fix(scratchlist): bound client-supplied entryId length (HAPI Bot, PR tiann#896)

The POST /api/sessions/:id/scratchlist body validator left `entryId`
unbounded (`z.string().min(1)`), but that string is persisted as part
of the SQLite primary key. An authenticated/direct client could grow
the table and its index well beyond the intended scratchlist limits
by submitting oversized keys.

Adds `SCRATCHLIST_MAX_ENTRY_ID_LENGTH = 128` (comfortably fits a
UUID's 36 chars plus any prefix scheme we might layer on later) and
applies `.max(...)` to the optional `entryId` in
`ScratchlistEntryCreateRequestSchema`. Anything longer is rejected
with 400 before the row hits SQLite.

Test pins the new behavior: a 129-char id returns 400 and never reaches
the engine.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: heavygee

hub/src/web/routes/sessions-scratchlist.test.ts

@@ -286,6 +286,21 @@ describe('POST /api/sessions/:id/scratchlist', () => {
         expect(res.status).toBe(409)
     })
 
+    it('rejects oversized entryId with 400 (HAPI Bot, PR #896 follow-up)', async () => {
+        // Server-side guard for the SQLite primary key: an authenticated
+        // client could otherwise grow the table and its index with
+        // arbitrarily large keys. 129 chars is one over the 128-char
+        // cap defined in SCRATCHLIST_MAX_ENTRY_ID_LENGTH.
+        const session = createSession()
+        const app = createApp(session)
+        const res = await app.request('/api/sessions/session-1/scratchlist', {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ text: 'oversized id', entryId: 'x'.repeat(129) })
+        })
+        expect(res.status).toBe(400)
+    })
+
     it('returns 404 when the engine reports session-not-found post-auth', async () => {
         // This path covers a race: auth said the session was visible
         // (resolveSessionAccess.ok), but by the time we INSERT the row the

shared/src/apiTypes.ts

@@ -164,6 +164,14 @@ export type RenameSessionRequest = z.infer<typeof RenameSessionRequestSchema>
  */
 export const SCRATCHLIST_MAX_ENTRIES = 200
 export const SCRATCHLIST_MAX_TEXT_LENGTH = 10_000
+/**
+ * Hard cap on client-supplied entry id length. The id is persisted as
+ * part of the SQLite primary key, so without a bound an authenticated
+ * client could grow the table and its index with arbitrarily large
+ * keys. 128 chars comfortably fits a UUID (36) plus any prefix scheme
+ * we might layer on later.
+ */
+export const SCRATCHLIST_MAX_ENTRY_ID_LENGTH = 128
 
 export const ScratchlistEntryCreateRequestSchema = z.object({
     /**
@@ -173,7 +181,7 @@ export const ScratchlistEntryCreateRequestSchema = z.object({
      * tree. New entries created post-v2 can omit this and let the hub
      * generate one.
      */
-    entryId: z.string().min(1).optional(),
+    entryId: z.string().min(1).max(SCRATCHLIST_MAX_ENTRY_ID_LENGTH).optional(),
     text: z.string().min(1).max(SCRATCHLIST_MAX_TEXT_LENGTH),
     /**
      * Optional client-supplied createdAt. Used by the migration path to