Merge pull request #728 from Penielka/fix/penielka-issues-615-course-dto-validation

fix(backend): enforce course DTO validation and canonical taxonomy (BA-047)

Author: Nabeelahh

BackendAcademy/src/courses/course.service.spec.ts

@@ -381,6 +381,84 @@ describe('CourseService', () => {
   });
 
   // ---------------------------------------------------------------------------
+  // ---------------------------------------------------------------------------
+  // Taxonomy normalization (BA-047)
+  // ---------------------------------------------------------------------------
+
+  it('normalizes free-text fields on create', async () => {
+    const course = await service.create({
+      title: '  Rust   Basics  ',
+      description: '  An intro to Rust.  ',
+      level: 'INTERMEDIATE' as CourseLevel,
+      order: 1,
+      learningPathId: 'path-1',
+      duration: 30,
+    });
+
+    expect(course.title).toBe('Rust Basics');
+    expect(course.description).toBe('An intro to Rust.');
+    expect(course.level).toBe(CourseLevel.INTERMEDIATE);
+    expect(course.slug).toBe('rust-basics');
+  });
+
+  it('canonicalizes taxonomy arrays (trim, lowercase, dedupe, drop blanks) on create', async () => {
+    const course = await service.create({
+      title: 'Rust Basics',
+      description: 'An intro',
+      level: CourseLevel.BEGINNER,
+      order: 1,
+      learningPathId: 'path-1',
+      duration: 30,
+      category: 'WASM',
+      categories: ['WASM', '  Rust ', 'Rust', '  '],
+      tags: [' Ownership ', 'ownership'],
+      prerequisites: ['  borrowed ', 'lifetimes'],
+      skills: ['Memory Safety', 'memory safety'],
+    });
+
+    expect(course.category).toBe('wasm');
+    expect(course.categories).toEqual(['wasm', 'rust']);
+    expect(course.tags).toEqual(['ownership']);
+    expect(course.prerequisites).toEqual(['borrowed', 'lifetimes']);
+    expect(course.skills).toEqual(['memory safety']);
+  });
+
+  it('normalizes taxonomy fields on update only when provided', async () => {
+    const course = await service.create({
+      title: 'Rust Basics',
+      description: 'An intro',
+      level: CourseLevel.BEGINNER,
+      order: 1,
+      learningPathId: 'path-1',
+      duration: 30,
+      tags: [' original '],
+      prerequisites: ['stay'],
+    });
+
+    const updated = await service.update(course.id, { skills: [' WASM ', 'wasm'] });
+
+    // Fields that were not part of the update payload must be untouched.
+    expect(updated!.tags).toEqual(['original']);
+    expect(updated!.prerequisites).toEqual(['stay']);
+    // Provided taxonomy is canonicalized.
+    expect(updated!.skills).toEqual(['wasm']);
+  });
+
+  it('keeps the canonical title bound reflected in the persisted slug on update', async () => {
+    const course = await service.create({
+      title: 'Rust Basics',
+      description: 'An intro',
+      level: CourseLevel.BEGINNER,
+      order: 1,
+      learningPathId: 'path-1',
+      duration: 30,
+    });
+
+    const updated = await service.update(course.id, { title: ' Rust   Advanced ' });
+    expect(updated!.title).toBe('Rust Advanced');
+    expect(updated!.slug).toBe('rust-advanced');
+  });
+
   // Revision lookup
   // ---------------------------------------------------------------------------
 

BackendAcademy/src/courses/course.service.ts

@@ -2,6 +2,7 @@ import { Injectable, Logger, NotFoundException, Optional, ConflictException } fr
 import { InjectRepository } from '@nestjs/typeorm';
 import { Repository } from 'typeorm';
 import { CourseEntity } from './course.entity';
+import { CourseLevel } from './interfaces/course-level.enum';
 import {
   CourseRevisionEntity,
   CourseRevisionReason,
@@ -71,12 +72,14 @@ export class CourseService {
    * observe a course without an audit trail entry.
    */
   async create(dto: CreateCourseDto): Promise<CourseEntity> {
-    const slug = await this.createUniqueSlug(dto.title);
+    // BA-047: bound + canonicalize taxonomy before anything is persisted.
+    const normalized = this.normalizeCourseInput(dto);
+    const slug = await this.createUniqueSlug(normalized.title ?? dto.title);
     const course = this.courseRepo.create({
       id: crypto.randomUUID(),
       version: CourseService.INITIAL_VERSION,
       slug,
-      ...dto,
+      ...normalized,
     });
 
     const txResult = await this.transactionManager.runAtomic(async (tx) => {
@@ -128,14 +131,17 @@ export class CourseService {
     const course = await this.courseRepo.findOne({ where: { id } });
     if (!course) return null;
 
+    // BA-047: bound + canonicalize taxonomy so only canonical values persist.
+    const normalized = this.normalizeCourseInput(dto);
+
     const previousVersion = course.version;
     course.version = previousVersion + 1;
     course.updatedAt = new Date();
-    Object.assign(course, dto);
-    if (dto.title !== undefined) {
-      course.slug = await this.createUniqueSlug(dto.title, course.id);
+    Object.assign(course, normalized);
+    if (normalized.title !== undefined) {
+      course.slug = await this.createUniqueSlug(normalized.title, course.id);
     }
-    this.syncCourseTaxonomy(course, dto);
+    this.syncCourseTaxonomy(course, normalized);
     const saved = await this.courseRepo.save(course);
 
     // #449: Rollback the course update if the revision append fails
@@ -524,6 +530,92 @@ export class CourseService {
     }
   }
 
+  /**
+   * BA-047: Canonicalize course taxonomy input so that only bounded,
+   * normalized values reach persistence.
+   *
+   * - Free-text fields (title, description, category) are trimmed and
+   *   inner whitespace is collapsed.
+   * - The enum level is lower-cased to its canonical `CourseLevel` value.
+   * - Taxonomy arrays (categories, tags, prerequisites, skills) are
+   *   trimmed, lower-cased, de-duplicated, and have blank items removed.
+   */
+  private normalizeCourseInput<T extends Partial<CreateCourseDto>>(
+    input: T,
+  ): Partial<CourseEntity> {
+    const normalized: Partial<CourseEntity> = { ...input } as Partial<
+      CourseEntity
+    >;
+
+    if (typeof normalized.title === 'string') {
+      normalized.title = this.collapseWhitespace(normalized.title);
+    }
+    if (typeof normalized.description === 'string') {
+      normalized.description = normalized.description.trim();
+    }
+    if (typeof normalized.category === 'string') {
+      normalized.category = this.normalizeTaxonomyItem(normalized.category);
+    }
+    if (typeof normalized.level === 'string') {
+      normalized.level = this.canonicalizeLevel(normalized.level);
+    }
+
+    // Only normalize taxonomy arrays that were actually provided, so an
+    // absent field on update never overwrites already-persisted values with
+    // an empty/undefined array.
+    if (Array.isArray(input.categories)) {
+      normalized.categories = this.normalizeTaxonomy(input.categories);
+    }
+    if (Array.isArray(input.tags)) {
+      normalized.tags = this.normalizeTaxonomy(input.tags);
+    }
+    if (Array.isArray(input.prerequisites)) {
+      normalized.prerequisites = this.normalizeTaxonomy(input.prerequisites);
+    }
+    if (Array.isArray(input.skills)) {
+      normalized.skills = this.normalizeTaxonomy(input.skills);
+    }
+
+    return normalized;
+  }
+
+  private collapseWhitespace(value: string): string {
+    return value.trim().replace(/\s+/g, ' ');
+  }
+
+  private normalizeTaxonomyItem(value: string): string {
+    return value
+      .trim()
+      .toLowerCase()
+      .replace(/\s+/g, ' ');
+  }
+
+  private normalizeTaxonomy(values: string[]): string[] {
+    const seen = new Set<string>();
+    const result: string[] = [];
+    for (const raw of values) {
+      const item = this.normalizeTaxonomyItem(raw ?? '');
+      if (item && !seen.has(item)) {
+        seen.add(item);
+        result.push(item);
+      }
+    }
+    return result;
+  }
+
+  private canonicalizeLevel(level: string): CourseLevel {
+    const canonical = level.trim().toLowerCase();
+    if (
+      canonical === CourseLevel.BEGINNER ||
+      canonical === CourseLevel.INTERMEDIATE ||
+      canonical === CourseLevel.ADVANCED ||
+      canonical === CourseLevel.WEB3
+    ) {
+      return canonical as CourseLevel;
+    }
+    return level as CourseLevel;
+  }
+
   private async createUniqueSlug(title: string, excludeId?: string): Promise<string> {
     const baseSlug = this.normalizeSlug(title);
     let slug = baseSlug;

BackendAcademy/src/courses/dto/course-dto.spec.ts

@@ -0,0 +1,99 @@
+import { validate } from 'class-validator';
+import { CreateCourseDto } from './create-course.dto';
+import { UpdateCourseDto } from './update-course.dto';
+import { CourseLevel } from '../interfaces/course-level.enum';
+
+describe('CreateCourseDto validation (BA-047)', () => {
+  const valid = () => {
+    const dto = new CreateCourseDto();
+    Object.assign(dto, {
+      title: 'Rust Basics',
+      description: 'An intro to Rust.',
+      level: CourseLevel.BEGINNER,
+      order: 1,
+      learningPathId: 'path-1',
+      duration: 60,
+      category: 'blockchain',
+      categories: ['blockchain'],
+      tags: ['ownership'],
+      prerequisites: ['borrowing'],
+      skills: ['memory-safety'],
+    });
+    return dto;
+  };
+
+  it('accepts a valid payload', async () => {
+    expect(await validate(valid())).toEqual([]);
+  });
+
+  it('rejects a title that is too short', async () => {
+    const dto = valid();
+    dto.title = 'Ru';
+    const errors = await validate(dto);
+    expect(errors.some((e) => e.property === 'title')).toBe(true);
+  });
+
+  it('rejects an over-long title', async () => {
+    const dto = valid();
+    dto.title = 'x'.repeat(121);
+    const errors = await validate(dto);
+    expect(errors.some((e) => e.property === 'title')).toBe(true);
+  });
+
+  it('rejects a blank required field', async () => {
+    const dto = valid();
+    dto.description = '';
+    const errors = await validate(dto);
+    expect(errors.some((e) => e.property === 'description')).toBe(true);
+  });
+
+  it('rejects an out-of-enum level', async () => {
+    const dto = valid();
+    dto.level = 'extreme' as CourseLevel;
+    const errors = await validate(dto);
+    expect(errors.some((e) => e.property === 'level')).toBe(true);
+  });
+
+  it('rejects blank taxonomy items in skills', async () => {
+    const dto = valid();
+    dto.skills = [''];
+    const errors = await validate(dto);
+    expect(errors.some((e) => e.property === 'skills')).toBe(true);
+  });
+
+  it('rejects an over-long taxonomy item in tags', async () => {
+    const dto = valid();
+    dto.tags = ['x'.repeat(61)];
+    const errors = await validate(dto);
+    expect(errors.some((e) => e.property === 'tags')).toBe(true);
+  });
+
+  it('rejects taxonomy arrays that exceed the max item count', async () => {
+    const dto = valid();
+    dto.skills = Array.from({ length: 21 }, (_, i) => `skill-${i}`);
+    const errors = await validate(dto);
+    expect(errors.some((e) => e.property === 'skills')).toBe(true);
+  });
+});
+
+describe('UpdateCourseDto validation (BA-047)', () => {
+  it('accepts a valid partial payload', async () => {
+    const dto = new UpdateCourseDto();
+    Object.assign(dto, { title: 'Rust Basics', skills: ['mem'] });
+    expect(await validate(dto)).toEqual([]);
+  });
+
+  it('rejects a title that is too short on update', async () => {
+    const dto = new UpdateCourseDto();
+    Object.assign(dto, { title: 'Ru' });
+    const errors = await validate(dto);
+    expect(errors.some((e) => e.property === 'title')).toBe(true);
+  });
+
+  it('rejects an over-long taxonomy item in categories on update', async () => {
+    const dto = new UpdateCourseDto();
+    Object.assign(dto, { categories: ['c'.repeat(61)] });
+    const errors = await validate(dto);
+    expect(errors.some((e) => e.property === 'categories')).toBe(true);
+  });
+});