From 617eaef78eb3692704534805397f8d8f8032038c Mon Sep 17 00:00:00 2001 From: Jakub Zych Date: Wed, 4 Nov 2026 11:05:55 +0100 Subject: [PATCH] docs: capture todo - Enforce min/max length on text fields in lagoon.Validate --- ...-validate-min-max-length-on-text-fields.md | 37 +++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 .planning/todos/pending/2026-11-04-lagoon-validate-min-max-length-on-text-fields.md diff --git a/.planning/todos/pending/2026-11-04-lagoon-validate-min-max-length-on-text-fields.md b/.planning/todos/pending/2026-11-04-lagoon-validate-min-max-length-on-text-fields.md new file mode 100644 index 00000000..aa661bfc --- /dev/null +++ b/.planning/todos/pending/2026-11-04-lagoon-validate-min-max-length-on-text-fields.md @@ -0,0 +1,37 @@ +--- +created: 2026-11-04T10:05:42.444Z +title: Enforce min/max length on text fields in lagoon.Validate +area: database +severity: major +files: + - modules/lagoon/validate.go:163 + - modules/lagoon/README.md + - docs/database/casts-and-validation.md + - modules/phrasebook/lang/pl/validation.yaml +--- + +## Problem + +`lagoon.Validate` (the model validator used by cabana admin saves, including +settings screens at `modules/cabana/settings.go:267`) does not check `min`/`max` +on non-numeric fields: the tags loop around `validate.go:163` skips them. So +`nullable|max:255`, or the README example `required|max:255|unique:posts`, +accept a value of any length, although the docs say min/max compare length. + +Quick task 261104-f4x (adds the `string` and `url` rules) enforces length only +when `string` or `url` is present, to avoid changing behaviour for existing +rules. The general gap remains. + +The request validator (`validate_rules.go`, Laravel semantics) already treats +min/max as length on strings; the two validators disagree. + +Also: `modules/phrasebook/lang/pl/validation.yaml` still has an English +`string:` message. + +## Solution + +Decide whether to enforce length for every non-numeric `min`/`max` (Laravel +behaviour). Risk: a plugin whose stored values already exceed a declared limit +would start failing admin saves for those records; audit plugin `Rules()` and +`fields.yaml` rules (core plugins: user, blog, pages, payment, journal) before +switching, and call it out in release notes. Translate the pl `string:` line.