1 files changed, 23 insertions, 2 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/groups.py b/packages/meshbay-hub/src/meshbay_hub/api/groups.py
index 10049b2..fc117bf 100644
--- a/packages/meshbay-hub/src/meshbay_hub/api/groups.py
+++ b/packages/meshbay-hub/src/meshbay_hub/api/groups.py
@@ -1,6 +1,7 @@
 """Group endpoints — /v1/groups/*"""
 
 import re
+import unicodedata
 from datetime import UTC, datetime
 
 from fastapi import APIRouter, Depends, HTTPException, Query, Request
@@ -347,6 +348,25 @@ async def join_group(
             "owner_username": owner}
 
 
+# The column's width. A longer name was a database error on PostgreSQL (a 500)
+# and silently truncated on SQLite.
+MAX_GROUP_NAME = 128
+# Line breaks and other C0/C1 controls, and the bidirectional overrides that
+# make a name display as something other than what it is. Joiners stay: an
+# emoji family is a ZWJ sequence.
+_BIDI_CONTROLS = frozenset("\u202a\u202b\u202c\u202d\u202e\u2066\u2067\u2068\u2069")
+
+
+def _group_name_problem(name: str) -> str | None:
+    if not name:
+        return "A group needs a name."
+    if len(name) > MAX_GROUP_NAME:
+        return f"A group name is at most {MAX_GROUP_NAME} characters."
+    if any(unicodedata.category(c) == "Cc" or c in _BIDI_CONTROLS for c in name):
+        return "A group name cannot contain control characters."
+    return None
+
+
 class GroupCreateRequest(BaseModel):
     name:        str
     visibility:  str = "private"   # public|private
@@ -426,8 +446,9 @@ async def create_group(
                    "anyone to be able to join.")
 
     name = body.name.strip()
-    if not name:
-        raise HTTPException(status_code=422, detail="A group needs a name.")
+    problem = _group_name_problem(name)
+    if problem:
+        raise HTTPException(status_code=422, detail=problem)
     # One name per owner, case-insensitively. Two *different* owners may each
     # have a "photos" — that is why the check is scoped to `admin_id` and why
     # the group's real identity stays its UUID. The DB has a unique index too