fix(api): a long name crashed the request, and a blank one was accepted

Naming an engine or a scan context with more than 200 characters reached
Postgres and came back as a 500 — the column is bounded, the request
model was not. A name of spaces was accepted outright by engines,
contexts, schedules and projects, and a project created that way got an
empty slug, which is the segment its own URL is built from.

Proxies and notification channels already ran their names through
clean_name; every other named entity now does the same, on update as
well as on create, where none of them did. A rejected name says whether
it was empty or too long instead of failing at the database.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01K6LcH8uUddjJbKrahf34ys

shared/models/notification_channel.py

@@ -1,5 +1,6 @@
 import uuid
 from datetime import datetime
+from functools import partial
 
 from pydantic import BaseModel, field_validator
 from sqlalchemy import Column
@@ -9,7 +10,7 @@ from sqlmodel import Field, SQLModel
 from shared.enums.notification import NotificationType
 from shared.enums.notification_channel import NotificationProvider
 from shared.utils.datetime import utc_now
-from shared.utils.validation import clean_name
+from shared.utils.validation import clean_name, clean_optional_name
 
 PROVIDERS = tuple(p.value for p in NotificationProvider)
 
@@ -60,6 +61,8 @@ class NotificationChannelUpdate(BaseModel):
     config: dict | None = None
     events: NotificationPreference | None = None
 
+    _validate_name = field_validator("name")(partial(clean_optional_name, max_len=120))
+
 
 class NotificationChannelRead(BaseModel):
     id: uuid.UUID

shared/models/project.py

@@ -1,15 +1,19 @@
 import uuid
 from datetime import datetime
+from functools import partial
 
-from pydantic import BaseModel
+from pydantic import BaseModel, field_validator
 from sqlmodel import Field, SQLModel
 
 from shared.utils.datetime import utc_now
+from shared.utils.validation import clean_name
 
 
 class ProjectBase(SQLModel):
     name: str = Field(max_length=50)
 
+    _validate_name = field_validator("name")(partial(clean_name, max_len=50))
+
 
 class Project(ProjectBase, table=True):
     __tablename__ = "projects"

shared/models/proxy.py

@@ -1,12 +1,13 @@
 import uuid
 from datetime import datetime
+from functools import partial
 
 from pydantic import BaseModel, field_validator
 from sqlmodel import Field, SQLModel
 
 from shared.enums.proxy import ProxyMode, ProxyProtocol
 from shared.utils.datetime import utc_now
-from shared.utils.validation import clean_name
+from shared.utils.validation import clean_name, clean_optional_name
 
 PROXY_MODES = tuple(m.value for m in ProxyMode)
 PROXY_SCHEMES = tuple(p.value for p in ProxyProtocol)
@@ -67,6 +68,8 @@ class ProxyUpdate(BaseModel):
     is_default: bool | None = None
     endpoints: list[ProxyEndpoint] | None = None
 
+    _validate_name = field_validator("name")(partial(clean_optional_name, max_len=120))
+
 
 class ProxyRead(BaseModel):
     id: uuid.UUID

shared/models/scan_context.py

@@ -1,13 +1,15 @@
 import uuid
 from datetime import datetime
+from functools import partial
 
-from pydantic import BaseModel
+from pydantic import BaseModel, field_validator
 from sqlalchemy import Column
 from sqlalchemy.types import JSON
 from sqlmodel import Field, SQLModel
 
 from shared.models.types import EncryptedJSON
 from shared.utils.datetime import utc_now
+from shared.utils.validation import clean_name, clean_optional_name
 
 AUTH_TYPES = ("none", "header", "bearer", "basic", "cookie", "api_key")
 HTTP_PROTOCOLS = ("both", "http_only", "https_only")
@@ -103,6 +105,8 @@ class ScanContextCreate(BaseModel):
     compare_baseline_scan_id: uuid.UUID | None = None
     scan_only_new_assets: bool = False
 
+    _validate_name = field_validator("name")(partial(clean_name, max_len=200))
+
 
 class ScanContextUpdate(BaseModel):
     name: str | None = None
@@ -124,6 +128,8 @@ class ScanContextUpdate(BaseModel):
     compare_baseline_scan_id: uuid.UUID | None = None
     scan_only_new_assets: bool | None = None
 
+    _validate_name = field_validator("name")(partial(clean_optional_name, max_len=200))
+
 
 class ContextUsage(BaseModel):
     schedules: int = 0

shared/models/scan_engine.py

@@ -1,7 +1,8 @@
 import uuid
 from datetime import datetime
+from functools import partial
 
-from pydantic import BaseModel
+from pydantic import BaseModel, field_validator
 from pydantic import Field as PydanticField
 from sqlalchemy import Column
 from sqlalchemy.types import JSON, Text
@@ -10,6 +11,7 @@ from sqlmodel import Field, SQLModel
 from shared.definitions.constants import DEFAULT_GLOBAL_THREADS
 from shared.models.scan_context import ScanContextCreate
 from shared.utils.datetime import utc_now
+from shared.utils.validation import clean_name, clean_optional_name
 
 
 class ScanEngine(SQLModel, table=True):
@@ -47,6 +49,8 @@ class ScanEngineCreate(BaseModel):
     yaml_source: str | None = None
     tool_options: dict[str, str] = PydanticField(default_factory=dict)
 
+    _validate_name = field_validator("name")(partial(clean_name, max_len=200))
+
 
 class ScanEngineUpdate(BaseModel):
     name: str | None = None
@@ -59,6 +63,8 @@ class ScanEngineUpdate(BaseModel):
     yaml_source: str | None = None
     tool_options: dict[str, str] | None = None
 
+    _validate_name = field_validator("name")(partial(clean_optional_name, max_len=200))
+
 
 class EngineUsage(BaseModel):
     schedules: int = 0

shared/models/scan_schedule.py

@@ -1,7 +1,8 @@
 import uuid
 from datetime import datetime
+from functools import partial
 
-from pydantic import BaseModel
+from pydantic import BaseModel, field_validator
 from sqlalchemy import Column
 from sqlalchemy.types import JSON
 from sqlmodel import Field, SQLModel
@@ -9,6 +10,7 @@ from sqlmodel import Field, SQLModel
 from shared.definitions.schedule_constants import MAX_SCHEDULE_TARGETS
 from shared.enums.scan_schedule import ScheduleStatus
 from shared.utils.datetime import utc_now
+from shared.utils.validation import clean_name, clean_optional_name
 
 
 class ScanSchedule(SQLModel, table=True):
@@ -62,6 +64,8 @@ class ScanScheduleCreate(BaseModel):
     daily_at_time: str | None = None
     cron_expression: str | None = None
 
+    _validate_name = field_validator("name")(partial(clean_name, max_len=200))
+
 
 class ScanScheduleUpdate(BaseModel):
     name: str | None = None
@@ -77,6 +81,8 @@ class ScanScheduleUpdate(BaseModel):
     daily_at_time: str | None = None
     cron_expression: str | None = None
 
+    _validate_name = field_validator("name")(partial(clean_optional_name, max_len=200))
+
 
 class ScanScheduleRead(BaseModel):
     id: uuid.UUID

shared/utils/validation.py

@@ -20,6 +20,11 @@ def clean_name(v: str, *, max_len: int = MAX_NAME_LEN) -> str:
     return v
 
 
+def clean_optional_name(v: str | None, *, max_len: int = MAX_NAME_LEN) -> str | None:
+    """An update that omits the name leaves it alone; one that sends it must send a real one."""
+    return None if v is None else clean_name(v, max_len=max_len)
+
+
 def validate_domain(value: str) -> bool:
     return validators.domain(value) is True