cassproject 5.0.16 → 5.0.18

package/package.json

@@ -1,15 +1,24 @@
 {
 	"name": "cassproject",
-	"version": "5.0.16",
+	"version": "5.0.18",
 	"description": "Competency and Skills Service",
 	"main": "index.js",
 	"scripts": {
-		"test": "concurrently --maxProcesses=1 --kill-others-on-fail \"npm run test16HttpsFips\" \"npm run test16Https11Fips\" \"npm run test16Https\" \"npm run test16Https11\" \"npm run test16Fips\" \"npm run test16\" \"npm run test15HttpsFips\" \"npm run test15Https11Fips\" \"npm run test15Https\" \"npm run test15Https11\" \"npm run test15Fips\" \"npm run test15\"",
+		"test": "concurrently --maxProcesses=1 --kill-others-on-fail \"npm run test17HttpsFips\" \"npm run test17Https11Fips\" \"npm run test17Https\" \"npm run test17Https11\" \"npm run test17Fips\" \"npm run test17\" \"npm run test16HttpsFips\" \"npm run test16Https11Fips\" \"npm run test16Https\" \"npm run test16Https11\" \"npm run test16Fips\" \"npm run test16\" \"npm run test15HttpsFips\" \"npm run test15Https11Fips\" \"npm run test15Https\" \"npm run test15Https11\" \"npm run test15Fips\" \"npm run test15\"",
 		"testActionCypress": "npm run testkill && export CASS_LOOPBACK=http://cass-test15/api/|| set CASS_LOOPBACK=http://cass-test15/api/&& npm run testkill15 && docker run -d --network cass-net -e CASS_LOOPBACK --name cass-test15 -p80:80 cassproject/cass:1.5.75 && wait-on http://localhost/api/ping && concurrently --kill-others-on-fail \"npm run testCypress\"",
 		"testCustom": "npm run test14 && npm run test13 && npm run test12",
 		"multitest": "concurrently --kill-others-on-fail \"npm run test15\" \"npm run test14\" \"npm run test13\" \"npm run test12\"",
 		"testCassTest": "npm run testkill && docker run -d --network cass-net --name cass-test -p80:80 -e CASS_LOOPBACK cass-test && wait-on http://localhost/api/ping && npm run testNode18 && npm run testNode18Fips && npm run testCypressEdge && npm run testCypress && npm run testkill",
 		"testDevHttps": "npm run testkill && docker run -d --network cass-net --name cass-test -p443:80 -e CASS_LOOPBACK -e HTTPS=true cassproject/cass:dev && wait-on https://localhost/api/ping && npm run testNode18HttpsFips && npm run testNode18Https && npm run testCypressEdgeHttps && npm run testCypressHttps",
+		"test17HttpsFips": "export CASS_LOOPBACK=https://cass-testsf17/api/|| set CASS_LOOPBACK=https://cass-testsf17/api/&& npm run testkillsf17 && docker run -d --network cass-net --name cass-testsf17 -p454:443 -e CASS_LOOPBACK -e HTTPS=true --pull always cassproject/cass:1.7 && wait-on https://localhost:454/api/ping && concurrently --kill-others-on-fail \"npm run testCypressHttps\" \"npm run testNode24Https\" \"npm run testNode24HttpsFips\" \"npm run testNode24HttpsForceFips\" \"npm run testNode22Https\" \"npm run testNode22HttpsFips\" \"npm run testNode22HttpsForceFips\" \"npm run testNode20Https\" \"npm run testNode20HttpsFips\" \"npm run testNode20HttpsForceFips\" \"npm run testNode18Https\" && npm run testkillsf17",
+		"test17Https11Fips": "export CASS_LOOPBACK=https://cass-testsf1117/api/|| set CASS_LOOPBACK=https://cass-testsf1117/api/&& npm run testkillsf1117 && docker run -d --network cass-net --name cass-testsf1117 -p453:443 -e CASS_LOOPBACK -e HTTPS=true -e HTTP2=false cassproject/cass:1.7 && wait-on https://localhost:453/api/ping && concurrently --kill-others-on-fail \"npm run testCypressHttps\" \"npm run testNode24Https\" \"npm run testNode24HttpsFips\" \"npm run testNode24HttpsForceFips\" \"npm run testNode22Https\" \"npm run testNode22HttpsFips\" \"npm run testNode22HttpsForceFips\" \"npm run testNode20Https\" \"npm run testNode20HttpsFips\" \"npm run testNode20HttpsForceFips\" \"npm run testNode18Https\" && npm run testkillsf1117",
+		"test17Https": "export CASS_LOOPBACK=https://cass-tests17/api/|| set CASS_LOOPBACK=https://cass-tests17/api/&& npm run testkills17 && docker run -d --network cass-net --name cass-tests17 -p452:443 -e CASS_LOOPBACK -e HTTPS=true cassproject/cass:1.7 && wait-on https://localhost:452/api/ping && concurrently --kill-others-on-fail \"npm run testCypressHttps\" \"npm run testNode24Https\" \"npm run testNode24HttpsFips\" \"npm run testNode22Https\" \"npm run testNode22HttpsFips\" \"npm run testNode20Https\" \"npm run testNode20HttpsFips\" \"npm run testNode18Https\" && npm run testkills17",
+		"test17HttpsNoFips": "export CASS_LOOPBACK=https://cass-tests17/api/|| set CASS_LOOPBACK=https://cass-tests17/api/&& npm run testkills17 && docker run -d --network cass-net --name cass-tests17 -p452:443 -e CASS_LOOPBACK -e HTTPS=true cassproject/cass:1.7 && wait-on https://localhost:452/api/ping && concurrently --kill-others-on-fail \"npm run testCypressHttps\" \"npm run testNode24Https\" \"npm run testNode22Https\" \"npm run testNode20Https\" \"npm run testNode18Https\" && npm run testkills17",
+		"test17Https11": "export CASS_LOOPBACK=https://cass-tests1117/api/|| set CASS_LOOPBACK=https://cass-tests1117/api/&& npm run testkills1117 && docker run -d --network cass-net --name cass-tests1117 -p455:443 -e CASS_LOOPBACK -e HTTPS=true -e HTTP2=false cassproject/cass:1.7 && wait-on https://localhost:455/api/ping && concurrently --kill-others-on-fail \"npm run testCypressHttps\" \"npm run testNode24Https\" \"npm run testNode24HttpsFips\" \"npm run testNode22Https\" \"npm run testNode22HttpsFips\" \"npm run testNode20Https\" \"npm run testNode20HttpsFips\" \"npm run testNode18Https\" && npm run testkills1117",
+		"test17Https11NoFips": "export CASS_LOOPBACK=https://cass-tests1117/api/|| set CASS_LOOPBACK=https://cass-tests1117/api/&& npm run testkills1117 && docker run -d --network cass-net --name cass-tests1117 -p455:443 -e CASS_LOOPBACK -e HTTPS=true -e HTTP2=false cassproject/cass:1.7 && wait-on https://localhost:455/api/ping && concurrently --kill-others-on-fail \"npm run testCypressHttps\" \"npm run testNode24Https\" \"npm run testNode22Https\" \"npm run testNode20Https\" \"npm run testNode18Https\" && npm run testkills1117",
+		"test17Fips": "export CASS_LOOPBACK=http://cass-testf17/api/|| set CASS_LOOPBACK=http://cass-testf17/api/&& npm run testkillf17 && docker run -d --network cass-net -e CASS_LOOPBACK --name cass-testf17 -p85:80 cassproject/cass:1.7 && wait-on http://localhost:85/api/ping && concurrently --kill-others-on-fail \"npm run testCypress\" \"npm run testNode24\" \"npm run testNode24Fips\" \"npm run testNode24ForceFips\" \"npm run testNode22\" \"npm run testNode22Fips\" \"npm run testNode22ForceFips\" \"npm run testNode20\" \"npm run testNode20Fips\" \"npm run testNode20ForceFips\" \"npm run testNode18\" && npm run testkillf17",
+		"test17": "export CASS_LOOPBACK=http://cass-test17/api/|| set CASS_LOOPBACK=http://cass-test17/api/&& npm run testkill17 && docker run -d --network cass-net -e CASS_LOOPBACK --name cass-test17 -p84:80 cassproject/cass:1.7 && wait-on http://localhost:84/api/ping && concurrently --kill-others-on-fail \"npm run testCypress\" \"npm run testNode24\" \"npm run testNode24Fips\" \"npm run testNode22\" \"npm run testNode22Fips\" \"npm run testNode20\" \"npm run testNode20Fips\" \"npm run testNode18\" && npm run testkill17",
+		"test17NoFips": "export CASS_LOOPBACK=http://cass-test17/api/|| set CASS_LOOPBACK=http://cass-test17/api/&& npm run testkill17 && docker run -d --network cass-net -e CASS_LOOPBACK --name cass-test17 -p84:80 cassproject/cass:1.7 && wait-on http://localhost:84/api/ping && concurrently --kill-others-on-fail \"npm run testCypress\" \"npm run testNode24\" \"npm run testNode22\" \"npm run testNode20\" \"npm run testNode18\" && npm run testkill17",
 		"test16HttpsFips": "export CASS_LOOPBACK=https://cass-testsf16/api/|| set CASS_LOOPBACK=https://cass-testsf16/api/&& npm run testkillsf16 && docker run -d --network cass-net --name cass-testsf16 -p450:443 -e CASS_LOOPBACK -e HTTPS=true --pull always cassproject/cass:1.6 && wait-on https://localhost:450/api/ping && concurrently --kill-others-on-fail \"npm run testCypressHttps\" \"npm run testNode24Https\" \"npm run testNode24HttpsFips\" \"npm run testNode24HttpsForceFips\" \"npm run testNode22Https\" \"npm run testNode22HttpsFips\" \"npm run testNode22HttpsForceFips\" \"npm run testNode20Https\" \"npm run testNode20HttpsFips\" \"npm run testNode20HttpsForceFips\" \"npm run testNode18Https\" && npm run testkillsf16",
 		"test16Https11Fips": "export CASS_LOOPBACK=https://cass-testsf1116/api/|| set CASS_LOOPBACK=https://cass-testsf1116/api/&& npm run testkillsf1116 && docker run -d --network cass-net --name cass-testsf1116 -p449:443 -e CASS_LOOPBACK -e HTTPS=true -e HTTP2=false cassproject/cass:1.6 && wait-on https://localhost:449/api/ping && concurrently --kill-others-on-fail \"npm run testCypressHttps\" \"npm run testNode24Https\" \"npm run testNode24HttpsFips\" \"npm run testNode24HttpsForceFips\" \"npm run testNode22Https\" \"npm run testNode22HttpsFips\" \"npm run testNode22HttpsForceFips\" \"npm run testNode20Https\" \"npm run testNode20HttpsFips\" \"npm run testNode20HttpsForceFips\" \"npm run testNode18Https\" && npm run testkillsf1116",
 		"test16Https": "export CASS_LOOPBACK=https://cass-tests16/api/|| set CASS_LOOPBACK=https://cass-tests16/api/&& npm run testkills16 && docker run -d --network cass-net --name cass-tests16 -p448:443 -e CASS_LOOPBACK -e HTTPS=true cassproject/cass:1.6 && wait-on https://localhost:448/api/ping && concurrently --kill-others-on-fail \"npm run testCypressHttps\" \"npm run testNode24Https\" \"npm run testNode24HttpsFips\" \"npm run testNode22Https\" \"npm run testNode22HttpsFips\" \"npm run testNode20Https\" \"npm run testNode20HttpsFips\" \"npm run testNode18Https\" && npm run testkills16",
@@ -31,6 +40,12 @@
 		"test14": "npm run testkill14 && docker run -d --network cass-net -e CASS_LOOPBACK --name cass-test14 -p80:80 cassproject/cass:1.4.4 && wait-on http://localhost/api/ping && concurrently --kill-others-on-fail \"npm run testCypress\" \"npm run testNode16\" && npm run testkill14",
 		"test13": "npm run testkill13 && docker run -d --network cass-net -e CASS_LOOPBACK --name cass-test13 -p80:80 cassproject/cass:1.3.18 && wait-on http://localhost/api/ping && concurrently --kill-others-on-fail \"npm run testCypress\" \"npm run testNode16\" && npm run testkill13",
 		"test12": "npm run testkill12 && docker run -d --network cass-net -e CASS_LOOPBACK --name cass-test12 -p80:80 cassproject/cass:1.2.44 && wait-on http://localhost/api/ping && concurrently --kill-others-on-fail \"npm run testCypress\" \"npm run testNode16\" && npm run testkill12",
+		"testkillsf17": "docker kill cass-testsf17 | exit 0 && docker rm cass-testsf17 | exit 0 && docker network create cass-net | exit 0",
+		"testkillsf1117": "(docker kill cass-testsf1117 | exit 0) && (docker rm cass-testsf1117 | exit 0) && docker network create cass-net | exit 0",
+		"testkills17": "docker kill cass-tests17 | exit 0 && docker rm cass-tests17 | exit 0 && docker network create cass-net | exit 0",
+		"testkills1117": "docker kill cass-tests1117 | exit 0 && docker rm cass-tests1117 | exit 0 && docker network create cass-net | exit 0",
+		"testkillf17": "docker kill cass-testf17 | exit 0 && docker rm cass-testf17 | exit 0 && docker network create cass-net | exit 0",
+		"testkill17": "docker kill cass-test17 | exit 0 && docker rm cass-test17 | exit 0 && docker network create cass-net | exit 0",
 		"testkillsf16": "docker kill cass-testsf16 | exit 0 && docker rm cass-testsf16 | exit 0 && docker network create cass-net | exit 0",
 		"testkillsf1116": "(docker kill cass-testsf1116 | exit 0) && (docker rm cass-testsf1116 | exit 0) && docker network create cass-net | exit 0",
 		"testkills16": "docker kill cass-tests16 | exit 0 && docker rm cass-tests16 | exit 0 && docker network create cass-net | exit 0",
@@ -171,18 +186,18 @@
 	"devDependencies": {
 		"@cypress/webpack-preprocessor": "^7.1.1",
 		"chai": "^4.5.0",
-		"concurrently": "^10.0.3",
-		"cypress": "^15.18.0",
+		"concurrently": "^10.0.4",
+		"cypress": "15.19.0",
 		"cypress-fail-fast": "^8.1.0",
-		"eslint": "^10.5.0",
+		"eslint": "^10.8.0",
 		"fake-indexeddb": "^6.2.5",
-		"mocha": "^11.7.6",
+		"mocha": "^11.8.0",
 		"node-polyfill-webpack-plugin": "^4.1.0",
 		"nodemon": "^3.1.14",
 		"nyc": "^18.0.0",
 		"sinon": "^21.1.2",
-		"wait-on": "^9.0.10",
-		"webpack": "^5.107.2"
+		"wait-on": "^9.1.0",
+		"webpack": "^5.109.2"
 	},
 	"packageManager": "npm@11.3.0+sha512.96eb611483f49c55f7fa74df61b588de9e213f80a256728e6798ddc67176c7b07e4a1cfc7de8922422cbce02543714367037536955221fa451b0c4fefaf20c66"
 }

package/src/org/cass/importer/CTDLASNCSVConceptImport.js

@@ -207,6 +207,20 @@ module.exports = class CTDLASNCSVConceptImport {
 								continue;
 							}
 						}
+						// Validate registry URL fields (only if url rules provided)
+						if (validationRules && validationRules.urlRules) {
+							const urlErrors = CTDLASNCSVImport.validateRegistryUrls(
+								pretranslatedE,
+								"skos:ConceptScheme",
+								each + 2,
+								validationRules.urlRules
+							);
+							if (urlErrors) {
+								errors.push(...urlErrors);
+								rowsWithErrors.add(each);
+								continue;
+							}
+						}
 						let translator = new EcLinkedData(null, null);
 						translator.copyFrom(pretranslatedE);
 						CTDLASNCSVImport.cleanUpTranslator(
@@ -294,6 +308,20 @@ module.exports = class CTDLASNCSVConceptImport {
 								continue;
 							}
 						}
+						// Validate registry URL fields (only if url rules provided)
+						if (validationRules && validationRules.urlRules) {
+							const urlErrors = CTDLASNCSVImport.validateRegistryUrls(
+								pretranslatedE,
+								"skos:Concept",
+								each + 2,
+								validationRules.urlRules
+							);
+							if (urlErrors) {
+								errors.push(...urlErrors);
+								rowsWithErrors.add(each);
+								continue;
+							}
+						}
 						let translator = new EcLinkedData(null, null);
 						translator.copyFrom(pretranslatedE);
 						CTDLASNCSVImport.cleanUpTranslator(
@@ -583,6 +611,20 @@ module.exports = class CTDLASNCSVConceptImport {
 								continue;
 							}
 						}
+						// Validate registry URL fields (only if url rules provided)
+						if (validationRules && validationRules.urlRules) {
+							const urlErrors = CTDLASNCSVImport.validateRegistryUrls(
+								pretranslatedE,
+								"asn:ProgressionModel",
+								each + 2,
+								validationRules.urlRules
+							);
+							if (urlErrors) {
+								errors.push(...urlErrors);
+								rowsWithErrors.add(each);
+								continue;
+							}
+						}
 						let translator = new EcLinkedData(null, null);
 						translator.copyFrom(pretranslatedE);
 						CTDLASNCSVImport.cleanUpTranslator(
@@ -666,6 +708,20 @@ module.exports = class CTDLASNCSVConceptImport {
 								continue;
 							}
 						}
+						// Validate registry URL fields (only if url rules provided)
+						if (validationRules && validationRules.urlRules) {
+							const urlErrors = CTDLASNCSVImport.validateRegistryUrls(
+								pretranslatedE,
+								"asn:ProgressionLevel",
+								each + 2,
+								validationRules.urlRules
+							);
+							if (urlErrors) {
+								errors.push(...urlErrors);
+								rowsWithErrors.add(each);
+								continue;
+							}
+						}
 						let translator = new EcLinkedData(null, null);
 						translator.copyFrom(pretranslatedE);
 						CTDLASNCSVImport.cleanUpTranslator(

package/src/org/cass/importer/CTDLASNCSVImport.js

@@ -255,6 +255,20 @@ module.exports = class CTDLASNCSVImport {
 								continue;
 							}
 						}
+						// Validate registry URL fields (only if url rules provided)
+						if (validationRules && validationRules.urlRules) {
+							const urlErrors = CTDLASNCSVImport.validateRegistryUrls(
+								pretranslatedE,
+								"ceasn:CompetencyFramework",
+								i + 2,
+								validationRules.urlRules
+							);
+							if (urlErrors) {
+								errors.push(...urlErrors);
+								rowsWithErrors.add(i);
+								continue;
+							}
+						}
 
 						let translator = new EcLinkedData(null, null);
 						translator.copyFrom(pretranslatedE);
@@ -404,6 +418,20 @@ module.exports = class CTDLASNCSVImport {
 							continue;
 						}
 					}
+					// Validate registry URL fields (only if url rules provided)
+					if (validationRules && validationRules.urlRules) {
+						const urlErrors = CTDLASNCSVImport.validateRegistryUrls(
+							pretranslatedE,
+							"ceasn:Competency",
+							i + 2,
+							validationRules.urlRules
+						);
+						if (urlErrors) {
+							errors.push(...urlErrors);
+							rowsWithErrors.add(i);
+							continue;
+						}
+					}
 
 						let translator = new EcLinkedData(null, null);
 						translator.copyFrom(pretranslatedE);
@@ -850,6 +878,20 @@ module.exports = class CTDLASNCSVImport {
 								continue;
 							}
 						}
+						// Validate registry URL fields (only if url rules provided)
+						if (validationRules && validationRules.urlRules) {
+							const urlErrors = CTDLASNCSVImport.validateRegistryUrls(
+								pretranslatedE,
+								"ceterms:Collection",
+								i + 2,
+								validationRules.urlRules
+							);
+							if (urlErrors) {
+								errors.push(...urlErrors);
+								rowsWithErrors.add(i);
+								continue;
+							}
+						}
 						let translator = new EcLinkedData(null, null);
 						translator.copyFrom(pretranslatedE);
 						CTDLASNCSVImport.cleanUpTranslator(
@@ -939,6 +981,20 @@ module.exports = class CTDLASNCSVImport {
 								continue;
 							}
 						}
+						// Validate registry URL fields (only if url rules provided)
+						if (validationRules && validationRules.urlRules) {
+							const urlErrors = CTDLASNCSVImport.validateRegistryUrls(
+								pretranslatedE,
+								"ceasn:Competency",
+								i + 2,
+								validationRules.urlRules
+							);
+							if (urlErrors) {
+								errors.push(...urlErrors);
+								rowsWithErrors.add(i);
+								continue;
+							}
+						}
 						let translator = new EcLinkedData(null, null);
 						translator.copyFrom(pretranslatedE);
 						CTDLASNCSVImport.cleanUpTranslator(
@@ -1447,6 +1503,48 @@ module.exports = class CTDLASNCSVImport {
 		return null;
 	}
 
+	/*
+	 * Validates that reference fields contain either a CTID (ce-...) or a
+	 * credential registry URL whose origin is allowed for this environment.
+	 * CTIDs are resolved by the CTID pipeline (getIdFromCtid); any other value
+	 * must be an http(s) URL with an origin listed in urlRules.allowedOrigins.
+	 *
+	 * urlRules = {
+	 *     fields: { "<@type>": ["ceasn:creator", ...], ... },
+	 *     allowedOrigins: ["https://sandbox.credentialengineregistry.org", ...]
+	 * }
+	 *
+	 * Returns an array of error strings, or null when everything passes.
+	 */
+	static validateRegistryUrls(obj, type, rowIndex, urlRules) {
+		if (!urlRules) return null;
+		const fields = urlRules.fields ? urlRules.fields[type] : null;
+		const allowedOrigins = urlRules.allowedOrigins;
+		if (!fields || !allowedOrigins || allowedOrigins.length === 0) return null;
+
+		const ctidPattern = /^ce-[0-9a-fA-F-]+$/;
+		const errors = [];
+		for (const field of fields) {
+			const raw = obj[field];
+			if (raw == null) continue;
+			const values = Array.isArray(raw) ? raw : String(raw).split("|");
+			for (let value of values) {
+				value = String(value).trim();
+				if (value === "" || ctidPattern.test(value)) continue;
+				let origin = null;
+				try {
+					origin = new URL(value).origin;
+				} catch (e) {
+					// Not parseable as a URL; falls through to the error below.
+				}
+				if (origin == null || !allowedOrigins.includes(origin)) {
+					errors.push(`Row ${rowIndex}: ${field} must be a CTID or a credential registry URL for this environment (got: ${value})`);
+				}
+			}
+		}
+		return errors.length > 0 ? errors : null;
+	}
+
 	static validateFrameworkHierarchy(tabularData, hierarchyRules) {
 		// Use provided hierarchy rules or fall back to defaults
 		if (!hierarchyRules) {

package/src/org/cassproject/ebac/repository/EcRepository.js

@@ -134,6 +134,23 @@ module.exports = class EcRepository {
 			return Reflect.deleteProperty(...arguments);
 		}
 	});
+	/**
+	 *  Empties the in-memory cache and, if L2 caching is enabled, the
+	 *  IndexedDB backing store. Do not reassign cacheBacking to clear the
+	 *  cache -- the cache proxy permanently wraps the original object.
+	 *
+	 *  @memberOf EcRepository
+	 *  @method clearCache
+	 *  @static
+	 */
+	static clearCache = () => {
+		for (let prop of Object.keys(EcRepository.cacheBacking))
+			delete EcRepository.cacheBacking[prop];
+		if (EcRepository.cachingL2 == true && EcRepository.cacheDB != null) {
+			const transaction = EcRepository.cacheDB.transaction(EcRepository.LONGIDS, "readwrite");
+			transaction.objectStore(EcRepository.LONGIDS).clear();
+		}
+	};
 	static fetching = {};
 	static repos = [];
 	static defaultPlugins = [];

package/src/test/1.CTDLASNCSVImport.validateRegistryUrls.test.js

@@ -0,0 +1,100 @@
+let chai = require("chai");
+const CTDLASNCSVImport = require("../org/cass/importer/CTDLASNCSVImport.js");
+
+let expect = chai.expect;
+
+// Unit tests for the registry URL validation added for cassproject/cass-editor#1423:
+// CSV reference fields must contain either a CTID (ce-...) or a credential
+// registry URL whose origin matches the configured environment.
+describe("CTDLASNCSVImport.validateRegistryUrls", () => {
+    const urlRules = {
+        fields: {
+            "ceasn:CompetencyFramework": ["ceasn:creator", "ceasn:publisher", "asn:hasProgressionModel", "ceasn:hasTopChild"],
+            "ceasn:Competency": ["ceasn:creator", "ceterms:hasTask"]
+        },
+        allowedOrigins: ["https://sandbox.credentialengineregistry.org"]
+    };
+    const type = "ceasn:CompetencyFramework";
+
+    it("accepts a CTID value", () => {
+        const obj = { "ceasn:publisher": "ce-11111111-2222-3333-4444-555555555555" };
+        expect(CTDLASNCSVImport.validateRegistryUrls(obj, type, 2, urlRules)).to.equal(null);
+    });
+
+    it("accepts a registry URL with an allowed origin", () => {
+        const obj = { "ceasn:publisher": "https://sandbox.credentialengineregistry.org/resources/ce-1111" };
+        expect(CTDLASNCSVImport.validateRegistryUrls(obj, type, 2, urlRules)).to.equal(null);
+    });
+
+    it("rejects a URL from a different origin", () => {
+        const obj = { "ceasn:publisher": "https://credentialengineregistry.org/resources/ce-1111" };
+        const errors = CTDLASNCSVImport.validateRegistryUrls(obj, type, 2, urlRules);
+        expect(errors).to.be.an("array").with.lengthOf(1);
+        expect(errors[0]).to.contain("Row 2");
+        expect(errors[0]).to.contain("ceasn:publisher");
+        expect(errors[0]).to.contain("https://credentialengineregistry.org/resources/ce-1111");
+    });
+
+    it("rejects an arbitrary non-registry URL", () => {
+        const obj = { "ceasn:creator": "https://example.com/x" };
+        const errors = CTDLASNCSVImport.validateRegistryUrls(obj, type, 3, urlRules);
+        expect(errors).to.be.an("array").with.lengthOf(1);
+        expect(errors[0]).to.contain("ceasn:creator");
+    });
+
+    it("rejects a value that is neither CTID nor URL", () => {
+        const obj = { "ceasn:publisher": "Some Publisher Name" };
+        const errors = CTDLASNCSVImport.validateRegistryUrls(obj, type, 4, urlRules);
+        expect(errors).to.be.an("array").with.lengthOf(1);
+        expect(errors[0]).to.contain("Some Publisher Name");
+    });
+
+    it("reports only the bad part of a pipe-delimited value", () => {
+        const obj = { "ceasn:hasTopChild": "ce-11111111-2222-3333-4444-555555555555|https://evil.example.com/resources/ce-2222" };
+        const errors = CTDLASNCSVImport.validateRegistryUrls(obj, type, 5, urlRules);
+        expect(errors).to.be.an("array").with.lengthOf(1);
+        expect(errors[0]).to.contain("https://evil.example.com/resources/ce-2222");
+    });
+
+    it("validates array values", () => {
+        const obj = { "ceasn:creator": ["https://sandbox.credentialengineregistry.org/resources/ce-1", "https://example.org/nope"] };
+        const errors = CTDLASNCSVImport.validateRegistryUrls(obj, type, 6, urlRules);
+        expect(errors).to.be.an("array").with.lengthOf(1);
+        expect(errors[0]).to.contain("https://example.org/nope");
+    });
+
+    it("collects errors across multiple fields", () => {
+        const obj = {
+            "ceasn:creator": "https://example.com/a",
+            "ceasn:publisher": "https://example.com/b"
+        };
+        const errors = CTDLASNCSVImport.validateRegistryUrls(obj, type, 7, urlRules);
+        expect(errors).to.be.an("array").with.lengthOf(2);
+    });
+
+    it("ignores fields not configured for the type", () => {
+        const obj = { "ceasn:description": "https://example.com/not-checked" };
+        expect(CTDLASNCSVImport.validateRegistryUrls(obj, type, 8, urlRules)).to.equal(null);
+    });
+
+    it("is inert for types with no configured fields", () => {
+        const obj = { "ceasn:publisher": "https://example.com/x" };
+        expect(CTDLASNCSVImport.validateRegistryUrls(obj, "skos:Concept", 9, urlRules)).to.equal(null);
+    });
+
+    it("is inert when urlRules is absent", () => {
+        const obj = { "ceasn:publisher": "https://example.com/x" };
+        expect(CTDLASNCSVImport.validateRegistryUrls(obj, type, 10, null)).to.equal(null);
+    });
+
+    it("is inert when allowedOrigins is empty", () => {
+        const obj = { "ceasn:publisher": "https://example.com/x" };
+        const rules = { fields: urlRules.fields, allowedOrigins: [] };
+        expect(CTDLASNCSVImport.validateRegistryUrls(obj, type, 11, rules)).to.equal(null);
+    });
+
+    it("skips empty and null values", () => {
+        const obj = { "ceasn:publisher": "", "ceasn:creator": null };
+        expect(CTDLASNCSVImport.validateRegistryUrls(obj, type, 12, urlRules)).to.equal(null);
+    });
+});

package/src/test/1.EcRepository.cache.test.js

@@ -0,0 +1,179 @@
+require('fake-indexeddb/auto');
+
+const schema = {
+    "Thing": require('../org/schema/Thing.js')
+};
+
+let chai = require("chai");
+const EcRepository = require('../org/cassproject/ebac/repository/EcRepository.js');
+const EcCrypto = require('../com/eduworks/ec/crypto/EcCrypto.js');
+const EcRemoteLinkedData = require('../org/cassproject/schema/general/EcRemoteLinkedData.js');
+
+let assert = chai.assert;
+
+const TEST_DB = "EcRepositoryCacheTest";
+
+// Ids that contain /api/data/ and end in /<digits> are "versioned" and eligible
+// for L2 caching; anything else is L1-only.
+let versionedId = () => "http://localhost/api/data/schema.org.Thing/" + EcCrypto.generateUUID() + "/1690000000000";
+let unversionedId = () => "http://localhost/api/data/schema.org.Thing/" + EcCrypto.generateUUID();
+
+let makeThing = (id) => {
+    let thing = new schema.Thing();
+    thing.id = id;
+    thing.setName("Some Thing " + EcCrypto.generateUUID());
+    return thing;
+};
+
+let openTestDb = () => new Promise((resolve, reject) => {
+    const request = indexedDB.open(TEST_DB, 3);
+    request.onerror = reject;
+    request.onupgradeneeded = (event) => {
+        event.target.result.createObjectStore(EcRepository.LONGIDS, { keyPath: "id" });
+    };
+    request.onsuccess = (event) => resolve(event.target.result);
+});
+
+// Reads straight from IndexedDB, bypassing L1, to observe what the proxy wrote.
+let l2Get = (id) => new Promise((resolve, reject) => {
+    const transaction = EcRepository.cacheDB.transaction(EcRepository.LONGIDS, "readonly");
+    const request = transaction.objectStore(EcRepository.LONGIDS).get(id);
+    request.onerror = () => reject(request.error);
+    request.onsuccess = () => resolve(request.result == null ? null : request.result);
+});
+
+let l2Count = () => new Promise((resolve, reject) => {
+    const transaction = EcRepository.cacheDB.transaction(EcRepository.LONGIDS, "readonly");
+    const request = transaction.objectStore(EcRepository.LONGIDS).count();
+    request.onerror = () => reject(request.error);
+    request.onsuccess = () => resolve(request.result);
+});
+
+describe("EcRepository (Cache Management)", () => {
+    before(async () => {
+        EcRepository.caching = true;
+        EcRepository.cachingL2 = false;
+        EcRepository.clearCache();
+        EcRepository.cacheDB = await openTestDb();
+    });
+    after(() => {
+        EcRepository.cachingL2 = true;
+        EcRepository.clearCache();
+        EcRepository.caching = false;
+        EcRepository.cachingL2 = false;
+        EcRepository.cacheDB.close();
+        EcRepository.cacheDB = null;
+        indexedDB.deleteDatabase(TEST_DB);
+    });
+
+    describe("L1", () => {
+        before(() => {
+            EcRepository.cachingL2 = false;
+        });
+        it('cache proxy reads and writes the cacheBacking object', async () => {
+            let id = unversionedId();
+            let thing = makeThing(id);
+            EcRepository.cache[id] = thing;
+            assert.strictEqual(EcRepository.cacheBacking[id], thing, "Write through proxy did not land in cacheBacking.");
+            EcRepository.cacheBacking[id + "/direct"] = thing;
+            assert.strictEqual(EcRepository.cache[id + "/direct"], thing, "Write to cacheBacking not visible through proxy.");
+            assert.strictEqual(await EcRepository.cacheGet(id), thing);
+            delete EcRepository.cache[id + "/direct"];
+        });
+        it('delete through the proxy removes the entry', async () => {
+            let id = unversionedId();
+            EcRepository.cache[id] = makeThing(id);
+            delete EcRepository.cache[id];
+            assert.isUndefined(EcRepository.cacheBacking[id]);
+            assert.isUndefined(await EcRepository.cacheGet(id));
+        });
+        it('clearCache empties L1', async () => {
+            let ids = [unversionedId(), unversionedId(), versionedId()];
+            for (let id of ids)
+                EcRepository.cache[id] = makeThing(id);
+            EcRepository.clearCache();
+            assert.equal(Object.keys(EcRepository.cacheBacking).length, 0);
+            for (let id of ids)
+                assert.isUndefined(await EcRepository.cacheGet(id));
+        });
+    });
+
+    describe("L2", () => {
+        before(() => {
+            EcRepository.cachingL2 = true;
+        });
+        it('versioned writes go to both L1 and IndexedDB', async () => {
+            let id = versionedId();
+            EcRepository.cache[id] = makeThing(id);
+            assert.isDefined(EcRepository.cacheBacking[id], "Entry missing from L1.");
+            let stored = await l2Get(id);
+            assert.isNotNull(stored, "Entry missing from IndexedDB.");
+            assert.equal(stored.id, id);
+        });
+        it('unversioned writes stay in L1 only', async () => {
+            let id = unversionedId();
+            EcRepository.cache[id] = makeThing(id);
+            assert.isDefined(EcRepository.cacheBacking[id], "Entry missing from L1.");
+            assert.isNull(await l2Get(id), "Unversioned entry should not be in IndexedDB.");
+        });
+        it('cacheGet falls back to IndexedDB on L1 miss', async () => {
+            let id = versionedId();
+            let thing = makeThing(id);
+            EcRepository.cache[id] = thing;
+            // Evict from L1 only; a proxy delete would also remove the L2 copy.
+            delete EcRepository.cacheBacking[id];
+            let got = await EcRepository.cacheGet(id);
+            assert.instanceOf(got, EcRemoteLinkedData);
+            assert.equal(got.id, id);
+            assert.equal(got.getName(), thing.getName());
+        });
+        it('delete through the proxy removes the entry from both layers', async () => {
+            let id = versionedId();
+            EcRepository.cache[id] = makeThing(id);
+            delete EcRepository.cache[id];
+            assert.isUndefined(EcRepository.cacheBacking[id], "Entry still in L1.");
+            assert.isNull(await l2Get(id), "Entry still in IndexedDB.");
+            assert.isUndefined(await EcRepository.cacheGet(id));
+        });
+        it('setting an entry to null removes it from IndexedDB', async () => {
+            let id = versionedId();
+            EcRepository.cache[id] = makeThing(id);
+            assert.isNotNull(await l2Get(id));
+            EcRepository.cache[id] = null;
+            assert.isNull(await l2Get(id), "Entry still in IndexedDB.");
+            assert.isNull(EcRepository.cacheBacking[id], "L1 should hold the null marker.");
+            delete EcRepository.cache[id];
+        });
+    });
+
+    describe("clearCache", () => {
+        it('clears both L1 and L2 when L2 caching is enabled', async () => {
+            EcRepository.cachingL2 = true;
+            let vId = versionedId();
+            let uId = unversionedId();
+            EcRepository.cache[vId] = makeThing(vId);
+            EcRepository.cache[uId] = makeThing(uId);
+            assert.isAbove(await l2Count(), 0);
+            EcRepository.clearCache();
+            assert.equal(Object.keys(EcRepository.cacheBacking).length, 0);
+            assert.equal(await l2Count(), 0, "IndexedDB store not emptied.");
+            assert.isUndefined(await EcRepository.cacheGet(vId));
+            assert.isUndefined(await EcRepository.cacheGet(uId));
+        });
+        it('clears only L1 when L2 caching is disabled', async () => {
+            EcRepository.cachingL2 = true;
+            let id = versionedId();
+            EcRepository.cache[id] = makeThing(id);
+            EcRepository.cachingL2 = false;
+            EcRepository.clearCache();
+            assert.equal(Object.keys(EcRepository.cacheBacking).length, 0);
+            assert.isNotNull(await l2Get(id), "IndexedDB copy should survive an L1-only clear.");
+            // The surviving L2 copy is served again once L2 caching is re-enabled.
+            EcRepository.cachingL2 = true;
+            let got = await EcRepository.cacheGet(id);
+            assert.instanceOf(got, EcRemoteLinkedData);
+            assert.equal(got.id, id);
+            EcRepository.clearCache();
+        });
+    });
+});