closes #144: limit max documents in insert many (#315)

src/main/java/io/stargate/sgv2/jsonapi/api/model/command/impl/InsertManyCommand.java

@@ -4,6 +4,7 @@
 import com.fasterxml.jackson.databind.JsonNode;
 import io.stargate.sgv2.jsonapi.api.model.command.Command;
 import io.stargate.sgv2.jsonapi.api.model.command.ModifyCommand;
+import io.stargate.sgv2.jsonapi.api.model.command.validation.MaxInsertManyDocuments;
 import java.util.List;
 import javax.annotation.Nullable;
 import javax.validation.constraints.NotEmpty;
@@ -22,6 +23,7 @@
 public record InsertManyCommand(
     @NotNull
         @NotEmpty
+        @MaxInsertManyDocuments
         @Schema(
             description = "JSON document to insert.",
             implementation = Object.class,

src/main/java/io/stargate/sgv2/jsonapi/api/model/command/validation/MaxInsertManyDocuments.java

@@ -0,0 +1,25 @@
+package io.stargate.sgv2.jsonapi.api.model.command.validation;
+
+import static java.lang.annotation.ElementType.*;
+import static java.lang.annotation.RetentionPolicy.RUNTIME;
+
+import io.stargate.sgv2.jsonapi.config.DocumentLimitsConfig;
+import java.lang.annotation.Retention;
+import java.lang.annotation.Target;
+import javax.validation.Constraint;
+import javax.validation.Payload;
+
+/**
+ * Limits the maximum amount of documents to insert, as defined in the {@link DocumentLimitsConfig}.
+ */
+@Target({METHOD, FIELD, ANNOTATION_TYPE, CONSTRUCTOR, PARAMETER, TYPE_USE})
+@Retention(RUNTIME)
+@Constraint(validatedBy = {MaxInsertManyDocumentsValidation.class})
+public @interface MaxInsertManyDocuments {
+
+  String message() default "amount of documents to insert is over the max limit";
+
+  Class<?>[] groups() default {};
+
+  Class<? extends Payload>[] payload() default {};
+}

src/main/java/io/stargate/sgv2/jsonapi/api/model/command/validation/MaxInsertManyDocumentsValidation.java

@@ -0,0 +1,29 @@
+package io.stargate.sgv2.jsonapi.api.model.command.validation;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import java.util.List;
+import javax.enterprise.context.ApplicationScoped;
+import javax.validation.ConstraintValidator;
+import javax.validation.ConstraintValidatorContext;
+import org.eclipse.microprofile.config.inject.ConfigProperty;
+
+/** Validator for the {@link MaxInsertManyDocuments} annotation. */
+@ApplicationScoped
+public class MaxInsertManyDocumentsValidation
+    implements ConstraintValidator<MaxInsertManyDocuments, List<JsonNode>> {
+
+  private final int limit;
+
+  // due to https://github.com/quarkusio/quarkus/issues/32265
+  // I can only inject prop, not the whole config class
+  public MaxInsertManyDocumentsValidation(
+      @ConfigProperty(name = "stargate.jsonapi.doc-limits.max-insert-many-documents") int limit) {
+    this.limit = limit;
+  }
+
+  /** {@inheritDoc} */
+  @Override
+  public boolean isValid(List<JsonNode> value, ConstraintValidatorContext context) {
+    return null != value && value.size() <= limit;
+  }
+}

src/main/java/io/stargate/sgv2/jsonapi/config/DocumentLimitsConfig.java

@@ -37,12 +37,20 @@ public interface DocumentLimitsConfig {
   @WithDefault("64")
   int maxObjectProperties();
 
-  /** @return Defines the maximum length of , defaults to {@code 8 levels} */
+  /** @return Defines the maximum length of a single String value. */
   @Positive
   @WithDefault("16000")
   int maxStringLength();
 
+  /** @return Maximum length of an array. */
   @Positive
   @WithDefault("100")
   int maxArrayLength();
+
+  /**
+   * @return Maximum amount of documents that can be inserted using <code>insertMany</code> command.
+   */
+  // keep in sync with MaxInsertManyDocumentsValidation
+  @Positive
+  int maxInsertManyDocuments();
 }

src/main/resources/application.yaml

@@ -13,6 +13,11 @@ stargate:
     global-tags:
       module: sgv2-jsonapi
 
+  # explicitly set limits
+  jsonapi:
+    doc-limits:
+      max-insert-many-documents: 20
+
 quarkus:
 
   # general app properties

src/test/java/io/stargate/sgv2/jsonapi/api/model/command/impl/InsertManyCommandTest.java

@@ -6,6 +6,7 @@
 import io.quarkus.test.junit.QuarkusTest;
 import io.quarkus.test.junit.TestProfile;
 import io.stargate.sgv2.common.testprofiles.NoGlobalResourcesTestProfile;
+import java.util.Map;
 import java.util.Set;
 import javax.inject.Inject;
 import javax.validation.ConstraintViolation;
@@ -14,9 +15,17 @@
 import org.junit.jupiter.api.Test;
 
 @QuarkusTest
-@TestProfile(NoGlobalResourcesTestProfile.Impl.class)
+@TestProfile(InsertManyCommandTest.Profile.class)
 class InsertManyCommandTest {
 
+  public static class Profile implements NoGlobalResourcesTestProfile {
+
+    @Override
+    public Map<String, String> getConfigOverrides() {
+      return Map.of("stargate.jsonapi.doc-limits.max-insert-many-documents", "2");
+    }
+  }
+
   @Inject ObjectMapper objectMapper;
 
   @Inject Validator validator;
@@ -62,5 +71,49 @@ public void documentsArrayEmpty() throws Exception {
           .extracting(ConstraintViolation::getMessage)
           .contains("must not be empty");
     }
+
+    @Test
+    public void tooManyDocuments() throws Exception {
+      String json =
+          """
+          {
+            "insertMany": {
+              "documents": [
+                {},
+                {},
+                {}
+              ]
+            }
+          }
+          """;
+
+      InsertManyCommand command = objectMapper.readValue(json, InsertManyCommand.class);
+      Set<ConstraintViolation<InsertManyCommand>> result = validator.validate(command);
+
+      assertThat(result)
+          .isNotEmpty()
+          .extracting(ConstraintViolation::getMessage)
+          .contains("amount of documents to insert is over the max limit");
+    }
+
+    @Test
+    public void acceptableDocuments() throws Exception {
+      String json =
+          """
+          {
+            "insertMany": {
+              "documents": [
+                {},
+                {}
+              ]
+            }
+          }
+          """;
+
+      InsertManyCommand command = objectMapper.readValue(json, InsertManyCommand.class);
+      Set<ConstraintViolation<InsertManyCommand>> result = validator.validate(command);
+
+      assertThat(result).isEmpty();
+    }
   }
 }