[huyplb]

From the 2026-11-01 manual walk. The board card is credential-name-rule.

Bug

The credential form allowed only letters, numbers, spaces, - and _ (max 50), and applied that to the stored name when it opened. But the app makes names outside that rule itself:

• the form saves host/database (or the file path) when the name is left empty
• Query files names credentials Files: <file name>

So editing one of those and saving silently renamed it: 127.0.0.1/foxdb became 127001foxdb. Of the 130 connections in my dev workspace, 9 distinct names were affected. The server had no rule at all.

Fix

You picked free text on both sides. checkConnectionName in @foxschema/shared is the one rule:

• trimmed, up to 120 characters
• no control characters (they can't be seen)
• React renders names as text, so no other character needs refusing

Where it applies:

• POST and PUT /api/connections refuse anything else with 400 invalid_input, before saving
• the form drops only invisible characters; its hint now reads "Up to 120 characters"
• the default host/database name is capped at the same length

Also in this PR: the credential dialog is never taller than the window. The overlay centres it and can't scroll, so at 1280×800 the Edit Credential title was cut off. The fields now scroll between a fixed header and footer. I checked this in the app at 600 px tall: dialog at 16–584 px, title and Save visible, body scrolls (570 / 426 px).

Tests

• connection-name.test.ts: names the app makes are kept; trimming and blank names; control characters, too long, and non-strings are refused
• connections.routes.test.ts (new): POST and PUT keep 127.0.0.1/foxdb trimmed; refuse a control character without calling the store; refuse 121 characters
• ConnectionModal.test.tsx: a stored 127.0.0.1/foxdb (staging) stays as it is in the form

A/B: with the old route and form, all 6 new route and form tests fail. With the fix, all pass. tsc and eslint are clean, and the test-ID catalog is regenerated (two new IDs on the dialog card and body).

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes validation and normalization on every connection create/update path; behavior shift from permissive server + strict form to one shared rule.

Overview
Fixes credentials being silently renamed on edit when the app had already stored names like 127.0.0.1/foxdb or Files: … but the form only allowed alphanumerics (max 50) and stripped everything else on open/save.

Introduces shared checkConnectionName in @foxschema/shared: trimmed free text up to 120 characters, rejecting only control characters. POST/PUT connection routes now run this check and return 400 invalid_input before persisting; the credential form strips invisible characters only and updates its hint accordingly. Auto-generated default names are capped at the same limit on save.

The Edit Credential dialog is capped to the viewport height with a scrollable body so title and Save stay visible on short screens (conn-modal-card / conn-modal-body test IDs). Tests cover shared validation, route handlers, and preserving a stored name in the modal.

^{Reviewed by Cursor Bugbot for commit 03e6992. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Test IDs

Added (2)

• conn-modal-body
• conn-modal-card

{…} is a part filled in at run time. The full tree: docs/testing/TEST_IDS.md.