[kiel997]

closes #636

What

Constrains payment queries to supported statuses, valid date ranges and bounded pages.

Changes

• PaymentQuery: added status (validated against PaymentStatus), fromDate/toDate (ISO dates, toDate >= fromDate, range capped at 366 days) and an upper bound on page (10,000; limit was already capped at 100 by PaginationDto)
• PaymentFailureQueryDto: fromDate/toDate are now validated as ISO dates with the same range rule (previously any string was accepted)
• FindPaymentsProvider applies the new filters with andWhere, so non-admin users stay scoped to their own payments
• A date-only toDate includes the whole day
• Tests for malformed filters and for user vs staff/admin scoping

Testing

jest payments.service.spec → 17 passed

Notes

• Whole-project TypeScript builds already fail on main (bookings, email queue, missing packages), so I ran jest with diagnostics off and type-checked only the files I changed.
• The 366-day maximum and the page cap of 10,000 are my choices; happy to change them.
• page is redeclared in PaymentQuery because PaginationDto has no upper bound and is outside this task's scope.

[drips-wave]

@kiel997 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[kiel997]

please kindly review

[Qoder-Voidd]

LGTM