Extracted some parts of server side validation from schema into share…

…d space. Changed the schema structure a bit to avoid casting inside validation code. (#87523)

x-pack/plugins/security_solution/common/endpoint/schema/trusted_apps.ts

@@ -6,23 +6,14 @@
 
 import { schema, Type } from '@kbn/config-schema';
 import { ConditionEntry, ConditionEntryField, OperatingSystem } from '../types';
-
-const HASH_LENGTHS: readonly number[] = [
-  32, // MD5
-  40, // SHA1
-  64, // SHA256
-];
-const INVALID_CHARACTERS_PATTERN = /[^0-9a-f]/i;
+import { getDuplicateFields, isValidHash } from '../validation/trusted_apps';
 
 const entryFieldLabels: { [k in ConditionEntryField]: string } = {
   [ConditionEntryField.HASH]: 'Hash',
   [ConditionEntryField.PATH]: 'Path',
   [ConditionEntryField.SIGNER]: 'Signer',
 };
 
-const isValidHash = (value: string) =>
-  HASH_LENGTHS.includes(value.length) && !INVALID_CHARACTERS_PATTERN.test(value);
-
 export const DeleteTrustedAppsRequestSchema = {
   params: schema.object({
     id: schema.string(),
@@ -36,61 +27,58 @@ export const GetTrustedAppsRequestSchema = {
   }),
 };
 
-const createNewTrustedAppForOsScheme = <O extends OperatingSystem, F extends ConditionEntryField>(
+const ConditionEntryTypeSchema = schema.literal('match');
+const ConditionEntryOperatorSchema = schema.literal('included');
+const HashConditionEntrySchema = schema.object({
+  field: schema.literal(ConditionEntryField.HASH),
+  type: ConditionEntryTypeSchema,
+  operator: ConditionEntryOperatorSchema,
+  value: schema.string({
+    validate: (hash) => (isValidHash(hash) ? undefined : `Invalid hash value [${hash}]`),
+  }),
+});
+const PathConditionEntrySchema = schema.object({
+  field: schema.literal(ConditionEntryField.PATH),
+  type: ConditionEntryTypeSchema,
+  operator: ConditionEntryOperatorSchema,
+  value: schema.string({ minLength: 1 }),
+});
+const SignerConditionEntrySchema = schema.object({
+  field: schema.literal(ConditionEntryField.SIGNER),
+  type: ConditionEntryTypeSchema,
+  operator: ConditionEntryOperatorSchema,
+  value: schema.string({ minLength: 1 }),
+});
+
+const createNewTrustedAppForOsScheme = <O extends OperatingSystem, E extends ConditionEntry>(
   osSchema: Type<O>,
-  fieldSchema: Type<F>
+  entriesSchema: Type<E>
 ) =>
   schema.object({
     name: schema.string({ minLength: 1, maxLength: 256 }),
     description: schema.maybe(schema.string({ minLength: 0, maxLength: 256, defaultValue: '' })),
     os: osSchema,
-    entries: schema.arrayOf(
-      schema.object({
-        field: fieldSchema,
-        type: schema.literal('match'),
-        operator: schema.literal('included'),
-        value: schema.string({ minLength: 1 }),
-      }),
-      {
-        minSize: 1,
-        validate(entries) {
-          const usedFields = new Set();
-
-          for (const entry of entries) {
-            // unfortunately combination of generics and Type<...> for "field" causes type errors
-            const { field, value } = entry as ConditionEntry;
-
-            if (usedFields.has(field)) {
-              return `[${entryFieldLabels[field]}] field can only be used once`;
-            }
-
-            usedFields.add(field);
-
-            if (field === ConditionEntryField.HASH && !isValidHash(value)) {
-              return `Invalid hash value [${value}]`;
-            }
-          }
-        },
-      }
-    ),
+    entries: schema.arrayOf(entriesSchema, {
+      minSize: 1,
+      validate(entries) {
+        return (
+          getDuplicateFields(entries)
+            .map((field) => `[${entryFieldLabels[field]}] field can only be used once`)
+            .join(', ') || undefined
+        );
+      },
+    }),
   });
 
 export const PostTrustedAppCreateRequestSchema = {
   body: schema.oneOf([
     createNewTrustedAppForOsScheme(
       schema.oneOf([schema.literal(OperatingSystem.LINUX), schema.literal(OperatingSystem.MAC)]),
-      schema.oneOf([
-        schema.literal(ConditionEntryField.HASH),
-        schema.literal(ConditionEntryField.PATH),
-      ])
+      schema.oneOf([HashConditionEntrySchema, PathConditionEntrySchema])
     ),
     createNewTrustedAppForOsScheme(
       schema.literal(OperatingSystem.WINDOWS),
-      schema.oneOf([
-        schema.literal(ConditionEntryField.HASH),
-        schema.literal(ConditionEntryField.PATH),
-        schema.literal(ConditionEntryField.SIGNER),
-      ])
+      schema.oneOf([HashConditionEntrySchema, PathConditionEntrySchema, SignerConditionEntrySchema])
     ),
   ]),
 };

x-pack/plugins/security_solution/common/endpoint/validation/trusted_apps.ts

@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { ConditionEntry, ConditionEntryField } from '../types';
+
+const HASH_LENGTHS: readonly number[] = [
+  32, // MD5
+  40, // SHA1
+  64, // SHA256
+];
+const INVALID_CHARACTERS_PATTERN = /[^0-9a-f]/i;
+
+export const isValidHash = (value: string) =>
+  HASH_LENGTHS.includes(value.length) && !INVALID_CHARACTERS_PATTERN.test(value);
+
+export const getDuplicateFields = (entries: ConditionEntry[]) => {
+  const groupedFields = new Map<ConditionEntryField, ConditionEntry[]>();
+
+  entries.forEach((entry) => {
+    groupedFields.set(entry.field, [...(groupedFields.get(entry.field) || []), entry]);
+  });
+
+  return [...groupedFields.entries()]
+    .filter((entry) => entry[1].length > 1)
+    .map((entry) => entry[0]);
+};