The requesting domain is already limited for an account, but I now want to restrict each account to a list of up to 7 paths.
Theres a couple of layers I can think of / combine, but none of them alone seem "correct"
The UI seems the easiest, the CSRF token means that only this form can post to the management module, if it only has 7 fields, it can only post a maximum of 7 paths. But I know the UI should present the persisted data and perform some basic validation before sending it to the backend, not enforce the business logic of it.
The database, An RDBMS (As far as I know) can only really enforce this if the account table has a 7 whitelist fields, or a single account_whitelist table with a foreign key of account id and 7 whitelist fields. I don't think I can restrict a maximum number of occurrences of the foreign key, so effectively a 2 column table (with additional path metadata if need be) that has up to 7 rows per account seems out of the question.
The Model. It's easy enough to create 7 model attributes as null / set them to a string, but I'm not sold as to whether this really enforce the business logic anywhere, if anything "enforcement" is a side effect of the ORM. Like enforcing no more than 2 school children in a shop at any given time by simply reducing the available floor space.
The controller, I could reject any request to persist more than 7 pieces of information. Again this seems like more enforcement based approach than the other options.
Or all of the above, but this seems like overkill, and less maintainable if the number 7 changes up or down over time.