Restrict values to known settings

To avoid accidental typos and misuse in the user input

Author: sldblog

lib/canvas/validators/schema_attributes/product.rb

@@ -7,6 +7,7 @@ class SchemaAttribute
       # Attribute validations specific to product-type variables.
       class Product < Base
         ALLOWED_DEFAULT_VALUES = %w[random].freeze
+        ALLOWED_RESTRICTIONS = %w[experiences accommodations extras].freeze
 
         def validate
           super &&
@@ -43,10 +44,16 @@ def ensure_only_values_are_valid
 
           if attribute["only"].empty?
             @errors << %["only" cannot be empty]
-            false
-          else
-            true
+            return false
           end
+
+          usupported_entries = attribute["only"] - ALLOWED_RESTRICTIONS
+          if usupported_entries.any?
+            @errors << %["only" contains unsupported entries: #{usupported_entries}]
+            return false
+          end
+
+          true
         end
 
         def default_value_is_valid?(value)

spec/lib/canvas/validators/schema_attributes/product_spec.rb

@@ -26,10 +26,11 @@
 
       context "when `only` is provided" do
         it "is valid when using an array" do
+          all_allowed_values = %w[experiences accommodations extras]
           validator = described_class.new({
             "name" => "my_product",
             "type" => "product",
-            "only" => ["Experience", "Product"],
+            "only" => all_allowed_values,
           })
           expect(validator.validate).to eq(true)
         end
@@ -44,6 +45,16 @@
           expect(validator.errors).to include(%["only" cannot be empty])
         end
 
+        it "is invalid when using unsupported option" do
+          validator = described_class.new({
+            "name" => "my_product",
+            "type" => "product",
+            "only" => ["unsupported"],
+          })
+          expect(validator.validate).to eq(false)
+          expect(validator.errors).to include(%["only" contains unsupported entries: ["unsupported"]])
+        end
+
         it "is invalid when not an array" do
           validator = described_class.new({
             "name" => "my_product",