From 54bb2258bf428022ca1885043bc891ef173516d7 Mon Sep 17 00:00:00 2001
From: TastyHeadphones <76083688+TastyHeadphones@users.noreply.github.com>
Date: Sun, 27 Sep 2026 20:23:48 +0900
Subject: [PATCH] fix: cap invite_user list at 20

The invite endpoint accepted an uncapped invite_user array, so one
request could fan out a huge number of notifications. Match a 20-user
server/UI limit.
---
 internal/schema/question_schema.go                           | 4 ++--
 .../Questions/Detail/components/InviteToAnswer/index.tsx     | 5 +++++
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/internal/schema/question_schema.go b/internal/schema/question_schema.go
index 4c6d2ead7..6a9886a48 100644
--- a/internal/schema/question_schema.go
+++ b/internal/schema/question_schema.go
@@ -185,7 +185,7 @@ type QuestionUpdate struct {
 	Content string `validate:"gte=0,lte=65535" json:"content"`
 	// html
 	HTML       string   `json:"-"`
-	InviteUser []string `validate:"omitempty"  json:"invite_user"`
+	InviteUser []string `validate:"omitempty,max=20" json:"invite_user"`
 	// tags
 	Tags []*TagItem `validate:"dive" json:"tags"`
 	// edit summary
@@ -205,7 +205,7 @@ type QuestionRecoverReq struct {
 
 type QuestionUpdateInviteUser struct {
 	ID         string   `validate:"required" json:"id"`
-	InviteUser []string `validate:"omitempty"  json:"invite_user"`
+	InviteUser []string `validate:"omitempty,max=20" json:"invite_user"`
 	UserID     string   `json:"-"`
 	QuestionPermission
 	CaptchaID   string `json:"captcha_id"` // captcha_id
diff --git a/ui/src/pages/Questions/Detail/components/InviteToAnswer/index.tsx b/ui/src/pages/Questions/Detail/components/InviteToAnswer/index.tsx
index b8e29942c..3dd6c2c6b 100644
--- a/ui/src/pages/Questions/Detail/components/InviteToAnswer/index.tsx
+++ b/ui/src/pages/Questions/Detail/components/InviteToAnswer/index.tsx
@@ -37,6 +37,8 @@ interface Props {
   questionId: string;
   readOnly?: boolean;
 }
+const MAX_INVITE_USERS = 20;
+
 const Index: FC<Props> = ({ questionId, readOnly = false }) => {
   const { t } = useTranslation('translation', {
     keyPrefix: 'invite_to_answer',
@@ -69,6 +71,9 @@ const Index: FC<Props> = ({ questionId, readOnly = false }) => {
         return _.id !== user.id;
       });
     } else {
+      if (userList.length >= MAX_INVITE_USERS) {
+        return;
+      }
       userList.push(user);
     }
     setUsers(userList);