validators

func IsStringArrayEqual ¶

func IsStringArrayEqual(a, b []string) bool

IsStringArrayEqual validates if string array are equal. This does check if the order is same

func IsValidEmail ¶

func IsValidEmail(email string) bool

IsValidEmail validates email

func IsValidEmailTemplateEventName ¶

func IsValidEmailTemplateEventName(eventName string) bool

IsValidEmailTemplateEventName function to validate email template events

func IsValidOrigin ¶

func IsValidOrigin(inputURL string, allowedOriginsConfig []string) bool

IsValidOrigin validates origin based on ALLOWED_ORIGINS

func IsValidPassword ¶

func IsValidPassword(password string, isStrongPasswordDisabled bool) error

IsValidPassword validates the password against the following policy min char length: 6 max char length: 36 at least one upper case letter at least one lower case letter at least one digit at least one special character

func IsValidRedirectURI ¶

func IsValidRedirectURI(redirectURI string, allowedOrigins []string, hostname string) bool

IsValidRedirectURI validates a redirect URI for security-critical flows (password reset, magic link, OAuth, etc.). Unlike IsValidOrigin (used for CORS), this function never accepts "*" as a blanket pass. When allowed_origins contains only "*" (the default), it restricts redirects to the server's own hostname. When explicit origins are configured, it validates against those using the same matching logic as IsValidOrigin.

func IsValidRoles ¶

func IsValidRoles(userRoles []string, roles []string) bool

IsValidRoles validates roles

func IsValidVerificationIdentifier ¶

func IsValidVerificationIdentifier(identifier string) bool

IsValidVerificationIdentifier validates verification identifier that is used to identify the type of verification request

func IsValidWebhookEventName ¶

func IsValidWebhookEventName(eventName string) bool

IsValidWebhookEventName to validate webhook event name

func SafeHTTPClient ¶

func SafeHTTPClient(ctx context.Context, rawURL string, timeout time.Duration) (*http.Client, error)

SafeHTTPClient parses rawURL, resolves the host once, rejects any private, loopback, or otherwise non-routable IPs, and returns an *http.Client whose Transport.DialContext is pinned to dial the validated IP directly. This defeats SSRF DNS-rebinding TOCTOU because the http stack never re-resolves the hostname between validation and the actual dial. TLS still uses ServerName=host so SNI and certificate validation continue to work.

timeout applies to both the dial and the overall request. If timeout is 0, a default of 30 seconds is used.

func SafeHTTPClientAllowPrivate ¶

func SafeHTTPClientAllowPrivate(ctx context.Context, rawURL string, timeout time.Duration) (*http.Client, error)

SafeHTTPClientAllowPrivate is identical to SafeHTTPClient except it skips the private/loopback/internal-IP rejection. It has exactly two callers, each gated behind Config.Env == constants.E2EEnv (--env=e2e, never true in production): the per-org SSO OIDC broker's discovery/JWKS/token-endpoint fetches (internal/http_handlers/oauth_sso.go's ssoHTTPClient) and webhook delivery (internal/events/events.go's webhookHTTPClient) — both need it because e2e-playground's mock IdP / webhook-sink are only reachable at a docker-compose-private address, which SafeHTTPClient would otherwise refuse unconditionally. Every other invariant (scheme allow-list, DNS-rebinding-proof host pinning, TLS SNI) is unchanged. Do not add a third caller without equally careful review.

func ValidateEndpointURL ¶

func ValidateEndpointURL(endpoint string, allowPrivate bool) error

ValidateEndpointURL checks the webhook endpoint URL for SSRF at registration time. Rejects non-http(s) schemes and missing hosts always; rejects private/loopback/link-local IPs unless allowPrivate is set. allowPrivate (Config.Env == constants.E2EEnv) is the registration-time counterpart to the delivery-time SafeHTTPClientAllowPrivate escape hatch: it exists solely so e2e-playground can register a webhook pointing at its docker-private webhook-sink mock. The scheme allow-list stays enforced either way. Must remain off (allowPrivate=false) in production - never true unless --env=e2e.