| | | 1 | | using ArturRios.Heimdall.Domain.Enums; |
| | | 2 | | using ArturRios.Heimdall.Shared.Messages; |
| | | 3 | | using FluentValidation; |
| | | 4 | | |
| | | 5 | | namespace ArturRios.Heimdall.Command.Input.Validation; |
| | | 6 | | |
| | | 7 | | /// <summary> |
| | | 8 | | /// Input validation for <see cref="UpdateScopeCommand" /> (UC-03). Only checks the shape of the |
| | | 9 | | /// request — including the field lengths the columns impose, so an overlong value is a named 400 |
| | | 10 | | /// here rather than the persistence layer's unclassified data-access failure; business rules |
| | | 11 | | /// that require data access (existence, name uniqueness) are enforced by the handler. |
| | | 12 | | /// </summary> |
| | | 13 | | public class UpdateScopeCommandValidator : AbstractValidator<UpdateScopeCommand> |
| | | 14 | | { |
| | 36 | 15 | | public UpdateScopeCommandValidator() |
| | | 16 | | { |
| | 36 | 17 | | RuleFor(command => command.Name) |
| | 36 | 18 | | .NotEmpty() |
| | 36 | 19 | | .WithMessage(ScopeMessages.NameRequired) |
| | 36 | 20 | | .MaximumLength(200) |
| | 36 | 21 | | .WithMessage(ScopeMessages.NameTooLong); |
| | | 22 | | |
| | | 23 | | // FluentValidation's MaximumLength rule skips a null argument, so only a non-null overlong |
| | | 24 | | // description is rejected — matching how the Application and ScopePermission validators |
| | | 25 | | // treat their optional descriptions. |
| | 36 | 26 | | RuleFor(command => command.Description) |
| | 36 | 27 | | .MaximumLength(500) |
| | 36 | 28 | | .WithMessage(ScopeMessages.DescriptionTooLong); |
| | | 29 | | |
| | | 30 | | // NFR-23. Consent is refused rather than accepted-and-ignored: a tenant that asked for it |
| | | 31 | | // and was silently given contract performance would believe a basis applied that did not. |
| | 36 | 32 | | RuleFor(command => command.DefaultLegalBasis) |
| | 25 | 33 | | .Must(basis => basis != (int)LegalBases.Consent) |
| | 36 | 34 | | .WithMessage(ScopeMessages.ConsentBasisNotSupported); |
| | | 35 | | |
| | 36 | 36 | | RuleFor(command => command.DefaultLegalBasis) |
| | 25 | 37 | | .Must(basis => basis is null || (Enum.IsDefined((LegalBases)basis.Value) |
| | 25 | 38 | | && basis.Value != (int)LegalBases.Unrecorded)) |
| | 36 | 39 | | .WithMessage(ScopeMessages.LegalBasisUnknown); |
| | | 40 | | |
| | | 41 | | // The scheme is checked, not just absoluteness. On Unix, Uri.TryCreate parses "/some/path" |
| | | 42 | | // as an absolute file:// URI, so an absoluteness check alone accepts a local filesystem path |
| | | 43 | | // as a tenant's published privacy notice — worse than the relative link it was meant to |
| | | 44 | | // refuse, because it looks valid and points at the host's disk. |
| | 36 | 45 | | RuleFor(command => command.PrivacyNoticeUri) |
| | 25 | 46 | | .Must(uri => string.IsNullOrWhiteSpace(uri) || |
| | 25 | 47 | | (Uri.TryCreate(uri, UriKind.Absolute, out var parsed) |
| | 25 | 48 | | && (parsed.Scheme == Uri.UriSchemeHttps || parsed.Scheme == Uri.UriSchemeHttp))) |
| | 36 | 49 | | .WithMessage(ScopeMessages.PrivacyNoticeUriInvalid); |
| | | 50 | | |
| | 36 | 51 | | RuleFor(command => command.PrivacyNoticeUri) |
| | 36 | 52 | | .MaximumLength(2048) |
| | 36 | 53 | | .WithMessage(ScopeMessages.PrivacyNoticeUriInvalid); |
| | 36 | 54 | | } |
| | | 55 | | } |