Feat/add rate limiting and input validation

[EA10-lite]

Pull Request

Description

Add input validation and rate limiting on EventManager contract entrypoints to limit storage bloat and abusive patterns (spam events, oversized strings, runaway ticket batches, unrealistic prices/schedules).

Fixes #99

Type of Change

Please delete options that are not relevant.

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Code refactoring
• Performance improvement
• Test coverage improvement

Changes Made

• Strings: theme, event_type, and tier names must be non-empty and within a max byte length (200); failures return InvalidStringInput.
• Numeric bounds: Per-tier and aggregate ticket supply capped (500k); ticket price capped per tier / legacy single price (TicketPriceOutOfRange); purchase_tickets quantity capped per transaction (500, PurchaseQuantityTooLarge).
• Schedule: Enforces end_date > start_date > ledger time on create; max event duration (~366 days) and max how far start may be in the future (~5 years) via EventScheduleOutOfRange / existing date errors. update_event applies the same span/future-start rules only when the effective start is still in the future so in-progress events can extend end_date sensibly.
• Tier count: At most 32 tiers (TooManyTicketTiers).
• Organizer limits: Persistent OrganizerOpenEventCount — max 50 open events per organizer (TooManyOrganizerEvents). Count increments on successful create and decrements on cancel_event and withdraw_funds.
• Rate limiting: OrganizerLastCreateTs + 120s cooldown between creates only while the organizer still has at least one open event (EventCreationRateLimited), so canceling/withdrawing all events allows an immediate replacement create.
• Build fixes bundled with this contract: Completed DataKey / Error variants used by waitlist, escrow balance, and withdraw paths; added no-op try_promote_from_waitlist for withdraw_funds.
• Tests: #[cfg(test)] mod test wired; tests use create_event_with_tiers / correct purchase_tickets arity; fixed corrupted test_withdraw_funds_double_withdrawal; added tests for empty theme, rate limit, post-cancel recreate, and over-limit purchase quantity. Integration test bumps ledger time between two creates for the same organizer; import Ledger testutils for set_timestamp.

Testing

Please describe the tests that you ran to verify your changes:

• cargo test -p event_manager (32 unit tests)
• cargo build -p event_manager --target wasm32-unknown-unknown --release

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published

Screenshots (if applicable)

Add screenshots to help explain your changes.

N/A (contract-only changes)

Additional Notes

• New contract error codes were appended (19–27). Any generated client bindings that map Error discriminants should be regenerated after deploy.
• Integration tests (integration_tests) still require built WASM artifacts under target/wasm32-unknown-unknown/release/ for contractimport!; this is unchanged from the existing workflow.

[drips-wave]

@EA10-lite Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits