limit max buddies to 30/group in feedbag endpoint

server/http/mgmt_api.go

@@ -1342,28 +1342,37 @@ func putFeedbagBuddyHandler(w http.ResponseWriter, r *http.Request, buddyBroadca
 
 	var group *wire.FeedbagItem
 
+	count := 0
 	for _, item := range items {
 		switch {
 		case item.ClassID == wire.FeedbagClassIdGroup && item.GroupID == groupID:
 			group = &item
-		case item.ClassID == wire.FeedbagClassIdBuddy && item.GroupID == groupID && item.Name == newBuddy.IdentScreenName().String():
-			response := struct {
-				Name    string `json:"name"`
-				GroupID uint16 `json:"group_id"`
-				ItemID  uint16 `json:"item_id"`
-			}{
-				Name:    buddyScreenName,
-				GroupID: groupID,
-				ItemID:  item.ItemID,
-			}
-			w.WriteHeader(http.StatusOK)
-			if err := json.NewEncoder(w).Encode(response); err != nil {
-				logger.Error("error encoding response", "err", err.Error())
+		case item.ClassID == wire.FeedbagClassIdBuddy && item.GroupID == groupID:
+			count++
+			if item.Name == newBuddy.IdentScreenName().String() {
+				response := struct {
+					Name    string `json:"name"`
+					GroupID uint16 `json:"group_id"`
+					ItemID  uint16 `json:"item_id"`
+				}{
+					Name:    buddyScreenName,
+					GroupID: groupID,
+					ItemID:  item.ItemID,
+				}
+				w.WriteHeader(http.StatusOK)
+				if err := json.NewEncoder(w).Encode(response); err != nil {
+					logger.Error("error encoding response", "err", err.Error())
+				}
+				return
 			}
-			return
 		}
 	}
 
+	if count >= 30 {
+		errorMsg(w, "too many buddies in group. max: 30", http.StatusBadRequest)
+		return
+	}
+
 	if group == nil {
 		errorMsg(w, "group not found", http.StatusNotFound)
 		return

server/http/mgmt_api_test.go

@@ -3700,6 +3700,43 @@ func TestFeedbagBuddyHandler_PUT(t *testing.T) {
 				},
 			},
 		},
+		{
+			name:           "too many buddies in group - max 30",
+			screenName:     "userA",
+			groupID:        "1",
+			requestBody:    `{"name":"newbuddy"}`,
+			wantStatusCode: http.StatusBadRequest,
+			wantResponse:   `{"message":"too many buddies in group. max: 30"}`,
+			mockParams: mockParams{
+				feedbagManagerParams: feedbagManagerParams{
+					feedbagParams: feedbagParams{
+						{
+							screenName: state.NewIdentScreenName("userA"),
+							result: func() []wire.FeedbagItem {
+								items := []wire.FeedbagItem{
+									{
+										ClassID: wire.FeedbagClassIdGroup,
+										Name:    "Friends",
+										GroupID: 1,
+									},
+								}
+								// Add 30 buddies to the group
+								for i := 1; i <= 30; i++ {
+									items = append(items, wire.FeedbagItem{
+										ItemID:  uint16(i),
+										ClassID: wire.FeedbagClassIdBuddy,
+										Name:    fmt.Sprintf("buddy%d", i),
+										GroupID: 1,
+									})
+								}
+								return items
+							}(),
+							err: nil,
+						},
+					},
+				},
+			},
+		},
 		{
 			name:           "group not found",
 			screenName:     "userA",