a36a4cac6b
Validation: the dump validators refuse the nulls their shared types don't allow (a null title or note on creation, a null URL on edit); a playlist title of spaces is refused and titles are stored trimmed; usernames and emails are checked by the same USERNAME_RE and EMAIL_RE in shared/validation.ts on sign-up, on PATCH /api/users/me (which checked other limits) and in the sign-up form. Mentions are read by shared/mention.ts's mentionedUsernames, which skips code and URLs as Markdown shows them: https://mastodon.social/@bob or a `@bob` in code notified bob; the editor's suggestions derive their trigger from the same pattern instead of a copy. Following an unknown user is a 404 rather than a foreign-key 500, and following a private playlist a 404 rather than a 403 that confirmed it exists. `ws` and `emojibase` are reserved category slugs, since the server answers them before the app. GET /api/users/me no longer turns every error into a 500. Dead code goes: adminOnlyMiddleware, verifyEmailTransport, listUsers, deleteUser with disconnectUser and the force_logout message only it sent, PATCH /api/notifications/:id/read (with markOneRead), isSlugAvailable, the unreachable 500 in fetchComment, and the `if (!ctx.state.user)` checks behind authMiddleware. 214 backend and 627 frontend tests pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
51 lines
1.5 KiB
TypeScript
51 lines
1.5 KiB
TypeScript
/**
|
|
* Holds the limits on what users submit, shared so that the forms check the
|
|
* same limits the server enforces.
|
|
*
|
|
* @module
|
|
*/
|
|
|
|
/**
|
|
* Read by the validators and services, which refuse what breaks a limit, and
|
|
* by the forms, which say so before sending. Lengths are JavaScript string
|
|
* lengths, so an emoji may count for two. The category limits are checked on
|
|
* the server only.
|
|
*/
|
|
export const VALIDATION = {
|
|
USERNAME_MIN: 1,
|
|
USERNAME_MAX: 32,
|
|
PASSWORD_MIN: 8,
|
|
PASSWORD_MAX: 128,
|
|
DUMP_TITLE_MAX: 200,
|
|
/** Applies to a dump's note, which the API calls its comment. */
|
|
DUMP_COMMENT_MAX: 5000,
|
|
PLAYLIST_TITLE_MAX: 100,
|
|
PLAYLIST_DESCRIPTION_MAX: 2000,
|
|
COMMENT_BODY_MAX: 5000,
|
|
USER_DESCRIPTION_MAX: 2000,
|
|
CATEGORY_NAME_MAX: 50,
|
|
CATEGORY_SLUG_MAX: 50,
|
|
CHAT_MESSAGE_MAX: 2000,
|
|
} as const;
|
|
|
|
/**
|
|
* Matches a valid username: letters, digits and underscores, within the
|
|
* `VALIDATION` limits. Sign-up checks it on both sides; it is the same `\w`
|
|
* that a mention's pattern reads a name with.
|
|
*/
|
|
export const USERNAME_RE: RegExp = new RegExp(
|
|
`^[a-zA-Z0-9_]{${VALIDATION.USERNAME_MIN},${VALIDATION.USERNAME_MAX}}$`,
|
|
);
|
|
|
|
/**
|
|
* Matches an email address well enough to catch a typo; only the reset email
|
|
* arriving proves it.
|
|
*/
|
|
export const EMAIL_RE: RegExp = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
|
|
|
|
/**
|
|
* The largest file a file dump may hold, in bytes. dump-service refuses a
|
|
* bigger one, and the create form before uploading it.
|
|
*/
|
|
export const DUMP_MAX_FILE_SIZE_BYTES: number = 50 * 1024 * 1024;
|