fix: api rate limit

internal/repository/post_repo.go

@@ -213,13 +213,41 @@ func (r *PostRepo) ListByUser(ctx context.Context, userID string, limit, offset
 	if err != nil {
 		return nil, 0, err
 	}
+	// id DESC tiebreak must match ListByUserKeyset so the scroll feed's first
+	// (offset) page and its keyset continuation agree on the order of
+	// same-created_at posts — otherwise the keyset page re-returns already-shown
+	// rows, the client's cursor never advances, and it loops forever.
 	q := `SELECT ` + postSelectColumns + postSelectFrom + `
 		WHERE p.user_id = $1 AND p.is_hidden = FALSE AND p.deleted_at IS NULL
-		ORDER BY p.created_at DESC, p.id
+		ORDER BY p.created_at DESC, p.id DESC
 		LIMIT $2 OFFSET $3`
 	return r.collectPosts(ctx, total, q, userID, limit, offset)
 }
 
+// ListByUserKeyset returns the user's visible posts older than the cursor
+// (created_at, id), newest-first — keyset pagination for the Instagram-style
+// scroll feed. A zero beforeAt returns the newest page. No total is computed
+// (infinite scroll infers "more" from a full page, like FeedForViewer). The
+// (created_at, id) DESC ordering matches the tuple comparison so paging never
+// skips or repeats a row even when timestamps tie.
+func (r *PostRepo) ListByUserKeyset(ctx context.Context, userID string, beforeAt time.Time, beforeID string, limit int) ([]model.Post, error) {
+	base := `SELECT ` + postSelectColumns + postSelectFrom + `
+		WHERE p.user_id = $1 AND p.is_hidden = FALSE AND p.deleted_at IS NULL`
+	if beforeAt.IsZero() {
+		q := base + `
+			ORDER BY p.created_at DESC, p.id DESC
+			LIMIT $2`
+		posts, _, err := r.collectPosts(ctx, 0, q, userID, limit)
+		return posts, err
+	}
+	q := base + `
+		  AND (p.created_at < $2 OR (p.created_at = $2 AND p.id < $3))
+		ORDER BY p.created_at DESC, p.id DESC
+		LIMIT $4`
+	posts, _, err := r.collectPosts(ctx, 0, q, userID, beforeAt, beforeID, limit)
+	return posts, err
+}
+
 // ListHiddenByUser returns the owner's hidden posts, newest first — the
 // /u/me "Hidden" tab. Owner-only (the caller enforces auth + scoping).
 func (r *PostRepo) ListHiddenByUser(ctx context.Context, userID string, limit, offset int) ([]model.Post, int, error) {