Check the variables a step resume writes as start() and setVariable() check them

Frank Mablyrequested to merge
issue/orchestra-3633205:3633205-check-the-variables into 1.x

Closes https://www.drupal.org/project/orchestra/issues/3633205

  • LocalOrchestraClient::resumeStep() now holds every variable to the limits a start and setVariable() apply (reserved name, name over 255 characters, value JSON cannot encode or over 64 KB encoded), and the payload to the same size cap, before anything is read or written. A refusal is answered as a refused result naming the variable.
  • The checks are shared: findVariableRefusal() / findValueRefusal(), with validateVariable() throwing on the same reasons for the start and set doors.
  • OrchestraClientInterface::resumeStep() and docs/openapi.yaml say so.
  • On a client site, the remote form handler and the step decision form now log the reason of a refused resume (warning, orchestra_client_webform), as the engine site's own form does. The person still gets the general message, and only the reason says which rule refused the answers (for example an answer too large to store). Tests: RemoteWorkflowHandlerTest::testRefusalReasonIsLogged(), StepControllerTest::testRefusalReasonIsLogged().
  • Test: StepEndpointTest::testVariablesTheInstanceCannotCarryAreRefused() (fails on 1.x: the long name and the large value were accepted).

AI-Generated: Yes (Claude Code was used to audit the module and to write this code, its test and this description.)

Edited by Frank Mably

Merge request reports