From e107fae76ff01f2c531d58fa5723e6252d70312c Mon Sep 17 00:00:00 2001
From: Kazuhiro Oka <k.oka@kazutech.jp>
Date: Fri, 19 Dec 2025 22:11:04 +0900
Subject: [PATCH 1/2] =?UTF-8?q?update:=20slug=E3=81=AB/=E3=81=8C=E4=BD=BF?=
 =?UTF-8?q?=E3=81=88=E3=82=8B=E3=82=88=E3=81=86=E3=81=AB=E5=A4=89=E6=9B=B4?=
 =?UTF-8?q?=E3=80=82?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 lambda/admin_portal/static/links.html | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/lambda/admin_portal/static/links.html b/lambda/admin_portal/static/links.html
index 23af538..f953bfa 100644
--- a/lambda/admin_portal/static/links.html
+++ b/lambda/admin_portal/static/links.html
@@ -241,8 +241,8 @@ <h5 class="modal-title" id="createLinkModalLabel">
                                     <div class="col-md-6 mb-3">
                                         <label for="linkSlug" class="form-label">Slug <span class="text-danger">*</span></label>
                                         <input type="text" class="form-control" id="linkSlug" name="link_slug" required
-                                               pattern="[a-zA-Z0-9_\-]+" title="英数字、ハイフン、アンダースコアのみ使用可能">
-                                        <div class="form-text">英数字、ハイフン、アンダースコアのみ使用可能</div>
+                                               pattern="[a-zA-Z0-9_\-/]+" title="英数字、ハイフン、アンダースコア、スラッシュのみ使用可能">
+                                        <div class="form-text">英数字、ハイフン、アンダースコア、スラッシュのみ使用可能</div>
                                     </div>
 
                                     <!-- HTTP Status -->
@@ -522,7 +522,7 @@ <h5 class="modal-title" id="editLinkModalLabel">
                     e.stopPropagation();
 
                     const slugInput = document.getElementById('linkSlug');
-                    const slugPattern = /^[a-zA-Z0-9_-]+$/;
+                    const slugPattern = /^[a-zA-Z0-9_\-/]+$/;
 
                     if (!slugInput.value) {
                         alert('Slugを入力してください。');
@@ -530,7 +530,7 @@ <h5 class="modal-title" id="editLinkModalLabel">
                     }
 
                     if (!slugPattern.test(slugInput.value)) {
-                        alert('Slugは英数字、ハイフン、アンダースコアのみ使用可能です。');
+                        alert('Slugは英数字、ハイフン、アンダースコア、スラッシュのみ使用可能です。');
                         return;
                     }
 

From db868e652a99351e47d2923fd010a9e7cf59c303 Mon Sep 17 00:00:00 2001
From: Kazuhiro Oka <k.oka@kazutech.jp>
Date: Fri, 19 Dec 2025 22:26:03 +0900
Subject: [PATCH 2/2] add: link validation

---
 .../common/python/ddb/models/delibird_link.py | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/lambda/layers/common/python/ddb/models/delibird_link.py b/lambda/layers/common/python/ddb/models/delibird_link.py
index 0c2cc41..80dae1a 100644
--- a/lambda/layers/common/python/ddb/models/delibird_link.py
+++ b/lambda/layers/common/python/ddb/models/delibird_link.py
@@ -1,6 +1,7 @@
 import json
 import logging
 import os
+import re
 from dataclasses import dataclass
 from datetime import datetime
 from enum import Enum, auto
@@ -18,6 +19,8 @@
 from util.logger_util import setup_logger
 
 _REGION = os.environ["AWS_REGION"]
+_MAX_SLUG_LENGTH = 255
+_SLUG_PATTERN = re.compile(r'^[a-zA-Z0-9\-_]+(?:/[a-zA-Z0-9\-_]+)*$', re.ASCII)
 
 logger = setup_logger("delibird.link_table", logging.INFO)
 
@@ -55,11 +58,27 @@ class DelibirdLink:
 
     max_uses: Optional[int] = None
 
+    @staticmethod
+    def _validation(link: "DelibirdLink") -> None:
+        # domain
+        if not link.domain:
+            raise ValueError("Domain is required.")
+        # slug
+        if (not (slug := link.link_slug)) or (len(slug) > _MAX_SLUG_LENGTH) or (not _SLUG_PATTERN.fullmatch(slug)):
+            raise ValueError(f"Invalid slug: {slug}")
+        # origin
+        if not link.link_origin:
+            raise ValueError("Origin is required.")
+        # status
+        if not link.status.is_redirection:
+            raise ValueError(f"Status code {link.status} is not a redirection status.")
+
     def __post_init__(self):
         if self.query_whitelist is None:
             self.query_whitelist = set()
         if self.tag is None:
             self.tag = set()
+        DelibirdLink._validation(self)
 
     def check_active(self) -> tuple[bool, Optional[DelibirdLinkInactiveReason]]:
         if self.disabled: