feat(db): add length limits to unbounded text columns

API/Controller/Admin/DTOs/AddWebhookDto.cs

@@ -1,7 +1,11 @@
-namespace OpenShock.API.Controller.Admin.DTOs;
+using System.ComponentModel.DataAnnotations;
+using OpenShock.Common.Constants;
+
+namespace OpenShock.API.Controller.Admin.DTOs;
 
 public sealed class AddWebhookDto
 {
+    [StringLength(ApiHardLimits.DiscordWebhookNameMaxLength)]
     public required string Name { get; init; }
     public required Uri Url { get; init; }
 }

API/Controller/Admin/DTOs/ConfigurationAddItemRequest.cs

@@ -1,5 +1,6 @@
-using OpenShock.Common.OpenShockDb;
-using System.ComponentModel.DataAnnotations;
+using System.ComponentModel.DataAnnotations;
+using OpenShock.Common.Constants;
+using OpenShock.Common.OpenShockDb;
 
 namespace OpenShock.API.Controller.Admin.DTOs;
 
@@ -13,12 +14,14 @@ public sealed class ConfigurationAddItemRequest
     /// Must consist of uppercase letters and underscores only.
     /// </summary>
     [Required(AllowEmptyStrings = false)]
+    [StringLength(ApiHardLimits.ConfigurationNameMaxLength)]
     public required string Name { get; init; }
 
     /// <summary>
     /// A human-readable description of the configuration item’s purpose.
     /// </summary>
     [Required(AllowEmptyStrings = true)]
+    [StringLength(ApiHardLimits.ConfigurationDescriptionMaxLength)]
     public required string Description { get; init; }
 
     /// <summary>
@@ -32,5 +35,6 @@ public sealed class ConfigurationAddItemRequest
     /// Must conform to the format required by <see cref="Type"/>.
     /// </summary>
     [Required(AllowEmptyStrings = true)]
+    [StringLength(ApiHardLimits.ConfigurationValueMaxLength)]
     public required string Value { get; init; }
 }

API/Controller/Admin/DTOs/ConfigurationUpdateItemRequest.cs

@@ -1,5 +1,6 @@
-using OpenShock.Common.OpenShockDb;
-using System.ComponentModel.DataAnnotations;
+using System.ComponentModel.DataAnnotations;
+using OpenShock.Common.Constants;
+using OpenShock.Common.OpenShockDb;
 
 namespace OpenShock.API.Controller.Admin.DTOs;
 
@@ -15,16 +16,19 @@ public sealed class ConfigurationUpdateItemRequest
     /// Must consist only of uppercase letters and underscores.
     /// </summary>
     [Required(AllowEmptyStrings = false)]
+    [StringLength(ApiHardLimits.ConfigurationNameMaxLength)]
     public required string Name { get; init; }
 
     /// <summary>
     /// (Optional) New description for the configuration item.
     /// </summary>
+    [StringLength(ApiHardLimits.ConfigurationDescriptionMaxLength)]
     public string? Description { get; init; }
 
     /// <summary>
     /// (Optional) New value for the configuration item.
     /// Must match the format expected by its existing <see cref="ConfigurationValueType"/>.
     /// </summary>
+    [StringLength(ApiHardLimits.ConfigurationValueMaxLength)]
     public string? Value { get; init; }
 }

API/Services/Account/AccountService.cs

@@ -234,7 +234,7 @@ public async Task<AccountCreationResult> CreateOAuthOnlyAccountAsync(
                 UserId = user.Id,
                 ProviderKey = provider,
                 ExternalId = providerAccountId,
-                DisplayName = providerAccountName,
+                DisplayName = providerAccountName?.Truncate(ApiHardLimits.OAuthDisplayNameMaxLength),
                 CreatedAt = creationTime,
             });
 

API/Services/OAuthConnection/OAuthConnectionService.cs

@@ -1,8 +1,10 @@
 using Microsoft.EntityFrameworkCore;
 using Npgsql;
+using OpenShock.Common.Constants;
 using OpenShock.Common.Models;
 using OpenShock.Common.OpenShockDb;
 using OpenShock.Common.Services.Audit;
+using OpenShock.Common.Utils;
 
 namespace OpenShock.API.Services.OAuthConnection;
 
@@ -58,7 +60,7 @@ public async Task<bool> TryAddConnectionAsync(Guid userId, string provider, stri
                 UserId = userId,
                 ProviderKey = provider.ToLowerInvariant(),
                 ExternalId = providerAccountId,
-                DisplayName = providerAccountName
+                DisplayName = providerAccountName?.Truncate(ApiHardLimits.OAuthDisplayNameMaxLength)
             });
             await _db.SaveChangesAsync();
         }

Common.Tests/Utils/StringUtilsTests.cs

@@ -45,4 +45,18 @@ public async Task Truncate_MaxOne_ReturnsSingleChar()
         var result = "hello".Truncate(1);
         await Assert.That(result).IsEqualTo("h");
     }
+
+    [Test]
+    public async Task Truncate_CutInsideSurrogatePair_DropsWholePair()
+    {
+        var result = "abc😀".Truncate(4);
+        await Assert.That(result).IsEqualTo("abc");
+    }
+
+    [Test]
+    public async Task Truncate_CutAfterSurrogatePair_KeepsPair()
+    {
+        var result = "abc😀def".Truncate(5);
+        await Assert.That(result).IsEqualTo("abc😀");
+    }
 }

Common/Constants/ApiHardLimits.cs

@@ -1,5 +1,3 @@
-using OpenShock.Internal.Common.Constants;
-
 namespace OpenShock.Common.Constants;
 
 /// <summary>
@@ -27,6 +25,17 @@ public static class ApiHardLimits
     public const int PasswordResetSecretMaxLength = 100;
     public const int AuditReasonMaxLength = 512;
 
+    public const int ConfigurationNameMaxLength = 64;
+    public const int ConfigurationDescriptionMaxLength = 255;
+    public const int ConfigurationValueMaxLength = 4096;
+
+    public const int OAuthProviderKeyMaxLength = 16;
+    public const int OAuthExternalIdMaxLength = 255;
+    public const int OAuthDisplayNameMaxLength = 64;
+
+    public const int DiscordWebhookNameMaxLength = 64;
+    public const int DiscordWebhookTokenMaxLength = 255;
+
     public const int MaxTurnstileResponseTokenLength = 2048; // https://developers.cloudflare.com/turnstile/get-started/server-side-validation/
 
     // Don't allow any firmware prior to 2024.