[Cases] Add guardrails for add and update comment API

x-pack/plugins/cases/common/api/cases/comment/index.test.ts

@@ -29,6 +29,7 @@ import {
   BulkGetAttachmentsRequestRt,
   BulkGetAttachmentsResponseRt,
 } from '.';
+import { MAX_COMMENT_LENGTH } from '../../../constants';
 
 describe('Comments', () => {
   describe('CommentAttributesBasicRt', () => {
@@ -340,6 +341,23 @@ describe('Comments', () => {
         right: defaultRequest,
       });
     });
+
+    it.skip('throws error when comment is too long', () => {
+      const longComment = 'x'.repeat(MAX_COMMENT_LENGTH + 1);
+
+      expect(CommentRequestRt.decode({ ...defaultRequest, comment: longComment })).toMatchObject({
+        _tag: 'Left',
+        left: [{
+          context:[{
+          actual: {
+              ...defaultRequest,
+              comment: longComment,
+              message: "The length of the comment is too long. The maximum length is 30000."
+            }
+          }]
+        }]
+      });
+    });
   });
 
   describe('CommentRt', () => {

x-pack/plugins/cases/server/client/attachments/add.test.ts

@@ -25,9 +25,7 @@ describe('addComment', () => {
   });
 
   it('should throw an error if the comment length is too long', async () => {
-    const longComment = Array(MAX_COMMENT_LENGTH + 1)
-      .fill('x')
-      .toString();
+    const longComment = 'x'.repeat(MAX_COMMENT_LENGTH + 1);
 
     await expect(
       addComment({ comment: { ...comment, comment: longComment }, caseId: 'test-case' }, clientArgs)

x-pack/test/cases_api_integration/security_and_spaces/tests/common/internal/bulk_create_attachments.ts

@@ -441,6 +441,23 @@ export default ({ getService }: FtrProviderContext): void => {
         });
       });
 
+      it('400s when comment is too long', async () => {
+        const longComment = 'x'.repeat(30001);
+
+        await bulkCreateAttachments({
+          supertest,
+          caseId: 'case-id',
+          params: [
+            {
+              type: CommentType.user,
+              comment: longComment,
+              owner: 'securitySolutionFixture',
+            },
+          ],
+          expectedHttpCode: 400,
+        });
+      });
+
       it('400s when adding excess attributes for type user', async () => {
         const postedCase = await createCase(supertest, postCaseReq);