studio-engine 0.69.4 → 0.69.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 12d0b8a6c255a4f9e18d6a3a588abefdd7dd5d54a3801deb9b52eb99da2d78fe
-  data.tar.gz: 3467bf1af09d79805053d721c1d0d6028fd0c5b0f806c94d6a2cdc7864f048f1
+  metadata.gz: 44ac04785253cb277ef70cd1d6398b81718e223adc7e300c1a19329183a88be5
+  data.tar.gz: 01c13c3974eb5da7887fc82e77f3526eb50af53a3e590b993a7602914e8daa81
 SHA512:
-  metadata.gz: 3fd8ea14026738113f2348ea267b2cde306afa6a37d1b37dbf23e426013cb632be62164413e64516893f913e9f8a1618559ef326187e328001d6effceffe4187
-  data.tar.gz: 1498813d632e019fc574a6467e87fa73965f0e018001c845cac52a22d21443cfad8426e50a94ec9d37e874a6f1d059770dd97696665141853fb2a9c458b97242
+  metadata.gz: db96cbe447a67732cc7d2babc54f605071ccd9e3d77d20da4fb7486c5e89f5354e21dc34066757ec7bde7f66fb7fb08e257a15c364753d3a98f34ea8065df25b
+  data.tar.gz: f8a47251bf78b0c3bab42dfc743565c2dba66502f6f204516718144cd9506a5206bf6342b7ce496fa12f6f67a34727dc8fc7cbc5e03529ce5d3ab1e3727b4761

data/CHANGELOG.md

@@ -55,6 +55,57 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ### Fixed
 
+- **Onboarding no longer truncates a surname to fit a first name's cap.**
+  `Studio::OnboardingController#first_name` measured the WHOLE typed answer with
+  `Studio::FIRST_NAME_MAX_LENGTH` — the PER-FIELD cap, 40. The field asks for a
+  name and people type a full one, so "Bartholomew Fitzwilliam
+  Montgomery-Smythe" (41 characters) stored 40 of them and handed the account
+  back its own surname misspelled, **"Montgomery-Smyth"**, on every surface
+  `name` feeds.
+
+  **ONE CONSTANT WAS ANSWERING TWO QUESTIONS**, which is why neither call site
+  looked wrong. `/profile` applies the same number PER FIELD (`normalized_name`,
+  once to each of its two inputs); onboarding applied it to first name PLUS
+  surname in one string. The fix NAMES the second question rather than
+  re-scoping the first: **`Studio::FULL_NAME_MAX_LENGTH`**, the whole-answer
+  cap, `(FIRST_NAME_MAX_LENGTH * 2) + 1` = **81**. It is DERIVED, not picked —
+  first(40) + a space + last(40) is the longest answer whose two halves BOTH
+  still fit the per-field cap, so onboarding can never accept a name `/profile`
+  would silently shorten on the next save, which is the drift the shared
+  constant existed to prevent. `FIRST_NAME_MAX_LENGTH` keeps its value and its
+  meaning, and `test/integration/profile_name_field_caps_test.rb` now proves
+  that by sending BOTH fields over-long in one request and reading two 40s back
+  — a single-field assertion cannot tell "per field" from "per whole name".
+
+  **PAST THE CAP IT REFUSES INSTEAD OF TRUNCATING** (422 + `{ error: … }`,
+  rendered inline by the modal). `.first(cap)` on a name is not a cap but a
+  rewrite: it accepted the answer, stored something nobody typed, and reported
+  success — and raising the number alone would only move that cliff one
+  character further out. Two independent rules, because the whole answer becomes
+  `name` while each half becomes its own column: the answer must fit the
+  whole-answer cap, and each derived half must fit the per-field cap (a single
+  60-character word passes the first and would still land a `first_name`
+  `/profile` shortens). The onboarding input's `maxlength` default was a LITERAL
+  `40` — a third copy of the per-field number, on the one field that receives a
+  whole name — and now reads `FULL_NAME_MAX_LENGTH`, so the browser bound and
+  the server bound cannot drift.
+
+  **NEITHER CAP IS A COLUMN CEILING.** Measured 2026-09-06 across all six
+  consumer databases (mcritchie-studio, turf-monster, mcritchie-industries;
+  production and QA): `name`, `first_name` and `last_name` are unbounded
+  `character varying` — `character_maximum_length` NULL, no CHECK constraint, no
+  model length validation. Raising the bound cannot trade a silent truncation
+  for a raised error at any value, so this is a product decision start to
+  finish.
+
+  **NO DATA REPAIR SHIPS.** Re-measured for THIS defect on the same six
+  databases: **zero rows** carry a `name`, `first_name` or `last_name` at or
+  over 40 characters, and the longest `name` in the fleet is 27 (control:
+  5 / 6 / 46 / 15 / 4 / 4 users scanned, `max(length(name))` non-null in every
+  one). Nothing was truncated in production, so there is nothing to repair — and
+  a row whose halves disagree with its `name` because of a `/profile` edit must
+  never be auto-repaired anyway.
+
 - **Onboarding no longer stores a two-word answer as the whole first name.**
   `Studio::OnboardingController#first_name` writes with `update_columns`, which
   skips callbacks — so the host's `before_save :set_name_parts` never ran and
@@ -72,10 +123,16 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
   `test/integration/onboarding_name_parts_test.rb` carries that as a live
   control (`update!` moves `pat-pat@example.com` → `ada-lovelace-pat@…`), not as
   a claim. `last_name` is written only where the column exists: the engine's own
-  standard-columns migration does not carry it, so mcritchie-industries,
-  moms-app and acquisition-studio would otherwise have taken a
-  `MissingAttributeError` 500 on every hyphen-free two-word answer
-  (`test/integration/onboarding_thin_host_test.rb`).
+  standard-columns migration does not carry it, so a host that opts into these
+  routes before it runs that column would otherwise take a
+  `MissingAttributeError` 500 on every two-word answer
+  (`test/integration/onboarding_thin_host_test.rb`). **Corrected 2026-09-06:**
+  an earlier version of this entry named mcritchie-industries, moms-app and
+  acquisition-studio as apps that would have taken that 500. They carry no
+  `last_name`, but they do not mount these endpoints at all —
+  `Studio.draw_onboarding_routes` defaults to false and only mcritchie-studio
+  and turf-monster set it true, and both of those HAVE the column. The guard is
+  a standing one for the next host to opt in, not a live save.
   NO DATA REPAIR SHIPS: measured 2026-09-05 across both production databases
   (mcritchie-studio 5 users, turf-monster 43) and both QA ones, **zero rows**
   carry a space in `first_name`. Repairing rows whose halves merely disagree

data/app/controllers/studio/onboarding_controller.rb

@@ -23,22 +23,40 @@ module Studio
     # Both actions are for the freshly signed-in user, so authentication is the
     # host's default require_authentication — no skip_before_action here.
 
-    # The shared cap (Studio::FIRST_NAME_MAX_LENGTH). Kept under the old name
-    # here because it is referenced from outside this class; what changed is that
-    # it is no longer a SECOND definition of the same number. /profile writes the
-    # same column and now reads the same constant.
+    # The PER-FIELD cap (Studio::FIRST_NAME_MAX_LENGTH) — what one derived half
+    # may be. Kept under the old name here because it is referenced from outside
+    # this class; what changed is that it is no longer a SECOND definition of
+    # the same number. /profile writes the same columns and reads the same
+    # constant.
     MAX_FIRST_NAME = Studio::FIRST_NAME_MAX_LENGTH
 
+    # The WHOLE-ANSWER cap (Studio::FULL_NAME_MAX_LENGTH) — what this endpoint
+    # actually bounds. It is a different question from the one above and now has
+    # a different name: the field asks for a name and people type a full one, so
+    # the string arriving here is first name PLUS surname, and measuring it with
+    # the per-field number stored 40 characters of a 41-character name and
+    # handed the account back a misspelled surname.
+    MAX_FULL_NAME = Studio::FULL_NAME_MAX_LENGTH
+
     # POST /onboarding/first_name
     #
     # Writes users.first_name, and backfills `name` when it is blank so the
     # display-name chain has something better than an email prefix to show.
     def first_name
-      value = params[:first_name].to_s.strip.gsub(/\s+/, " ").first(MAX_FIRST_NAME)
+      value = params[:first_name].to_s.strip.gsub(/\s+/, " ")
 
       if value.blank?
-        return render json: { ok: false, error: "Enter your first name, or skip for now." },
-                      status: :unprocessable_entity
+        return refuse("Enter your first name, or skip for now.")
+      end
+
+      # DERIVE FIRST, THEN GUARD, THEN WRITE. The halves are what the length
+      # rules are about, so they are computed once and both the guard and the
+      # write read the same hash — a guard measuring a second derivation could
+      # pass over values the write then stored.
+      attrs = name_columns(value)
+
+      if (message = length_refusal(value, attrs))
+        return refuse(message)
       end
 
       rescue_and_log(target: current_user) do
@@ -63,7 +81,7 @@ module Studio
         # never self-healed, because set_name_parts is gated on `name_changed?`
         # and no later save sees a name change. So the derivation comes to the
         # writer instead: Studio::NameParts is the same rule the callback runs.
-        attrs = name_columns(value)
+        # (`attrs` was derived above, so the guard and this write cannot disagree.)
         attrs[:name] = value if current_user.name.blank?
         current_user.update_columns(attrs)
 
@@ -86,6 +104,50 @@ module Studio
 
     private
 
+    # The one refusal shape both guards answer with. The modal renders `error`
+    # inline and leaves the field filled, so a refusal here is a correction the
+    # person can act on rather than a dead end.
+    def refuse(message)
+      render json: { ok: false, error: message }, status: :unprocessable_entity
+    end
+
+    # WHY THIS REFUSES INSTEAD OF TRUNCATING, which is the product decision this
+    # endpoint used to make silently and badly.
+    #
+    # `.first(cap)` on a name is not a cap, it is a rewrite: it accepted the
+    # answer, stored something the person never typed, and reported success.
+    # "Bartholomew Fitzwilliam Montgomery-Smythe" came back as
+    # "…Montgomery-Smyth" — plausible enough to miss, which is the worst kind of
+    # wrong for a name. Raising the number alone only moves that cliff one
+    # character further out; a bound that rewrites its input is the defect at
+    # any value. So the bound goes up (MAX_FULL_NAME now fits a real full name)
+    # AND anything past it is refused with a sentence saying so.
+    #
+    # BOTH LENGTHS ARE CHECKED, and they are independent rather than redundant.
+    # The whole answer becomes `name`; each half becomes its own column that
+    # /profile caps separately. A single 60-character word passes the first rule
+    # and would still land a `first_name` /profile silently shortens on the next
+    # save — the very drift the two constants exist to prevent — so the halves
+    # are measured too.
+    #
+    # UNREACHABLE FROM THE MODAL, ON PURPOSE. The partial's input carries the
+    # same MAX_FULL_NAME as its maxlength, so the browser stops a typist first.
+    # This is the server being the real bound, for a direct POST or for a host
+    # that passes a larger `max_length` local.
+    #
+    # Returns the message to refuse with, or nil to proceed.
+    def length_refusal(value, attrs)
+      if value.length > MAX_FULL_NAME
+        return "Please shorten that to #{MAX_FULL_NAME} characters or fewer."
+      end
+
+      if attrs.values.compact.any? { |part| part.length > MAX_FIRST_NAME }
+        return "Please keep each name to #{MAX_FIRST_NAME} characters or fewer."
+      end
+
+      nil
+    end
+
     # The name halves to write, derived exactly as the host's set_name_parts
     # would derive them from the same string.
     #

data/app/views/studio/modals/onboarding/_first_name.html.erb

@@ -15,7 +15,10 @@
     heading     — (default "What should we call you?")
     subtext     — the one-line why (default speaks about emails)
     placeholder — (default "Alex")
-    max_length  — (default 40; the server stays the real bound)
+    max_length  — (default Studio::FULL_NAME_MAX_LENGTH; the server stays the
+                  real bound, and it REFUSES past that rather than truncating,
+                  so a host raising this makes the endpoint answer 422 rather
+                  than store a name nobody typed)
     progress    — [current, total] to render the segmented pill, or nil for none
     modal_store — Alpine store name (default "modals"; the living style guide
                   mounts its own page-scoped host and passes "dsModals")
@@ -41,7 +44,7 @@
   subtext     = local_assigns.fetch(:subtext,
                   "Just your first name — we use it to address you in emails.")
   placeholder = local_assigns.fetch(:placeholder, "Alex")
-  max_length  = local_assigns.fetch(:max_length, 40)
+  max_length  = local_assigns.fetch(:max_length, Studio::FULL_NAME_MAX_LENGTH)
   progress    = local_assigns.fetch(:progress, nil)
   modal_store = local_assigns.fetch(:modal_store, "modals")
   done_event  = local_assigns.fetch(:done_event, "onboarding-step-done")

data/lib/studio/version.rb

@@ -1,3 +1,3 @@
 module Studio
-  VERSION = "0.69.4"
+  VERSION = "0.69.5"
 end

data/lib/studio.rb

@@ -407,17 +407,46 @@ module Studio
   # later session may ask again. That is the whole reason this is not a column.
   FIRST_NAME_SKIP_SESSION_KEY = :onboarding_skipped_first_name
 
-  # How long a first name may be. ONE constant because users.first_name is
-  # written from TWO surfaces — the onboarding step (seconds after signup) and
-  # /profile (any time after) — and rendered by a third, the profile form's
-  # maxlength. Two independently-correct caps that disagreed would let onboarding
-  # accept a name /profile then refused to save, a bug with no obvious owner.
+  # How long ONE name field may be — users.first_name, and users.last_name where
+  # a host carries it. PER FIELD, which is the only thing this number has ever
+  # measured: /profile caps each of the two inputs with it, and the profile
+  # form's maxlength renders it. Two independently-correct caps that disagreed
+  # would let one surface accept a name another then refused to save, a bug with
+  # no obvious owner.
   #
   # Keeping it here rather than on either controller also keeps the VIEW off a
   # controller constant: the form needs the number, and a view reaching into
   # Studio::ProfilesController to get it would couple the two for no reason.
   FIRST_NAME_MAX_LENGTH = 40
 
+  # How long a WHOLE typed answer may be — one string holding a full name, which
+  # the onboarding step stores as users.name and SPLITS into the two halves
+  # above (Studio::NameParts).
+  #
+  # A SECOND CONSTANT BECAUSE THIS IS A SECOND QUESTION. Onboarding asked the
+  # per-field number for a whole-answer bound, and the two readings were both
+  # defensible at their own call site: "Bartholomew Fitzwilliam
+  # Montgomery-Smythe" is 41 characters, so it stored 40 and handed the account
+  # back its own surname misspelled — "Montgomery-Smyth". Nothing was wrong in
+  # either controller alone; the number was answering two questions with one
+  # value. Giving the whole-answer bound its own name makes that borrow
+  # unwriteable rather than merely discouraged.
+  #
+  # DERIVED, NOT PICKED. It is the longest answer whose two halves BOTH still
+  # fit the per-field cap — first(40) + a space + last(40) — so onboarding can
+  # never accept a name /profile would later shorten, which is the drift
+  # FIRST_NAME_MAX_LENGTH exists to prevent. Raising the per-field cap moves
+  # this one with it, by construction.
+  #
+  # NOT BOUNDED BY THE COLUMN. Measured 2026-09-06 across all six consumer
+  # databases (mcritchie-studio, turf-monster and mcritchie-industries, prod and
+  # QA): every one of `name`, `first_name` and `last_name` is an unbounded
+  # `character varying` — character_maximum_length NULL, no CHECK constraint, no
+  # model length validation. So this cap is a product decision start to finish,
+  # not a column ceiling, and raising it cannot trade a truncation for a
+  # PG::StringDataRightTruncation.
+  FULL_NAME_MAX_LENGTH = (FIRST_NAME_MAX_LENGTH * 2) + 1
+
   # The shared rule for "does this account still owe us a first name?" — the one
   # piece of onboarding logic every app agrees on. Hosts compose it into their own
   # flow rather than re-deriving it (turf's OnboardingFlow calls straight through).

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: studio-engine
 version: !ruby/object:Gem::Version
-  version: 0.69.4
+  version: 0.69.5
 platform: ruby
 authors:
 - Alex McRitchie