From d6d9796a2322b2938724696855478f5ba7d6294a Mon Sep 17 00:00:00 2001
From: Victor Solano <victor.solanonunez@gmail.com>
Date: Tue, 8 Sep 2026 16:25:33 +0200
Subject: [PATCH] Reject empty document fields at API boundary

---
 tests/test_api.py | 14 ++++++++++++++
 vaultrag/main.py  |  6 +++---
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/tests/test_api.py b/tests/test_api.py
index f25d074..8d8568a 100644
--- a/tests/test_api.py
+++ b/tests/test_api.py
@@ -94,6 +94,20 @@ async def test_health(client):
     assert r.status_code == 200
 
 
+async def test_empty_document_text_is_rejected(client):
+    r = await client.post(
+        "/documents",
+        json={
+            "id": "empty-text",
+            "title": "Empty Text",
+            "source": "wiki",
+            "acl": ["engineering"],
+            "text": "",
+        },
+    )
+    assert r.status_code == 422
+
+
 async def test_ask_requires_identity(client):
     r = await client.post("/ask", json={"question": "what is the bonus"})
     assert r.status_code == 422, "no user header should be rejected, not defaulted"
diff --git a/vaultrag/main.py b/vaultrag/main.py
index 239ea16..9324821 100644
--- a/vaultrag/main.py
+++ b/vaultrag/main.py
@@ -54,10 +54,10 @@ class AskResponse(BaseModel):
 
 
 class DocIn(BaseModel):
-    id: str
-    title: str
+    id: str = Field(min_length=1)
+    title: str = Field(min_length=1)
     source: str
-    text: str
+    text: str = Field(min_length=1)
     acl: list[str] = Field(description="user ids and/or group names. Empty means nobody can see it.")
     owner: str | None = None
     department: str | None = None