From 7bfc3f43a591287c038187ed5e782de6b9dd738b Mon Sep 17 00:00:00 2001
From: Elias Schneider <login@eliasschneider.com>
Date: Mon, 28 Oct 2024 18:34:25 +0100
Subject: [PATCH] feat: add validation to custom claim input

---
 backend/internal/dto/custom_claim_dto.go        |  9 ++++++---
 backend/internal/dto/validations.go             | 17 +++++++++++++++--
 backend/internal/middleware/error_handler.go    |  2 --
 .../lib/components/auto-complete-input.svelte   | 11 +++++++++++
 4 files changed, 32 insertions(+), 7 deletions(-)

diff --git a/backend/internal/dto/custom_claim_dto.go b/backend/internal/dto/custom_claim_dto.go
index f80f9a6..433a1d9 100644
--- a/backend/internal/dto/custom_claim_dto.go
+++ b/backend/internal/dto/custom_claim_dto.go
@@ -1,8 +1,11 @@
 package dto
 
 type CustomClaimDto struct {
-	Key   string `json:"key" binding:"required,max=20"`
-	Value string `json:"value" binding:"required,max=10000"`
+	Key   string `json:"key"`
+	Value string `json:"value"`
 }
 
-type CustomClaimCreateDto = CustomClaimDto
+type CustomClaimCreateDto struct {
+	Key   string `json:"key" binding:"required,claimKey"`
+	Value string `json:"value" binding:"required"`
+}
diff --git a/backend/internal/dto/validations.go b/backend/internal/dto/validations.go
index 59a2162..5199c6c 100644
--- a/backend/internal/dto/validations.go
+++ b/backend/internal/dto/validations.go
@@ -29,8 +29,15 @@ var validateUsername validator.Func = func(fl validator.FieldLevel) bool {
 }
 
 var validateUserGroupName validator.Func = func(fl validator.FieldLevel) bool {
-	// [a-z0-9_] : The group name can only contain lowercase letters, numbers, and underscores
-	regex := "^[a-z0-9_]+$"
+	// The string can only contain lowercase letters, numbers, and underscores
+	regex := "^[a-z0-9_]*$"
+	matched, _ := regexp.MatchString(regex, fl.Field().String())
+	return matched
+}
+
+var validateClaimKey validator.Func = func(fl validator.FieldLevel) bool {
+	// The string can only contain letters and numbers
+	regex := "^[A-Za-z0-9]*$"
 	matched, _ := regexp.MatchString(regex, fl.Field().String())
 	return matched
 }
@@ -52,4 +59,10 @@ func init() {
 			log.Fatalf("Failed to register custom validation: %v", err)
 		}
 	}
+
+	if v, ok := binding.Validator.Engine().(*validator.Validate); ok {
+		if err := v.RegisterValidation("claimKey", validateClaimKey); err != nil {
+			log.Fatalf("Failed to register custom validation: %v", err)
+		}
+	}
 }
diff --git a/backend/internal/middleware/error_handler.go b/backend/internal/middleware/error_handler.go
index e02361a..487fda4 100644
--- a/backend/internal/middleware/error_handler.go
+++ b/backend/internal/middleware/error_handler.go
@@ -8,7 +8,6 @@ import (
 	"github.com/go-playground/validator/v10"
 	"github.com/stonith404/pocket-id/backend/internal/common"
 	"gorm.io/gorm"
-	"log"
 	"net/http"
 	"strings"
 )
@@ -54,7 +53,6 @@ func (m *ErrorHandlerMiddleware) Add() gin.HandlerFunc {
 				return
 			}
 
-			log.Println(err)
 			c.JSON(http.StatusInternalServerError, gin.H{"error": "Something went wrong"})
 		}
 	}
diff --git a/frontend/src/lib/components/auto-complete-input.svelte b/frontend/src/lib/components/auto-complete-input.svelte
index da5e3c5..b1650c1 100644
--- a/frontend/src/lib/components/auto-complete-input.svelte
+++ b/frontend/src/lib/components/auto-complete-input.svelte
@@ -16,6 +16,7 @@
 
 	let filteredSuggestions: string[] = $state(suggestions.slice(0, suggestionLimit));
 	let selectedIndex = $state(-1);
+	let keyError: string | undefined = $state();
 
 	let isInputFocused = $state(false);
 
@@ -25,6 +26,13 @@
 	}
 
 	function handleOnInput() {
+		if (value.length > 0 && !/^[A-Za-z0-9]*$/.test(value)) {
+			keyError = 'Only alphanumeric characters are allowed';
+			return;
+		} else {
+			keyError = undefined;
+		}
+
 		filteredSuggestions = suggestions
 			.filter((s) => s.includes(value.toLowerCase()))
 			.slice(0, suggestionLimit);
@@ -75,6 +83,9 @@
 		onfocus={() => (isInputFocused = true)}
 		onblur={() => (isInputFocused = false)}
 	/>
+	{#if keyError}
+		<p class="mt-1 text-sm text-red-500">{keyError}</p>
+	{/if}
 	<Popover.Root
 		open={isOpen}
 		disableFocusTrap