Abstract Validation into Service for Web Service Context

Problem/Motivation

The current strategy is tightly coupled into Form API validation callback. Client applications, using REST or JSONAPI, should be able to apply the validation logic inside HOOK_user_presave().

Expected Results:

When a client application creates a user that does not meet the password policy constraints, a descriptive exception is thrown, and processed by the client.

Actual Result:

When a client application creates a user that does not meet the password policy constraints, the user is saved.

In Progress Resolution

  public function presaveUserValidate(User $entity) {

    $request = \Drupal\Component\Serialization\Json::decode(\Drupal::request()->getContent());
    $pass = $request['data']['attributes']['pass'];

    //@todo get role
    $roles = $entity->getRoles();
    if (empty($roles)) {
      $roles = ['authenticated' => 'authenticated'];
    }

    // Run validation.
    $applicable_policies = [];
    $ids = [];
    foreach ($roles as $role_key => $role_enabled) {
      if ($role_enabled) {
        $role_map = ['roles.' . $role_enabled => $role_enabled];
        $role_policies = \Drupal::entityTypeManager()->getStorage('password_policy')->loadByProperties($role_map);
        /** @var \Drupal\password_policy\Entity\PasswordPolicy $policy */
        foreach ($role_policies as $policy) {
          if (!in_array($policy->id(), $ids)) {
            $applicable_policies[] = $policy;
            $ids[] = $policy->id();
          }
        }
      }
    }

    // Run validation.
    $failed = FALSE;
    $force_failure = FALSE;

    // Process user context
    // TODO - Turn this into configuration.
    $user_context_fields = ['mail', 'name', 'uid'];
    $user_context_values = [];
    foreach ($user_context_fields as $user_context_field) {
      if($entity->hasField($user_context_field)) {
        $user_context_values[$user_context_field] = $entity->get($user_context_field)->value;
      }
    }

    /** @var \Drupal\password_policy\Entity\PasswordPolicy $policy */
    foreach ($applicable_policies as $policy_id => $policy) {
      $policy_constraints = $policy->getConstraints();

      foreach ($policy_constraints as $constraint_id => $constraint) {

        $plugin_inst = \Drupal::service('plugin.manager.password_policy.password_constraint');
        $plugin_object = $plugin_inst->createInstance($constraint['id'], $constraint);

        // Execute validation.
        $validation = $plugin_object->validate($pass, $user_context_values);

        if ($validation->isValid() && !$force_failure) {
          $status = t('Pass');
        }
        else {
          $message = $validation->getErrorMessage();
          $failed = TRUE;
        }

      }
    }

    if($failed) {
      throw new AccessDeniedHttpException('There is an issue with the password');
    }
    return;
  }