| | | 1 | | using System.Text.RegularExpressions; |
| | | 2 | | using Elsa.ExternalAuthentication.Contracts; |
| | | 3 | | using Elsa.ExternalAuthentication.Models; |
| | | 4 | | |
| | | 5 | | namespace Elsa.ExternalAuthentication.Services; |
| | | 6 | | |
| | | 7 | | /// <summary> |
| | | 8 | | /// Validates extension descriptors before they are exposed to configuration or Studio. |
| | | 9 | | /// </summary> |
| | | 10 | | public sealed class ExtensionDescriptorValidator |
| | | 11 | | { |
| | 2 | 12 | | private static readonly Regex IdentifierPattern = new("^[a-z][a-z0-9]*(?:[-.][a-z0-9]+)*$", RegexOptions.CultureInva |
| | 2 | 13 | | private static readonly Regex SettingFieldNamePattern = new("^[a-z][A-Za-z0-9]*$", RegexOptions.CultureInvariant); |
| | 2 | 14 | | private static readonly HashSet<string> SupportedValueTypes = new(StringComparer.Ordinal) |
| | 2 | 15 | | { |
| | 2 | 16 | | "string", "secret", "boolean", "integer", "number", "uri", "string-array", "json" |
| | 2 | 17 | | }; |
| | | 18 | | |
| | | 19 | | public ExternalAuthenticationAdapterDescriptor Validate(IExternalAuthenticationAdapter extension) |
| | | 20 | | { |
| | 5 | 21 | | var descriptor = extension.Describe(); |
| | 5 | 22 | | ValidateDescriptor(extension.Type, descriptor.Type, descriptor.DisplayName, descriptor.Description, descriptor.S |
| | 3 | 23 | | return descriptor; |
| | | 24 | | } |
| | | 25 | | |
| | | 26 | | public UnlinkedIdentityPolicyDescriptor Validate(IUnlinkedIdentityPolicy extension) |
| | | 27 | | { |
| | 3 | 28 | | var descriptor = extension.Describe(); |
| | 3 | 29 | | ValidateDescriptor(extension.Type, descriptor.Type, descriptor.DisplayName, descriptor.Description, descriptor.S |
| | 3 | 30 | | return descriptor; |
| | | 31 | | } |
| | | 32 | | |
| | | 33 | | public PermissionGrantSourceDescriptor Validate(IPermissionGrantSource extension) |
| | | 34 | | { |
| | 2 | 35 | | var descriptor = extension.Describe(); |
| | 2 | 36 | | ValidateDescriptor(extension.Type, descriptor.Type, descriptor.DisplayName, descriptor.Description, descriptor.S |
| | 2 | 37 | | return descriptor; |
| | | 38 | | } |
| | | 39 | | |
| | | 40 | | public ExternalUserMatcherDescriptor Validate(IExternalUserMatcher extension) |
| | | 41 | | { |
| | 0 | 42 | | var descriptor = extension.Describe(); |
| | 0 | 43 | | ValidateDescriptor(extension.Type, descriptor.Type, descriptor.DisplayName, descriptor.Description, descriptor.S |
| | 0 | 44 | | return descriptor; |
| | | 45 | | } |
| | | 46 | | |
| | | 47 | | private static void ValidateDescriptor( |
| | | 48 | | string extensionType, |
| | | 49 | | string descriptorType, |
| | | 50 | | string displayName, |
| | | 51 | | string description, |
| | | 52 | | int settingsVersion, |
| | | 53 | | IReadOnlyList<SettingFieldDescriptor> fields, |
| | | 54 | | CustomEditorContract? customEditor) |
| | | 55 | | { |
| | 10 | 56 | | var failures = new List<string>(); |
| | 10 | 57 | | if (!IsIdentifier(extensionType)) |
| | 1 | 58 | | failures.Add($"Extension type '{extensionType}' is not a stable identifier."); |
| | 10 | 59 | | if (!string.Equals(extensionType, descriptorType, StringComparison.Ordinal)) |
| | 1 | 60 | | failures.Add($"Descriptor type '{descriptorType}' does not match extension type '{extensionType}'."); |
| | 10 | 61 | | if (string.IsNullOrWhiteSpace(displayName)) |
| | 1 | 62 | | failures.Add($"Extension '{extensionType}' must define a display name."); |
| | 10 | 63 | | if (string.IsNullOrWhiteSpace(description)) |
| | 1 | 64 | | failures.Add($"Extension '{extensionType}' must define a description."); |
| | 10 | 65 | | if (settingsVersion <= 0) |
| | 1 | 66 | | failures.Add($"Extension '{extensionType}' must define a positive settings version."); |
| | 10 | 67 | | if (fields is null) |
| | 0 | 68 | | failures.Add($"Extension '{extensionType}' must define a fields collection."); |
| | | 69 | | else |
| | 10 | 70 | | ValidateFields(extensionType, fields, failures); |
| | 10 | 71 | | if (customEditor is not null && (!IsIdentifier(customEditor.Key) || customEditor.ContractVersion <= 0)) |
| | 1 | 72 | | failures.Add($"Extension '{extensionType}' has an invalid custom-editor contract."); |
| | | 73 | | |
| | 10 | 74 | | if (failures.Count > 0) |
| | 2 | 75 | | throw new InvalidOperationException(string.Join(" ", failures)); |
| | 8 | 76 | | } |
| | | 77 | | |
| | | 78 | | private static void ValidateFields(string extensionType, IReadOnlyCollection<SettingFieldDescriptor> fields, ICollec |
| | | 79 | | { |
| | 10 | 80 | | var names = new HashSet<string>(StringComparer.Ordinal); |
| | 32 | 81 | | foreach (var field in fields) |
| | | 82 | | { |
| | 6 | 83 | | if (!IsSettingFieldName(field.Name)) |
| | 0 | 84 | | failures.Add($"Extension '{extensionType}' has invalid field name '{field.Name}'."); |
| | 6 | 85 | | else if (!names.Add(field.Name)) |
| | 0 | 86 | | failures.Add($"Extension '{extensionType}' defines field '{field.Name}' more than once."); |
| | 6 | 87 | | if (string.IsNullOrWhiteSpace(field.DisplayName) || string.IsNullOrWhiteSpace(field.Description)) |
| | 0 | 88 | | failures.Add($"Field '{field.Name}' must define display text."); |
| | 6 | 89 | | if (!SupportedValueTypes.Contains(field.ValueType)) |
| | 0 | 90 | | failures.Add($"Field '{field.Name}' has unsupported value type '{field.ValueType}'."); |
| | 6 | 91 | | if (string.IsNullOrWhiteSpace(field.UiHint)) |
| | 0 | 92 | | failures.Add($"Field '{field.Name}' must define a UI hint."); |
| | 6 | 93 | | if (field.Validation.MinimumLength is < 0 || |
| | 6 | 94 | | field.Validation.MaximumLength is < 0 || |
| | 6 | 95 | | field.Validation.MinimumLength > field.Validation.MaximumLength) |
| | 0 | 96 | | failures.Add($"Field '{field.Name}' has invalid length validation."); |
| | 6 | 97 | | if (field.Validation.Pattern is { Length: > 0 } pattern) |
| | | 98 | | { |
| | | 99 | | try |
| | | 100 | | { |
| | 0 | 101 | | _ = new Regex(pattern, RegexOptions.CultureInvariant, TimeSpan.FromSeconds(1)); |
| | 0 | 102 | | } |
| | 0 | 103 | | catch (ArgumentException) |
| | | 104 | | { |
| | 0 | 105 | | failures.Add($"Field '{field.Name}' has an invalid validation pattern."); |
| | 0 | 106 | | } |
| | | 107 | | } |
| | 6 | 108 | | if (field.AllowedValues.Any(string.IsNullOrWhiteSpace) || |
| | 6 | 109 | | field.AllowedValues.Distinct(StringComparer.Ordinal).Count() != field.AllowedValues.Count) |
| | 0 | 110 | | failures.Add($"Field '{field.Name}' has invalid or duplicate allowed values."); |
| | 6 | 111 | | if (field.IsSecretBinding && (!string.Equals(field.ValueType, "secret", StringComparison.Ordinal) || !field. |
| | 1 | 112 | | failures.Add($"Secret-binding field '{field.Name}' must use the secret value type and be redacted."); |
| | | 113 | | } |
| | | 114 | | |
| | 28 | 115 | | foreach (var field in fields.Where(x => x.VisibleWhen is not null)) |
| | | 116 | | { |
| | 1 | 117 | | var condition = field.VisibleWhen!; |
| | 1 | 118 | | if (!names.Contains(condition.Field) || |
| | 1 | 119 | | string.Equals(condition.Field, field.Name, StringComparison.Ordinal) || |
| | 1 | 120 | | string.IsNullOrWhiteSpace(condition.ExpectedValue)) |
| | 1 | 121 | | failures.Add($"Field '{field.Name}' has an invalid visibility condition."); |
| | | 122 | | } |
| | 10 | 123 | | } |
| | | 124 | | |
| | | 125 | | private static bool IsIdentifier(string? value) => |
| | 15 | 126 | | !string.IsNullOrWhiteSpace(value) && IdentifierPattern.IsMatch(value); |
| | | 127 | | |
| | | 128 | | private static bool IsSettingFieldName(string? value) => |
| | 6 | 129 | | !string.IsNullOrWhiteSpace(value) && SettingFieldNamePattern.IsMatch(value); |
| | | 130 | | } |