Repository navigation
validate identity provider form fields before save - #2816
Merged
AlexSanchez-bit merged 7 commits intoOct 6, 2026
Merged
AlexSanchez-bit merged 7 commits into
AlexSanchez-bit merged 7 commits into
Conversation
🛑 AI review — Sensitive area, extra care recommendedThis PR touches critical paths or introduces changes the model cannot judge with sufficient confidence. Review carefully before merging. 🛑
|
2 of 3 tasks
…ad ?? on paren check, port message 0..65535 - HOST_RE now allows [::1] alongside bare hostnames (the form no longer blocks IPv6 LDAP hosts; backend parity + the dial gap are documented in idp-form-validation.md under "Paridad con el backend"). - userFilter paren balance: each side resolves to a number with its own ?? 0. The right-hand ?? in the old one-liner was dead code (!== binds before ??), which read as if it guarded a zero-paren filter. - 7 locales: port error says "between 0 and 65535" to match the validator and the backend, where 0 is the default (dialled as 389). - 4 regression tests: bracketed IPv6 accepted, unbracketed rejected, single unclosed paren flagged, zero-paren filter accepted.
… IPv6; fix bind password and name checks
AlexSanchez-bit
deleted the
backlog/identity-provider-form-field-validation
branch
October 6, 2026 18:56
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
feat(v12): validate identity provider form fields before save
The IdP create/edit form only checked presence and the backend only
checked format at login, so a mistyped URL, PEM or port reached a
signing user instead of the admin who typed it.
Add src/features/settings/lib/idp-form-validation.ts (pure, no React)
that returns one i18n key per bad field, and wire it into the
UpsertDialog: per-field red border + aria-invalid + message, and the
save button gated on it.
Rules per protocol:
disabled, so its format must not lock the form out of saving
anything else)
(http/https/urn) on create; certificate and private key must carry
PEM armour; secret required on create, optional on edit
https or an http loopback per RFC 8252 section 7.3; client secret
required on create
1-65535 (0 is the 389 default, not a mistype); userFilter must
contain %s and have balanced parentheses; bind password required
on create
Fix the LDAP port input: it stored Number(e.target.value), so a float
like 389.5 400'd on unmarshal to int. Now Math.trunc(...).
Sources cross-checked: OpenID Connect Core 1.0, RFC 8252 section 7.3,
SAML vendor guides (Cisco IPR, OneStream, Vendasta), and the backend's
own service-bind -> search -> user-bind flow in modules/iam/usecase/idp.go.
41 unit tests in idp-form-validation.test.ts, one per rule.
i18n keys under idp.form.errors.* in en/es/fr/de/it/pt/ru.