From e4f2f88a3213d27b910691dfd61777dd6acb4826 Mon Sep 17 00:00:00 2001
From: haelyra <49814733+haelyra@users.noreply.github.com>
Date: Thu, 29 Oct 2026 19:40:29 -0700
Subject: [PATCH] docs(tinystruct): validate example login inputs before
 authentication

Add null, blank and example-specific UTF-16 length checks to the English and Japanese login snippets before AuthService. Preserve credential bytes, authentication-failure behavior and the existing successful-session flow. Label the 256/1024 limits as application examples rather than tinystruct defaults.

Compile and execute exact extracted methods against controlled request/auth/session stubs with ephemeral official checksum-verified Temurin17. Baseline: 8 pass,20 fail. Candidate:28 pass,0 fail. Tagged Request API and Java17 target verified. Markdownlint, Unicode and diff checks pass. Root independently reviewed both documents. No full HTTP host, real authentication service, cookie-policy or envelope changes claimed; registry rebound remains root-owned.
---
 docs/ja-JP/skills/tinystruct-patterns/SKILL.md | 11 +++++++++++
 skills/tinystruct-patterns/SKILL.md            | 11 +++++++++++
 2 files changed, 22 insertions(+)

diff --git a/docs/ja-JP/skills/tinystruct-patterns/SKILL.md b/docs/ja-JP/skills/tinystruct-patterns/SKILL.md
index 20116dd8f..82e88fe28 100644
--- a/docs/ja-JP/skills/tinystruct-patterns/SKILL.md
+++ b/docs/ja-JP/skills/tinystruct-patterns/SKILL.md
@@ -136,12 +136,23 @@ public class MyService extends AbstractApplication {
 ```
 
 ### HTTPモード分岐（login）
+
+以下の長さ制限は UTF-16 コード単位で数えるアプリケーション側の設定例であり、tinystruct のデフォルトではありません。認証サービスの方針に合わせてください。空白だけの認証情報は拒否しますが、認証に渡す値をトリミングしたり変更したりしません。
+
 ```java
 @Action(value = "login", mode = Mode.HTTP_POST)
 public String doLogin(Request<?, ?> request) throws ApplicationException {
     String username = request.getParameter("username");
     String password = request.getParameter("password");
 
+    final int maxUsernameLength = 256;
+    final int maxPasswordLength = 1024;
+    if (username == null || password == null
+            || username.length() > maxUsernameLength || password.length() > maxPasswordLength
+            || username.isBlank() || password.isBlank()) {
+        throw new ApplicationException("Invalid credentials");
+    }
+
     // AuthService はアプリケーション独自のクラスであり、tinystruct の一部ではない
     String userId = AuthService.getInstance().authenticate(username, password); // 失敗時は null
     if (userId == null) {
diff --git a/skills/tinystruct-patterns/SKILL.md b/skills/tinystruct-patterns/SKILL.md
index b3c30d167..ec8a6ca12 100644
--- a/skills/tinystruct-patterns/SKILL.md
+++ b/skills/tinystruct-patterns/SKILL.md
@@ -136,12 +136,23 @@ public class MyService extends AbstractApplication {
 ```
 
 ### HTTP Mode Disambiguation (login)
+
+The limits below are example application policy measured in UTF-16 code units, not tinystruct defaults. Align them with your authentication service. Reject blank credentials without trimming or otherwise changing the values passed to authentication.
+
 ```java
 @Action(value = "login", mode = Mode.HTTP_POST)
 public String doLogin(Request<?, ?> request) throws ApplicationException {
     String username = request.getParameter("username");
     String password = request.getParameter("password");
 
+    final int maxUsernameLength = 256;
+    final int maxPasswordLength = 1024;
+    if (username == null || password == null
+            || username.length() > maxUsernameLength || password.length() > maxPasswordLength
+            || username.isBlank() || password.isBlank()) {
+        throw new ApplicationException("Invalid credentials");
+    }
+
     // AuthService is your application's own class, not part of tinystruct
     String userId = AuthService.getInstance().authenticate(username, password); // null on failure
     if (userId == null) {