Validate document content length by extracted text, not JSON size

Add Node.TextLength() to walk the ProseMirror tree and sum actual user
text. Introduce ProseMirrorDocumentMaxTextLength validator that enforces
a 50k character limit on extracted text, paired with a 500k byte safety
cap on the raw JSON string. Extend e2e tests for content length.

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/validator/validator_prosemirror.go

@@ -15,6 +15,7 @@
 package validator
 
 import (
+	"fmt"
 	"strings"
 
 	"go.probo.inc/probo/pkg/prosemirror"
@@ -42,3 +43,35 @@ func ProseMirrorDocumentContent() ValidatorFunc {
 		return nil
 	}
 }
+
+// ProseMirrorDocumentMaxTextLength validates that the total text content
+// within a ProseMirror/Tiptap JSON document does not exceed maxLength bytes.
+// Only user-visible text is counted; structural markup is excluded.
+// Nil, empty, and whitespace-only values pass. Invalid JSON is skipped
+// (let ProseMirrorDocumentContent handle format errors).
+func ProseMirrorDocumentMaxTextLength(maxLength int) ValidatorFunc {
+	return func(value any) *ValidationError {
+		actualValue, isNil := dereferenceValue(value)
+		if isNil {
+			return nil
+		}
+		s, ok := actualValue.(string)
+		if !ok {
+			return newValidationError(ErrorCodeInvalidFormat, "value must be a string")
+		}
+		if strings.TrimSpace(s) == "" {
+			return nil
+		}
+		n, err := prosemirror.Parse(s)
+		if err != nil {
+			return nil
+		}
+		if n.TextLength() > maxLength {
+			return newValidationError(
+				ErrorCodeTooLong,
+				fmt.Sprintf("text content must be at most %d characters", maxLength),
+			)
+		}
+		return nil
+	}
+}

pkg/validator/validator_prosemirror_test.go

@@ -14,7 +14,10 @@
 
 package validator
 
-import "testing"
+import (
+	"strings"
+	"testing"
+)
 
 func TestProseMirrorDocumentContent(t *testing.T) {
 	t.Parallel()
@@ -51,3 +54,45 @@ func TestProseMirrorDocumentContent(t *testing.T) {
 		})
 	}
 }
+
+func proseMirrorDoc(text string) string {
+	return `{"type":"doc","content":[{"type":"paragraph","content":[{"type":"text","text":"` + text + `"}]}]}`
+}
+
+func TestProseMirrorDocumentMaxTextLength(t *testing.T) {
+	t.Parallel()
+
+	const maxLen = 10
+
+	tests := []struct {
+		name      string
+		value     any
+		wantError bool
+		wantCode  ErrorCode
+	}{
+		{"nil value", nil, false, ""},
+		{"nil *string", (*string)(nil), false, ""},
+		{"empty string", "", false, ""},
+		{"whitespace only", "   \n\t  ", false, ""},
+		{"under limit", proseMirrorDoc("hello"), false, ""},
+		{"at limit", proseMirrorDoc(strings.Repeat("a", maxLen)), false, ""},
+		{"over limit", proseMirrorDoc(strings.Repeat("a", maxLen+1)), true, ErrorCodeTooLong},
+		{"invalid json skipped", "not json", false, ""},
+		{"non-string", 42, true, ErrorCodeInvalidFormat},
+	}
+
+	fn := ProseMirrorDocumentMaxTextLength(maxLen)
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			err := fn(tt.value)
+			if (err != nil) != tt.wantError {
+				t.Errorf("ProseMirrorDocumentMaxTextLength() error = %v, wantError %v", err, tt.wantError)
+			}
+			if err != nil && tt.wantCode != "" && err.Code != tt.wantCode {
+				t.Errorf("expected code %s, got %s", tt.wantCode, err.Code)
+			}
+		})
+	}
+}