mgv-backoffice 1.33.0 → 1.34.0

package/src/utils/validate.test.ts

@@ -0,0 +1,82 @@
+import { describe, it, expect } from 'vitest'
+import {
+  isValidAbsoluteUrl,
+  isValidJson,
+  isValidXml,
+  isValidBase64,
+} from './validate'
+
+describe('isValidAbsoluteUrl', () => {
+  it('accepts absolute http/https URLs', () => {
+    expect(isValidAbsoluteUrl('http://example.com')).toBe(true)
+    expect(isValidAbsoluteUrl('https://example.com/path?q=1')).toBe(true)
+    expect(isValidAbsoluteUrl('  https://example.com  ')).toBe(true)
+  })
+
+  it('rejects empty, relative and non-http schemes', () => {
+    expect(isValidAbsoluteUrl('')).toBe(false)
+    expect(isValidAbsoluteUrl('   ')).toBe(false)
+    expect(isValidAbsoluteUrl('/relative/path')).toBe(false)
+    expect(isValidAbsoluteUrl('example.com')).toBe(false)
+    expect(isValidAbsoluteUrl('ftp://example.com')).toBe(false)
+    expect(isValidAbsoluteUrl('mailto:a@b.c')).toBe(false)
+    expect(isValidAbsoluteUrl('not a url')).toBe(false)
+  })
+})
+
+describe('isValidJson', () => {
+  it('treats empty input as valid', () => {
+    expect(isValidJson('')).toBe(true)
+    expect(isValidJson('  \n ')).toBe(true)
+  })
+
+  it('accepts well-formed JSON of any root type', () => {
+    expect(isValidJson('{"a":1}')).toBe(true)
+    expect(isValidJson('[1,2]')).toBe(true)
+    expect(isValidJson('"str"')).toBe(true)
+    expect(isValidJson('42')).toBe(true)
+  })
+
+  it('rejects malformed JSON', () => {
+    expect(isValidJson('{a:1}')).toBe(false)
+    expect(isValidJson('{"a":1,}')).toBe(false)
+    expect(isValidJson('<xml/>')).toBe(false)
+  })
+})
+
+describe('isValidXml', () => {
+  it('treats empty input as valid', () => {
+    expect(isValidXml('')).toBe(true)
+    expect(isValidXml('   ')).toBe(true)
+  })
+
+  it('accepts well-formed XML', () => {
+    expect(isValidXml('<root><child a="1"/></root>')).toBe(true)
+    expect(isValidXml('<?xml version="1.0"?><r/>')).toBe(true)
+  })
+
+  it('rejects malformed XML', () => {
+    expect(isValidXml('<root><unclosed></root>')).toBe(false)
+    expect(isValidXml('just text')).toBe(false)
+    expect(isValidXml('<a><b></a></b>')).toBe(false)
+  })
+})
+
+describe('isValidBase64', () => {
+  it('treats empty input as valid', () => {
+    expect(isValidBase64('')).toBe(true)
+    expect(isValidBase64(' \n ')).toBe(true)
+  })
+
+  it('accepts well-formed base64, ignoring embedded whitespace', () => {
+    expect(isValidBase64('aGVsbG8=')).toBe(true)
+    expect(isValidBase64('aGVs\nbG8=')).toBe(true)
+    expect(isValidBase64('YQ==')).toBe(true)
+  })
+
+  it('rejects bad lengths, bad alphabets and undecodable input', () => {
+    expect(isValidBase64('aGVsbG8')).toBe(false) // length % 4 !== 0
+    expect(isValidBase64('aGV$bG8=')).toBe(false) // bad character
+    expect(isValidBase64('====')).toBe(false) // padding only
+  })
+})

package/src/utils/validate.ts

@@ -0,0 +1,76 @@
+/**
+ * Pure, dependency-free input validators shared across back-office forms —
+ * extracted from WireMate's mock form.
+ *
+ * Semantics note: the payload validators (`isValidJson`, `isValidXml`,
+ * `isValidBase64`) treat empty/whitespace-only input as VALID — callers
+ * gate on "is there something to check" separately (required-ness is a
+ * different rule from well-formedness). `isValidAbsoluteUrl` is the
+ * opposite: it validates a value that must exist, so empty is invalid.
+ */
+
+/**
+ * `true` when `value` parses as an absolute http:// or https:// URL.
+ * Deliberately tightens the scheme list — backends' HTTP clients won't
+ * follow ftp:// or mailto: anyway, so a stray scheme is a typo.
+ */
+export function isValidAbsoluteUrl(value: string): boolean {
+  const trimmed = (value ?? '').trim()
+  if (!trimmed) return false
+  try {
+    const url = new URL(trimmed)
+    return url.protocol === 'http:' || url.protocol === 'https:'
+  } catch {
+    return false
+  }
+}
+
+/**
+ * `true` when `str` is empty or parses as JSON.
+ */
+export function isValidJson(str: string): boolean {
+  if (!str.trim()) return true
+  try {
+    JSON.parse(str)
+    return true
+  } catch {
+    return false
+  }
+}
+
+/**
+ * `true` when `str` is empty or is well-formed XML. Runs the browser's
+ * DOMParser and checks for a `<parsererror>` node — the only reliable
+ * signal DOMParser provides, since it never throws on bad input.
+ */
+export function isValidXml(str: string): boolean {
+  if (!str.trim()) return true
+  try {
+    const doc = new DOMParser().parseFromString(str, 'application/xml')
+    return !doc.getElementsByTagName('parsererror').length
+  } catch {
+    return false
+  }
+}
+
+/**
+ * `true` when `str` is empty or is well-formed base64 (after stripping
+ * whitespace/newlines, which are harmless in both RFC 4648 and most
+ * real-world payloads). Rejects lengths that can't possibly decode
+ * (`length % 4 !== 0` after padding) — the common "off by a character"
+ * copy/paste issue — then defers to the native decoder as the final
+ * authority.
+ */
+export function isValidBase64(str: string): boolean {
+  if (!str.trim()) return true
+  const compact = str.replace(/\s+/g, '')
+  if (!compact) return true
+  if (compact.length % 4 !== 0) return false
+  if (!/^[A-Za-z0-9+/]*={0,2}$/.test(compact)) return false
+  try {
+    atob(compact)
+    return true
+  } catch {
+    return false
+  }
+}