Input Validation & Data Integrity

User Stories

As a developer, I want shared Zod schemas for all core models, so that validation rules are defined once and reused everywhere #TBD
As a developer, I want all API routes to use Zod instead of ad-hoc checks, so that validation is consistent and complete #TBD
As a developer, I want a standardized error response shape, so that clients get actionable feedback and internal details are never leaked #TBD
As a developer, I want database-level length constraints, so that the DB is a hard backstop even if app-layer validation is bypassed #TBD
As a user, I want long names and text to be gracefully truncated in the UI, so that layout is never broken by oversized input #TBD

Technical Requirements

Create next/lib/schemas/ directory with Zod schemas for User, Event, Quote, GoLink, Mentor, Project, Sponsor, Alumni, Announcement, Purchasing
Enforce maxLength on all free-text fields: name <= 100, bio/description <= 1000, URLs <= 500, quote text <= 2000
Create next/lib/apiError.ts with validationError(), unauthorized(), forbidden() helpers
Add @db.VarChar(N) annotations to Prisma schema matching Zod limits; generate and apply migration
Apply Tailwind truncate and line-clamp-N classes to all name/title/bio display components

Design Considerations

zod@^4.1.12 is already a declared dependency — no new package needed
Prisma migrations must be backward-compatible (VarChar constraints on existing data must not truncate silently)
Truncation in UI is a display concern only — the backend Zod limit is the authoritative max

Epic 1 (#331) should be completed first so auth checks are in place before validation is layered on

Design Documents

Permission matrix and field limit decisions in plan: auth_&_validation_epics_af68b015.plan.md

# Input Validation & Data Integrity ## User Stories - [ ] As a developer, I want shared Zod schemas for all core models, so that validation rules are defined once and reused everywhere #TBD - [ ] As a developer, I want all API routes to use Zod instead of ad-hoc checks, so that validation is consistent and complete #TBD - [ ] As a developer, I want a standardized error response shape, so that clients get actionable feedback and internal details are never leaked #TBD - [ ] As a developer, I want database-level length constraints, so that the DB is a hard backstop even if app-layer validation is bypassed #TBD - [ ] As a user, I want long names and text to be gracefully truncated in the UI, so that layout is never broken by oversized input #TBD ## Technical Requirements - [ ] Create next/lib/schemas/ directory with Zod schemas for User, Event, Quote, GoLink, Mentor, Project, Sponsor, Alumni, Announcement, Purchasing - [ ] Enforce maxLength on all free-text fields: name <= 100, bio/description <= 1000, URLs <= 500, quote text <= 2000 - [ ] Create next/lib/apiError.ts with validationError(), unauthorized(), forbidden() helpers - [ ] Add @db.VarChar(N) annotations to Prisma schema matching Zod limits; generate and apply migration - [ ] Apply Tailwind truncate and line-clamp-N classes to all name/title/bio display components ## Design Considerations - [ ] zod@^4.1.12 is already a declared dependency — no new package needed - [ ] Prisma migrations must be backward-compatible (VarChar constraints on existing data must not truncate silently) - [ ] Truncation in UI is a display concern only — the backend Zod limit is the authoritative max ## Dependencies - [ ] Epic 1 (#331) should be completed first so auth checks are in place before validation is layered on ## Design Documents - Permission matrix and field limit decisions in plan: auth_&_validation_epics_af68b015.plan.md

Rows
Columns

Epic: Input Validation & Data Integrity #340

Input Validation & Data Integrity

User Stories

Technical Requirements

Design Considerations

Dependencies

Design Documents