systemprompt_models/profile/validation/
mod.rs

1//! Profile validation logic.
2//!
3//! This module contains all validation logic for Profile configurations,
4//! including path validation, security settings, CORS, and rate limits.
5//!
6//! Copyright (c) systemprompt.io — Business Source License 1.1.
7//! See <https://systemprompt.io> for licensing details.
8
9mod network;
10mod security;
11
12use super::{Profile, ProfileError, ProfileResult};
13
14impl Profile {
15    pub fn validate(&self) -> ProfileResult<()> {
16        let mut errors: Vec<String> = Vec::new();
17        let is_cloud = self.target.is_cloud();
18
19        self.validate_required_fields(&mut errors);
20        self.validate_urls(&mut errors);
21        self.validate_paths(&mut errors, is_cloud);
22        self.validate_security_settings(&mut errors);
23        self.validate_database_pool(&mut errors);
24        self.validate_cors_origins(&mut errors);
25        self.validate_rate_limits(&mut errors);
26        self.validate_governance(&mut errors, is_cloud);
27        self.validate_external_url_is_reachable(&mut errors, is_cloud);
28
29        if errors.is_empty() {
30            Ok(())
31        } else {
32            Err(ProfileError::Validation {
33                name: self.name.clone(),
34                errors,
35            })
36        }
37    }
38
39    pub(crate) fn validate_paths(&self, errors: &mut Vec<String>, is_cloud: bool) {
40        if is_cloud {
41            self.validate_cloud_paths(errors);
42        } else {
43            self.validate_local_paths(errors);
44        }
45    }
46
47    pub(crate) fn validate_cloud_paths(&self, errors: &mut Vec<String>) {
48        Self::require_non_empty(errors, &self.paths.system, "Paths system");
49        Self::require_non_empty(errors, &self.paths.services, "Paths services");
50        Self::require_non_empty(errors, &self.paths.bin, "Paths bin");
51
52        for (name, path) in [
53            ("system", self.paths.system.as_str()),
54            ("services", self.paths.services.as_str()),
55            ("bin", self.paths.bin.as_str()),
56        ] {
57            if !path.is_empty() && !path.starts_with("/app") {
58                errors.push(format!(
59                    "Cloud profile {} path should start with /app, got: {}",
60                    name, path
61                ));
62            }
63        }
64
65        if let Some(web_path) = &self.paths.web_path
66            && !web_path.is_empty()
67        {
68            if !web_path.starts_with("/app/web") {
69                errors.push(format!(
70                    "Cloud profile web_path should start with /app/web, got: {}. Note: \
71                         web_path points to the parent of dist/, e.g., /app/web for /app/web/dist",
72                    web_path
73                ));
74            }
75            if web_path.contains("/services/web") {
76                errors.push(format!(
77                    "Cloud profile web_path should be /app/web (for dist output), not \
78                         /app/services/web (which is for templates/config). Got: {}",
79                    web_path
80                ));
81            }
82        }
83    }
84
85    pub(crate) fn validate_local_paths(&self, errors: &mut Vec<String>) {
86        Self::require_non_empty(errors, &self.paths.system, "Paths system");
87        Self::require_non_empty(errors, &self.paths.services, "Paths services");
88        Self::require_non_empty(errors, &self.paths.bin, "Paths bin");
89    }
90
91    pub(crate) fn validate_required_fields(&self, errors: &mut Vec<String>) {
92        Self::require_non_empty(errors, &self.name, "Profile name");
93        Self::require_non_empty(errors, &self.display_name, "Profile display_name");
94        Self::require_non_empty(errors, &self.site.name, "Site name");
95        Self::require_non_empty(errors, &self.server.host, "Server host");
96        Self::require_non_empty(errors, &self.server.api_server_url, "Server api_server_url");
97        Self::require_non_empty(
98            errors,
99            &self.server.api_internal_url,
100            "Server api_internal_url",
101        );
102        Self::require_non_empty(
103            errors,
104            &self.server.api_external_url,
105            "Server api_external_url",
106        );
107
108        if self.server.port == 0 {
109            errors.push("Server port must be greater than 0".to_owned());
110        }
111    }
112
113    pub(crate) fn require_non_empty(errors: &mut Vec<String>, value: &str, field_name: &str) {
114        if value.is_empty() {
115            errors.push(format!("{field_name} is required"));
116        }
117    }
118
119    pub(crate) fn validate_urls(&self, errors: &mut Vec<String>) {
120        for (name, value) in [
121            ("server.api_server_url", self.server.api_server_url.as_str()),
122            (
123                "server.api_internal_url",
124                self.server.api_internal_url.as_str(),
125            ),
126            (
127                "server.api_external_url",
128                self.server.api_external_url.as_str(),
129            ),
130            ("security.issuer", self.security.issuer.as_str()),
131        ] {
132            Self::require_absolute_url(errors, name, value, false);
133        }
134
135        if !self.server.host.is_empty() && self.server.host.contains("://") {
136            errors.push(format!(
137                "server.host must be a bare hostname or IP, not a URL (got: {})",
138                self.server.host
139            ));
140        }
141
142        for (idx, issuer) in self.security.trusted_issuers.iter().enumerate() {
143            Self::require_absolute_url(
144                errors,
145                &format!("security.trusted_issuers[{idx}].issuer"),
146                &issuer.issuer,
147                false,
148            );
149            Self::require_absolute_url(
150                errors,
151                &format!("security.trusted_issuers[{idx}].jwks_uri"),
152                &issuer.jwks_uri,
153                true,
154            );
155        }
156
157        if let Some(hook) = self.governance.as_ref().and_then(|g| g.authz.as_ref())
158            && let Some(url) = hook.hook.url.as_deref()
159        {
160            Self::require_absolute_url(errors, "governance.authz.hook.url", url, false);
161        }
162    }
163
164    fn require_absolute_url(errors: &mut Vec<String>, field: &str, value: &str, https_only: bool) {
165        if value.is_empty() {
166            return;
167        }
168        let allowed: &[&str] = if https_only {
169            &["https"]
170        } else {
171            &["http", "https"]
172        };
173        match url::Url::parse(value) {
174            Ok(url) if !allowed.contains(&url.scheme()) => {
175                errors.push(format!(
176                    "{field} must be {} (got scheme '{}': {value})",
177                    if https_only {
178                        "an https URL"
179                    } else {
180                        "an http(s) URL"
181                    },
182                    url.scheme()
183                ));
184            },
185            Ok(url) if url.host_str().is_none_or(str::is_empty) => {
186                errors.push(format!("{field} must include a host (got: {value})"));
187            },
188            Ok(_) => {},
189            Err(e) => errors.push(format!("{field} is not a valid URL ({e}): {value}")),
190        }
191    }
192}
systemprompt_models/profile/validation/mod.rs

systemprompt_models/profile/validation/
mod.rs
