Add metadata size limits#111
Merged
Merged
Conversation
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.
Tip: disable this comment in your organization's Code Review settings.
Contributor
Author
|
@coderabbitai review |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (21)
📝 WalkthroughWalkthroughStreamCore and DependencyRegistry contracts enforce numeric byte-size limits on metadata fields, scripts, and generated tokenURI output through new constants and validation helpers. Tests verify boundary conditions and rejections. Documentation, operational logs, and release artifacts are updated to reflect the changes. ChangesMetadata Size Limits
Sequence Diagram(s)sequenceDiagram
participant Client as createCollection / mint / updateCollectionInfo
participant StreamCore
participant ValidateCollection as _requireCollectionInfoLimits
participant ValidateBytes as _requireMaxBytes
Client->>StreamCore: call mutation with metadata
StreamCore->>ValidateCollection: validate all collection fields / full metadata
ValidateCollection->>ValidateBytes: check each field byte length
ValidateBytes-->>ValidateCollection: revert MetadataFieldTooLarge if exceeded
ValidateCollection-->>StreamCore: revert if any field oversized
StreamCore-->>Client: revert MetadataFieldTooLarge(field, actual, max)
Note over Client,StreamCore: On valid input
StreamCore->>StreamCore: persist collection/token data
StreamCore-->>Client: success
sequenceDiagram
participant Client as _onchainTokenURI
participant Renderer as StreamMetadataRenderer
participant ValidateBytes as _requireMaxBytes
Client->>Renderer: render metadata to JSON
Renderer-->>Client: generatedTokenUri
Client->>ValidateBytes: validate generatedTokenUri length
ValidateBytes-->>Client: revert MetadataFieldTooLarge(tokenURI, actual, max) if exceeded
Note over Client,Renderer: On valid length
Client-->>Client: return generatedTokenUri
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
✅ Action performedReview finished.
|
This was referenced Jun 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
StreamCorecollection metadata, token data/image/attributes, generatedtokenURI, andDependencyRegistryscript/provenance inputs.MetadataFieldTooLarge/DependencyFieldTooLargecustom errors plus focused boundary/oversized-input tests.Continues #51. This intentionally leaves URI policy, semantic/structured attribute validation, invalid UTF-8 policy, and browser render-sandbox tests for later P1-META-006 slices.
Local validation
forge test --match-contract StreamMetadataSizeLimitsTest -vvvforge test --match-contract StreamMetadataEscapingTest -vvvforge test --match-contract StreamDependencyRegistryTest -vvvforge build --sizes --via-ir --skip test --skip script --force(StreamCore24,461 bytes, 115 bytes headroom)make release-checksumsmake checkpowershell -ExecutionPolicy Bypass -File scripts\check.ps1forge fmt --check smart-contracts\StreamCore.sol smart-contracts\DependencyRegistry.sol test\StreamMetadataSizeLimits.t.solgit diff --checkNote: full
forge fmt --check smart-contractsstill fails on existing legacy formatting outside this PR, as tracked in the roadmap; the files touched by this PR pass formatting.Summary by CodeRabbit
New Features
Tests
Documentation