Add paginated user query sproc

[rmartin93]

Adds stored procedure for paginated, filterable user queries

Closes #2

Generated with Claude Code

[claude]

PR Review: Paginated User Query Stored Procedure

✅ Strengths

• Clean, well-documented code with clear usage example
• Proper input validation (page bounds, max page size cap)
• Uses OFFSET/FETCH for pagination (modern T-SQL approach)
• SET NOCOUNT ON for performance
• Returns total count via OUTPUT param for UI pagination

⚠️ Security Concerns

SQL Injection Vulnerability (CRITICAL)
The LIKE pattern concatenation is vulnerable:

WHERE @SearchTerm IS NULL
   OR FirstName LIKE '%' + @SearchTerm + '%'

If @SearchTerm contains % or _, users can perform wildcard attacks. Escape special chars:

-- Add after input validation
SET @SearchTerm = REPLACE(REPLACE(@SearchTerm, '[', '[[]'), '%', '[%]');
SET @SearchTerm = REPLACE(REPLACE(@SearchTerm, ']', '[]]'), '_', '[_]');

🐛 Issues

1. Query Duplication
WHERE clause repeated in COUNT and SELECT - maintenance risk. Consider CTE:

WITH FilteredUsers AS (
    SELECT * FROM Users
    WHERE @SearchTerm IS NULL OR ...
)
SELECT @TotalCount = COUNT(*) FROM FilteredUsers;
SELECT ... FROM FilteredUsers ORDER BY ...

2. Full Table Scan
LIKE '%term%' (leading wildcard) can't use indexes. Performance degrades with large tables.

Recommendations:

• Add full-text search index if supported
• Use FirstName LIKE @SearchTerm + '%' (no leading wildcard) if acceptable
• Consider separate exact-match params

📊 Performance

Missing Index
Add composite index:

CREATE INDEX IX_Users_Name_Email 
ON Users(LastName, FirstName, Email, Username)
INCLUDE (UserId, IsActive, CreatedAt, LastLoginAt);

COUNT(*) Cost
Every request counts all matching rows. For large tables, consider caching or approximate counts.

🧪 Test Coverage

No tests present. Add validation for:

• Edge cases (PageNumber=0, PageSize=1000, NULL SearchTerm)
• Special chars in SearchTerm (%_[])
• Empty result sets
• Case sensitivity

✨ Minor Improvements

• Add @SortOrder param (ASC/DESC) for flexibility
• Return metadata in second result set (TotalPages, CurrentPage)
• Consider TRY/CATCH for error handling

📋 Verdict

Needs fixes before merge - address SQL injection escaping. Otherwise solid foundation per repo conventions (self-contained, well-commented, copy/paste ready).

---

🤖 Generated review via Claude Code

[rmartin93]

@claude can you take a look at this PR Review and make any updates necessary?