fix(web): Stripe key format, change-email/2FA edge, feedback-respond cap (BUNYIP-117) #163
No reviewers
Labels
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
psa-systems/bunyip!163
Loading…
Reference in a new issue
No description provided.
Delete branch "fix/web-edge-117-validation-and-error-surfacing"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Cross-cutting web-edge validation gaps called out by BUNYIP-117. The domain layer is correct in every case; the gap is that bunyip-web posts unbounded / unformatted input to the API and (for several admin POSTs) discards the API result with
let _ = ..., so a backend rejection produces no inline feedback and over-length input lands in the DB cap or round-trips silently.Stripe config (admin.rs::stripe_save): replaced the prior
let _ = update_stripe_config(...).awaitwith a Result match. New edge validation: app_tag bounded to 200 chars, secret_key checked forsk_orrk_prefix and bounded to 255 chars when present, webhook_secret checked forwhsec_prefix and bounded to 255 chars when present. Empty inputs still mean "no change" (the API treats omission as the persisted-value carrier). A newstripe_error_pagehelper renders the page with the supplied inline error so a failed save no longer silently 200-redirects.2FA code inputs (auth_pages.rs::twofa_verify form + dashboard.rs::twofa_setup form): both now carry
pattern="[0-9]{6}" maxlength="6" minlength="6" required. The browser bounds + format-checks before submit; the authoritative check still lives inservices::totp::verify_code. Before this, a non-numeric code round-tripped to the API.Change email (dashboard.rs::settings_email): new_email gets
type="email" maxlength="254" requiredand an inline shape check at the handler via the BUNYIP-115validate::emailhelper, so garbage like "x@y" no longer round-trips. Required attribute on current_password too, with a clean inline message when it is empty.Feedback respond (admin.rs::feedback_respond): bounded the admin response body to 16,000 chars (the same cap chat messages get) so a runaway paste does not silently produce an oversize stored row or oversize outbound email.
Reuses the shared validators in
bunyip-web/src/handlers/validate.rsintroduced by the BUNYIP-112/113/115/122 bundle PR; this commit builds on top of that one.cargo test -p bunyip-weball green,just lintandjust typecheckclean. Deferred to a follow-up: full sweep of the remaininglet _ = ...swallowing sites in admin (entitlement grants, app group set, etc.) - these are lower-frequency surfaces and out of scope for the v1 cross-cutting fix.#BUNYIP-117
Cross-cutting web-edge validation gaps called out by BUNYIP-117. The domain layer is correct in every case; the gap is that bunyip-web posts unbounded / unformatted input to the API and (for several admin POSTs) discards the API result with `let _ = ...`, so a backend rejection produces no inline feedback and over-length input lands in the DB cap or round-trips silently. Stripe config (admin.rs::stripe_save): replaced the prior `let _ = update_stripe_config(...).await` with a Result match. New edge validation: app_tag bounded to 200 chars, secret_key checked for `sk_` or `rk_` prefix and bounded to 255 chars when present, webhook_secret checked for `whsec_` prefix and bounded to 255 chars when present. Empty inputs still mean "no change" (the API treats omission as the persisted-value carrier). A new `stripe_error_page` helper renders the page with the supplied inline error so a failed save no longer silently 200-redirects. 2FA code inputs (auth_pages.rs::twofa_verify form + dashboard.rs::twofa_setup form): both now carry `pattern="[0-9]{6}" maxlength="6" minlength="6" required`. The browser bounds + format-checks before submit; the authoritative check still lives in `services::totp::verify_code`. Before this, a non-numeric code round-tripped to the API. Change email (dashboard.rs::settings_email): new_email gets `type="email" maxlength="254" required` and an inline shape check at the handler via the BUNYIP-115 `validate::email` helper, so garbage like "x@y" no longer round-trips. Required attribute on current_password too, with a clean inline message when it is empty. Feedback respond (admin.rs::feedback_respond): bounded the admin response body to 16,000 chars (the same cap chat messages get) so a runaway paste does not silently produce an oversize stored row or oversize outbound email. Reuses the shared validators in `bunyip-web/src/handlers/validate.rs` introduced by the BUNYIP-112/113/115/122 bundle PR; this commit builds on top of that one. `cargo test -p bunyip-web` all green, `just lint` and `just typecheck` clean. Deferred to a follow-up: full sweep of the remaining `let _ = ...` swallowing sites in admin (entitlement grants, app group set, etc.) - these are lower-frequency surfaces and out of scope for the v1 cross-cutting fix. #BUNYIP-117