From 642bf1d60b2d7c6d8dbbb1ea34406ef01802294a Mon Sep 17 00:00:00 2001
From: Rory& <root@rory.gay>
Date: Sat, 14 Feb 2026 17:44:55 +0100
Subject: [PATCH] Try to enforce channel limts?

---
 assets/openapi.json                           | Bin 932748 -> 932832 bytes
 assets/schemas.json                           | Bin 405585 -> 405645 bytes
 src/api/routes/channels/#channel_id/index.ts  |  28 +++++++++++++++++-
 .../uncategorised/ChannelModifySchema.ts      |   3 --
 .../subconfigurations/limits/ChannelLimits.ts |   1 +
 src/util/util/FieldError.ts                   |   4 +++
 6 files changed, 32 insertions(+), 4 deletions(-)

diff --git a/assets/openapi.json b/assets/openapi.json
index f7bc123af2eb60605b0a1702d6f0c065a61fbaec..a06d0d78286ea6d915cfb7b557c9728004fb1fc7 100644
GIT binary patch
delta 241
zcmeDAZt>u|MMDeY7N!=b$psNMlOM3KPvUTxULV3DK7GR@CiV7wXQu7>&dfcPSfznd
zOg&7~KWMPUOrNlXk!^CmPt<gK0rrmRTuv-z(-pXx^`{58u>73fz|E*ReZprJ*69Y#
z%o`xqNKISM%riY;AEVs#19mLz({o)}gxkZ9Fat3Q5VLL%Kf>0MJ6%AEMS?l8!f!g`
zE@sW?3l6d9PLEe&mzZuK$K(MP|G1P<db*zhJ4d^g5jzlrXigyJ0%C3;<^f{f?OH~B
GNt^&>@KD+S

delta 335
zcmaFx-J<8aMMDeY7N!=b>FYC?d8S8jGe=K$;ANY{;V?aKBdhr23;Q@GJ8;NP-*=Z)
z0>qilH=kK)`iHx$VqjimC<{bb?jBUW6DHyZ6WIw9se_74j^~hXZ*gJT-r~aSTR~@w
zftE7)GEPtMV~Ux+po-Oa8WW@LbOSf0j_H4WnUW`85aeh-dypB3S%8>z``LqRyYeSD
gTySqMGhzo~4j|?PVlE)&24Wr{=G|Uq#Fxbh0F!NnAOHXW

diff --git a/assets/schemas.json b/assets/schemas.json
index 3d4b7447d3c8480266af5f04836886d12b56df3f..f10afc4a44b90fff6958f553c5c2a3a4d520e82d 100644
GIT binary patch
delta 129
zcmcckK%)1dM8g)w)vqT%;MAGEpO;l?y23-I$=j`rnCCD~uU*XSF<sy%E6a2RC8pNt
z>Wi4Cx37B7xP8@orm2poI@*CcfS3iSlXc<!=@;19gc$v%ALM6JoUX8fS#|ma7B+$D
V_xac&fub9^n1r_*3b8530RRyyF0B9n

delta 72
zcmeBuC~@(DM8g)w)vu@jpUUJveE~1C+4crQW+A3_g?EhG72YxZbwbFr17(1i1*n2m
R{K53~9*kkzbA{Lx<N$T|9AW?f

diff --git a/src/api/routes/channels/#channel_id/index.ts b/src/api/routes/channels/#channel_id/index.ts
index a1db91373..37767574d 100644
--- a/src/api/routes/channels/#channel_id/index.ts
+++ b/src/api/routes/channels/#channel_id/index.ts
@@ -17,7 +17,19 @@
 */
 
 import { route } from "@spacebar/api";
-import { Channel, ChannelDeleteEvent, ChannelUpdateEvent, Recipient, emitEvent, handleFile } from "@spacebar/util";
+import {
+    Channel,
+    ChannelDeleteEvent,
+    ChannelUpdateEvent,
+    Recipient,
+    emitEvent,
+    handleFile,
+    Config,
+    FieldError,
+    ErrorList,
+    ObjectErrorContent,
+    makeObjectErrorContent,
+} from "@spacebar/util";
 import { Request, Response, Router } from "express";
 import { ChannelModifySchema, ChannelType } from "@spacebar/schemas";
 
@@ -174,6 +186,7 @@ router.patch(
                 channel.available_tags = channel.available_tags.filter((_) => filter.has(_.id));
             }
         }
+
         if (payload.applied_tags) {
             if (channel.isThread()) {
                 const parent = await Channel.findOneOrFail({
@@ -201,6 +214,19 @@ router.patch(
 
         if (payload.icon) payload.icon = await handleFile(`/channel-icons/${channel_id}`, payload.icon);
 
+        const channelLimits = Config.get().limits.channel;
+
+        const errors: ErrorList = {};
+        if (payload.name && (payload.name.length < 1 || payload.name.length > channelLimits.maxName))
+            errors["name"] = makeObjectErrorContent("BASE_TYPE_BAD_LENGTH", `Channel name must be between 1 and ${channelLimits.maxName} characters`);
+        if (payload.topic !== undefined && payload.topic.length > channelLimits.maxTopic)
+            errors["topic"] = makeObjectErrorContent("BASE_TYPE_BAD_LENGTH", `Channel topic must be less than ${channelLimits.maxTopic} characters`);
+        if (payload.user_limit !== undefined && payload.user_limit < 0) errors["user_limit"] = makeObjectErrorContent("BASE_TYPE_BAD_VALUE", "User limit must be 0 or higher");
+
+        if (Object.keys(errors).length) {
+            throw new FieldError(400, "Invalid form body", errors);
+        }
+
         channel.assign(payload);
         if (channel.thread_metadata) {
             if (payload.archived !== undefined) {
diff --git a/src/schemas/uncategorised/ChannelModifySchema.ts b/src/schemas/uncategorised/ChannelModifySchema.ts
index b83dc12e9..093da8e64 100644
--- a/src/schemas/uncategorised/ChannelModifySchema.ts
+++ b/src/schemas/uncategorised/ChannelModifySchema.ts
@@ -19,9 +19,6 @@
 import { ChannelPermissionOverwriteType, ChannelType, TagCreateSchema } from "@spacebar/schemas";
 
 export interface ChannelModifySchema {
-    /**
-     * @maxLength 100
-     */
     name?: string;
     type?: ChannelType;
     topic?: string;
diff --git a/src/util/config/types/subconfigurations/limits/ChannelLimits.ts b/src/util/config/types/subconfigurations/limits/ChannelLimits.ts
index 266e6a327..6d5d28f86 100644
--- a/src/util/config/types/subconfigurations/limits/ChannelLimits.ts
+++ b/src/util/config/types/subconfigurations/limits/ChannelLimits.ts
@@ -20,4 +20,5 @@ export class ChannelLimits {
     maxPins: number = 500;
     maxTopic: number = 1024;
     maxWebhooks: number = 100;
+    maxName: number = 32;
 }
diff --git a/src/util/util/FieldError.ts b/src/util/util/FieldError.ts
index eb91a0ecb..f0ba4aeed 100644
--- a/src/util/util/FieldError.ts
+++ b/src/util/util/FieldError.ts
@@ -28,6 +28,10 @@ export type ErrorList = Record<string, ObjectErrorContent>;
 export type ErrorContent = { code: string; message: string };
 export type ObjectErrorContent = { _errors: ErrorContent[] };
 
+export function makeObjectErrorContent(code: string, message: string): ObjectErrorContent {
+    return { _errors: [{ code, message }] };
+}
+
 export function FieldErrors(fields: Record<string, { code?: string; message: string }>, errors?: ErrorObject[]) {
     const errorObj: ErrorList = {};
     for (const [key, { message, code }] of Object.entries(fields)) {