fix(drive): enforce aggregate query limits

packages/rs-drive/src/query/drive_document_sum_query/drive_dispatcher.rs

@@ -22,6 +22,29 @@ use dpp::platform_value::Value;
 use dpp::version::PlatformVersion;
 use grovedb::TransactionArg;
 
+fn effective_no_proof_distinct_limit(
+    requested_limit: Option<u32>,
+    drive_config: &crate::config::DriveConfig,
+) -> Result<u16, Error> {
+    let effective_limit = requested_limit
+        .unwrap_or(drive_config.default_query_limit as u32)
+        .min(drive_config.max_query_limit as u32);
+
+    if effective_limit == 0 {
+        return Err(Error::Query(
+            crate::error::query::QuerySyntaxError::InvalidLimit(
+                "effective distinct SUM limit must be greater than zero".to_string(),
+            ),
+        ));
+    }
+
+    u16::try_from(effective_limit).map_err(|_| {
+        Error::Query(crate::error::query::QuerySyntaxError::InvalidLimit(
+            "effective distinct SUM limit does not fit u16".to_string(),
+        ))
+    })
+}
+
 #[cfg(feature = "server")]
 impl Drive {
     /// Server-side entry point for the sum surface. Routes a
@@ -66,6 +89,7 @@ impl Drive {
             DocumentSumMode::PerInValue => {
                 let options = RangeSumOptions {
                     return_distinct_sums_in_range: false,
+                    distinct_limit: None,
                     carrier_outer_limit: None,
                     left_to_right: order_by_ascending,
                 };
@@ -87,8 +111,12 @@ impl Drive {
                     request.mode,
                     SumMode::GroupByRange | SumMode::GroupByCompound
                 );
+                let distinct_limit = return_distinct
+                    .then(|| effective_no_proof_distinct_limit(request.limit, request.drive_config))
+                    .transpose()?;
                 let options = RangeSumOptions {
                     return_distinct_sums_in_range: return_distinct,
+                    distinct_limit,
                     carrier_outer_limit: None,
                     left_to_right: order_by_ascending,
                 };
@@ -252,3 +280,37 @@ pub fn where_clauses_from_value(value: &Value) -> Result<Vec<WhereClause>, Error
 pub fn order_clauses_from_value(value: &Value) -> Result<Vec<OrderClause>, Error> {
     crate::query::drive_document_count_query::drive_dispatcher::order_clauses_from_value(value)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::effective_no_proof_distinct_limit;
+    use crate::config::DriveConfig;
+
+    #[test]
+    fn no_proof_distinct_limit_uses_the_default_and_clamps_to_the_maximum() {
+        let config = DriveConfig {
+            default_query_limit: 25,
+            max_query_limit: 100,
+            ..DriveConfig::default()
+        };
+
+        assert_eq!(
+            effective_no_proof_distinct_limit(None, &config).unwrap(),
+            25
+        );
+        assert_eq!(
+            effective_no_proof_distinct_limit(Some(7), &config).unwrap(),
+            7
+        );
+        assert_eq!(
+            effective_no_proof_distinct_limit(Some(10_000), &config).unwrap(),
+            100
+        );
+
+        let disabled = DriveConfig {
+            max_query_limit: 0,
+            ..config
+        };
+        assert!(effective_no_proof_distinct_limit(None, &disabled).is_err());
+    }
+}

packages/rs-drive/src/query/drive_document_sum_query/execute_range_sum.rs

@@ -148,13 +148,17 @@ impl DriveDocumentSumQuery<'_> {
             }]);
         }
 
-        // Distinct mode. Mirror count's analog; currently relies on
-        // `distinct_sum_path_query` which is stubbed (pending port).
-        // Defer to the same builder so the error surfaces cleanly when
-        // distinct mode is requested before the builder body lands.
-        let (path_query_limit, left_to_right) = (None::<u16>, options.left_to_right);
-        let path_query =
-            self.distinct_sum_path_query(path_query_limit, left_to_right, platform_version)?;
+        // Distinct mode must always be bounded before the storage walk.
+        let distinct_limit = options.distinct_limit.ok_or_else(|| {
+            Error::Query(QuerySyntaxError::InvalidLimit(
+                "distinct range SUM execution requires an effective limit".to_string(),
+            ))
+        })?;
+        let path_query = self.distinct_sum_path_query(
+            Some(distinct_limit),
+            options.left_to_right,
+            platform_version,
+        )?;
         let base_path_len = path_query.path.len();
 
         let mut drive_operations = vec![];

packages/rs-drive/src/query/drive_document_sum_query/mod.rs

@@ -269,6 +269,9 @@ pub struct RangeSumOptions {
     /// When `true`, emit one `SumEntry` per distinct in-range value
     /// rather than a single `Aggregate(i64)`.
     pub return_distinct_sums_in_range: bool,
+    /// `Some(n)` caps the distinct range walk before GroveDB materializes
+    /// matching entries. `None` is valid only for non-distinct execution.
+    pub distinct_limit: Option<u16>,
     /// `Some(n)` caps the carrier walk for compound `(In, range)`
     /// shapes at n entries. `None` accepts the platform-wide
     /// `MAX_CARRIER_AGGREGATE_OUTER_RANGE_LIMIT`.