thats-me/backend/app/Rules/ScalarSetting.php

<?php

namespace App\Rules;

use Closure;
use Illuminate\Contracts\Validation\ValidationRule;

/**
 * Allows only bounded scalar values inside the settings document, so a
 * client cannot nest arrays or objects where a shader uniform or a colour
 * string is expected.
 */
class ScalarSetting implements ValidationRule
{
    public function __construct(private readonly int $maxLength = 4096) {}

    public function validate(string $attribute, mixed $value, Closure $fail): void
    {
        if ($value === null || is_bool($value) || is_int($value) || is_float($value)) {
            return;
        }

        if (! is_string($value)) {
            $fail('The :attribute must be a string, number or boolean.');

            return;
        }

        if (mb_strlen($value) > $this->maxLength) {
            $fail("The :attribute may not be greater than {$this->maxLength} characters.");
        }
    }
}