feat(routes-b): validate hex color and enforce 100 tag limit per user…

[Peolite001]

Closes #536

Description

This PR implements the requirements for #536 - Validate hex color and enforce max tags per user on the routes-b tags POST endpoint.

Changes Made

*All changes are strictly within app/api/routes-b/ as per scope:

• app/api/routes-b/_lib/limits.ts (new)

  • Added TAG_LIMITS constant with MAX_TAGS_PER_USER: 100

• app/api/routes-b/tags/schema.ts

  • Enhanced createTagSchema with:
    • Strict 6-character hex color validation (#RRGGBB)
    • Name trimming + lowercasing
    • Empty name rejection
    • Max 32 characters name limit

• app/api/routes-b/tags/route.ts

  • Added proper validation using Zod
  • Enforced per-user tag limit atomically using Prisma $transaction
  • Returns 409 Conflict when limit is reached
  • Improved error handling for validation failures

• app/api/routes-b/tags/tests/create.test.ts (new)

  • Added unit tests covering:
    • Successful tag creation
    • Invalid hex color rejection
    • Empty name after trim
    • Name longer than 32 characters
    • Tag limit enforcement (409 response)

Key Features

• No invalid hex colors can reach the database
• Tag limit is enforced safely (no race conditions)
• Tag names are normalized (trimmed + lowercased)
• All new helpers live inside app/api/routes-b/_lib/
• Tests are located in app/api/routes-b/tags/tests/

Out of Scope (as specified)

• Per-tenant configurable limits
• Tag merge UI
• Any files outside app/api/routes-b/

Testing

• All acceptance criteria covered in tests
• Manual testing recommended for auth edge cases

[vercel]

@Peolite001 is attempting to deploy a commit to the david's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@Peolite001 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits