Field Validation Rules

Every ObjectStack field type has built-in validation behavior that runs automatically at the schema level. This reference documents the default constraints, required properties, and validation semantics for each field type.

Universal Field Constraints

These properties apply to all field types and are validated by the base FieldSchema:

Text Types

text

Default constraints: None. Unbounded text unless maxLength is set.

textarea

Default constraints: None. Multi-line text with no length limit by default.

email

Default constraints: Must contain an @ and a domain with a dot — a lightweight pattern check, not full RFC 5322 validation.

url

Default constraints: Must be a valid URL with protocol prefix.

phone

Default constraints: Accepts digits, + ( ) - . and spaces (minimum 5 characters) — a lenient character-set check, not strict E.164 structural validation.

password

Default constraints: Validated the same as text (maxLength/minLength only) — the engine does not automatically hash or mask a password-typed field's value on read; even the platform's own credential column (sys_account.password) is declared as Field.text(), with hashing and verification owned entirely by the auth subsystem (better-auth), not driven by this field type. For a reversible encrypted-at-rest value on your own objects, use the secret type instead.

Rich Content Types

markdown

Default constraints: Accepts valid Markdown syntax. No length limit by default.

html

Default constraints: HTML content is sanitized to prevent XSS. No length limit by default.

richtext

Default constraints: Stored as structured rich text (e.g., ProseMirror/Tiptap JSON). Sanitized on save.

Number Types

number

Default constraints: Any valid number. No range or precision limits by default.

currency

Default constraints: Stored as { value, currency } pair. Precision defaults to 2 decimal places.

percent

Default constraints: Stored as decimal (e.g., 0.85 for 85%). No range limit by default.

Date & Time Types

date

Required props: None.
Default constraints: Validates ISO 8601 date format (YYYY-MM-DD). No range restrictions.

datetime

Required props: None.
Default constraints: Validates ISO 8601 datetime format (YYYY-MM-DDTHH:mm:ssZ). Stored in UTC.

time

Required props: None.
Default constraints: Validates ISO 8601 time format (HH:mm:ss). 24-hour format.

Boolean Types

boolean

Default constraints: Only accepts true or false. Renders as checkbox.

toggle

Default constraints: Identical validation to boolean. Distinct UI — renders as toggle switch.

Selection Types

select

Option validation: Each option value must be a lowercase system identifier — starts with a letter, then letters/digits/underscores/dots (^[a-z][a-z0-9_.]*$), minimum 2 characters.

multiselect

Default constraints: Stores array of selected option values. Each value validated against options.

radio

Default constraints: Single-value selection. Same validation as select with radio button UI.

checkboxes

Default constraints: Multi-value selection. Same validation as multiselect with checkbox group UI.

Relational Types

lookup

Default constraints: Validates that referenced record exists. Foreign key integrity enforced.

master_detail

Default constraints: Enforces parent-child ownership. Child records cascade-delete with the parent by default.

tree

Default constraints: Self-referencing lookup for hierarchical structures. Stored and expanded like a lookup; the engine does not run a cycle check on write, so a self-reference chain that loops back on itself is not automatically rejected.

Media Types

image

Default constraints: Accepts common image MIME types. Optional dimension and thumbnail validation via fileAttachmentConfig.

file

Default constraints: Accepts any file type unless restricted. Supports virus scanning, size limits, and type restrictions.

// File field with validation
{
  name: 'contract_pdf',
  label: 'Contract',
  type: 'file',
  fileAttachmentConfig: {
    maxSize: 10485760,           // 10MB
    allowedTypes: ['.pdf', '.docx'],
    virusScan: true,
    virusScanProvider: 'clamav'
  }
}

avatar

Default constraints: Single image upload. Typically constrained to square aspect ratio and small file sizes.

video

Default constraints: Accepts common video MIME types. Size limits recommended via fileAttachmentConfig.

audio

Default constraints: Accepts common audio MIME types. Size limits recommended via fileAttachmentConfig.

Computed & System Types

formula

Default constraints: Read-only. Value computed at runtime from expression. Not directly writable.

{
  name: 'full_name',
  label: 'Full Name',
  type: 'formula',
  expression: 'record.first_name + " " + record.last_name',
  dependencies: ['first_name', 'last_name']
}

summary

Default constraints: Read-only. Value computed from child records. Only valid on master objects.

autonumber

Default constraints: Read-only. Auto-incremented. Cannot be manually set after creation.

Enhanced Types

location

Default constraints: Stored as { latitude, longitude, altitude?, accuracy? }. Latitude: -90 to 90. Longitude: -180 to 180. No per-type config properties.

address

Default constraints: Stored as structured object with street, city, state, postalCode, country, countryCode, formatted (all parts optional). No per-type config properties.

code

Default constraints: Stored as plain text. Language used for UI syntax highlighting only.

json

Default constraints: Must be valid JSON. Parsed and validated on save.

color

Default constraints: Stores the color value as a string. No per-type config properties.

rating

Default constraints: Integer between 0 and max.

slider

Default constraints: Numeric value between min and max in step increments.

signature

Default constraints: Stored as base64-encoded image data. Immutable after creation in most workflows.

qrcode

Default constraints: Stores the encoded value; rendered as a scannable code. No per-type config properties.

progress

Default constraints: Numeric value rendered as a progress bar. Usually 0–100.

tags

Default constraints: Stored as array of strings. A lone scalar value is coerced into a single-element array; the engine does not trim or deduplicate entries.

AI/ML Types

vector

Default constraints: Must be a numeric array of exactly dimensions length. The nested vectorConfig object is retained for back-compat only and is a runtime no-op — set the flat dimensions property instead.

{
  name: 'content_embedding',
  label: 'Content Embedding',
  type: 'vector',
  dimensions: 1536
}

Security & Compliance Properties

For sensitive data, use the properties and types the platform actually enforces:

For reversible encrypted-at-rest values (API keys, tokens, DB passwords), use the secret field type — it is the type with an enforced masking/encryption code path. password is validated like plain text and has no built-in hashing or read-masking (see the password section above). See the Field Type Gallery.

Quick Validation Summary