fix(backend): validate non-blank name in CreateFolderRequest and UpdateFolderRequest ($25 bounty proposal)

Closed
AI
8h ago
+92-0

Summary

Added field validation and whitespace normalization to CreateFolderRequest.name and UpdateFolderRequest.name in backend/models/folder.py to protect against empty or whitespace-only names when creating or updating custom folders.

What changed and why

  • In backend/models/folder.py, CreateFolderRequest and UpdateFolderRequest previously relied solely on min_length=1. A string of spaces (e.g., " ") satisfied min_length=1, allowing blank folders to be persisted in Firestore via POST /v1/folders and PATCH /v1/folders/{id}.
  • Blank folder names create invisible or unclickable tabs/buttons in web, desktop, and mobile user interfaces, degrading user navigation.
  • Added @field_validator('name') to both CreateFolderRequest and UpdateFolderRequest to strip leading/trailing whitespace and reject empty or whitespace-only strings with ValueError('folder name cannot be empty or blank') (mapped to HTTP 422).
  • Valid names (e.g. " Work ") are automatically trimmed to "Work".

Product invariants affected

none

How it was verified

Ran verification via hermetic unit tests with Pydantic:

  • Verified CreateFolderRequest(name=" ") and UpdateFolderRequest(name=" ") raise ValidationError with folder name cannot be empty or blank.
  • Verified CreateFolderRequest(name=" Work & Projects ") normalizes to "Work & Projects".
  • Verified omitted name on update (UpdateFolderRequest(description="new desc")) remains None.
  • All 8 unit tests pass in 0.007s.

Tests

Added hermetic unit tests in backend/tests/unit/test_folder_name_validation.py covering:

  • CreateFolderRequest rejection of empty and whitespace-only names.
  • CreateFolderRequest stripping of leading and trailing whitespace.
  • UpdateFolderRequest rejection of empty and whitespace-only names.
  • UpdateFolderRequest optional omitted name passthrough and normalization.

UI evidence

UI-Evidence: none -- backend validation only

Failure class (fixes)

Failure-Class: none

Bounty Proposal

  • Proposed Bounty: $25 USD
  • Target Maintainers: @kodjima33 @aryanorastar