docs: capture todo - Enforce min/max length on text fields in lagoon.Validate

.planning/todos/pending/2026-11-04-lagoon-validate-min-max-length-on-text-fields.md

@@ -0,0 +1,37 @@
+---
+created: 2026-11-04T10:05:42.444Z
+title: Enforce min/max length on text fields in lagoon.Validate
+area: database
+severity: major
+files:
+  - modules/lagoon/validate.go:163
+  - modules/lagoon/README.md
+  - docs/database/casts-and-validation.md
+  - modules/phrasebook/lang/pl/validation.yaml
+---
+
+## Problem
+
+`lagoon.Validate` (the model validator used by cabana admin saves, including
+settings screens at `modules/cabana/settings.go:267`) does not check `min`/`max`
+on non-numeric fields: the tags loop around `validate.go:163` skips them. So
+`nullable|max:255`, or the README example `required|max:255|unique:posts`,
+accept a value of any length, although the docs say min/max compare length.
+
+Quick task 261104-f4x (adds the `string` and `url` rules) enforces length only
+when `string` or `url` is present, to avoid changing behaviour for existing
+rules. The general gap remains.
+
+The request validator (`validate_rules.go`, Laravel semantics) already treats
+min/max as length on strings; the two validators disagree.
+
+Also: `modules/phrasebook/lang/pl/validation.yaml` still has an English
+`string:` message.
+
+## Solution
+
+Decide whether to enforce length for every non-numeric `min`/`max` (Laravel
+behaviour). Risk: a plugin whose stored values already exceed a declared limit
+would start failing admin saves for those records; audit plugin `Rules()` and
+`fields.yaml` rules (core plugins: user, blog, pages, payment, journal) before
+switching, and call it out in release notes. Translate the pl `string:` line.