252 lines
11 KiB
TypeScript
252 lines
11 KiB
TypeScript
import { z } from 'zod';
|
|
import type { PortfolioContent, PublicAssetManifest, ProductionInputs, SiteConfig } from './types.ts';
|
|
|
|
const canonicalNavigationIds = [
|
|
'start', 'profile', 'experience', 'infrastructure', 'selected-builds', 'additional-work', 'toolkit', 'contact',
|
|
] as const;
|
|
const socialHosts = {
|
|
GitHub: 'github.com',
|
|
GitLab: 'gitlab.com',
|
|
LinkedIn: 'linkedin.com',
|
|
} as const;
|
|
const approvedPrivateProjectTitles = [
|
|
'Private self-hosted medication tracker',
|
|
'Private healthcare platform',
|
|
'Private game prototype',
|
|
] as const;
|
|
|
|
const hasUnpairedSurrogate = (value: string): boolean => {
|
|
for (let index = 0; index < value.length; index += 1) {
|
|
const codeUnit = value.charCodeAt(index);
|
|
if (codeUnit >= 0xd800 && codeUnit <= 0xdbff) {
|
|
const next = value.charCodeAt(index + 1);
|
|
if (next < 0xdc00 || next > 0xdfff) return true;
|
|
index += 1;
|
|
} else if (codeUnit >= 0xdc00 && codeUnit <= 0xdfff) {
|
|
return true;
|
|
}
|
|
}
|
|
return false;
|
|
};
|
|
const hasVisibleCopy = (value: string): boolean =>
|
|
value.trim().length > 0 &&
|
|
value === value.normalize('NFC') &&
|
|
!hasUnpairedSurrogate(value) &&
|
|
!/[\u0000-\u001f\u007f]/u.test(value);
|
|
const visibleString = z.string().refine(hasVisibleCopy, 'Visible copy must be non-empty, well-formed Unicode, NFC-normalized, and control-character free.');
|
|
const opaqueId = z.string().regex(/^[a-z][a-z0-9-]{0,63}$/, 'IDs must be generated safe identifiers.');
|
|
const httpUrl = z.string().refine((value) => {
|
|
if (value !== value.normalize('NFC') || hasUnpairedSurrogate(value) || /[\u0000-\u001f\u007f]/u.test(value)) {
|
|
return false;
|
|
}
|
|
try {
|
|
const url = new URL(value);
|
|
const authority = /^https:\/\/([^/?#]+)/u.exec(value)?.[1];
|
|
return url.protocol === 'https:' &&
|
|
!url.username &&
|
|
!url.password &&
|
|
!url.search &&
|
|
!url.hash &&
|
|
authority !== undefined &&
|
|
!authority.includes(':');
|
|
} catch {
|
|
return false;
|
|
}
|
|
}, 'URL must be an absolute HTTPS URL without credentials, query, or fragment.');
|
|
|
|
const navigationItemSchema = z.object({
|
|
id: z.enum(canonicalNavigationIds),
|
|
label: visibleString,
|
|
}).strict();
|
|
const projectSchema = z.object({
|
|
id: opaqueId,
|
|
title: visibleString,
|
|
visibility: z.enum(['public', 'private']),
|
|
maturity: z.enum(['learning', 'experimental', 'prototype', 'work-in-progress', 'active']),
|
|
summary: visibleString,
|
|
problem: visibleString,
|
|
contribution: visibleString,
|
|
technicalDecisions: z.array(visibleString).min(1),
|
|
outcome: visibleString,
|
|
url: httpUrl.optional(),
|
|
assetIds: z.array(opaqueId),
|
|
}).strict().superRefine((project, context) => {
|
|
if (project.visibility === 'private' && project.url !== undefined) {
|
|
context.addIssue({ code: 'custom', message: 'A private project may not include a url.', path: ['url'] });
|
|
}
|
|
if (project.visibility === 'private' && !approvedPrivateProjectTitles.includes(project.title as (typeof approvedPrivateProjectTitles)[number])) {
|
|
context.addIssue({ code: 'custom', message: 'Private project title must use an approved generic title.', path: ['title'] });
|
|
}
|
|
});
|
|
|
|
const portfolioContentSchema = z.object({
|
|
identity: z.object({
|
|
name: z.literal('Luca Pîslaru'),
|
|
role: z.literal('System Administrator & Full-Stack Developer'),
|
|
valueProposition: visibleString,
|
|
}).strict(),
|
|
navigation: z.array(navigationItemSchema).length(8),
|
|
profile: z.object({
|
|
introduction: visibleString,
|
|
screeningFacts: z.array(z.object({ label: visibleString, value: visibleString }).strict()),
|
|
}).strict(),
|
|
experience: z.array(z.object({
|
|
id: opaqueId,
|
|
role: visibleString,
|
|
organization: visibleString,
|
|
dates: visibleString,
|
|
location: visibleString.optional(),
|
|
highlights: z.array(visibleString).min(2).max(4),
|
|
}).strict()).min(1),
|
|
systemsOperations: z.object({
|
|
id: opaqueId,
|
|
title: z.literal('Professional systems operations'),
|
|
summary: visibleString,
|
|
evidence: z.array(visibleString).min(1),
|
|
}).strict(),
|
|
infrastructure: z.object({
|
|
id: opaqueId,
|
|
title: z.literal('Secure self-hosted platform and lifecycle'),
|
|
summary: visibleString,
|
|
bands: z.array(z.object({ id: opaqueId, title: visibleString, summary: visibleString }).strict()).length(4),
|
|
}).strict(),
|
|
projects: z.object({
|
|
selected: z.array(projectSchema).length(3),
|
|
additional: z.array(projectSchema).min(1),
|
|
}).strict(),
|
|
toolkit: z.array(z.object({
|
|
title: visibleString,
|
|
technologies: z.array(z.object({ name: visibleString, assetId: opaqueId.optional() }).strict()).min(1),
|
|
}).strict()).min(1),
|
|
contact: z.object({
|
|
email: z.email(),
|
|
social: z.array(z.object({
|
|
service: z.enum(['GitHub', 'GitLab', 'LinkedIn']),
|
|
url: httpUrl,
|
|
}).strict()).superRefine((links, context) => {
|
|
for (const [index, link] of links.entries()) {
|
|
const host = new URL(link.url).hostname;
|
|
if (host !== socialHosts[link.service]) {
|
|
context.addIssue({ code: 'custom', message: `Social URL must use the approved ${link.service} host.`, path: [index, 'url'] });
|
|
}
|
|
}
|
|
}),
|
|
cvMessage: visibleString,
|
|
}).strict(),
|
|
metadata: z.object({
|
|
title: visibleString,
|
|
description: visibleString,
|
|
socialPreviewAssetId: opaqueId.optional(),
|
|
}).strict(),
|
|
sceneDescription: visibleString,
|
|
}).strict().superRefine((content, context) => {
|
|
const navigationIds = content.navigation.map((item) => item.id);
|
|
if (new Set(navigationIds).size !== canonicalNavigationIds.length ||
|
|
canonicalNavigationIds.some((id) => !navigationIds.includes(id))) {
|
|
context.addIssue({ code: 'custom', message: 'Navigation must contain each canonical section ID exactly once.', path: ['navigation'] });
|
|
}
|
|
|
|
const projects = [...content.projects.selected, ...content.projects.additional];
|
|
const projectIds = projects.map((project) => project.id);
|
|
if (new Set(projectIds).size !== projectIds.length) {
|
|
context.addIssue({ code: 'custom', message: 'Project IDs must be unique.', path: ['projects'] });
|
|
}
|
|
if (content.projects.selected.filter((project) => project.maturity === 'experimental').length !== 1) {
|
|
context.addIssue({ code: 'custom', message: 'Selected builds must include exactly one supporting experimental research panel.', path: ['projects', 'selected'] });
|
|
}
|
|
const experienceIds = content.experience.map((record) => record.id);
|
|
if (new Set(experienceIds).size !== experienceIds.length) {
|
|
context.addIssue({ code: 'custom', message: 'Experience IDs must be unique.', path: ['experience'] });
|
|
}
|
|
const bandIds = content.infrastructure.bands.map((band) => band.id);
|
|
if (new Set(bandIds).size !== bandIds.length) {
|
|
context.addIssue({ code: 'custom', message: 'Infrastructure band IDs must be unique.', path: ['infrastructure', 'bands'] });
|
|
}
|
|
});
|
|
|
|
const mediaTypes = ['image/avif', 'image/jpeg', 'image/png', 'image/svg+xml', 'image/webp', 'video/mp4', 'video/webm'] as const;
|
|
const fileExtensionByMediaType: Record<(typeof mediaTypes)[number], string> = {
|
|
'image/avif': 'avif',
|
|
'image/jpeg': 'jpg',
|
|
'image/png': 'png',
|
|
'image/svg+xml': 'svg',
|
|
'image/webp': 'webp',
|
|
'video/mp4': 'mp4',
|
|
'video/webm': 'webm',
|
|
};
|
|
const publicAssetSchema = z.object({
|
|
id: opaqueId,
|
|
fileName: z.string().regex(/^[a-z0-9][a-z0-9-]*\.(avif|jpg|png|svg|webp|mp4|webm)$/, 'Asset filenames must be generated safe filenames.'),
|
|
sha256: z.string().regex(/^[a-f0-9]{64}$/, 'Asset sha256 must be lowercase hexadecimal.'),
|
|
mediaType: z.enum(mediaTypes),
|
|
width: z.number().int().positive().nullable(),
|
|
height: z.number().int().positive().nullable(),
|
|
durationMs: z.number().int().positive().nullable(),
|
|
rightsHolder: visibleString,
|
|
license: visibleString,
|
|
attribution: visibleString,
|
|
}).strict().superRefine((asset, context) => {
|
|
if (!asset.fileName.endsWith(`.${fileExtensionByMediaType[asset.mediaType]}`)) {
|
|
context.addIssue({ code: 'custom', message: 'Asset filename extension must match media type.', path: ['fileName'] });
|
|
}
|
|
const image = asset.mediaType.startsWith('image/');
|
|
if (image && (asset.width === null || asset.height === null || asset.durationMs !== null)) {
|
|
context.addIssue({ code: 'custom', message: 'Image assets require dimensions and no duration.', path: ['width'] });
|
|
}
|
|
if (!image && (asset.width === null || asset.height === null || asset.durationMs === null)) {
|
|
context.addIssue({ code: 'custom', message: 'Video assets require dimensions and duration.', path: ['durationMs'] });
|
|
}
|
|
});
|
|
const publicAssetManifestSchema = z.object({ assets: z.array(publicAssetSchema) }).strict().superRefine((manifest, context) => {
|
|
const ids = manifest.assets.map((asset) => asset.id);
|
|
if (new Set(ids).size !== ids.length) {
|
|
context.addIssue({ code: 'custom', message: 'Duplicate asset ID in manifest.', path: ['assets'] });
|
|
}
|
|
const filenames = manifest.assets.map((asset) => asset.fileName);
|
|
if (new Set(filenames).size !== filenames.length || new Set(filenames.map((name) => name.toLocaleLowerCase('en-US'))).size !== filenames.length) {
|
|
context.addIssue({ code: 'custom', message: 'Asset filenames must be unique without case-fold collisions.', path: ['assets'] });
|
|
}
|
|
});
|
|
|
|
const siteConfigSchema = z.object({
|
|
environment: z.enum(['preview', 'production']),
|
|
canonicalUrl: httpUrl,
|
|
buildId: z.string().regex(/^[a-z0-9][a-z0-9._-]{0,127}$/, 'Build ID must be a safe immutable identifier.'),
|
|
}).strict().superRefine((site, context) => {
|
|
if (site.environment === 'preview' && site.canonicalUrl !== 'https://portfolio.localhost/') {
|
|
context.addIssue({ code: 'custom', message: 'Preview canonical URL must be exactly https://portfolio.localhost/.', path: ['canonicalUrl'] });
|
|
}
|
|
if (site.environment === 'production') {
|
|
context.addIssue({ code: 'custom', message: 'Production hostname is not approved.', path: ['canonicalUrl'] });
|
|
}
|
|
});
|
|
|
|
export const parsePortfolioContent = (input: unknown): PortfolioContent => portfolioContentSchema.parse(input) as PortfolioContent;
|
|
export const parsePublicAssetManifest = (input: unknown): PublicAssetManifest => publicAssetManifestSchema.parse(input) as PublicAssetManifest;
|
|
export const parseSiteConfig = (input: unknown): SiteConfig => siteConfigSchema.parse(input) as SiteConfig;
|
|
|
|
export const validateProductionInputs = (
|
|
contentInput: unknown,
|
|
manifestInput: unknown,
|
|
siteInput: unknown,
|
|
_preparedAssetRoot: URL,
|
|
): ProductionInputs => {
|
|
const content = parsePortfolioContent(contentInput);
|
|
const manifest = parsePublicAssetManifest(manifestInput);
|
|
const site = parseSiteConfig(siteInput);
|
|
const manifestIds = new Set(manifest.assets.map((asset) => asset.id));
|
|
const referencedAssetIds = [
|
|
...content.projects.selected.flatMap((project) => project.assetIds),
|
|
...content.projects.additional.flatMap((project) => project.assetIds),
|
|
...content.toolkit.flatMap((group) => group.technologies.flatMap((technology) =>
|
|
technology.assetId === undefined ? [] : [technology.assetId])),
|
|
...(content.metadata.socialPreviewAssetId === undefined ? [] : [content.metadata.socialPreviewAssetId]),
|
|
];
|
|
for (const assetId of referencedAssetIds) {
|
|
if (!manifestIds.has(assetId)) {
|
|
throw new Error(`Unmanifested asset reference: ${assetId}`);
|
|
}
|
|
}
|
|
return { content, manifest, site };
|
|
};
|