fix: close task 3 resolution findings

central/app/blocker_resolution.py

@@ -13,6 +13,8 @@ from .models import Agent, BlockedProduct, FiscalContextEntry, Installation, Ten
 
 WORKFLOW_SCOPES = {"PRODUCT", "GROUP", "COMPANY"}
 ENTRY_FIELDS = {"scope", "scope_key", "key", "value", "reason"}
+MAX_VALUE_LENGTH = 512
+MAX_REASON_LENGTH = 2000
 
 
 def validate_resolution_input(payload):
@@ -22,6 +24,14 @@ def validate_resolution_input(payload):
     unexpected = set(payload) - ENTRY_FIELDS
     if unexpected:
         return None, f"unsupported resolution fields: {sorted(unexpected)}"
+    if not isinstance(payload.get("value"), str):
+        return None, "value must be a string"
+    if not isinstance(payload.get("reason"), str):
+        return None, "reason must be a string"
+    if len(payload["value"]) > MAX_VALUE_LENGTH:
+        return None, f"value must be at most {MAX_VALUE_LENGTH} characters"
+    if len(payload["reason"]) > MAX_REASON_LENGTH:
+        return None, f"reason must be at most {MAX_REASON_LENGTH} characters"
 
     normalized, error = validate_entry(payload)
     if error:
@@ -69,15 +79,15 @@ def resolve_blocker_with_context(session, blocker_id, admin, payload, request_ip
             installation = session.get(Installation, blocker.installation_id)
             if installation is None:
                 raise LookupError("blocker installation not found")
+            if installation.tenant_id != blocker.tenant_id:
+                raise LookupError("blocker installation tenant mismatch")
             agent = session.get(Agent, installation.agent_id)
+            if agent is None:
+                raise LookupError("blocker installation agent not found")
+            if agent.tenant_id != blocker.tenant_id:
+                raise LookupError("blocker agent tenant mismatch")
         else:
-            agent = session.scalar(
-                select(Agent)
-                .where(Agent.tenant_id == blocker.tenant_id, Agent.enabled.is_(True))
-                .order_by(Agent.id.asc())
-            )
-        if agent is None:
-            raise LookupError("blocker agent not found")
+            raise LookupError("blocker installation is required")
 
         tenant = session.get(Tenant, blocker.tenant_id)
         company_key = _company_key(blocker, installation, tenant)