AIKIDO-2026-84206

TL;DR

The ash_typescript typed controller request handler casts route arguments with Ash.Type.cast_input/3 but never calls Ash.Type.apply_constraints/3, so declared constraints such as one_of, max_length, min, max, and match are not enforced. A client using a plain HTTP request can submit values outside those constraints, for example a role the argument was meant to exclude. When those arguments gate authorization or state machine decisions, this leads to a privilege or workflow bypass. The fix applies type constraints after casting.