Data Entry Validation Guidelines
| Field | Value |
|---|---|
| Version | 1.0 |
| Effective Date | April 2026 |
| Review Cycle | Annual |
| Document Owner | Chief Information Security Officer (CISO) |
| Classification | CONFIDENTIAL — Internal Use Only |
| Applicable Standard | SOC 2 Type II — Security, Availability, Confidentiality |
1. Purpose and Scope
This document establishes detailed procedures and guidelines for all data entry into QA Touch and defines the validation rules applied at each point of entry to ensure data integrity, completeness, and accuracy throughout the platform. It applies to all users and automated systems interacting with QA Touch via the web UI, REST API, or file import workflows, and supports SOC 2 Processing Integrity criteria.
2. Data Entry Channels
| Channel | User Population | Applicable Validation Tier |
|---|---|---|
| Web Application UI | All authenticated workspace users | Client-side validation (UX) + mandatory server-side validation |
| REST API | Developers, automation engineers, CI/CD systems | Server-side validation only (mandatory); client-side N/A |
| Excel / CSV File Import | Admins and users with import permission | File-level, column-level, and row-level validation |
| Integration Sync (Jira, ADO, etc.) | Automated integration connectors | Payload schema + field mapping validation |
| AI Feature Input Fields | Users submitting prompts or uploading BRDs / images | Text length limits; file type and size validation; content moderation [VERIFY] |
| Webhook Inbound Payloads | External CI/CD or third-party systems | HMAC authentication + JSON schema validation |
3. Universal Validation Rules
| Validation Type | Rule Description | Layer | QA Touch Example |
|---|---|---|---|
| Required Field | Must be present and non-null/empty. | Client + Server | Test Case Title; Defect Title; Project Name; Tester email |
| Maximum Length | String must not exceed defined max character count. | Client + Server | Test Case Title: 255 chars; Step description: 5,000 chars; Comment: 10,000 chars |
| Minimum Length | String must meet minimum character count. | Server | Password: 12 chars minimum; API key name: 3 chars minimum |
| Data Type | Value must match declared type. | Server | Priority: integer enum; Due date: ISO 8601; Workspace ID: UUID v4 |
| Enum / Picklist | Value must be within a predefined set. | Client + Server | Priority: Low/Medium/High/Critical; Status: Draft/Active/Deprecated |
| Date Format | Dates must match ISO 8601 (YYYY-MM-DD) or locale setting. | Client + Server | Test Run start/end dates; Milestone due date; Created/Updated timestamps |
| Email Format | Must match RFC 5322 pattern. | Client + Server | User account email; notification recipient; integration contact email |
| URL Format | Must be a valid HTTP/HTTPS URL. | Server | Webhook endpoint URL; integration base URL |
| UUID Format | Must be a valid UUID v4. | Server | Workspace ID, Project ID, Test Case ID in API path parameters |
| Range Check | Numeric value within defined min/max bounds. | Server | Custom numeric fields: admin-defined min/max at field creation |
| Uniqueness | Value must be unique within defined scope. | Server | Project name: unique per workspace; User email: unique across platform |
| Referential Integrity | FK reference must point to an existing record in same workspace. | Server | Test Case in a Test Run must exist in the same project |
| Cross-Field Consistency | Field combination must be logically valid. | Server | Run end date ≥ start date; Defect fix version ≥ affected version |
| File Type | Uploaded file MIME type and extension must be in allowed list. | Server | Attachments: jpg, png, gif, pdf, xlsx, csv, zip; AI input: jpg, png, pdf |
| File Size | File must not exceed maximum size. | Server | Attachments: 20 MB [VERIFY]; Import files: 10 MB [VERIFY]; AI uploads: 10 MB [VERIFY] |
| XSS Sanitisation | HTML/script tags stripped from text fields via allowlist sanitiser. | Server | Descriptions, comments, step action/expected result fields |
| SQL Injection Prevention | Parameterised queries enforced for all DB operations. | Server (ORM) | All create/update/delete operations through ORM layer |
| Encoding | All text normalised to UTF-8. | Server | Handles international characters in test names, comments, descriptions |
4. Entity-Specific Validation Rules
4.1 Test Cases
- Title: required; 1–255 characters.
- Steps: at least one step required; each step must have both Action and Expected Result fields populated.
- Priority: required; one of [Low, Medium, High, Critical]; default Medium.
- Status: required; one of [Draft, Active, Deprecated]; default Draft.
- Custom Fields: validated against the field type, allowed values, and constraints defined by the workspace admin.
4.2 Test Runs
- Test Plan reference: required; must point to an existing Test Plan in the same project.
- Step result: on submission, must be one of [Pass, Fail, Blocked, Not Run, In Progress].
- Execution comment: optional; maximum 10,000 characters; sanitised for XSS.
- Linked defects: referenced defect IDs must exist within the same workspace.
4.3 Defects
- Title: required; 1–255 characters.
- Severity: required; one of [Critical, Major, Minor, Trivial].
- Status: required; one of [Open, In Progress, Fixed, Closed, Reopened].
4.4 User Accounts
- Email: required; RFC 5322 format; unique across the entire QA Touch platform.
- Password: minimum 12 characters; complexity: uppercase, lowercase, number, special character [VERIFY policy specifics].
- Role: must be a valid role defined in the workspace RBAC configuration.
4.5 AI Input Fields
- Prompt text: maximum character limit enforced (assumption: 4,096 tokens / ~16,000 characters [VERIFY]).
- Uploaded file for AI: MIME type validated (jpg, png, pdf); maximum 10 MB [VERIFY].
- Prompt content: transmitted to LLM provider over TLS; stored per AI retention policy [VERIFY].
5. Import-Specific Guidelines
- Users must download and use the current QA Touch import template; older template versions generate a warning on upload.
- Date columns: must be formatted as YYYY-MM-DD or MM/DD/YYYY per workspace locale setting.
- Boolean fields: True/False or 1/0 values only; any other value causes row rejection.
- Empty rows are silently skipped; they do not contribute to the error rate threshold.
- After processing, users receive an import summary: records imported, records skipped, records with errors, plus a downloadable row-level error report.
6. Validation Failure Responses
| Scenario | User-Facing Response | System Behaviour |
|---|---|---|
| Missing required field (Web UI) | Red border + inline error message below field | Form submission blocked; no API request sent to server |
| Invalid format (Web UI) | Inline: ‘Invalid email format’ or ‘Date must be YYYY-MM-DD’ | Form submission blocked; corrective hint displayed |
| Missing required field (API) | HTTP 422 with JSON: {field: 'title', message: 'Title is required'} | Record not created; error logged with user ID and timestamp |
| Invalid enum value (API) | HTTP 422: ‘priority must be one of [Low, Medium, High, Critical]‘ | Record not created; error logged |
| Import row validation failure | Row listed in error report with row number and reason | Valid rows processed; invalid rows excluded; user can fix and re-import |
| File type not accepted | ’Only .xlsx and .csv files are supported for import’ | Upload rejected immediately before any processing begins |
| File exceeds size limit | ’File exceeds the 10 MB maximum size limit’ | Upload rejected; no partial storage |
| Referential integrity failure | HTTP 422: ‘Referenced project does not exist in your workspace’ | Record not created; error logged |
| Rate limit exceeded | HTTP 429 with Retry-After header | Request rejected; client should retry after indicated delay |