fix: impose character limits on comment (#712)

libs/app-error/src/lib.rs

@@ -122,6 +122,9 @@ pub enum AppError {
 
   #[error("{0}")]
   AIServiceUnavailable(String),
+
+  #[error("{0}")]
+  StringLengthLimitReached(String),
 }
 
 impl AppError {
@@ -182,6 +185,7 @@ impl AppError {
       AppError::Utf8Error(_) => ErrorCode::Internal,
       AppError::PublishNamespaceAlreadyTaken(_) => ErrorCode::PublishNamespaceAlreadyTaken,
       AppError::AIServiceUnavailable(_) => ErrorCode::AIServiceUnavailable,
+      AppError::StringLengthLimitReached(_) => ErrorCode::StringLengthLimitReached,
     }
   }
 }
@@ -294,6 +298,7 @@ pub enum ErrorCode {
   PublishNamespaceAlreadyTaken = 1031,
   AIServiceUnavailable = 1032,
   AIResponseLimitExceeded = 1033,
+  StringLengthLimitReached = 1034,
 }
 
 impl ErrorCode {

src/biz/workspace/ops.rs

@@ -35,6 +35,8 @@ use crate::biz::user::user_init::initialize_workspace_for_user;
 use crate::mailer::{Mailer, WorkspaceInviteMailerParam};
 use crate::state::GoTrueAdmin;
 
+const MAX_COMMENT_LENGTH: usize = 5000;
+
 pub async fn delete_workspace_for_user(
   pg_pool: &PgPool,
   workspace_id: &Uuid,
@@ -186,6 +188,11 @@ pub async fn create_comment_on_published_view(
   content: &str,
   user_uuid: &Uuid,
 ) -> Result<(), AppError> {
+  if content.len() > MAX_COMMENT_LENGTH {
+    return Err(AppError::StringLengthLimitReached(
+      "comment content exceed limit".to_string(),
+    ));
+  }
   insert_comment_to_published_view(pg_pool, view_id, user_uuid, content, reply_comment_id).await?;
   Ok(())
 }

tests/workspace/publish.rs

@@ -414,6 +414,42 @@ async fn test_publish_comments() {
   assert!(published_view_comments.iter().all(|c| !c.can_be_deleted));
 }
 
+#[tokio::test]
+async fn test_excessive_comment_length() {
+  let (client, _) = generate_unique_registered_user_client().await;
+  let workspace_id = get_first_workspace_string(&client).await;
+  let published_view_namespace = uuid::Uuid::new_v4().to_string();
+  client
+    .set_workspace_publish_namespace(&workspace_id.to_string(), &published_view_namespace)
+    .await
+    .unwrap();
+
+  let publish_name = "published-view";
+  let view_id = uuid::Uuid::new_v4();
+  client
+    .publish_collabs::<MyCustomMetadata, &[u8]>(
+      &workspace_id,
+      vec![PublishCollabItem {
+        meta: PublishCollabMetadata {
+          view_id,
+          publish_name: publish_name.to_string(),
+          metadata: MyCustomMetadata {
+            title: "some_title".to_string(),
+          },
+        },
+        data: "yrs_encoded_data_1".as_bytes(),
+      }],
+    )
+    .await
+    .unwrap();
+
+  let resp = client
+    .create_comment_on_published_view(&view_id, "a".repeat(5001).as_str(), &None)
+    .await;
+  assert!(resp.is_err());
+  assert_eq!(resp.unwrap_err().code, ErrorCode::StringLengthLimitReached);
+}
+
 #[tokio::test]
 async fn test_publish_reactions() {
   let (page_owner_client, _) = generate_unique_registered_user_client().await;