feat(lagoon): check min and max as length on every non-numeric field (quick-261104-fx1)

- min and max compare the characters of a string or a number's decimal
  form and the element count of a slice or map on any field without
  numeric or integer (Laravel's getSize), with the min.array and
  max.array messages for lists
- blank values, booleans, dates and byte slices are not measured; a
  malformed bound is an error on every non-numeric field
- reverse the 261104-f4x pin, prove it through the cabana settings save
  sequence, and update the README, docs and the storePassword comment

modules/cabana/backend_users_admin.go

@@ -868,9 +868,10 @@ const adminPasswordMinChars = 4
 
 // storePassword hashes a typed password onto user and reports whether one
 // was typed. A password under adminPasswordMinChars characters or over
-// bcrypt's 72-byte limit is a 422 on the field. The length is checked here
-// because the form's min:4 rule is a string rule, which the model validator
-// does not apply.
+// bcrypt's 72-byte limit is a 422 on the field. The form's min:4 rule
+// already refuses a shorter password in lagoon.Validate before this hook
+// runs; the hook repeats the check so it never hashes one, and adds bcrypt's
+// 72-byte limit.
 func (c usersAdmin) storePassword(ctx context.Context, user *BackendUser) (bool, error) {
 	plain := submittedPassword(ctx)
 	if plain == "" {

modules/cabana/settings_string_url_test.go

@@ -14,25 +14,28 @@ import (
 
 // stringURLSettings is a settings model whose rules use the Laravel string
 // and url tokens the way plugin settings models do (title, feed URL,
-// language code).
+// language code); one rule (code) has no string token, so its max is a
+// length all the same.
 type stringURLSettings struct {
 	ID       uint    `gorm:"column:id;primaryKey"`
 	Title    *string `gorm:"column:title"`
 	Website  *string `gorm:"column:website"`
 	Language string  `gorm:"column:language"`
+	Code     *string `gorm:"column:code"`
 }
 
 func (stringURLSettings) TableName() string  { return "cabana_string_url_settings" }
-func (stringURLSettings) Fillable() []string { return []string{"title", "website", "language"} }
+func (stringURLSettings) Fillable() []string { return []string{"title", "website", "language", "code"} }
 func (stringURLSettings) Rules() map[string]string {
 	return map[string]string{
 		"title":    "nullable|string|max:255",
 		"website":  "nullable|url|max:500",
 		"language": "nullable|string|max:10",
+		"code":     "nullable|max:5",
 	}
 }
 
-const stringURLSettingsFields = "fields:\n    title:\n        type: text\n    website:\n        type: text\n    language:\n        type: text\n"
+const stringURLSettingsFields = "fields:\n    title:\n        type: text\n    website:\n        type: text\n    language:\n        type: text\n    code:\n        type: text\n"
 
 func compileStringURLSetting(t *testing.T) *CompiledSetting {
 	t.Helper()
@@ -47,8 +50,9 @@ func compileStringURLSetting(t *testing.T) *CompiledSetting {
 
 // TestSettingsStringURLRules runs the validation sequence of
 // SettingsService.Put without a database: the string and url rules are
-// accepted, valid, empty and null values pass, and an invalid URL is a
-// message on the field.
+// accepted, valid, empty and null values pass, and an invalid URL or an
+// over-long value (with or without the string token) is a message on the
+// field.
 func TestSettingsStringURLRules(t *testing.T) {
 	setting := compileStringURLSetting(t)
 	cases := []struct {
@@ -61,6 +65,9 @@ func TestSettingsStringURLRules(t *testing.T) {
 		{"null website and title", map[string]any{"website": nil, "title": nil}, nil},
 		{"invalid website", map[string]any{"website": "not a url"}, map[string][]string{"website": {"The website format is invalid."}}},
 		{"title too long", map[string]any{"title": strings.Repeat("a", 256)}, map[string][]string{"title": {"The title may not be greater than 255 characters."}}},
+		{"code at max", map[string]any{"code": "abcde"}, nil},
+		{"empty code", map[string]any{"code": ""}, nil},
+		{"code too long", map[string]any{"code": "abcdef"}, map[string][]string{"code": {"The code may not be greater than 5 characters."}}},
 	}
 	for _, tc := range cases {
 		model := &stringURLSettings{}