From 712c5707ee9acd996e6570cad3751503d9cfed2d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= <mbombeck@gmail.com>
Date: Mon, 1 Jun 2026 23:38:50 +0200
Subject: [PATCH] fix(auth): cap insurerIkNumber length before the digit refine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The insurerIkNumber field went straight to the 9-digit regex refine with
no upper bound, unlike its siblings insurerName and fullName which cap at
120 characters. Add a defensive .max(32) before the transform — well
above the 9 digits the value ever holds — so an oversized string is
rejected at the length gate rather than reaching the regex. The refine
already rejects malformed input; this is hardening for consistency with
the surrounding fields.
---
 src/lib/validations/auth.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/lib/validations/auth.ts b/src/lib/validations/auth.ts
index e7e94d9db..7c899cf61 100644
--- a/src/lib/validations/auth.ts
+++ b/src/lib/validations/auth.ts
@@ -65,6 +65,7 @@ export const profileSchema = z.object({
   // the iOS client contract). Surfaced on the FHIR `Coverage` payor.
   insurerIkNumber: z
     .string()
+    .max(32)
     .nullable()
     .optional()
     .transform((v) => {