fix(scale): page mail and batch roles

JobTrackerApi/Controllers/CorrespondenceController.cs

@@ -51,14 +51,48 @@ namespace JobTrackerApi.Controllers
             int LabelCount,
             int AttachmentCount);
 
+        public sealed record CorrespondenceInboxPageDto(
+            List<CorrespondenceInboxItemDto> Items,
+            int Page,
+            int PageSize,
+            int Total,
+            int TotalPages);
+
         [HttpGet]
         public async Task<ActionResult<List<CorrespondenceInboxItemDto>>> GetInbox(
             [FromQuery] string? q,
             [FromQuery] string? direction,
             [FromQuery] string? linkState,
             CancellationToken cancellationToken)
+        {
+            var query = BuildInboxQuery(q, direction, linkState);
+            var items = await LoadInboxItemsAsync(query, 0, 200, cancellationToken);
+            return Ok(items);
+        }
+
+        [HttpGet("page")]
+        public async Task<ActionResult<CorrespondenceInboxPageDto>> GetInboxPage(
+            [FromQuery] string? q,
+            [FromQuery] string? direction,
+            [FromQuery] string? linkState,
+            [FromQuery] int page = 1,
+            [FromQuery] int pageSize = 50,
+            CancellationToken cancellationToken = default)
+        {
+            page = Math.Max(1, page);
+            pageSize = Math.Clamp(pageSize, 1, 100);
+            var query = BuildInboxQuery(q, direction, linkState);
+            var total = await query.CountAsync(cancellationToken);
+            var totalPages = total == 0 ? 0 : (int)Math.Ceiling(total / (double)pageSize);
+            if (totalPages > 0) page = Math.Min(page, totalPages);
+            var items = await LoadInboxItemsAsync(query, (page - 1) * pageSize, pageSize, cancellationToken);
+            return Ok(new CorrespondenceInboxPageDto(items, page, pageSize, total, totalPages));
+        }
+
+        private IQueryable<Correspondence> BuildInboxQuery(string? q, string? direction, string? linkState)
         {
             var query = _db.Correspondences
+                .AsNoTracking()
                 .Include(c => c.JobApplication)
                 .ThenInclude(j => j.Company)
                 .AsQueryable();
@@ -88,9 +122,20 @@ namespace JobTrackerApi.Controllers
                 query = query.Where(c => c.ExternalThreadId == null);
             }
 
+            return query;
+        }
+
+        private static async Task<List<CorrespondenceInboxItemDto>> LoadInboxItemsAsync(
+            IQueryable<Correspondence> query,
+            int skip,
+            int take,
+            CancellationToken cancellationToken)
+        {
             var rows = await query
                 .OrderByDescending(c => c.Date)
-                .Take(200)
+                .ThenByDescending(c => c.Id)
+                .Skip(skip)
+                .Take(take)
                 .Select(c => new
                 {
                     c.Id,
@@ -132,7 +177,7 @@ namespace JobTrackerApi.Controllers
                 DeserializeLabels(c.ExternalLabelsJson).Count,
                 DeserializeAttachments(c.AttachmentMetadataJson).Count)).ToList();
 
-            return Ok(items);
+            return items;
         }
 
         // GET all messages for a job

JobTrackerApi/Controllers/UsersController.cs

@@ -1,5 +1,6 @@
 using JobTrackerApi.Models;
 using JobTrackerApi.Services;
+using JobTrackerApi.Data;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Identity;
 using Microsoft.AspNetCore.Mvc;
@@ -20,7 +21,8 @@ public sealed class UsersController : ControllerBase
     private readonly ExternalOrigin _externalOrigin;
     private readonly ILogger<UsersController> _logger;
     private readonly AccountDeletionService? _deletions;
-    public UsersController(UserManager<ApplicationUser> users, RoleManager<IdentityRole> roles, IAppEmailSender email, IConfiguration cfg, ILogger<UsersController> logger, ExternalOrigin? externalOrigin = null, AccountDeletionService? deletions = null)
+    private readonly JobTrackerContext? _db;
+    public UsersController(UserManager<ApplicationUser> users, RoleManager<IdentityRole> roles, IAppEmailSender email, IConfiguration cfg, ILogger<UsersController> logger, ExternalOrigin? externalOrigin = null, AccountDeletionService? deletions = null, JobTrackerContext? db = null)
     {
         _users = users;
         _roles = roles;
@@ -28,6 +30,7 @@ public sealed class UsersController : ControllerBase
         _externalOrigin = externalOrigin ?? ExternalOrigin.FromConfiguration(cfg);
         _logger = logger;
         _deletions = deletions;
+        _db = db;
     }
 
     public sealed record UserDto(
@@ -47,6 +50,36 @@ public sealed class UsersController : ControllerBase
     [HttpGet]
     public async Task<ActionResult<List<UserDto>>> List(CancellationToken cancellationToken)
     {
+        if (_db is not null)
+        {
+            var users = await _db.Users.AsNoTracking()
+                .OrderBy(user => user.Email)
+                .ToListAsync(cancellationToken);
+            var roleRows = await (
+                from userRole in _db.UserRoles.AsNoTracking()
+                join role in _db.Roles.AsNoTracking() on userRole.RoleId equals role.Id
+                select new { userRole.UserId, role.Name })
+                .ToListAsync(cancellationToken);
+            var rolesByUser = roleRows
+                .Where(row => !string.IsNullOrWhiteSpace(row.Name))
+                .GroupBy(row => row.UserId)
+                .ToDictionary(group => group.Key, group => group.Select(row => row.Name!).ToList());
+            var relationalAdminCount = roleRows
+                .Where(row => string.Equals(row.Name, "Admin", StringComparison.OrdinalIgnoreCase))
+                .Select(row => row.UserId)
+                .Distinct(StringComparer.Ordinal)
+                .Count();
+            var relationalCurrentUserId = User.FindFirstValue(ClaimTypes.NameIdentifier) ?? User.FindFirstValue("sub");
+
+            return Ok(users.Select(user =>
+            {
+                var roles = rolesByUser.GetValueOrDefault(user.Id) ?? [];
+                return ToDto(user, roles, relationalCurrentUserId, !roles.Contains("Admin", StringComparer.OrdinalIgnoreCase) || relationalAdminCount > 1);
+            }).ToList());
+        }
+
+        // Retained only for isolated controller tests/manual construction. The application DI path
+        // always supplies JobTrackerContext and uses the fixed two-query projection above.
         var items = await _users.Users
             .OrderBy(u => u.Email)
             .ToListAsync(cancellationToken);