Setting `after` parameter for `/carves` endpoint returns error

[getvictor]

Fleet version: Fleet 4.38.1

Web browser and operating system: macOS

---

💥  Actual behavior

Specifying an after parameter for /carves endpoint causes an error.

This parameter is not documented, so this is not an urgent issue. But we should fix the error and document the parameter.

🧑‍💻  Steps to reproduce

curl -k -i -H "Authorization: Bearer $TEST_TOKEN" "https://localhost:8080/api/v1/fleet/carves?order_key=carve_size&after=809472"
HTTP/2 422
content-type: application/json; charset=utf-8
content-length: 317
date: Mon, 16 Oct 2023 14:58:14 GMT

{
  "message": "Validation Failed",
  "errors": [
    {
      "name": "base",
      "reason": "Error 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '? ORDER BY `carve_size` ASC LIMIT 1000000' at line 16"
    }
  ]
}

🕯️ More info (optional)

It appears that the after value is not being set in the SQL statement. Here's the relevant log from server:
level=error ts=2023-10-16T15:04:13.717676Z component=sql-interceptor duration=716.875µs query="SELECT id, host_id, created_at, name, block_count, block_size, carve_size, carve_id, request_id, session_id, expired, max_block, error FROM carve_metadata WHERE NOT expired AND carve_size> ? ORDER BYcarve_sizeASC LIMIT 1000000" args={} err="Error 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '? ORDER BYcarve_size ASC LIMIT 1000000' at line 16"

[noahtalerman]

@zwass is the /after parameter supported? If so, then this should be supported.

If not, then we should update the error message to say something like "this parameter isn't supported."

[zwass]

I don't feel strongly. If it's relatively easy to support it here (which I think it is), I'd say we fix it. Otherwise I agree with improving the error message.

[noahtalerman]

@rachaelshaw what error message should we show instead?

cc @getvictor

[rachaelshaw]

@rachaelshaw what error message should we show instead?

@noahtalerman @getvictor left a comment on Victor's PR— the error message looks good, just left one small formatting suggestion 👍