Try to enforce channel limts?

1 files changed, 27 insertions, 1 deletions

diff --git a/src/api/routes/channels/#channel_id/index.ts b/src/api/routes/channels/#channel_id/index.ts

index a1db91373..37767574d 100644
--- a/src/api/routes/channels/#channel_id/index.ts
+++ b/src/api/routes/channels/#channel_id/index.ts
@@ -17,7 +17,19 @@
 */
 
 import { route } from "@spacebar/api";
-import { Channel, ChannelDeleteEvent, ChannelUpdateEvent, Recipient, emitEvent, handleFile } from "@spacebar/util";
+import {
+    Channel,
+    ChannelDeleteEvent,
+    ChannelUpdateEvent,
+    Recipient,
+    emitEvent,
+    handleFile,
+    Config,
+    FieldError,
+    ErrorList,
+    ObjectErrorContent,
+    makeObjectErrorContent,
+} from "@spacebar/util";
 import { Request, Response, Router } from "express";
 import { ChannelModifySchema, ChannelType } from "@spacebar/schemas";
 
@@ -174,6 +186,7 @@ router.patch(
                 channel.available_tags = channel.available_tags.filter((_) => filter.has(_.id));
             }
         }
+
         if (payload.applied_tags) {
             if (channel.isThread()) {
                 const parent = await Channel.findOneOrFail({
@@ -201,6 +214,19 @@ router.patch(
 
         if (payload.icon) payload.icon = await handleFile(`/channel-icons/${channel_id}`, payload.icon);
 
+        const channelLimits = Config.get().limits.channel;
+
+        const errors: ErrorList = {};
+        if (payload.name && (payload.name.length < 1 || payload.name.length > channelLimits.maxName))
+            errors["name"] = makeObjectErrorContent("BASE_TYPE_BAD_LENGTH", `Channel name must be between 1 and ${channelLimits.maxName} characters`);
+        if (payload.topic !== undefined && payload.topic.length > channelLimits.maxTopic)
+            errors["topic"] = makeObjectErrorContent("BASE_TYPE_BAD_LENGTH", `Channel topic must be less than ${channelLimits.maxTopic} characters`);
+        if (payload.user_limit !== undefined && payload.user_limit < 0) errors["user_limit"] = makeObjectErrorContent("BASE_TYPE_BAD_VALUE", "User limit must be 0 or higher");
+
+        if (Object.keys(errors).length) {
+            throw new FieldError(400, "Invalid form body", errors);
+        }
+
         channel.assign(payload);
         if (channel.thread_metadata) {
             if (payload.archived !== undefined) {