[pmg-devel] [PATCH widget-toolkit 2/2] window: AuthEditOpenId: add validation for required fields

[Stoiko Ivanov]

On Tue, 18 Mar 2025 14:59:18 +0100
Christoph Heiss <c.heiss at proxmox.com> wrote:

> For the `client-id` and `client-secret` OIDC-specific fields, allow the
> format specified in RFC 6749, Appendix A [0].
> 
> As per that, the OIDC-specific `client-id` and `client-key` can contain
> any printable ascii character, i.e. anything in the (inclusive) range
> 0x20-0x7E.
> 
> For the issuer URL, use our existing URL validation regex, while the
> realm name itself must follow authentication realm naming scheme.
> 
> [0] https://www.rfc-editor.org/rfc/rfc6749#appendix-A
> 
> Signed-off-by: Christoph Heiss <c.heiss at proxmox.com>

not a maintainer for widget-toolkit - but from looking through the RFC
consider this:
Reviewed-by: Stoiko Ivanov <s.ivanov at proxmox.com>

> ---
>  src/Utils.js                 | 4 ++++
>  src/window/AuthEditOpenId.js | 8 ++++++++
>  2 files changed, 12 insertions(+)
> 
> diff --git a/src/Utils.js b/src/Utils.js
> index c873c85..e17bee8 100644
> --- a/src/Utils.js
> +++ b/src/Utils.js
> @@ -1545,6 +1545,10 @@ utilities: {
>  
>  	// Same as SAFE_ID_REGEX in proxmox-schema
>  	me.safeIdRegex = /^(?:[A-Za-z0-9_][A-Za-z0-9._\\-]*)$/;
> +
> +	me.printableAsciiRegex = /^[\x20-\x7E]+$/;
> +
> +	me.authRealmNameRegex = /^[A-Za-z][A-Za-z0-9.\-_]+$/;
>      },
>  });
>  
> diff --git a/src/window/AuthEditOpenId.js b/src/window/AuthEditOpenId.js
> index ed0a6dc..5939516 100644
> --- a/src/window/AuthEditOpenId.js
> +++ b/src/window/AuthEditOpenId.js
> @@ -23,6 +23,8 @@ Ext.define('Proxmox.panel.OpenIDInputPanel', {
>  	    name: 'issuer-url',
>  	    fieldLabel: gettext('Issuer URL'),
>  	    allowBlank: false,
> +	    regex: Proxmox.Utils.httpUrlRegex,
> +	    regexText: gettext('Must be a valid URL'),
>  	},
>      ],
>  
> @@ -36,6 +38,8 @@ Ext.define('Proxmox.panel.OpenIDInputPanel', {
>  	    },
>  	    fieldLabel: gettext('Realm'),
>  	    allowBlank: false,
> +	    regex: Proxmox.Utils.authRealmNameRegex,
> +	    regexText: gettext('Must be a valid realm name'),
>  	},
>  	{
>  	    xtype: 'proxmoxcheckbox',
> @@ -57,6 +61,8 @@ Ext.define('Proxmox.panel.OpenIDInputPanel', {
>  	    fieldLabel: gettext('Client ID'),
>  	    name: 'client-id',
>  	    allowBlank: false,
> +	    regex: Proxmox.Utils.printableAsciiRegex, // RFC 6749, Appendix A
> +	    regexText: gettext('Must be a valid OIDC Client ID'),
>  	},
>  	{
>  	    xtype: 'proxmoxtextfield',
> @@ -65,6 +71,8 @@ Ext.define('Proxmox.panel.OpenIDInputPanel', {
>  		deleteEmpty: '{!isCreate}',
>  	    },
>  	    name: 'client-key',
> +	    regex: Proxmox.Utils.printableAsciiRegex, // RFC 6749, Appendix A
> +	    regexText: gettext('Must be a valid OIDC Client Secret'),
>  	},
>      ],
>