Rullst AcademyRullst Academy/Lesson
Applications with Rullst I · Lesson 06 / 14

Validate at the right boundary

A direct request does not pass through form rules.

Learning paths18 min

Let's discover together

  1. 1

    NewMission describes the expected shape; Deserialize reads JSON and deny_unknown_fields rejects extra fields. Then validate applies domain rules. Converting JSON into a struct does not prove an empty title or priority 9 makes sense.

  2. 2

    The title is trimmed, must contain 1–80 Unicode code points and rejects control characters such as newlines. chars().count() counts neither bytes nor necessarily perceived symbols: some emoji combine several code points. Priority must be between 1 and 3.

  3. 3

    Predict results for an all-space title, 80 é letters, 81 x letters and priority 0. Run cargo test --locked title_and_priority_boundaries. The é test distinguishes code points from UTF-8 bytes; also use an emoji example to explain the measure’s limit.

  4. 4

    In the handler, validate comes before store.create. Failure returns 422 with an error code and inserts no record. The HTTP test calls the API directly, without relying on browser required, and checks that the count did not change.

Your application workbench

The kit includes a complete app to investigate and modify. The excerpt below explains this step; the editor contains the indicated file. Rullst Academy does not compile or run this server in your browser.

File to study and modify

src/validation.rs

let title = input.title.trim().to_owned();
if !(1..=80).contains(&title.chars().count()) {
    return Err("invalid_title");
}

Extract the kit to a new folder and open a terminal beside Cargo.toml. Use Rust 1.96+; the first build may download dependencies and take time. Then open http://127.0.0.1:3010. Stop with Ctrl+C and run again after editing.

cargo test --locked
cargo run --locked
My files and GitHub

Download your draft and replace the indicated file in your extracted copy. The editor saves one file in this browser; your account saves assessments and XP. The ZIP excludes your edits. GitHub sends only the confirmed file; use Git manually for the whole app, excluding databases, backups and secrets.

Official links and next step

✦
YOUR MISSION

Test boundaries and reject invalid input before changing the database.

Now it's your turn

Discovery workshop

Decide before running

Test boundaries and reject invalid input before changing the database.
Build your answers and check when you are ready.
A moment to understand

Which evidence checks the server rule?

I need a hint

The API is an independent boundary. Check the response and absence of unintended changes, not just appearance.

Loading your journey…

Take it with you

In a copy, change the limit to 60. Update the rule, new-schema CHECK, interface explanation and 60/61 tests. Use a new test database: CREATE TABLE IF NOT EXISTS does not alter an existing table. Explain why changing text alone is insufficient.

At your own pace

My files and GitHub

Every lesson can become your own record: code, notes or a practice plan. Saving a file to GitHub is optional and does not change your XP.

Student guide

The editor and downloads open when this lesson is available to your account. Check access below or return to the track map.

Checking your access to this lesson…

Rullstpetbot

AI can make mistakes. Check the lesson material.