elastic / elastic/package-spec
[Change Proposal] Add `minimum`/`maximum` constraints for `type: integer` variables
- Dominant language
- Go
- Stars
- 20
- Forks
- 93
- Avg merge
- 15h 10m
- Merged PRs (30d)
- 12
Description
## Problem
Several integrations have `type: integer` manifest variables (e.g. `page_size`, `batch_size`) that control API page sizes and directly affect memory consumption. While `type: integer` prevents non-numeric input, there is no way to enforce that the value falls within a valid range.
For example, the sentinel_one integration has `batch_size` variables with a documented maximum of 1000 (per the SentinelOne API), but nothing stops a user from setting it to 50000. The constraint exists only as free text in the `description` field.
The `type: duration` variable type already has `min_duration`/`max_duration` (added in [#948](https://github.com/elastic/package-spec/pull/948)). The same pattern would be useful for `type: integer`.
## Proposal
Add optional `minimum` and `maximum` properties to `type: integer` variables:
```yaml
- name: batch_size
type: integer
title: Batch Size
description: Batch size for the API response.
default: 1000
minimum: 1
maximum: 1000
```
Validation rules:
- `minimum` and `maximum` are optional. Either can be specified independently.
- When both are present: `minimum` <= `default` <= `maximum`.
- `minimum` and `maximum` can only be used when `type` is `integer`.
- Fleet should reject values outside the range at both the UI and API layer.
## Motivation
This was identified during an audit of page/batch size enforcement across integrations ([elastic/integrations#19248](https://github.com/elastic/integrations/issues/19248)). The findings:
- 46 fields across 22 integrations were declared as `type: text` when the value is always numeric — those are being fixed to `type: integer`.
- Several of those fields have documented API limits (e.g. "maximum supported page size is 1000") that exist only in description text with no enforcement.
- `type: select` with discrete options was considered but breaks existing policies on upgrade due to integer/string type mismatch in stored policy values.
- `type: duration` with `min_duration`/`max_duration` solves the analogous problem for time intervals but requires `format_version: 3.5.0` (stack 9.2+), which many packages can't adopt yet.
Integer min/max constraints would close the enforcement gap for numeric variables without requiring a type change that breaks existing policies.
## Related
- [#44](https://github.com/elastic/package-spec/issues/44) — Define input variable types (meta issue)
- [#948](https://github.com/elastic/package-spec/pull/948) — Add `duration` variable data type with `min_duration`/`max_duration`
- [elastic/integrations#19248](https://github.com/elastic/integrations/issues/19248) — Numeric page_size/batch_size manifest variables incorrectly declared as `type: text`
Contributor guide
Assessment
This issue has not been assessed yet.