fields.go

package publiccode

import (
	"fmt"
	"net/url"
	"regexp"
	"strings"

	"github.com/alranel/go-vcsurl/v2"
	urlutil "github.com/publiccodeyml/libpubliccode/v5/internal"
)

// RFC 3986 scheme = ALPHA *( ALPHA / DIGIT / "+" / "-" / "." ).
var urlSchemeRegexp = regexp.MustCompile(`^([A-Za-z][A-Za-z0-9+.-]*):`)

type validateFn func(publiccode PublicCode, parser *Parser, network bool, baseURL *url.URL) error

// validateFieldsV0 validates publiccode.yml with additional rules not validatable
// with go-playground/validator
// It returns any error encountered as ValidationResults.
func validateFieldsV0(publiccode PublicCode, parser *Parser, network bool, baseURL *url.URL) error { //nolint:maintidx
	publiccodev0, ok := publiccode.(*PublicCodeV0)
	if !ok {
		return fmt.Errorf("internal: expected *PublicCodeV0, got %T", publiccode) //nolint:err113 // dynamic type name
	}

	var vr ValidationResults

	checksNetwork := network && !parser.disableExternalChecks

	if checksNetwork && publiccodev0.URL != nil {
		if reachable, err := parser.isReachable(*(*url.URL)(publiccodev0.URL)); !reachable {
			vr = append(vr, newValidationErrorf("url", "'%s' not reachable: %s", publiccodev0.URL, err.Error()))
		}

		if !vcsurl.IsRepo((*url.URL)(publiccodev0.URL)) {
			vr = append(vr, newValidationError("url", "is not a valid code repository"))
		}
	}

	if checksNetwork && publiccodev0.LandingURL != nil {
		if reachable, err := parser.isReachable(*(*url.URL)(publiccodev0.LandingURL)); !reachable {
			vr = append(vr, newValidationErrorf(
				"landingURL",
				"'%s' not reachable: %s", publiccodev0.LandingURL, err.Error(),
			))
		}
	}

	if checksNetwork && publiccodev0.Roadmap != nil {
		if reachable, err := parser.isReachable(*(*url.URL)(publiccodev0.Roadmap)); !reachable {
			vr = append(vr, newValidationErrorf(
				"roadmap",
				"'%s' not reachable: %s", publiccodev0.Roadmap, err.Error(),
			))
		}
	}

	if publiccodev0.Logo != nil && *publiccodev0.Logo != "" {
		if _, err := isRelativePathOrURL(*publiccodev0.Logo, "logo"); err != nil {
			vr = append(vr, err)
		} else if !parser.disableExternalChecks {
			u := toAbsoluteURL(*publiccodev0.Logo, baseURL, network)
			if u != nil {
				validLogo, err := parser.validLogo(*u, network)
				if !validLogo {
					vr = append(vr, newValidationError("logo", err.Error()))
				}
			}
		}
	}

	if publiccodev0.MonochromeLogo != nil && *publiccodev0.MonochromeLogo != "" {
		vr = append(vr, newValidationWarning(
			"monochromeLogo",
			"This key is DEPRECATED and will be removed in the future. Use 'logo' instead",
		))

		if _, err := isRelativePathOrURL(*publiccodev0.MonochromeLogo, "monochromeLogo"); err != nil {
			vr = append(vr, err)
		} else if !parser.disableExternalChecks {
			u := toAbsoluteURL(*publiccodev0.MonochromeLogo, baseURL, network)
			if u != nil {
				validLogo, err := parser.validLogo(*u, network)
				if !validLogo {
					vr = append(vr, newValidationError("monochromeLogo", err.Error()))
				}
			}
		}
	}

	if publiccodev0.IntendedAudience != nil {
		// This is not ideal, but we need to revalidate the countries
		// here, because otherwise we could get a warning and the advice
		// to use uppercase on an invalid country.
		if publiccodev0.IntendedAudience.Countries != nil {
			for i, c := range *publiccodev0.IntendedAudience.Countries {
				if sharedValidate.Var(c, "iso3166_1_alpha2_lower_or_upper") == nil && c == strings.ToLower(c) {
					vr = append(vr, newValidationWarningf(
						fmt.Sprintf("intendedAudience.countries[%d]", i),
						"Lowercase country codes are DEPRECATED. Use uppercase instead ('%s')", strings.ToUpper(c),
					))
				}
			}
		}

		if publiccodev0.IntendedAudience.Scope != nil {
			for i, scope := range *publiccodev0.IntendedAudience.Scope {
				if scope == "government" {
					vr = append(vr, newValidationWarning(
						fmt.Sprintf("intendedAudience.scope[%d]", i),
						"The 'government' scope is DEPRECATED and will be removed in the future. It's safe to drop it",
					))
				}
			}
		}

		if publiccodev0.IntendedAudience.UnsupportedCountries != nil {
			vr = append(vr, newValidationWarning(
				"intendedAudience.unsupportedCountries",
				"This key is DEPRECATED and will be removed in the future. "+
					"Use 'intendedAudience.countries' to list the targeted countries instead",
			))

			for i, c := range *publiccodev0.IntendedAudience.UnsupportedCountries {
				if sharedValidate.Var(c, "iso3166_1_alpha2_lower_or_upper") == nil && c == strings.ToLower(c) {
					vr = append(vr, newValidationWarningf(
						fmt.Sprintf("intendedAudience.unsupportedCountries[%d]", i),
						"Lowercase country codes are DEPRECATED. Use uppercase instead ('%s')", strings.ToUpper(c),
					))
				}
			}
		}
	}

	if publiccodev0.Maintenance.Contacts != nil {
		for i, contact := range *publiccodev0.Maintenance.Contacts {
			if contact.Phone == nil || *contact.Phone == "" {
				continue
			}

			if sharedValidate.Var(*contact.Phone, "e164") != nil {
				vr = append(vr, newValidationWarning(
					fmt.Sprintf("maintenance.contacts[%d].phone", i),
					"Phone numbers SHOULD use the E.164 format, e.g. '+3923113215112'",
				))
			}
		}
	}

	if publiccodev0.Legal.AuthorsFile != nil {
		vr = append(vr, newValidationWarning(
			"legal.authorsFile",
			"This key is DEPRECATED and will be removed in the future. It's safe to drop it",
		))

		if _, err := isRelativePathOrURL(*publiccodev0.Legal.AuthorsFile, "legal.authorsFile"); err != nil {
			vr = append(vr, err)
		} else if !parser.disableExternalChecks {
			u := toAbsoluteURL(*publiccodev0.Legal.AuthorsFile, baseURL, network)
			if u != nil {
				exists, err := parser.fileExists(*u, network)
				if !exists {
					vr = append(vr, newValidationErrorf(
						"legal.authorsFile", "'%s' does not exist: %s", urlutil.DisplayURL(u), err.Error(),
					))
				}
			}
		}
	}

	if publiccodev0.Legal.RepoOwner != nil {
		vr = append(vr, newValidationWarning(
			"legal.repoOwner",
			"This key is DEPRECATED and will be removed in the future. Use 'organisation.name' instead",
		))
	}

	if publiccodev0.InputTypes != nil {
		vr = append(vr, newValidationWarning(
			"inputTypes",
			"This key is DEPRECATED and will be removed in the future. It's safe to drop it",
		))
	}

	if publiccodev0.DependsOn != nil && publiccodev0.DependsOn.Open != nil {
		vr = append(vr, newValidationWarning(
			"dependsOn.open",
			"This key is DEPRECATED and will be removed in the future. It's safe to drop it",
		))
	}

	if publiccodev0.UsedBy != nil {
		vr = append(vr, newValidationWarning(
			"usedBy",
			"This key is DEPRECATED and will be removed in the future. It's safe to drop it",
		))
	}

	if publiccodev0.OutputTypes != nil {
		vr = append(vr, newValidationWarning(
			"outputTypes",
			"This key is DEPRECATED and will be removed in the future. It's safe to drop it",
		))
	}

	for lang, desc := range publiccodev0.Description {
		if len(desc.GenericName) > 0 {
			vr = append(vr, newValidationWarning(
				fmt.Sprintf("description.%s.genericName", lang),
				"This key is DEPRECATED and will be removed in the future. It's safe to drop it",
			))
		}

		if checksNetwork && desc.Documentation != nil {
			if reachable, err := parser.isReachable(*(*url.URL)(desc.Documentation)); !reachable {
				vr = append(vr, newValidationErrorf(
					fmt.Sprintf("description.%s.documentation", lang),
					"'%s' not reachable: %s", desc.Documentation, err.Error(),
				))
			}
		}

		if checksNetwork && desc.APIDocumentation != nil {
			if reachable, err := parser.isReachable(*(*url.URL)(desc.APIDocumentation)); !reachable {
				vr = append(vr, newValidationErrorf(
					fmt.Sprintf("description.%s.apiDocumentation", lang),
					"'%s' not reachable: %s", desc.APIDocumentation, err.Error(),
				))
			}
		}

		for i, v := range desc.Screenshots {
			keyName := fmt.Sprintf("description.%s.screenshots[%d]", lang, i)
			if _, err := isRelativePathOrURL(v, keyName); err != nil {
				vr = append(vr, err)
			} else if !parser.disableExternalChecks {
				u := toAbsoluteURL(v, baseURL, network)
				if u != nil {
					isImage, err := parser.isImageFile(*u, network)
					if !isImage {
						vr = append(vr, newValidationErrorf(
							keyName,
							"'%s' is not an image: %s", v, err.Error(),
						))
					}
				}
			}
		}

		if len(desc.Videos) > 0 {
			vr = append(vr, newValidationWarning(
				fmt.Sprintf("description.%s.videos", lang),
				"This key is DEPRECATED and will be removed in the future. "+
					"Link videos from the documentation or the website instead",
			))
		}

		for i, v := range desc.Videos {
			err := parser.checkOEmbedURL((*url.URL)(v))
			if err != nil {
				vr = append(vr, newValidationErrorf(
					fmt.Sprintf("description.%s.videos[%d]", lang, i),
					"'%s' is not a valid video URL supporting oEmbed: %s", v, err.Error(),
				))
			}
		}
	}

	it := publiccodev0.IT

	if publiccodev0.It != nil {
		vr = append(vr, newValidationWarning(
			"it",
			"Lowercase country codes are DEPRECATED and will be removed in the future. Use 'IT' instead",
		))

		it = publiccodev0.It
	}

	if publiccodev0.IT != nil && publiccodev0.It != nil {
		vr = append(vr, newValidationError("it", "'IT' key already present. Remove this key"))

		it = publiccodev0.IT
	}

	if it != nil {
		if it.Conforme != nil {
			vr = append(vr, newValidationWarning(
				"IT.conforme",
				"This key is DEPRECATED and will be removed in the future. It's safe to drop it",
			))
		}

		if it.Riuso.CodiceIPA != "" {
			if sharedValidate.Var(it.Riuso.CodiceIPA, "is_italian_ipa_code") == nil {
				vr = append(vr, newValidationWarningf(
					"IT.riuso.codiceIPA",
					"This key is DEPRECATED and will be removed in the future. "+
						"Use 'organisation.uri' and set it to 'urn:x-italian-pa:%s' instead",
					it.Riuso.CodiceIPA,
				))
			}
		}
	}

	if len(vr) == 0 {
		return nil
	}

	return vr
}

// validateFieldsV1 validates publiccode.yml with additional rules not validatable
// with go-playground/validator
// It returns any error encountered as ValidationResults.
func validateFieldsV1(publiccode PublicCode, parser *Parser, network bool, baseURL *url.URL) error {
	publiccodev1, ok := publiccode.(*PublicCodeV1)
	if !ok {
		return fmt.Errorf("internal: expected *PublicCodeV1, got %T", publiccode) //nolint:err113 // dynamic type name
	}

	var vr ValidationResults

	checksNetwork := network && !parser.disableExternalChecks

	if checksNetwork && publiccodev1.URL != nil {
		if reachable, err := parser.isReachable(*(*url.URL)(publiccodev1.URL)); !reachable {
			vr = append(vr, newValidationErrorf("url", "'%s' not reachable: %s", publiccodev1.URL, err.Error()))
		}

		if !vcsurl.IsRepo((*url.URL)(publiccodev1.URL)) {
			vr = append(vr, newValidationError("url", "is not a valid code repository"))
		}
	}

	if checksNetwork && publiccodev1.LandingURL != nil {
		if reachable, err := parser.isReachable(*(*url.URL)(publiccodev1.LandingURL)); !reachable {
			vr = append(vr, newValidationErrorf(
				"landingURL",
				"'%s' not reachable: %s", publiccodev1.LandingURL, err.Error(),
			))
		}
	}

	if checksNetwork && publiccodev1.Roadmap != nil {
		if reachable, err := parser.isReachable(*(*url.URL)(publiccodev1.Roadmap)); !reachable {
			vr = append(vr, newValidationErrorf(
				"roadmap",
				"'%s' not reachable: %s", publiccodev1.Roadmap, err.Error(),
			))
		}
	}

	if publiccodev1.Logo != nil && *publiccodev1.Logo != "" {
		if _, err := isRelativePathOrURL(*publiccodev1.Logo, "logo"); err != nil {
			vr = append(vr, err)
		} else if !parser.disableExternalChecks {
			u := toAbsoluteURL(*publiccodev1.Logo, baseURL, network)
			if u != nil {
				validLogo, err := parser.validLogo(*u, network)
				if !validLogo {
					vr = append(vr, newValidationError("logo", err.Error()))
				}
			}
		}
	}

	if publiccodev1.IntendedAudience != nil {
		// This is not ideal, but we need to revalidate the countries
		// here, because otherwise we could get a warning and the advice
		// to use uppercase on an invalid country.
		if publiccodev1.IntendedAudience.Countries != nil {
			for i, c := range *publiccodev1.IntendedAudience.Countries {
				if sharedValidate.Var(c, "iso3166_1_alpha2_lower_or_upper") == nil && c == strings.ToLower(c) {
					vr = append(vr, newValidationWarningf(
						fmt.Sprintf("intendedAudience.countries[%d]", i),
						"Lowercase country codes are DEPRECATED. Use uppercase instead ('%s')", strings.ToUpper(c),
					))
				}
			}
		}

		if publiccodev1.IntendedAudience.UnsupportedCountries != nil {
			for i, c := range *publiccodev1.IntendedAudience.UnsupportedCountries {
				if sharedValidate.Var(c, "iso3166_1_alpha2_lower_or_upper") == nil && c == strings.ToLower(c) {
					vr = append(vr, newValidationWarningf(
						fmt.Sprintf("intendedAudience.unsupportedCountries[%d]", i),
						"Lowercase country codes are DEPRECATED. Use uppercase instead ('%s')", strings.ToUpper(c),
					))
				}
			}
		}
	}

	for lang, desc := range publiccodev1.Description {
		if checksNetwork && desc.Documentation != nil {
			if reachable, err := parser.isReachable(*(*url.URL)(desc.Documentation)); !reachable {
				vr = append(vr, newValidationErrorf(
					fmt.Sprintf("description.%s.documentation", lang),
					"'%s' not reachable: %s", desc.Documentation, err.Error(),
				))
			}
		}

		if checksNetwork && desc.APIDocumentation != nil {
			if reachable, err := parser.isReachable(*(*url.URL)(desc.APIDocumentation)); !reachable {
				vr = append(vr, newValidationErrorf(
					fmt.Sprintf("description.%s.apiDocumentation", lang),
					"'%s' not reachable: %s", desc.APIDocumentation, err.Error(),
				))
			}
		}

		for i, v := range desc.Screenshots {
			keyName := fmt.Sprintf("description.%s.screenshots[%d]", lang, i)
			if _, err := isRelativePathOrURL(v, keyName); err != nil {
				vr = append(vr, err)
			} else if !parser.disableExternalChecks {
				u := toAbsoluteURL(v, baseURL, network)
				if u != nil {
					isImage, err := parser.isImageFile(*u, network)
					if !isImage {
						vr = append(vr, newValidationErrorf(
							keyName,
							"'%s' is not an image: %s", v, err.Error(),
						))
					}
				}
			}
		}

		for i, v := range desc.Videos {
			err := parser.checkOEmbedURL((*url.URL)(v))
			if err != nil {
				vr = append(vr, newValidationErrorf(
					fmt.Sprintf("description.%s.videos[%d]", lang, i),
					"'%s' is not a valid video URL supporting oEmbed: %s", v, err.Error(),
				))
			}
		}
	}

	if len(vr) == 0 {
		return nil
	}

	return vr
}

// isRelativePathOrURL checks whether the field contains either a relative filename
// or an HTTP URL
//
//nolint:unparam
func isRelativePathOrURL(content string, keyName string) (bool, error) {
	if strings.HasPrefix(content, "/") {
		return false, newValidationError(keyName, "is an absolute path. Only relative paths or HTTP(s) URLs allowed")
	}

	// Not url.Parse: it fails on values like "file:///%zz", which would then
	// pass as relative paths. URL schemes are case-insensitive (RFC 3986).
	if m := urlSchemeRegexp.FindStringSubmatch(content); m != nil {
		switch scheme := strings.ToLower(m[1]); scheme {
		case "http", "https":
			return true, nil
		case "file":
			return false, newValidationError(keyName, "is a file:// URL. Only relative paths or HTTP(s) URLs allowed")
		default:
			return false, newValidationErrorf(
				keyName, "has an unsupported URL scheme '%s'. Only relative paths or HTTP(s) URLs allowed", scheme,
			)
		}
	}

	return true, nil
}