Enhancement [CAT-FR-CO-05] On-Demand Asset Validation

[peleskek]

📦 [CAT-FR-CO-05] On-Demand Asset Validation — Architecture Documentation

🚀 Summary

Requirement: CAT-FR-CO-05 — On-Demand Asset Validation

This change is part of the Enhancement of XFSC Federated Catalogue. Details can be found here (permalink):

https://github.com/eclipse-xfsc/docs/blob/f3c6e6b6fbcc87732a1dfe83f060fa58a9a97873/federated-catalogue/src/docs/CAT%20Enhancement/CAT_Enhancement_Specifications%20v1.0.pdf

Documents the on-demand asset validation feature in the arc42 architecture — building block view, runtime view, and cross-cutting concepts.

✅ What's in this PR

Modified files:

• 05_building_block_view.adoc

  • Add On-Demand Asset Validation Service section: AssetValidationService interface and
    its ValidationStrategy SPI with three implementations (ShaclValidationStrategy,
    JsonSchemaValidationStrategy, XmlSchemaValidationStrategy); ShaclValidationExecutor
    as the shared SHACL engine (used by both upload verification and on-demand paths) with
    configurable timeout (federated-catalogue.validation.shacl.timeout-seconds, default 10 s)
    and pool size; single-asset vs multi-asset dispatch rules (multi-asset restricted to SHACL,
    max federated-catalogue.validation.max-assets-per-request assets, default 20);
    POST /assets/validate endpoint reference (CAT-FR-CO-05)
  • Document asset deletion cascade: AssetStoreImpl publishes AssetDeletedEvent on deletion;
    ValidationResultCleanupListener deletes all associated validation results atomically at
    BEFORE_COMMIT via ValidationResultStore.deleteByAssetId()
  • Update ValidationResultStore class diagram to reflect the full interface: findAll,
    syncToGraph, deleteByAssetId
  • Document validator_type values: SHACL, JSON_SCHEMA, XML_SCHEMA, TRUST_FRAMEWORK
  • Document SchemaValidationService scope: SHACL validation for the upload verification
    and revalidation paths; cross-reference to the new on-demand section
  • Update admin table: JSON Schema and XML Schema validation is active via
    AssetValidationService; OWL module toggle remains unwired

• 06_runtime_view.adoc

  • Verify Credential procedure: on-demand validation of stored assets routes through
    AssetValidationService (SHACL, JSON Schema, XML Schema); upload-flow SchemaValidationService
    is gated by federated-catalogue.verification.schema and shares ShaclValidationExecutor
    with the on-demand path
  • Delete Participant sequence diagram: Note over AssetStore captures the AssetDeletedEvent
    cascade that cleans up validation results before commit, with cross-reference to
    _validation_result_storage

• 08_concepts.adoc

  • New Input Parsing Security cross-cutting concept: XXE hardening
    (FEATURE_SECURE_PROCESSING + empty ACCESS_EXTERNAL_DTD/ACCESS_EXTERNAL_SCHEMA) in
    XmlSchemaValidationStrategy and XML parsers; SSRF protection via JSON $ref scheme
    allowlist in JsonSchemaValidationStrategy; SPARQL injection prevention via
    requireSafeIri in SparqlGraphStore. Policy: every new validator or store accepting
    user-supplied content adopts the same posture and ships a security-path test

🔍 Related Issues

Related to PR federated-catalogue — CAT-FR-CO-05 On-Demand Asset Validation https://github.com/eclipse-xfsc/federated-catalogue/pull/43
Implements documentation for CAT-FR-CO-05 (On-Demand Asset Validation)

📋 Checklist

• I've updated documentation if necessary
• My changes follow the project's coding style

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud