🟡 [FEATURE] Add input validation on all API endpoints

[github-actions]

Description

No input validation exists on any API endpoint. Tasks can be created with null titles, negative priorities, and invalid status codes.

Requirements

• Add Bean Validation annotations (@NotNull, @Size, @Min, @Max)
• Add @Valid on controller method parameters
• Return proper 400 Bad Request responses with validation error details
• Validate status transitions
• Validate priority range (1-5)

Files Affected

• src/main/java/com/taskflow/model/Task.java
• src/main/java/com/taskflow/model/User.java
• src/main/java/com/taskflow/model/Project.java
• All controllers

[github-actions]

🎯 Triage report

No Bean Validation is applied on any API endpoint, allowing tasks with null titles, invalid priorities, and illegal status codes. Requirements specify @NotNull/@Size/@Min/@Max annotations with @Valid on controller parameters and proper 400 responses.

📊 Assessment

Dimension	Value	Reasoning
Type	Feature	Adds new validation layer not currently present.
Labels	enhancement	Input validation is a missing safety feature.
Coding agent	Suitable	Specific annotations and files listed; well-defined scope with clear success criteria (400 on invalid input).

💡 Notes and suggestions

Add spring-boot-starter-validation if not already present. Use @ControllerAdvice (see also #14) to handle MethodArgumentNotValidException and return structured error responses. Validate status enum transitions via a custom @ValidTransition annotation. Priority range 1–5 should use @Min(1) @max(5).

Generated by Daily Issue Triage · 95.1 AIC · ⌖ 18.2 AIC · ⊞ 5.4K · ◷

Add this agentic workflows to your repo

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/daily-issue-triage.md@1c6668b751c51af8571f01204ceffb19362e0f66

[github-actions]

🤖 This is an automated response from Test Improver.

Great feature request! Once input validation is implemented, here's a testing approach to ensure it works correctly.

Suggested Testing Strategy for Input Validation

The most effective tests for validation logic are @WebMvcTest tests using MockMvc — they verify that controllers reject invalid input and return proper 400 responses without needing a full Spring context.

Example test patterns for TaskController:

`@Test`
void createTask_withNullTitle_returns400() throws Exception {
    String body = "{\"title\":null,\"priority\":3,\"status\":\"TODO\"}";
    mockMvc.perform(post("/api/tasks")
        .contentType(MediaType.APPLICATION_JSON)
        .content(body))
        .andExpect(status().isBadRequest())
        .andExpect(jsonPath("$.errors").exists()); // or whatever the error format is
}

`@Test`
void createTask_withPriorityOutOfRange_returns400() throws Exception {
    String body = "{\"title\":\"Test\",\"priority\":10}"; // > 5
    mockMvc.perform(post("/api/tasks")
        .contentType(MediaType.APPLICATION_JSON)
        .content(body))
        .andExpect(status().isBadRequest());
}

`@Test`
void createTask_withInvalidStatus_returns400() throws Exception {
    String body = "{\"title\":\"Test\",\"status\":\"INVALID_STATUS\"}";
    mockMvc.perform(post("/api/tasks")
        .contentType(MediaType.APPLICATION_JSON)
        .content(body))
        .andExpect(status().isBadRequest());
}

What's already in place

The existing @WebMvcTest tests in PR #52 (TaskController), #54 (ProjectController), and #56 (UserController) provide the scaffold. Once @Valid annotations are added to controllers, the existing @WebMvcTest suite can be extended with the patterns above — it's easy to add a "validation" group of tests to each controller test class.

Notes

• spring-boot-starter-validation must be on the classpath; without it, @Valid is silently ignored.
• Coordinate with Issue 🟡 [FEATURE] Add proper error handling and consistent HTTP status codes #14 on the error response format — the errors JSON path in test assertions must match whatever GlobalExceptionHandler returns.
• Edge cases worth testing: empty string vs null title, boundary priority values (1 and 5 should pass; 0 and 6 should fail), status transitions with invalid source state.

Happy to implement these validation tests once the feature is merged. 🚀

Generated by Test Improver · 49.8 AIC · ⌖ 6.45 AIC · ⊞ 10.9K · ◷
_{Comment /test-assist to run again}

Add this agentic workflows to your repo

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/test-improver.md@1c6668b751c51af8571f01204ceffb19362e0f66