cassproject 5.0.17 → 5.0.18

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cassproject",
-	"version": "5.0.17",
+	"version": "5.0.18",
 	"description": "Competency and Skills Service",
 	"main": "index.js",
 	"scripts": {
@@ -191,13 +191,13 @@
 		"cypress-fail-fast": "^8.1.0",
 		"eslint": "^10.8.0",
 		"fake-indexeddb": "^6.2.5",
-		"mocha": "^11.7.6",
+		"mocha": "^11.8.0",
 		"node-polyfill-webpack-plugin": "^4.1.0",
 		"nodemon": "^3.1.14",
 		"nyc": "^18.0.0",
 		"sinon": "^21.1.2",
 		"wait-on": "^9.1.0",
-		"webpack": "^5.109.1"
+		"webpack": "^5.109.2"
 	},
 	"packageManager": "npm@11.3.0+sha512.96eb611483f49c55f7fa74df61b588de9e213f80a256728e6798ddc67176c7b07e4a1cfc7de8922422cbce02543714367037536955221fa451b0c4fefaf20c66"
 }

package/src/org/cass/importer/CTDLASNCSVConceptImport.js

@@ -207,6 +207,20 @@ module.exports = class CTDLASNCSVConceptImport {
 								continue;
 							}
 						}
+						// Validate registry URL fields (only if url rules provided)
+						if (validationRules && validationRules.urlRules) {
+							const urlErrors = CTDLASNCSVImport.validateRegistryUrls(
+								pretranslatedE,
+								"skos:ConceptScheme",
+								each + 2,
+								validationRules.urlRules
+							);
+							if (urlErrors) {
+								errors.push(...urlErrors);
+								rowsWithErrors.add(each);
+								continue;
+							}
+						}
 						let translator = new EcLinkedData(null, null);
 						translator.copyFrom(pretranslatedE);
 						CTDLASNCSVImport.cleanUpTranslator(
@@ -294,6 +308,20 @@ module.exports = class CTDLASNCSVConceptImport {
 								continue;
 							}
 						}
+						// Validate registry URL fields (only if url rules provided)
+						if (validationRules && validationRules.urlRules) {
+							const urlErrors = CTDLASNCSVImport.validateRegistryUrls(
+								pretranslatedE,
+								"skos:Concept",
+								each + 2,
+								validationRules.urlRules
+							);
+							if (urlErrors) {
+								errors.push(...urlErrors);
+								rowsWithErrors.add(each);
+								continue;
+							}
+						}
 						let translator = new EcLinkedData(null, null);
 						translator.copyFrom(pretranslatedE);
 						CTDLASNCSVImport.cleanUpTranslator(
@@ -583,6 +611,20 @@ module.exports = class CTDLASNCSVConceptImport {
 								continue;
 							}
 						}
+						// Validate registry URL fields (only if url rules provided)
+						if (validationRules && validationRules.urlRules) {
+							const urlErrors = CTDLASNCSVImport.validateRegistryUrls(
+								pretranslatedE,
+								"asn:ProgressionModel",
+								each + 2,
+								validationRules.urlRules
+							);
+							if (urlErrors) {
+								errors.push(...urlErrors);
+								rowsWithErrors.add(each);
+								continue;
+							}
+						}
 						let translator = new EcLinkedData(null, null);
 						translator.copyFrom(pretranslatedE);
 						CTDLASNCSVImport.cleanUpTranslator(
@@ -666,6 +708,20 @@ module.exports = class CTDLASNCSVConceptImport {
 								continue;
 							}
 						}
+						// Validate registry URL fields (only if url rules provided)
+						if (validationRules && validationRules.urlRules) {
+							const urlErrors = CTDLASNCSVImport.validateRegistryUrls(
+								pretranslatedE,
+								"asn:ProgressionLevel",
+								each + 2,
+								validationRules.urlRules
+							);
+							if (urlErrors) {
+								errors.push(...urlErrors);
+								rowsWithErrors.add(each);
+								continue;
+							}
+						}
 						let translator = new EcLinkedData(null, null);
 						translator.copyFrom(pretranslatedE);
 						CTDLASNCSVImport.cleanUpTranslator(

package/src/org/cass/importer/CTDLASNCSVImport.js

@@ -255,6 +255,20 @@ module.exports = class CTDLASNCSVImport {
 								continue;
 							}
 						}
+						// Validate registry URL fields (only if url rules provided)
+						if (validationRules && validationRules.urlRules) {
+							const urlErrors = CTDLASNCSVImport.validateRegistryUrls(
+								pretranslatedE,
+								"ceasn:CompetencyFramework",
+								i + 2,
+								validationRules.urlRules
+							);
+							if (urlErrors) {
+								errors.push(...urlErrors);
+								rowsWithErrors.add(i);
+								continue;
+							}
+						}
 
 						let translator = new EcLinkedData(null, null);
 						translator.copyFrom(pretranslatedE);
@@ -404,6 +418,20 @@ module.exports = class CTDLASNCSVImport {
 							continue;
 						}
 					}
+					// Validate registry URL fields (only if url rules provided)
+					if (validationRules && validationRules.urlRules) {
+						const urlErrors = CTDLASNCSVImport.validateRegistryUrls(
+							pretranslatedE,
+							"ceasn:Competency",
+							i + 2,
+							validationRules.urlRules
+						);
+						if (urlErrors) {
+							errors.push(...urlErrors);
+							rowsWithErrors.add(i);
+							continue;
+						}
+					}
 
 						let translator = new EcLinkedData(null, null);
 						translator.copyFrom(pretranslatedE);
@@ -850,6 +878,20 @@ module.exports = class CTDLASNCSVImport {
 								continue;
 							}
 						}
+						// Validate registry URL fields (only if url rules provided)
+						if (validationRules && validationRules.urlRules) {
+							const urlErrors = CTDLASNCSVImport.validateRegistryUrls(
+								pretranslatedE,
+								"ceterms:Collection",
+								i + 2,
+								validationRules.urlRules
+							);
+							if (urlErrors) {
+								errors.push(...urlErrors);
+								rowsWithErrors.add(i);
+								continue;
+							}
+						}
 						let translator = new EcLinkedData(null, null);
 						translator.copyFrom(pretranslatedE);
 						CTDLASNCSVImport.cleanUpTranslator(
@@ -939,6 +981,20 @@ module.exports = class CTDLASNCSVImport {
 								continue;
 							}
 						}
+						// Validate registry URL fields (only if url rules provided)
+						if (validationRules && validationRules.urlRules) {
+							const urlErrors = CTDLASNCSVImport.validateRegistryUrls(
+								pretranslatedE,
+								"ceasn:Competency",
+								i + 2,
+								validationRules.urlRules
+							);
+							if (urlErrors) {
+								errors.push(...urlErrors);
+								rowsWithErrors.add(i);
+								continue;
+							}
+						}
 						let translator = new EcLinkedData(null, null);
 						translator.copyFrom(pretranslatedE);
 						CTDLASNCSVImport.cleanUpTranslator(
@@ -1447,6 +1503,48 @@ module.exports = class CTDLASNCSVImport {
 		return null;
 	}
 
+	/*
+	 * Validates that reference fields contain either a CTID (ce-...) or a
+	 * credential registry URL whose origin is allowed for this environment.
+	 * CTIDs are resolved by the CTID pipeline (getIdFromCtid); any other value
+	 * must be an http(s) URL with an origin listed in urlRules.allowedOrigins.
+	 *
+	 * urlRules = {
+	 *     fields: { "<@type>": ["ceasn:creator", ...], ... },
+	 *     allowedOrigins: ["https://sandbox.credentialengineregistry.org", ...]
+	 * }
+	 *
+	 * Returns an array of error strings, or null when everything passes.
+	 */
+	static validateRegistryUrls(obj, type, rowIndex, urlRules) {
+		if (!urlRules) return null;
+		const fields = urlRules.fields ? urlRules.fields[type] : null;
+		const allowedOrigins = urlRules.allowedOrigins;
+		if (!fields || !allowedOrigins || allowedOrigins.length === 0) return null;
+
+		const ctidPattern = /^ce-[0-9a-fA-F-]+$/;
+		const errors = [];
+		for (const field of fields) {
+			const raw = obj[field];
+			if (raw == null) continue;
+			const values = Array.isArray(raw) ? raw : String(raw).split("|");
+			for (let value of values) {
+				value = String(value).trim();
+				if (value === "" || ctidPattern.test(value)) continue;
+				let origin = null;
+				try {
+					origin = new URL(value).origin;
+				} catch (e) {
+					// Not parseable as a URL; falls through to the error below.
+				}
+				if (origin == null || !allowedOrigins.includes(origin)) {
+					errors.push(`Row ${rowIndex}: ${field} must be a CTID or a credential registry URL for this environment (got: ${value})`);
+				}
+			}
+		}
+		return errors.length > 0 ? errors : null;
+	}
+
 	static validateFrameworkHierarchy(tabularData, hierarchyRules) {
 		// Use provided hierarchy rules or fall back to defaults
 		if (!hierarchyRules) {

package/src/test/1.CTDLASNCSVImport.validateRegistryUrls.test.js

@@ -0,0 +1,100 @@
+let chai = require("chai");
+const CTDLASNCSVImport = require("../org/cass/importer/CTDLASNCSVImport.js");
+
+let expect = chai.expect;
+
+// Unit tests for the registry URL validation added for cassproject/cass-editor#1423:
+// CSV reference fields must contain either a CTID (ce-...) or a credential
+// registry URL whose origin matches the configured environment.
+describe("CTDLASNCSVImport.validateRegistryUrls", () => {
+    const urlRules = {
+        fields: {
+            "ceasn:CompetencyFramework": ["ceasn:creator", "ceasn:publisher", "asn:hasProgressionModel", "ceasn:hasTopChild"],
+            "ceasn:Competency": ["ceasn:creator", "ceterms:hasTask"]
+        },
+        allowedOrigins: ["https://sandbox.credentialengineregistry.org"]
+    };
+    const type = "ceasn:CompetencyFramework";
+
+    it("accepts a CTID value", () => {
+        const obj = { "ceasn:publisher": "ce-11111111-2222-3333-4444-555555555555" };
+        expect(CTDLASNCSVImport.validateRegistryUrls(obj, type, 2, urlRules)).to.equal(null);
+    });
+
+    it("accepts a registry URL with an allowed origin", () => {
+        const obj = { "ceasn:publisher": "https://sandbox.credentialengineregistry.org/resources/ce-1111" };
+        expect(CTDLASNCSVImport.validateRegistryUrls(obj, type, 2, urlRules)).to.equal(null);
+    });
+
+    it("rejects a URL from a different origin", () => {
+        const obj = { "ceasn:publisher": "https://credentialengineregistry.org/resources/ce-1111" };
+        const errors = CTDLASNCSVImport.validateRegistryUrls(obj, type, 2, urlRules);
+        expect(errors).to.be.an("array").with.lengthOf(1);
+        expect(errors[0]).to.contain("Row 2");
+        expect(errors[0]).to.contain("ceasn:publisher");
+        expect(errors[0]).to.contain("https://credentialengineregistry.org/resources/ce-1111");
+    });
+
+    it("rejects an arbitrary non-registry URL", () => {
+        const obj = { "ceasn:creator": "https://example.com/x" };
+        const errors = CTDLASNCSVImport.validateRegistryUrls(obj, type, 3, urlRules);
+        expect(errors).to.be.an("array").with.lengthOf(1);
+        expect(errors[0]).to.contain("ceasn:creator");
+    });
+
+    it("rejects a value that is neither CTID nor URL", () => {
+        const obj = { "ceasn:publisher": "Some Publisher Name" };
+        const errors = CTDLASNCSVImport.validateRegistryUrls(obj, type, 4, urlRules);
+        expect(errors).to.be.an("array").with.lengthOf(1);
+        expect(errors[0]).to.contain("Some Publisher Name");
+    });
+
+    it("reports only the bad part of a pipe-delimited value", () => {
+        const obj = { "ceasn:hasTopChild": "ce-11111111-2222-3333-4444-555555555555|https://evil.example.com/resources/ce-2222" };
+        const errors = CTDLASNCSVImport.validateRegistryUrls(obj, type, 5, urlRules);
+        expect(errors).to.be.an("array").with.lengthOf(1);
+        expect(errors[0]).to.contain("https://evil.example.com/resources/ce-2222");
+    });
+
+    it("validates array values", () => {
+        const obj = { "ceasn:creator": ["https://sandbox.credentialengineregistry.org/resources/ce-1", "https://example.org/nope"] };
+        const errors = CTDLASNCSVImport.validateRegistryUrls(obj, type, 6, urlRules);
+        expect(errors).to.be.an("array").with.lengthOf(1);
+        expect(errors[0]).to.contain("https://example.org/nope");
+    });
+
+    it("collects errors across multiple fields", () => {
+        const obj = {
+            "ceasn:creator": "https://example.com/a",
+            "ceasn:publisher": "https://example.com/b"
+        };
+        const errors = CTDLASNCSVImport.validateRegistryUrls(obj, type, 7, urlRules);
+        expect(errors).to.be.an("array").with.lengthOf(2);
+    });
+
+    it("ignores fields not configured for the type", () => {
+        const obj = { "ceasn:description": "https://example.com/not-checked" };
+        expect(CTDLASNCSVImport.validateRegistryUrls(obj, type, 8, urlRules)).to.equal(null);
+    });
+
+    it("is inert for types with no configured fields", () => {
+        const obj = { "ceasn:publisher": "https://example.com/x" };
+        expect(CTDLASNCSVImport.validateRegistryUrls(obj, "skos:Concept", 9, urlRules)).to.equal(null);
+    });
+
+    it("is inert when urlRules is absent", () => {
+        const obj = { "ceasn:publisher": "https://example.com/x" };
+        expect(CTDLASNCSVImport.validateRegistryUrls(obj, type, 10, null)).to.equal(null);
+    });
+
+    it("is inert when allowedOrigins is empty", () => {
+        const obj = { "ceasn:publisher": "https://example.com/x" };
+        const rules = { fields: urlRules.fields, allowedOrigins: [] };
+        expect(CTDLASNCSVImport.validateRegistryUrls(obj, type, 11, rules)).to.equal(null);
+    });
+
+    it("skips empty and null values", () => {
+        const obj = { "ceasn:publisher": "", "ceasn:creator": null };
+        expect(CTDLASNCSVImport.validateRegistryUrls(obj, type, 12, urlRules)).to.equal(null);
+    });
+});