LEGLINK-620: secret-key-on-Vendors screen

DotNet/ServiceTests/UnitTests/Tenant/VendorAuthenticationValidationTests.cs

@@ -0,0 +1,64 @@
+using LantanaGroup.Link.Shared.Application.Models.Tenant;
+using System.ComponentModel.DataAnnotations;
+
+namespace UnitTests.Tenant;
+
+public class VendorAuthenticationValidationTests
+{
+    private static IList<ValidationResult> Validate(string? signingKeySecretId)
+    {
+        var settings = new VendorAuthenticationSettings { SigningKeySecretId = signingKeySecretId };
+        var results = new List<ValidationResult>();
+
+        Validator.TryValidateObject(settings, new ValidationContext(settings), results, validateAllProperties: true);
+
+        return results;
+    }
+
+    [Fact]
+    public void NullSecretId_IsValid_BecauseItClearsTheAssociation()
+    {
+        Assert.Empty(Validate(null));
+    }
+
+    [Fact]
+    public void ValidSecretId_IsAccepted()
+    {
+        Assert.Empty(Validate("epic-signing-key"));
+    }
+
+    [Theory]
+    [InlineData("")]
+    [InlineData("   ")]
+    [InlineData("\t")]
+    public void BlankSecretId_IsRejected(string signingKeySecretId)
+    {
+        var results = Validate(signingKeySecretId);
+
+        Assert.NotEmpty(results);
+        Assert.Contains(nameof(VendorAuthenticationSettings.SigningKeySecretId),
+            results.SelectMany(result => result.MemberNames));
+    }
+
+    [Theory]
+    [InlineData("has space")]
+    [InlineData("has/slash")]
+    [InlineData("has_underscore")]
+    [InlineData("has.dot")]
+    public void SecretIdOutsideKeyVaultsCharacterSet_IsRejected(string signingKeySecretId)
+    {
+        Assert.NotEmpty(Validate(signingKeySecretId));
+    }
+
+    [Fact]
+    public void SecretIdLongerThanKeyVaultAllows_IsRejected()
+    {
+        Assert.NotEmpty(Validate(new string('a', 128)));
+    }
+
+    [Fact]
+    public void SecretIdAtKeyVaultsMaximumLength_IsAccepted()
+    {
+        Assert.Empty(Validate(new string('a', 127)));
+    }
+}

DotNet/Shared/Application/Models/Tenant/VendorAuthenticationSettings.cs

@@ -1,13 +1,33 @@
+using System.ComponentModel.DataAnnotations;
 using System.Runtime.Serialization;
 using System.Text.Json.Serialization;
+using System.Text.RegularExpressions;
 
 namespace LantanaGroup.Link.Shared.Application.Models.Tenant
 {
     [DataContract]
-    public class VendorAuthenticationSettings
+    public class VendorAuthenticationSettings : IValidatableObject
     {
+        private static readonly Regex KeyVaultSecretName =
+            new("^[0-9a-zA-Z-]{1,127}$", RegexOptions.Compiled);
+
         [DataMember]
         [JsonPropertyName("signingKeySecretId")]
         public string? SigningKeySecretId { get; set; }
+
+        public IEnumerable<ValidationResult> Validate(ValidationContext validationContext)
+        {
+            if (SigningKeySecretId is null)
+            {
+                yield break;
+            }
+
+            if (!KeyVaultSecretName.IsMatch(SigningKeySecretId))
+            {
+                yield return new ValidationResult(
+                    "SigningKeySecretId must be a Key Vault secret name: 1 to 127 characters of letters, digits and dashes. Send null to clear the association.",
+                    new[] { nameof(SigningKeySecretId) });
+            }
+        }
     }
 }

Web/Admin.UI/src/app/components/vendor/vendor-config-form/vendor-config-form.component.html

@@ -29,6 +29,11 @@
             <input matInput formControlName="secretId" [readonly]="viewOnly"
                    data-testid="vendor-secret-id-input">
             <mat-hint>Name of the Key Vault secret holding the PEM signing key.</mat-hint>
+            @if (secretId.hasError('pattern')) {
+              <mat-error data-testid="vendor-secret-id-error">
+                Use the secret's name, not its URL: 1 to 127 letters, digits or dashes.
+              </mat-error>
+            }
           </mat-form-field>
         </div>
       </mat-expansion-panel>

Web/Admin.UI/src/app/components/vendor/vendor-config-form/vendor-config-form.component.spec.ts

@@ -56,6 +56,89 @@ describe('VendorConfigFormComponent', () => {
     expect(bare.componentInstance.keySettingsExpanded).toBeFalse();
   });
 
+  ['has space', 'has/slash', 'has_underscore', 'https://v.vault.azure.net/secrets/k', 'a'.repeat(128)]
+    .forEach(invalid => {
+      it(`rejects a secret id Key Vault cannot accept: "${invalid.slice(0, 24)}"`, () => {
+        initWith(cerner, FormMode.Edit);
+
+        component.secretId.setValue(invalid);
+
+        expect(component.secretId.valid).toBeFalse();
+        expect(component.vendorForm.valid).toBeFalse();
+      });
+    });
+
+  it('marks the form invalid on the keystroke, before the field is blurred', () => {
+    initWith(cerner, FormMode.Edit);
+
+    component.secretId.setValue('has space');
+
+    expect(component.secretId.touched).toBeFalse();
+    expect(component.vendorForm.invalid).toBeTrue();
+  });
+
+  it('shows the inline message once the field is blurred', () => {
+    initWith(cerner, FormMode.Edit);
+
+    component.secretId.setValue('has space');
+    fixture.detectChanges();
+    const whileTyping = (fixture.nativeElement as HTMLElement)
+      .querySelector('[data-testid="vendor-secret-id-error"]');
+
+    component.secretId.markAsTouched();
+    fixture.detectChanges();
+    const afterBlur = (fixture.nativeElement as HTMLElement)
+      .querySelector('[data-testid="vendor-secret-id-error"]');
+
+    expect(whileTyping).toBeNull();
+    expect(afterBlur).not.toBeNull();
+  });
+
+  it('accepts a secret id Key Vault can resolve', () => {
+    initWith(cerner, FormMode.Edit);
+
+    component.secretId.setValue('epic-signing-key');
+
+    expect(component.secretId.valid).toBeTrue();
+  });
+
+  it('accepts an empty secret id, which clears the association', () => {
+    initWith(epic, FormMode.Edit);
+
+    component.secretId.setValue('');
+
+    expect(component.secretId.valid).toBeTrue();
+  });
+
+  it('does not call the service when the secret id is invalid', () => {
+    initWith(epic, FormMode.Edit);
+
+    component.secretId.setValue('has space');
+    component.submitConfiguration();
+
+    expect(vendorService.updateVendor).not.toHaveBeenCalled();
+  });
+
+  it('surfaces the field message when the API rejects the value', () => {
+    vendorService.updateVendor.and.returnValue(throwError(() => ({
+      message: 'An error occured in our API. Please use the trace id when requesting assistence. - 00-abc',
+      error: {
+        errors: {
+          'Authentication.SigningKeySecretId': ['SigningKeySecretId must be a Key Vault secret name.']
+        }
+      }
+    })));
+    initWith(epic, FormMode.Edit);
+
+    const outcomes: { success: boolean; message: string }[] = [];
+    component.submittedConfiguration.subscribe(o => outcomes.push(o));
+
+    component.submitConfiguration();
+
+    expect(outcomes[0].success).toBeFalse();
+    expect(outcomes[0].message).toContain('SigningKeySecretId must be a Key Vault secret name.');
+  });
+
   it('requires a name but not a secret id', () => {
     initWith(cerner, FormMode.Edit);
 

Web/Admin.UI/src/app/components/vendor/vendor-config-form/vendor-config-form.component.ts

@@ -1,7 +1,7 @@
 import {Component, EventEmitter, Input, OnChanges, OnInit, Output, SimpleChanges} from '@angular/core';
 
 import {MatSnackBar, MatSnackBarModule} from '@angular/material/snack-bar';
-import {FormBuilder, FormGroup, ReactiveFormsModule, Validators} from '@angular/forms';
+import {AbstractControl, FormBuilder, FormGroup, ReactiveFormsModule, ValidationErrors, Validators} from '@angular/forms';
 import {MatButtonModule} from '@angular/material/button';
 import {MatSelectModule} from '@angular/material/select';
 import {MatChipsModule} from '@angular/material/chips';
@@ -61,6 +61,15 @@ export class VendorConfigFormComponent {
 
   vendorForm!: FormGroup;
 
+  private static readonly KeyVaultSecretName = /^[0-9a-zA-Z-]{1,127}$/;
+
+  static keyVaultSecretNameValidator(control: AbstractControl): ValidationErrors | null {
+    const value = (control.value ?? '').trim();
+    return value === '' || VendorConfigFormComponent.KeyVaultSecretName.test(value)
+      ? null
+      : {pattern: true};
+  }
+
   /**
    * Whether the JWT / Authentication panel starts open. Expanded when the vendor already has a
    * secret id so existing configuration is visible without hunting for it, collapsed otherwise
@@ -71,9 +80,7 @@ export class VendorConfigFormComponent {
   constructor(private snackBar: MatSnackBar, private vendorService: VendorService, private dialog: MatDialog, private fb: FormBuilder) {
     this.vendorForm = this.fb.group({
       name: ["", Validators.required],
-      // No validator: the secret id is optional, and checking that it resolves in Key Vault is
-      // LEGLINK-566. A format rule here would reject ids this UI has no way to verify.
-      secretId: [""]
+      secretId: ["", VendorConfigFormComponent.keyVaultSecretNameValidator]
     });
   }
 
@@ -140,6 +147,11 @@ export class VendorConfigFormComponent {
    * snackbar while staying open so the admin's input is not thrown away.
    */
   private failureMessage(err: any): string {
+    const fieldMessages = Object.values(err?.error?.errors ?? {}).flat() as string[];
+    if (fieldMessages.length) {
+      return fieldMessages.join(' ');
+    }
+
     return err?.message ?? 'Failed to save the vendor configuration. Please try again.';
   }
 }