Summary
The client-side campaign-creation form accepts a title of any length, but the backend enforces a 200-character maximum — a user can fill out and submit a form that the backend will then reject.
Location
frontend/src/lib/validation/schemas.ts:7: title: z.string().min(1, "Title is required") (no .max()); backend: backend/src/routes/campaigns.ts:52: title: { type: 'string', required: true, minLength: 1, maxLength: 200 }
Problem
The Zod schema used for client-side validation doesn't match what the backend actually accepts. A user typing a longer title gets no client-side warning, fills out the rest of the form, submits, and only then discovers the backend rejected it — a poor UX for something that could be caught instantly.
Impact
Low-medium: not a security issue (the backend correctly enforces its own limit regardless), but a real UX gap that erodes trust in form validation.
Acceptance Criteria
Suggested Approach
One-line fix to the Zod schema. Worth a quick check of other fields on this and other forms for similar client/server validation mismatches while in the area, though that's optional scope beyond this specific issue.
Summary
The client-side campaign-creation form accepts a title of any length, but the backend enforces a 200-character maximum — a user can fill out and submit a form that the backend will then reject.
Location
frontend/src/lib/validation/schemas.ts:7:title: z.string().min(1, "Title is required")(no.max()); backend:backend/src/routes/campaigns.ts:52:title: { type: 'string', required: true, minLength: 1, maxLength: 200 }Problem
The Zod schema used for client-side validation doesn't match what the backend actually accepts. A user typing a longer title gets no client-side warning, fills out the rest of the form, submits, and only then discovers the backend rejected it — a poor UX for something that could be caught instantly.
Impact
Low-medium: not a security issue (the backend correctly enforces its own limit regardless), but a real UX gap that erodes trust in form validation.
Acceptance Criteria
schemas.ts'stitlevalidation adds.max(200, "Title must be 200 characters or less")(or whatever message convention the rest of the schema uses), matching the backend's limit exactlynpm testpasses infrontend/Suggested Approach
One-line fix to the Zod schema. Worth a quick check of other fields on this and other forms for similar client/server validation mismatches while in the area, though that's optional scope beyond this specific issue.