feat: Add comprehensive input validation

- Created lib/validation.ts with validation utilities for all form inputs
- Added validation for list titles, item titles, colors, dates, tags, descriptions, and notes
- Implemented inline validation with real-time error feedback in ListForm
- Enhanced ItemForm with comprehensive validation for all fields
- Updated InlineItemCreate with validation
- Added input sanitization to prevent XSS attacks
- Updated server actions to use validation utilities
- Added maxLength attributes to prevent excessive input
- Improved accessibility with aria-invalid and aria-describedby attributes
- Added visual feedback for validation errors with red borders
- Validates Requirements 1.1 and 2.1

lib/actions.ts

@@ -2,6 +2,14 @@
 
 import { prisma } from './db'
 import { revalidatePath } from 'next/cache'
+import {
+  validateListTitle,
+  validateItemTitle,
+  validateColor,
+  validateDateString,
+  validateTags,
+  sanitizeString,
+} from './validation'
 
 // Retry utility for database operations
 async function retryOperation<T>(
@@ -57,19 +65,23 @@ export async function getLists() {
 
 export async function createList(title: string, color: string = '#3B82F6') {
   try {
-    // Validate input
-    if (!title || !title.trim()) {
-      throw new Error('List title is required')
+    // Validate and sanitize input
+    const titleResult = validateListTitle(title)
+    if (!titleResult.isValid) {
+      throw new Error(titleResult.error)
     }
     
-    if (title.length > 200) {
-      throw new Error('List title must be less than 200 characters')
+    const colorResult = validateColor(color)
+    if (!colorResult.isValid) {
+      throw new Error(colorResult.error)
     }
     
+    const sanitizedTitle = sanitizeString(title)
+    
     const list = await retryOperation(() =>
       prisma.list.create({
         data: {
-          title: title.trim(),
+          title: sanitizedTitle,
           color,
         },
       })
@@ -79,7 +91,7 @@ export async function createList(title: string, color: string = '#3B82F6') {
     return list
   } catch (error) {
     console.error('Error creating list:', error)
-    if (error instanceof Error && error.message.includes('required')) {
+    if (error instanceof Error && (error.message.includes('required') || error.message.includes('must be'))) {
       throw error
     }
     throw new Error('Failed to create list. Please try again.')
@@ -165,24 +177,35 @@ export async function createItem(
       throw new Error('List ID is required')
     }
     
-    if (!title || !title.trim()) {
-      throw new Error('Item title is required')
+    const titleResult = validateItemTitle(title)
+    if (!titleResult.isValid) {
+      throw new Error(titleResult.error)
     }
     
-    if (title.length > 200) {
-      throw new Error('Item title must be less than 200 characters')
+    // Validate tags if provided
+    if (metadata?.tags) {
+      const tagsResult = validateTags(metadata.tags)
+      if (!tagsResult.isValid) {
+        throw new Error(tagsResult.error)
+      }
     }
     
+    // Sanitize inputs
+    const sanitizedTitle = sanitizeString(title)
+    const sanitizedDescription = description ? sanitizeString(description) : null
+    const sanitizedNotes = metadata?.notes ? sanitizeString(metadata.notes) : null
+    const sanitizedTags = metadata?.tags ? metadata.tags.map(sanitizeString) : undefined
+    
     const item = await retryOperation(() =>
       prisma.item.create({
         data: {
-          title: title.trim(),
-          description: description?.trim() || null,
+          title: sanitizedTitle,
+          description: sanitizedDescription,
           listId,
           ...(metadata?.priority && { priority: metadata.priority }),
           ...(metadata?.dueDate !== undefined && { dueDate: metadata.dueDate }),
-          ...(metadata?.tags && { tags: metadata.tags }),
-          ...(metadata?.notes !== undefined && { notes: metadata.notes }),
+          ...(sanitizedTags && { tags: sanitizedTags }),
+          ...(sanitizedNotes !== undefined && { notes: sanitizedNotes }),
         },
       })
     )
@@ -191,7 +214,7 @@ export async function createItem(
     return item
   } catch (error) {
     console.error('Error creating item:', error)
-    if (error instanceof Error && (error.message.includes('required') || error.message.includes('must be'))) {
+    if (error instanceof Error && (error.message.includes('required') || error.message.includes('must be') || error.message.includes('Invalid'))) {
       throw error
     }
     throw new Error('Failed to create item. Please try again.')
@@ -247,20 +270,32 @@ export async function updateItem(
       throw new Error('Item ID is required')
     }
     
-    // Validate title if provided
+    // Validate and sanitize title if provided
     if (data.title !== undefined) {
-      if (!data.title || !data.title.trim()) {
-        throw new Error('Item title cannot be empty')
+      const titleResult = validateItemTitle(data.title)
+      if (!titleResult.isValid) {
+        throw new Error(titleResult.error)
       }
-      if (data.title.length > 200) {
-        throw new Error('Item title must be less than 200 characters')
-      }
-      data.title = data.title.trim()
+      data.title = sanitizeString(data.title)
     }
     
-    // Trim description if provided
+    // Sanitize description if provided
     if (data.description !== undefined && data.description !== null) {
-      data.description = data.description.trim() || null
+      data.description = sanitizeString(data.description) || null
+    }
+    
+    // Validate tags if provided
+    if (data.tags !== undefined) {
+      const tagsResult = validateTags(data.tags)
+      if (!tagsResult.isValid) {
+        throw new Error(tagsResult.error)
+      }
+      data.tags = data.tags.map(sanitizeString)
+    }
+    
+    // Sanitize notes if provided
+    if (data.notes !== undefined && data.notes !== null) {
+      data.notes = sanitizeString(data.notes) || null
     }
     
     const item = await retryOperation(() =>
@@ -282,7 +317,7 @@ export async function updateItem(
     return updated
   } catch (error) {
     console.error('Error updating item:', error)
-    if (error instanceof Error && (error.message.includes('not found') || error.message.includes('required') || error.message.includes('cannot be'))) {
+    if (error instanceof Error && (error.message.includes('not found') || error.message.includes('required') || error.message.includes('cannot be') || error.message.includes('Invalid'))) {
       throw error
     }
     throw new Error('Failed to update item. Please try again.')
@@ -364,15 +399,21 @@ export async function updateList(
       throw new Error('List ID is required')
     }
     
-    // Validate title if provided
+    // Validate and sanitize title if provided
     if (data.title !== undefined) {
-      if (!data.title || !data.title.trim()) {
-        throw new Error('List title cannot be empty')
+      const titleResult = validateListTitle(data.title)
+      if (!titleResult.isValid) {
+        throw new Error(titleResult.error)
       }
-      if (data.title.length > 200) {
-        throw new Error('List title must be less than 200 characters')
+      data.title = sanitizeString(data.title)
+    }
+    
+    // Validate color if provided
+    if (data.color !== undefined) {
+      const colorResult = validateColor(data.color)
+      if (!colorResult.isValid) {
+        throw new Error(colorResult.error)
       }
-      data.title = data.title.trim()
     }
     
     const updated = await retryOperation(() =>
@@ -387,7 +428,7 @@ export async function updateList(
     return updated
   } catch (error) {
     console.error('Error updating list:', error)
-    if (error instanceof Error && (error.message.includes('not found') || error.message.includes('required') || error.message.includes('cannot be'))) {
+    if (error instanceof Error && (error.message.includes('not found') || error.message.includes('required') || error.message.includes('cannot be') || error.message.includes('Invalid'))) {
       throw error
     }
     throw new Error('Failed to update list. Please try again.')