fix(admin): restrict search fields to digits and max 9 digits

[DerekRoberts]

Description

Fixes an issue where entering more than 9 digits into the admin search fields (FOM Number and FSP ID) caused an internal server error.

Changes

• Admin UI:
  • Created and applied DigitsOnlyDirective ([appDigitsOnly]) for input fields to restrict keystrokes to numbers only, enforce a maximum length of 9 digits, and strip leading zeros on paste and input events.
  • Replaced <input type="number">, min, and inline oninput handlers in SearchComponent template with type="text", maxlength="9", and appDigitsOnly, resolving CSP blocking issues in higher environments.
  • Sanitized query parameter parsing and restoration in SearchComponent to safely handle invalid or out-of-range values.
• Backend API:
  • Added range validation (1 to 2,147,483,647) for integer query parameters (projectId, fspId, districtId) in ProjectController and PositiveIntPipe to prevent PostgreSQL 32-bit integer overflow exceptions.
• Tests:
  • Added unit tests for DigitsOnlyDirective covering keyboard interaction, input truncation, paste handling, and leading zero removal.
  • Added unit tests for SearchComponent deep link sanitization and ProjectController integer boundary validation.

Closes #666

---

Thanks for the PR!

Deployments, as required, will be available below:

• api
• admin
• public

Please create PRs in draft mode. Mark as ready to enable:

• Analysis Workflow

After merge, new images are deployed in:

• Merge Workflow

[Copilot]

Pull request overview

Prevents oversized admin search IDs from causing database integer-overflow errors.

Changes:

• Restricts FOM/FSP inputs to nine digits.
• Sanitizes restored search parameters.
• Adds backend 32-bit integer validation and tests.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
api/src/app/modules/project/project.controller.ts	Validates positive integer query parameters.
api/src/app/modules/project/project.controller.spec.ts	Tests invalid integer boundaries.
api/src/app/modules/external/projects-by-fsp/projects-by-fsp.controller.ts	Adds an upper bound to FSP validation.
admin/src/core/directives/digits-only.directive.ts	Implements digit-only input handling.
admin/src/core/directives/digits-only.directive.spec.ts	Tests directive behavior.
admin/src/app/search/search.component.ts	Sanitizes search criteria and URL parameters.
admin/src/app/search/search.component.spec.ts	Tests deep-link sanitization and clearing.
admin/src/app/search/search.component.html	Applies digit restrictions to search inputs.

Suppressed comments (1)

admin/src/core/directives/digits-only.directive.ts:112

• The paste handler replaces the entire field instead of the selected range, and preventDefault() suppresses the browser's native input event. Since the search fields use [(ngModel)], calling control.setValue() does not update the bound fNumber/fFspId property, so a pasted ID can be visible while the search still submits the previous value. Merge the pasted text at the current selection and dispatch an input event after assigning the sanitized value.

    const sanitized = pastedText.replace(/\D/g, '').replace(/^0+/, '').slice(0, maxLen);

    const inputEl = this.el.nativeElement;
    inputEl.value = sanitized;
    if (this.ngControl?.control) {

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.