internal/api/validate.go - master - t3/iam-server

internal/api/validate.go
192 строки5 KB
Ivan Shibkikh
fix P2 medium
20 июл 2026, 18:39
20 июл 2026, 18:396c5606a
package api

import (
	"fmt"
	"time"
)

// --- CreateUser ---

func validateCreateUser(req CreateUserRequest) []FieldError {
	var errs []FieldError
	if req.DisplayName == "" {
		errs = append(errs, FieldError{Field: "display_name", Issue: "must not be empty"})
	} else if len(req.DisplayName) > MaxFieldLenString {
		errs = append(errs, fieldLengthError("display_name", len(req.DisplayName), MaxFieldLenString))
	}
	return errs
}

// --- UpdateUser ---

func validateUpdateUser(req UpdateUserRequest) []FieldError {
	var errs []FieldError
	if req.DisplayName == "" {
		errs = append(errs, FieldError{Field: "display_name", Issue: "must not be empty"})
	} else if len(req.DisplayName) > MaxFieldLenString {
		errs = append(errs, fieldLengthError("display_name", len(req.DisplayName), MaxFieldLenString))
	}
	return errs
}

// --- UpdateRole ---

func validateUpdateRole(req UpdateRoleRequest) []FieldError {
	var errs []FieldError
	if req.Name == "" {
		errs = append(errs, FieldError{Field: "name", Issue: "must not be empty"})
	} else if len(req.Name) > MaxFieldLenString {
		errs = append(errs, fieldLengthError("name", len(req.Name), MaxFieldLenString))
	}
	return errs
}

// --- CreateRole ---

func validateCreateRole(req CreateRoleRequest) []FieldError {
	var errs []FieldError
	if req.Name == "" {
		errs = append(errs, FieldError{Field: "name", Issue: "must not be empty"})
	} else if len(req.Name) > MaxFieldLenString {
		errs = append(errs, fieldLengthError("name", len(req.Name), MaxFieldLenString))
	}
	return errs
}

// --- AssignRoles ---

func validateAssignRoles(req AssignRolesRequest) []FieldError {
	var errs []FieldError
	if len(req.RoleIDs) > effectiveMaxRoleIDsPerAssign {
		errs = append(errs, FieldError{Field: "role_ids", Issue: fmt.Sprintf("maximum %d role IDs allowed", effectiveMaxRoleIDsPerAssign)})
		return errs
	}

	seen := make(map[string]bool)
	for i, rid := range req.RoleIDs {
		// Duplicate check
		if seen[rid] {
			errs = append(errs, FieldError{
				Field: fmt.Sprintf("role_ids[%d]", i),
				Issue: "duplicate role ID",
			})
			continue
		}
		seen[rid] = true

		// Empty ID check
		if rid == "" {
			errs = append(errs, FieldError{
				Field: fmt.Sprintf("role_ids[%d]", i),
				Issue: "must not be empty",
			})
		}
	}
	return errs
}

// --- SetPermissions ---

func validateSetPermissions(req SetPermissionsRequest) []FieldError {
	var errs []FieldError
	if len(req.Permissions) > effectiveMaxPermissionsPerSet {
		errs = append(errs, FieldError{Field: "permissions", Issue: fmt.Sprintf("maximum %d permission rules allowed", effectiveMaxPermissionsPerSet)})
		return errs
	}

	for i, p := range req.Permissions {
		prefix := fmt.Sprintf("permissions[%d]", i)

		if p.Effect != "Allow" && p.Effect != "Deny" {
			errs = append(errs, FieldError{
				Field: prefix + ".effect",
				Issue: "must be 'Allow' or 'Deny'",
			})
		}

		if p.Action == "" {
			errs = append(errs, FieldError{
				Field: prefix + ".action",
				Issue: "must not be empty",
			})
		} else if len(p.Action) > MaxFieldLenAction {
			errs = append(errs, fieldLengthError(prefix+".action", len(p.Action), MaxFieldLenAction))
		}

		if p.Resource == "" {
			errs = append(errs, FieldError{
				Field: prefix + ".resource",
				Issue: "must not be empty",
			})
		} else if len(p.Resource) > MaxFieldLenResource {
			errs = append(errs, fieldLengthError(prefix+".resource", len(p.Resource), MaxFieldLenResource))
		}
	}
	return errs
}

// --- AuthCheck ---

func validateAuthCheck(req AuthCheckRequest) []FieldError {
	var errs []FieldError
	if req.Action == "" {
		errs = append(errs, FieldError{Field: "action", Issue: "must not be empty"})
	} else if len(req.Action) > MaxFieldLenAction {
		errs = append(errs, fieldLengthError("action", len(req.Action), MaxFieldLenAction))
	}
	if req.Resource == "" {
		errs = append(errs, FieldError{Field: "resource", Issue: "must not be empty"})
	} else if len(req.Resource) > MaxFieldLenResource {
		errs = append(errs, fieldLengthError("resource", len(req.Resource), MaxFieldLenResource))
	}
	return errs
}

// --- CreateAccessKey ---

func validateCreateAccessKey(req CreateAccessKeyRequest) []FieldError {
	var errs []FieldError
	if req.ExpiresAt != nil && *req.ExpiresAt != "" {
		t, err := time.Parse(time.RFC3339, *req.ExpiresAt)
		if err != nil {
			errs = append(errs, FieldError{Field: "expires_at", Issue: "must be a valid RFC3339 timestamp"})
		} else if !t.IsZero() && t.Before(time.Now().UTC()) {
			errs = append(errs, FieldError{Field: "expires_at", Issue: "must not be in the past"})
		}
	}
	return errs
}

// --- RotateAccessKey ---

func validateRotateAccessKey(req RotateAccessKeyRequest) []FieldError {
	var errs []FieldError
	if req.ExpiresAt != nil && *req.ExpiresAt != "" {
		t, err := time.Parse(time.RFC3339, *req.ExpiresAt)
		if err != nil {
			errs = append(errs, FieldError{Field: "expires_at", Issue: "must be a valid RFC3339 timestamp"})
		} else if !t.IsZero() && t.Before(time.Now().UTC()) {
			errs = append(errs, FieldError{Field: "expires_at", Issue: "must not be in the past"})
		}
	}
	return errs
}

// --- UpdateAccessKey ---

func validateUpdateAccessKey(req UpdateAccessKeyRequest) []FieldError {
	var errs []FieldError
	if req.Status != "Active" && req.Status != "Inactive" {
		errs = append(errs, FieldError{Field: "status", Issue: "must be 'Active' or 'Inactive'"})
	}
	return errs
}

// --- Helpers ---

func fieldLengthError(field string, got, max int) FieldError {
	return FieldError{
		Field: field,
		Issue: fmt.Sprintf("must be at most %d characters (got %d)", max, got),
	}
}