fix(security): close backend merge blockers

app/api/v1/rest_router.py

@@ -14,6 +14,7 @@ from pydantic import BaseModel, JsonValue, create_model
 from starlette.responses import Response
 
 from app.api.problem_details import ProblemDetails
+from app.api.pagination import PaginatedList
 from app.api.v1.router import api_router as handler_api_router
 from app.auth.metadata_dependencies import get_current_metadata_user
 from app.auth.project_dependencies import ProjectContext, get_project_context
@@ -41,8 +42,8 @@ _PUBLIC_PARAMETER_RENAMES = {
     "burst_ID": "burst_id",
     "drainage_node_ID": "drainage_node_id",
 }
-_MODEL_NAME_IS_NETWORK = {"RunSimulationManuallyByDate"}
-_MODEL_USERNAME_FROM_AUTH: set[str] = set()
+_MODEL_NAME_IS_NETWORK = {"RunSimulationManuallyByDate", "PressureSensorPlacement"}
+_MODEL_USERNAME_FROM_AUTH = {"PressureSensorPlacement"}
 
 
 def _clean_name(name: str) -> str:
@@ -230,9 +231,14 @@ def _with_pagination(endpoint):
         if not isinstance(result, list):
             return result
         if handler_handles_pagination:
+            if not isinstance(result, PaginatedList):
+                raise RuntimeError(
+                    f"Paginated handler {endpoint.__name__!r} must return "
+                    "PaginatedList with the real total"
+                )
             return Page(
                 items=result,
-                total=offset + len(result),
+                total=result.total,
                 limit=limit or len(result),
                 offset=offset,
             )