fix(projects): server-side validation for name + budget (fix Budget Hours 422) [PMS-324] #243
Loading…
Reference in a new issue
No description provided.
Delete branch "fix/PMS-324-project-input-validation"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
What
Project create/edit accepted invalid input on the server side (PMS-324).
budget_hours/budget_amount(Option<Decimal>) only deserialized from strings, so a numeric budget was rejected by Axum'sJsonextractor as a 422 before validation ran. This is the reported "Budget Hours request failed" (HTTP 422), whilebudget_amount: 500happened to be entered/sent in a form that also tripped it.namehad only a 255-char cap; budgets had no range/scale validation, so non-numeric ("Bobby Tables"), negative, oversized, and more-than-2-decimal values were silently accepted or overflowed theDECIMALcolumn (a 500 class).Changes
f64) so no floating-point drift is introduced.namecapped at 80 characters on create and update (per the PMS-324 decision).validate_budget_amount/validate_budget_hours: reject negatives, more than 2 decimal places, and magnitudes beyond the backingDECIMAL(12,2)/DECIMAL(10,2)columns. Invalid input returns a field-level 422 via the existingAppError::Validationmapping.project_input_validationcovering the numeric-budget path (regression guard for the 422) plus the name-length, negative, >2dp, and non-numeric rejections.Verification
cargo test --lib validation(container): green.cargo test -p mokosh-server --test projects project_input_validationagainst the compose Postgres: green.cargo clippy --all-targets -- -D warningsandcargo fmt --all --check: green.Client-side inline errors for the same form are in MAPPS-176 (linked).
#PMS-324
Project create/edit accepted invalid input. The mokosh-apps client posts budgets as JSON numbers, but budget_hours/budget_amount (Option<Decimal>) only deserialized from strings, so a numeric budget was rejected by Axum's Json extractor as a 422 before validation ran (the reported "Budget Hours request failed"). Name had only a 255-char cap and budgets had no range/scale checks, so non-numeric ("Bobby Tables"), negative, oversized, and more-than-2-decimal values were silently accepted or overflowed the DECIMAL column. Accept a JSON number, numeric string, or null for both budget fields, parsing a number from its exact textual form so no floating-point drift is introduced. Cap name at 80 characters on create and update. Add validate_budget_amount/validate_budget_hours rejecting negatives, more than 2 decimal places, and magnitudes beyond the DECIMAL(12,2)/DECIMAL(10,2) columns; invalid input now returns a field-level 422. Add validator unit tests and an integration test covering the numeric-budget path and each rejection. #PMS-324 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>