[FeatureReq - Edge Addons site] Add clear validation messages for Permission Justification fields instead of generic error banner

[bhuveshrohankar28-cmd]

Labels: Feature, Partner Center, Edge Addons

Related to: #640

Summary:

Currently, the "Permission justification" fields on the Privacy tab (Partner Center → extension submission) fail with a generic error banner — "Something went wrong while loading this page. Please refresh to try again." — whenever the input contains certain characters or patterns (e.g. https://, http//, or HTML tag syntax like <script>). This generic message gives no indication of what's actually wrong, and can easily be mistaken for a backend/session error (as happened in #640) rather than an input validation issue.

Requested feature:

Add proper client-side (or clearly surfaced server-side) validation feedback for these fields, similar to how the "Single purpose description" field already shows a live character counter. Specifically:

1. Inline validation messages — if a justification contains disallowed patterns (URL-like substrings, HTML tags, etc.), show a specific message near the field, e.g. "URLs and HTML tags are not allowed in this field," instead of failing the whole page save.
2. Live constraints shown upfront — document any character limits or disallowed patterns directly under each Permission justification textbox, the same way the Single Purpose Description field shows "421/1000."
3. Distinguish input errors from backend errors — the generic red banner is currently reused for both real backend failures (like the 403s in 403 Forbidden error when saving — "Something went wrong while loading this page" #640) and simple input validation issues. Separating these would save developers significant debugging time, since right now both look identical and get misdiagnosed as server problems.

Why this matters:

Since permission justifications often need to reference specific domains or URL patterns to properly explain why a host permission is needed (which is exactly what Microsoft's own guidance encourages), it's easy for developers to accidentally include a URL-like string in their justification text and get blocked with no explanation. This adds friction to an already important compliance step, and makes debugging failed submissions much harder than it needs to be.

Supporting findings from testing (extension: AlgoRhythm, Product ID: 1aa0fde7-c29a-4950-aaa8-219ec6672dc6):

• Confirmed triggers: https:///http// substrings, <script> tag syntax

---

[Rahul-Bauri]

Hi @bhuveshrohankar28-cmd Thank you for reporting the issues you encountered in the Privacy tab.
Could you please provide:

• Screenshots of the errors you are experiencing.
• Clear, reproducible steps for each issue you have mentioned.
• A HAR file captured while the issue occurs.

These details will help the engineering team reproduce, investigate, and resolve the issues more effectively. We look forward to your response. Thank you.

[bhuveshrohankar28-cmd]

hello @Rahul-Bauri sorry for late response!
I have provided the screen recording if it helps...
Note:- at first the copied text contains https but when i removed it at second time it worked.
also i am not sure is it only caused by https there may be many terms as i have mention in issue above.
if you need any further detailsi am ready to help thanks...

Recording.2026-07-07.174341.new.mp4

[Rahul-Bauri]

Hi @bhuveshrohankar28-cmd thank you for providing the video recording of the issue. This is valid feedback, and we were able to reproduce the issue on our side as well. I have shared the relevant details with the engineering team for further investigation.

I will provide an update in this thread once I receive any new information from the engineering team or if we require any additional details from you.

Additionally, I will close Issue #640, since it appears to be the same issue. Any future updates or developments will be tracked in this thread to keep the discussion consolidated.
Thank you for your cooperation and patience.