fix(hub): a group name fits its column and carries no control characters

Over 128 characters was a 500 on PostgreSQL; line breaks, C0/C1 controls and
bidi overrides are refused (joiners stay, for emoji). The creation form caps
the field at 128 (F-13, what remains of it).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 33 insertions, 0 deletions

diff --git a/packages/meshbay-hub/tests/test_group_name_checked.py b/packages/meshbay-hub/tests/test_group_name_checked.py
new file mode 100644
index 0000000..fbc8277
--- /dev/null
+++ b/packages/meshbay-hub/tests/test_group_name_checked.py
@@ -0,0 +1,33 @@
+"""
+A group name is checked where it is created.
+
+The column is 128 characters wide: a longer name was a database error on
+PostgreSQL and a silent truncation on SQLite. And the name is shown to other
+people — in their group list, in the invitation mail — so it carries no line
+breaks or other control characters, and no bidirectional override that makes it
+display as something other than what it is.
+"""
+
+import pytest
+from test_bundle_pepper import _login, _register
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("name,ok", [
+    ("Photos de famille", True),
+    ("x" * 128, True),
+    ("👨‍👩‍👧 Family", True),          # a ZWJ sequence is a name, not a trick
+    ("x" * 129, False),
+    ("Films\nClick here", False),
+    ("tab\there", False),
+    ("evil‮gpj.exe", False),
+    ("   ", False),
+])
+async def test_a_group_name(client, name, ok):
+    await _register(client, "group_namer")
+    token = (await _login(client, "group_namer"))["access_token"]
+    r = await client.post("/v1/groups", json={"name": name},
+                          headers={"Authorization": f"Bearer {token}"})
+    assert (r.status_code < 300) is ok, (name, r.status_code, r.text)
+    if not ok:
+        assert r.status_code == 422