Recipes
Input Validation
UX Patterns
Guard every field before the recipe engine ever sees it. Validation lives at the boundary — never trust raw input, even from your own dashboard.
Field-Level Rules
Length Bounds
Enforce min/max on every string field. Reject empty titles, truncate descriptions at 2048 chars before they hit the queue.
Type Coercion
Parse numbers strictly. “3.7” is a float, “0x1F” is rejected. Never rely on JavaScript loose equality for config values.
Allowed Charsets
Whitelist, never blacklist. Slugs get [a-z0-9-]. Names get Unicode letter classes. Everything else is noise.
Enum Locking
If a field accepts one of five modes, reject anything outside that set. No fuzzy matching, no silent fallback.
Error Display
Title is required
Provide a name for this recipe before saving.
Cooldown too low
Minimum cooldown is 60 seconds for rate-limited recipes.
Errors render inline next to the offending field. Never use toast for validation — the user needs persistent context while fixing multiple fields.
Server-Side Recheck
Client validation is a courtesy. The API re-validates every field identically and returns a 422 with a structured error bag. Duplicate the rules, never trust the boundary.