@chipmobilesdk/rn-auth 0.2.1 → 0.3.1

package/src/config/validateConfig.ts

@@ -1,108 +1,114 @@
-/**
- * Deterministic configuration validation (FR-005 → configuration-error).
- * Throws AuthConfigError before any provider flow can start (US4 scenario 2).
- * Covers the auth-config.md Section A–F rules.
- */
-
-import type { AuthConfig } from './types';
-import { AuthConfigError } from '../diagnostics/errors';
-
-function hasScheme(url: string): boolean {
-	return /^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(url);
-}
-
-export function validateConfig(config: AuthConfig): void {
-	// Section A — tenant/client settings
-	if (!config.authority || !config.authority.trim()) {
-		throw new AuthConfigError('auth.error.configuration', 'Missing "authority"');
-	}
-	if (!hasScheme(config.authority)) {
-		throw new AuthConfigError('auth.error.configuration', '"authority" must be an absolute URL');
-	}
-	if (!config.clientId || !config.clientId.trim()) {
-		throw new AuthConfigError('auth.error.configuration', 'Missing "clientId"');
-	}
-	if (!config.redirectUrl || !config.redirectUrl.trim()) {
-		throw new AuthConfigError('auth.error.configuration', 'Missing "redirectUrl"');
-	}
-	if (!hasScheme(config.redirectUrl)) {
-		throw new AuthConfigError(
-			'auth.error.redirectMismatch',
-			'"redirectUrl" must include a scheme matching the native redirect configuration',
-		);
-	}
-	if (!Array.isArray(config.scopes) || config.scopes.length === 0) {
-		throw new AuthConfigError('auth.error.configuration', 'At least one OIDC scope is required');
-	}
-	if (!config.scopes.includes('offline_access')) {
-		throw new AuthConfigError(
-			'auth.error.configuration',
-			'"offline_access" scope is required for session restore and silent refresh',
-		);
-	}
-
-	// Sections B/C — providers
-	if (!Array.isArray(config.providers) || config.providers.length === 0) {
-		throw new AuthConfigError('auth.error.configuration', 'At least one provider must be configured');
-	}
-	const providerIds = new Set<string>();
-	for (const provider of config.providers) {
-		if (providerIds.has(provider.id)) {
-			throw new AuthConfigError('auth.error.configuration', `Duplicate provider "${provider.id}"`);
-		}
-		providerIds.add(provider.id);
-		if (!provider.domainHint || !provider.domainHint.trim()) {
-			throw new AuthConfigError(
-				'auth.error.configuration',
-				`Provider "${provider.id}" is missing a domainHint`,
-			);
-		}
-		if (!Array.isArray(provider.platforms) || provider.platforms.length === 0) {
-			throw new AuthConfigError(
-				'auth.error.configuration',
-				`Provider "${provider.id}" must declare at least one platform`,
-			);
-		}
-	}
-
-	// Section D — resources
-	if (config.resources) {
-		const resourceKeys = new Set<string>();
-		for (const resource of config.resources) {
-			if (!resource.key || !resource.key.trim()) {
-				throw new AuthConfigError('auth.error.configuration', 'A resource is missing "key"');
-			}
-			if (resourceKeys.has(resource.key)) {
-				throw new AuthConfigError('auth.error.configuration', `Duplicate resource "${resource.key}"`);
-			}
-			resourceKeys.add(resource.key);
-			if (!Array.isArray(resource.scopes) || resource.scopes.length === 0) {
-				throw new AuthConfigError(
-					'auth.error.configuration',
-					`Resource "${resource.key}" must declare at least one scope`,
-				);
-			}
-		}
-	}
-
-	// Section E — access-tier mapping
-	const mapping = config.accessTierMapping;
-	if (!mapping) {
-		throw new AuthConfigError('auth.error.configuration', 'Missing "accessTierMapping"');
-	}
-	const hasPremiumIndicator =
-		(mapping.premiumGroupObjectIds?.length ?? 0) > 0 ||
-		(mapping.premiumRoleNames?.length ?? 0) > 0 ||
-		(mapping.premiumClaimMatchers?.length ?? 0) > 0;
-	if (!hasPremiumIndicator) {
-		throw new AuthConfigError(
-			'auth.error.configuration',
-			'accessTierMapping must define at least one premium group object id, role name, or claim matcher',
-		);
-	}
-
-	// Section F — injected ports
-	if (!config.secureStore) {
-		throw new AuthConfigError('auth.error.configuration', 'A secureStore is required (FR-021)');
-	}
-}
+/**
+ * Deterministic configuration validation (FR-005 → configuration-error).
+ * Throws AuthConfigError before any provider flow can start (US4 scenario 2).
+ * Covers the auth-config.md Section A–F rules.
+ */
+
+import type { AuthConfig } from './types';
+import { AuthConfigError } from '../diagnostics/errors';
+
+function hasScheme(url: string): boolean {
+	return /^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(url);
+}
+
+export function validateConfig(config: AuthConfig): void {
+	// Section A — tenant/client settings
+	if (!config.authority || !config.authority.trim()) {
+		throw new AuthConfigError('auth.error.configuration', 'Missing "authority"');
+	}
+	if (!hasScheme(config.authority)) {
+		throw new AuthConfigError('auth.error.configuration', '"authority" must be an absolute URL');
+	}
+	if (!config.clientId || !config.clientId.trim()) {
+		throw new AuthConfigError('auth.error.configuration', 'Missing "clientId"');
+	}
+	if (!config.redirectUrl || !config.redirectUrl.trim()) {
+		throw new AuthConfigError('auth.error.configuration', 'Missing "redirectUrl"');
+	}
+	if (!hasScheme(config.redirectUrl)) {
+		throw new AuthConfigError(
+			'auth.error.redirectMismatch',
+			'"redirectUrl" must include a scheme matching the native redirect configuration',
+		);
+	}
+	if (!Array.isArray(config.scopes) || config.scopes.length === 0) {
+		throw new AuthConfigError('auth.error.configuration', 'At least one OIDC scope is required');
+	}
+	if (!config.scopes.includes('offline_access')) {
+		throw new AuthConfigError(
+			'auth.error.configuration',
+			'"offline_access" scope is required for session restore and silent refresh',
+		);
+	}
+
+	// Sections B/C — providers
+	if (!Array.isArray(config.providers) || config.providers.length === 0) {
+		throw new AuthConfigError(
+			'auth.error.configuration',
+			'At least one provider must be configured',
+		);
+	}
+	const providerIds = new Set<string>();
+	for (const provider of config.providers) {
+		if (providerIds.has(provider.id)) {
+			throw new AuthConfigError('auth.error.configuration', `Duplicate provider "${provider.id}"`);
+		}
+		providerIds.add(provider.id);
+		if (!provider.domainHint || !provider.domainHint.trim()) {
+			throw new AuthConfigError(
+				'auth.error.configuration',
+				`Provider "${provider.id}" is missing a domainHint`,
+			);
+		}
+		if (!Array.isArray(provider.platforms) || provider.platforms.length === 0) {
+			throw new AuthConfigError(
+				'auth.error.configuration',
+				`Provider "${provider.id}" must declare at least one platform`,
+			);
+		}
+	}
+
+	// Section D — resources
+	if (config.resources) {
+		const resourceKeys = new Set<string>();
+		for (const resource of config.resources) {
+			if (!resource.key || !resource.key.trim()) {
+				throw new AuthConfigError('auth.error.configuration', 'A resource is missing "key"');
+			}
+			if (resourceKeys.has(resource.key)) {
+				throw new AuthConfigError(
+					'auth.error.configuration',
+					`Duplicate resource "${resource.key}"`,
+				);
+			}
+			resourceKeys.add(resource.key);
+			if (!Array.isArray(resource.scopes) || resource.scopes.length === 0) {
+				throw new AuthConfigError(
+					'auth.error.configuration',
+					`Resource "${resource.key}" must declare at least one scope`,
+				);
+			}
+		}
+	}
+
+	// Section E — access-tier mapping
+	const mapping = config.accessTierMapping;
+	if (!mapping) {
+		throw new AuthConfigError('auth.error.configuration', 'Missing "accessTierMapping"');
+	}
+	const hasPremiumIndicator =
+		(mapping.premiumGroupObjectIds?.length ?? 0) > 0 ||
+		(mapping.premiumRoleNames?.length ?? 0) > 0 ||
+		(mapping.premiumClaimMatchers?.length ?? 0) > 0;
+	if (!hasPremiumIndicator) {
+		throw new AuthConfigError(
+			'auth.error.configuration',
+			'accessTierMapping must define at least one premium group object id, role name, or claim matcher',
+		);
+	}
+
+	// Section F — injected ports
+	if (!config.secureStore) {
+		throw new AuthConfigError('auth.error.configuration', 'A secureStore is required (FR-021)');
+	}
+}