cassproject 5.0.17 → 5.0.19

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cassproject",
-	"version": "5.0.17",
+	"version": "5.0.19",
 	"description": "Competency and Skills Service",
 	"main": "index.js",
 	"scripts": {
@@ -184,20 +184,20 @@
 	},
 	"homepage": "https://github.com/cassproject/cass-npm#readme",
 	"devDependencies": {
-		"@cypress/webpack-preprocessor": "^7.1.1",
+		"@cypress/webpack-preprocessor": "^7.1.2",
 		"chai": "^4.5.0",
 		"concurrently": "^10.0.4",
 		"cypress": "15.19.0",
 		"cypress-fail-fast": "^8.1.0",
-		"eslint": "^10.8.0",
+		"eslint": "^10.8.1",
 		"fake-indexeddb": "^6.2.5",
-		"mocha": "^11.7.6",
+		"mocha": "^11.8.0",
 		"node-polyfill-webpack-plugin": "^4.1.0",
 		"nodemon": "^3.1.14",
 		"nyc": "^18.0.0",
 		"sinon": "^21.1.2",
 		"wait-on": "^9.1.0",
-		"webpack": "^5.109.1"
+		"webpack": "^5.109.2"
 	},
 	"packageManager": "npm@11.3.0+sha512.96eb611483f49c55f7fa74df61b588de9e213f80a256728e6798ddc67176c7b07e4a1cfc7de8922422cbce02543714367037536955221fa451b0c4fefaf20c66"
 }

package/src/com/eduworks/ec/remote/EcRemote.js

@@ -10,16 +10,27 @@ if (typeof process === 'object') {
     }
   }
 }
+let httpFormData = typeof FormData !== 'undefined' ? FormData : undefined;
 if (isNode)
-{	
-	let undici = eval("require('undici');");
+{
+	let undici = null;
+	try {
+		undici = eval("require('undici');");
+	} catch (ex) {
+		//undici is optional. Fall back to the platform's fetch and FormData.
+	}
 	if (undici != null)
 	{
 		var {setGlobalDispatcher,Agent,fetch} = undici; //NOSONAR - Intentional use of var to allow for global scope.
+		//fetch and FormData must come from the same implementation. undici's fetch
+		//does not recognize the platform's FormData and serializes it as text/plain.
+		httpFormData = undici.FormData;
 		setGlobalDispatcher(new Agent({
 			allowH2: process.env.HTTP2 != null ? process.env.HTTP2.trim() == 'true' : true
 		}))
 	}
+	else if (typeof globalThis.fetch === 'function')
+		var fetch = globalThis.fetch; //NOSONAR - Intentional use of var; the destructuring above hoists `fetch` to module scope, which would otherwise shadow the global with undefined.
 }
 if (typeof window !== 'undefined' && window.fetch != null)
 	var fetch = window.fetch;  //NOSONAR - Intentional use of var to allow for global scope.
@@ -50,6 +61,15 @@ const { cassPromisify } = require("../promises/helpers");
  *  @module com.eduworks.ec
  */
 module.exports = class EcRemote {
+	/**
+	 *  The FormData implementation paired with the fetch implementation EcRemote uses.
+	 *  Always construct multi-part bodies destined for EcRemote.post* with this,
+	 *  not the platform global, or bodies will be serialized as text/plain.
+	 *
+	 *  @property FormData
+	 *  @static
+	 */
+	static FormData = httpFormData;
 	//See https://github.com/nodejs/node/issues/47130 -- This is a workaround for a bug that causes http 1.1 keep-alive from throwing an error.
 	static leTired() {
 		if (isNode)

package/src/org/cass/importer/CTDLASNCSVConceptImport.js

@@ -207,6 +207,20 @@ module.exports = class CTDLASNCSVConceptImport {
 								continue;
 							}
 						}
+						// Validate registry URL fields (only if url rules provided)
+						if (validationRules && validationRules.urlRules) {
+							const urlErrors = CTDLASNCSVImport.validateRegistryUrls(
+								pretranslatedE,
+								"skos:ConceptScheme",
+								each + 2,
+								validationRules.urlRules
+							);
+							if (urlErrors) {
+								errors.push(...urlErrors);
+								rowsWithErrors.add(each);
+								continue;
+							}
+						}
 						let translator = new EcLinkedData(null, null);
 						translator.copyFrom(pretranslatedE);
 						CTDLASNCSVImport.cleanUpTranslator(
@@ -294,6 +308,20 @@ module.exports = class CTDLASNCSVConceptImport {
 								continue;
 							}
 						}
+						// Validate registry URL fields (only if url rules provided)
+						if (validationRules && validationRules.urlRules) {
+							const urlErrors = CTDLASNCSVImport.validateRegistryUrls(
+								pretranslatedE,
+								"skos:Concept",
+								each + 2,
+								validationRules.urlRules
+							);
+							if (urlErrors) {
+								errors.push(...urlErrors);
+								rowsWithErrors.add(each);
+								continue;
+							}
+						}
 						let translator = new EcLinkedData(null, null);
 						translator.copyFrom(pretranslatedE);
 						CTDLASNCSVImport.cleanUpTranslator(
@@ -583,6 +611,20 @@ module.exports = class CTDLASNCSVConceptImport {
 								continue;
 							}
 						}
+						// Validate registry URL fields (only if url rules provided)
+						if (validationRules && validationRules.urlRules) {
+							const urlErrors = CTDLASNCSVImport.validateRegistryUrls(
+								pretranslatedE,
+								"asn:ProgressionModel",
+								each + 2,
+								validationRules.urlRules
+							);
+							if (urlErrors) {
+								errors.push(...urlErrors);
+								rowsWithErrors.add(each);
+								continue;
+							}
+						}
 						let translator = new EcLinkedData(null, null);
 						translator.copyFrom(pretranslatedE);
 						CTDLASNCSVImport.cleanUpTranslator(
@@ -666,6 +708,20 @@ module.exports = class CTDLASNCSVConceptImport {
 								continue;
 							}
 						}
+						// Validate registry URL fields (only if url rules provided)
+						if (validationRules && validationRules.urlRules) {
+							const urlErrors = CTDLASNCSVImport.validateRegistryUrls(
+								pretranslatedE,
+								"asn:ProgressionLevel",
+								each + 2,
+								validationRules.urlRules
+							);
+							if (urlErrors) {
+								errors.push(...urlErrors);
+								rowsWithErrors.add(each);
+								continue;
+							}
+						}
 						let translator = new EcLinkedData(null, null);
 						translator.copyFrom(pretranslatedE);
 						CTDLASNCSVImport.cleanUpTranslator(

package/src/org/cass/importer/CTDLASNCSVImport.js

@@ -255,6 +255,20 @@ module.exports = class CTDLASNCSVImport {
 								continue;
 							}
 						}
+						// Validate registry URL fields (only if url rules provided)
+						if (validationRules && validationRules.urlRules) {
+							const urlErrors = CTDLASNCSVImport.validateRegistryUrls(
+								pretranslatedE,
+								"ceasn:CompetencyFramework",
+								i + 2,
+								validationRules.urlRules
+							);
+							if (urlErrors) {
+								errors.push(...urlErrors);
+								rowsWithErrors.add(i);
+								continue;
+							}
+						}
 
 						let translator = new EcLinkedData(null, null);
 						translator.copyFrom(pretranslatedE);
@@ -404,6 +418,20 @@ module.exports = class CTDLASNCSVImport {
 							continue;
 						}
 					}
+					// Validate registry URL fields (only if url rules provided)
+					if (validationRules && validationRules.urlRules) {
+						const urlErrors = CTDLASNCSVImport.validateRegistryUrls(
+							pretranslatedE,
+							"ceasn:Competency",
+							i + 2,
+							validationRules.urlRules
+						);
+						if (urlErrors) {
+							errors.push(...urlErrors);
+							rowsWithErrors.add(i);
+							continue;
+						}
+					}
 
 						let translator = new EcLinkedData(null, null);
 						translator.copyFrom(pretranslatedE);
@@ -850,6 +878,20 @@ module.exports = class CTDLASNCSVImport {
 								continue;
 							}
 						}
+						// Validate registry URL fields (only if url rules provided)
+						if (validationRules && validationRules.urlRules) {
+							const urlErrors = CTDLASNCSVImport.validateRegistryUrls(
+								pretranslatedE,
+								"ceterms:Collection",
+								i + 2,
+								validationRules.urlRules
+							);
+							if (urlErrors) {
+								errors.push(...urlErrors);
+								rowsWithErrors.add(i);
+								continue;
+							}
+						}
 						let translator = new EcLinkedData(null, null);
 						translator.copyFrom(pretranslatedE);
 						CTDLASNCSVImport.cleanUpTranslator(
@@ -939,6 +981,20 @@ module.exports = class CTDLASNCSVImport {
 								continue;
 							}
 						}
+						// Validate registry URL fields (only if url rules provided)
+						if (validationRules && validationRules.urlRules) {
+							const urlErrors = CTDLASNCSVImport.validateRegistryUrls(
+								pretranslatedE,
+								"ceasn:Competency",
+								i + 2,
+								validationRules.urlRules
+							);
+							if (urlErrors) {
+								errors.push(...urlErrors);
+								rowsWithErrors.add(i);
+								continue;
+							}
+						}
 						let translator = new EcLinkedData(null, null);
 						translator.copyFrom(pretranslatedE);
 						CTDLASNCSVImport.cleanUpTranslator(
@@ -1447,6 +1503,48 @@ module.exports = class CTDLASNCSVImport {
 		return null;
 	}
 
+	/*
+	 * Validates that reference fields contain either a CTID (ce-...) or a
+	 * credential registry URL whose origin is allowed for this environment.
+	 * CTIDs are resolved by the CTID pipeline (getIdFromCtid); any other value
+	 * must be an http(s) URL with an origin listed in urlRules.allowedOrigins.
+	 *
+	 * urlRules = {
+	 *     fields: { "<@type>": ["ceasn:creator", ...], ... },
+	 *     allowedOrigins: ["https://sandbox.credentialengineregistry.org", ...]
+	 * }
+	 *
+	 * Returns an array of error strings, or null when everything passes.
+	 */
+	static validateRegistryUrls(obj, type, rowIndex, urlRules) {
+		if (!urlRules) return null;
+		const fields = urlRules.fields ? urlRules.fields[type] : null;
+		const allowedOrigins = urlRules.allowedOrigins;
+		if (!fields || !allowedOrigins || allowedOrigins.length === 0) return null;
+
+		const ctidPattern = /^ce-[0-9a-fA-F-]+$/;
+		const errors = [];
+		for (const field of fields) {
+			const raw = obj[field];
+			if (raw == null) continue;
+			const values = Array.isArray(raw) ? raw : String(raw).split("|");
+			for (let value of values) {
+				value = String(value).trim();
+				if (value === "" || ctidPattern.test(value)) continue;
+				let origin = null;
+				try {
+					origin = new URL(value).origin;
+				} catch (e) {
+					// Not parseable as a URL; falls through to the error below.
+				}
+				if (origin == null || !allowedOrigins.includes(origin)) {
+					errors.push(`Row ${rowIndex}: ${field} must be a CTID or a credential registry URL for this environment (got: ${value})`);
+				}
+			}
+		}
+		return errors.length > 0 ? errors : null;
+	}
+
 	static validateFrameworkHierarchy(tabularData, hierarchyRules) {
 		// Use provided hierarchy rules or fall back to defaults
 		if (!hierarchyRules) {

package/src/org/cassproject/ebac/identity/remote/EcRemoteIdentityManager.js

@@ -1,6 +1,7 @@
 
 const {cassPromisify} = require("../../../../../com/eduworks/ec/promises/helpers");
 const EcRemote = require("../../../../../com/eduworks/ec/remote/EcRemote");
+const FormData = EcRemote.FormData;
 const EbacCredentialCommit = require("../../../../../com/eduworks/schema/ebac/EbacCredentialCommit");
 const EbacCredentialRequest = require("../../../../../com/eduworks/schema/ebac/EbacCredentialRequest");
 const EcContact = require("../EcContact");

package/src/org/cassproject/ebac/repository/EcRepository.js

@@ -1,13 +1,10 @@
-if (typeof process !== 'undefined' && process.version && process.version.startsWith("v16")) {
-	console.log("Loading polyfill for FormData.");
-	FormData = eval("require('undici').FormData");
-}
 const EcObject = require("../../../../com/eduworks/ec/array/EcObject");
 const EcEncryptedValue = require("./EcEncryptedValue");
 const EcIdentityManager = require("../identity/EcIdentityManager");
 const EcRekeyRequest = require("../identity/EcRekeyRequest");
 const EcArray = require("../../../../com/eduworks/ec/array/EcArray");
 const EcRemote = require("../../../../com/eduworks/ec/remote/EcRemote");
+const FormData = EcRemote.FormData;
 const { cassPromisify, cassReturnAsPromise, cassReturnNullAsPromise } = require("../../../../com/eduworks/ec/promises/helpers");
 const EcRemoteLinkedData = require("../../schema/general/EcRemoteLinkedData");
 const EcCrypto = require("../../../../com/eduworks/ec/crypto/EcCrypto");

package/src/org/cassproject/schema/general/EcRemoteLinkedData.js

@@ -6,6 +6,7 @@ const EcPpkFacade = require("../../../../com/eduworks/ec/crypto/EcPpkFacade.js")
 const EcRsaOaepAsyncWorker = require("../../../../com/eduworks/ec/crypto/EcRsaOaepAsyncWorker.js");
 const EcLinkedData = require("../../../json/ld/EcLinkedData.js");
 const Ebac = require("./Ebac.js");
+const FormData = require("../../../../com/eduworks/ec/remote/EcRemote.js").FormData;
 require("../../general/AuditLogger.js")
 
 /**
@@ -540,6 +541,19 @@ module.exports = class EcRemoteLinkedData extends EcLinkedData {
 				types[i].substring(lastSlash + 1) +
 				'")';
 		}
+		//Replace http with https in schema or visa versa and then do it again
+		for (let i = 0; i < types.length; i++) {
+			if (result != "") result += " OR ";
+			let lastSlash = types[i].lastIndexOf("/");
+			let context = types[i].substring(0, lastSlash + 1);
+			if (context.startsWith("http://")) {
+				let httpsContext = context.replace("http://", "https://");
+				result += '(@context:"' + httpsContext + '" AND @type:"' + types[i].substring(lastSlash + 1) + '")';
+			} else if (context.startsWith("https://")) {
+				let httpContext = context.replace("https://", "http://");
+				result += '(@context:"' + httpContext + '" AND @type:"' + types[i].substring(lastSlash + 1) + '")';
+			}
+		}
 		return "(" + result + ")";
 	}
 	asRdfXml(success, failure, signatureSheet) {

package/src/test/1.CTDLASNCSVImport.validateRegistryUrls.test.js

@@ -0,0 +1,100 @@
+let chai = require("chai");
+const CTDLASNCSVImport = require("../org/cass/importer/CTDLASNCSVImport.js");
+
+let expect = chai.expect;
+
+// Unit tests for the registry URL validation added for cassproject/cass-editor#1423:
+// CSV reference fields must contain either a CTID (ce-...) or a credential
+// registry URL whose origin matches the configured environment.
+describe("CTDLASNCSVImport.validateRegistryUrls", () => {
+    const urlRules = {
+        fields: {
+            "ceasn:CompetencyFramework": ["ceasn:creator", "ceasn:publisher", "asn:hasProgressionModel", "ceasn:hasTopChild"],
+            "ceasn:Competency": ["ceasn:creator", "ceterms:hasTask"]
+        },
+        allowedOrigins: ["https://sandbox.credentialengineregistry.org"]
+    };
+    const type = "ceasn:CompetencyFramework";
+
+    it("accepts a CTID value", () => {
+        const obj = { "ceasn:publisher": "ce-11111111-2222-3333-4444-555555555555" };
+        expect(CTDLASNCSVImport.validateRegistryUrls(obj, type, 2, urlRules)).to.equal(null);
+    });
+
+    it("accepts a registry URL with an allowed origin", () => {
+        const obj = { "ceasn:publisher": "https://sandbox.credentialengineregistry.org/resources/ce-1111" };
+        expect(CTDLASNCSVImport.validateRegistryUrls(obj, type, 2, urlRules)).to.equal(null);
+    });
+
+    it("rejects a URL from a different origin", () => {
+        const obj = { "ceasn:publisher": "https://credentialengineregistry.org/resources/ce-1111" };
+        const errors = CTDLASNCSVImport.validateRegistryUrls(obj, type, 2, urlRules);
+        expect(errors).to.be.an("array").with.lengthOf(1);
+        expect(errors[0]).to.contain("Row 2");
+        expect(errors[0]).to.contain("ceasn:publisher");
+        expect(errors[0]).to.contain("https://credentialengineregistry.org/resources/ce-1111");
+    });
+
+    it("rejects an arbitrary non-registry URL", () => {
+        const obj = { "ceasn:creator": "https://example.com/x" };
+        const errors = CTDLASNCSVImport.validateRegistryUrls(obj, type, 3, urlRules);
+        expect(errors).to.be.an("array").with.lengthOf(1);
+        expect(errors[0]).to.contain("ceasn:creator");
+    });
+
+    it("rejects a value that is neither CTID nor URL", () => {
+        const obj = { "ceasn:publisher": "Some Publisher Name" };
+        const errors = CTDLASNCSVImport.validateRegistryUrls(obj, type, 4, urlRules);
+        expect(errors).to.be.an("array").with.lengthOf(1);
+        expect(errors[0]).to.contain("Some Publisher Name");
+    });
+
+    it("reports only the bad part of a pipe-delimited value", () => {
+        const obj = { "ceasn:hasTopChild": "ce-11111111-2222-3333-4444-555555555555|https://evil.example.com/resources/ce-2222" };
+        const errors = CTDLASNCSVImport.validateRegistryUrls(obj, type, 5, urlRules);
+        expect(errors).to.be.an("array").with.lengthOf(1);
+        expect(errors[0]).to.contain("https://evil.example.com/resources/ce-2222");
+    });
+
+    it("validates array values", () => {
+        const obj = { "ceasn:creator": ["https://sandbox.credentialengineregistry.org/resources/ce-1", "https://example.org/nope"] };
+        const errors = CTDLASNCSVImport.validateRegistryUrls(obj, type, 6, urlRules);
+        expect(errors).to.be.an("array").with.lengthOf(1);
+        expect(errors[0]).to.contain("https://example.org/nope");
+    });
+
+    it("collects errors across multiple fields", () => {
+        const obj = {
+            "ceasn:creator": "https://example.com/a",
+            "ceasn:publisher": "https://example.com/b"
+        };
+        const errors = CTDLASNCSVImport.validateRegistryUrls(obj, type, 7, urlRules);
+        expect(errors).to.be.an("array").with.lengthOf(2);
+    });
+
+    it("ignores fields not configured for the type", () => {
+        const obj = { "ceasn:description": "https://example.com/not-checked" };
+        expect(CTDLASNCSVImport.validateRegistryUrls(obj, type, 8, urlRules)).to.equal(null);
+    });
+
+    it("is inert for types with no configured fields", () => {
+        const obj = { "ceasn:publisher": "https://example.com/x" };
+        expect(CTDLASNCSVImport.validateRegistryUrls(obj, "skos:Concept", 9, urlRules)).to.equal(null);
+    });
+
+    it("is inert when urlRules is absent", () => {
+        const obj = { "ceasn:publisher": "https://example.com/x" };
+        expect(CTDLASNCSVImport.validateRegistryUrls(obj, type, 10, null)).to.equal(null);
+    });
+
+    it("is inert when allowedOrigins is empty", () => {
+        const obj = { "ceasn:publisher": "https://example.com/x" };
+        const rules = { fields: urlRules.fields, allowedOrigins: [] };
+        expect(CTDLASNCSVImport.validateRegistryUrls(obj, type, 11, rules)).to.equal(null);
+    });
+
+    it("skips empty and null values", () => {
+        const obj = { "ceasn:publisher": "", "ceasn:creator": null };
+        expect(CTDLASNCSVImport.validateRegistryUrls(obj, type, 12, urlRules)).to.equal(null);
+    });
+});