at login. A User Profiles Service issues these tokens via two endpoints — one returning a full login response and another returning only a Bearer token for callers that already have user context. Before generating a token, the service verifies the user's password, resolves their relationships to projects, accounts, and organizations, and retrieves permissions from a dedicated permissions service. The resulting JWT payload contains not just a user ID but a full security context including project, account, organization, group, and per-service permission mappings. This graph-like linking model ensures that authorization decisions across services are based on verified, structured context rather than raw request headers.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Dev.to's Underused API Can Reconstruct Your Full Follower History in One Pull

A developer who has been publishing on Dev.to since April 2017 used the platform's largely overlooked public API to analyse nine years of their own writing and audience data. By querying the followers endpoint with the correct v1 accept header and a per_page value of 1000, they reduced a 227-request operation to just 19 calls. A key discovery was that each follower record includes a created_at timestamp, allowing the entire follower growth curve to be reconstructed retroactively from a single API pull rather than daily snapshots. However, the dataset only reflects current followers, meaning anyone who unfollowed is absent and the resulting curve rises monotonically, masking any real-world declines. The author notes that omitting the v1 accept header silently returns older v0 data with no error, a subtle gotcha that can cause documented fields to appear missing.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build Production-Grade Mobile Apps With Failure-First Architecture

A technical guide published on DEV Community outlines a failure-first approach to designing production-grade mobile applications, arguing that real engineering complexity lies beneath seemingly simple user interactions. The guide emphasizes defining clear system boundaries and layer ownership — separating presentation, domain, and data concerns — rather than starting with a list of screens. It warns against representing UI state with unrelated booleans, which can produce impossible combinations, and instead recommends sealed state interfaces to model meaningful transitions explicitly. The principles discussed are framework-neutral but are said to apply well to Kotlin/Android, Swift/iOS, Flutter, and React Native. The article also addresses offline-first behavior, network failure handling, and recovery strategies as essential considerations for scalable mobile codebases.

0 comments Read more at DEV Community