Input validation and hard limits

src/limits.js

// Everything that crosses into our system from outside gets checked: what users
// send us, and what the model sends back. Limits keep one bad request from
// costing a fortune, freezing the server, or crashing the layout engine.

import { THEMES } from "./theme.js";

export const LIMITS = {
  topicChars: 2000, // a longer brief is almost always a paste accident
  minSlides: 3,
  maxSlides: 12,
  xmlChars: 60_000, // about 15k tokens: far more than any real deck needs
  depth: 16, // how deeply elements may nest inside one slide
  elementsPerSlide: 150,
};

/**
 * Check a request body and return a clean copy with defaults filled in:
 *   { ok: true, value: { topic, slideCount, theme, research } }  or  { ok: false, error }
 */
export function validateRequest(body) {
  if (!body || typeof body !== "object") return { ok: false, error: "Send a JSON object." };

  const topic = typeof body.topic === "string" ? body.topic.trim() : "";
  if (topic.length < 3) return { ok: false, error: "Describe the deck in at least a few words." };
  if (topic.length > LIMITS.topicChars) return { ok: false, error: `Keep the description under ${LIMITS.topicChars} characters.` };

  const slideCount = body.slideCount === undefined ? 6 : Number(body.slideCount);
  if (!Number.isInteger(slideCount) || slideCount < LIMITS.minSlides || slideCount > LIMITS.maxSlides) {
    return { ok: false, error: `Choose between ${LIMITS.minSlides} and ${LIMITS.maxSlides} slides.` };
  }

  const theme = body.theme ?? "light";
  if (!Object.hasOwn(THEMES, theme)) return { ok: false, error: `Unknown theme "${theme}".` };

  return { ok: true, value: { topic, slideCount, theme, research: body.research === true } };
}

/** Throw if a slide tree is too deep or has too many elements to lay out safely. */
export function checkTreeLimits(tree) {
  let count = 0;
  let deepest = 0;

  const walk = (node, depth) => {
    if (node.tag === "#text") return;
    count += 1;
    deepest = Math.max(deepest, depth);
    if (depth > LIMITS.depth) return; // no need to go further: it's already too deep
    for (const child of node.children) walk(child, depth + 1);
  };
  walk(tree, 1);

  if (deepest > LIMITS.depth) throw new Error(`Elements are nested more than ${LIMITS.depth} levels deep.`);
  if (count > LIMITS.elementsPerSlide) throw new Error(`The slide has ${count} elements; the limit is ${LIMITS.elementsPerSlide}.`);
}