Add validation for API key IP and Referrer restrictions in DevPortal

[Gayuth-W]

Purpose

The DevPortal API key generation dialogs accept any string as a Security Restriction value - a key generates successfully with an IP or Referrer restriction that can never match, silently producing an unusable or falsely-restricted key.

Approach

Added isValidPermittedIPList / isValidPermittedRefererList to the existing Shared/AppsAndKeys/constraintValidator.js and wired them into both key generation dialogs (ApiKeyGenerate/ApiKeyListing and LegacyApiKeys) with an inline field error alongside the existing toast. Rules mirror what the gateway accepts (ApiKeyAuthenticatorUtils#validateAPIKeyRestrictions):

• IP - comma separated IPv4/IPv6 addresses or CIDR ranges, same patterns as the Admin Portal blacklist form

• Referrer - comma-separated URL/host/wildcard patterns; non-empty, no whitespace, must contain one of . : / *

Covered by unit tests (npx jest: 74/74 passing); verified manually on a local APIM 4.7.0 instance.

Fixes wso2/api-manager#5093

[sonarqubecloud]

Quality Gate failed

Failed conditions
19.6% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: d4525b5f-2dba-4a08-be9c-9f5738def8a4

📥 Commits

Reviewing files that changed from the base of the PR and between 7b680fc and 19705eb.

📒 Files selected for processing (6)

• portals/devportal/src/main/webapp/site/public/locales/en.json
• portals/devportal/src/main/webapp/source/Tests/Unit/constraintValidator.test.js
• portals/devportal/src/main/webapp/source/src/app/components/Apis/Details/APIKeys/ApiKeyGenerate.jsx
• portals/devportal/src/main/webapp/source/src/app/components/Apis/Details/APIKeys/ApiKeyListing.jsx
• portals/devportal/src/main/webapp/source/src/app/components/Shared/AppsAndKeys/LegacyApiKeys.jsx
• portals/devportal/src/main/webapp/source/src/app/components/Shared/AppsAndKeys/constraintValidator.js

---

📝 Walkthrough

Summary

• Added validation for API key IP address and referrer restrictions, including IPv4/IPv6, CIDR, URL, host, and wildcard formats.
• Integrated validation into standard and legacy API key generation flows for Production and Sandbox keys.
• Added inline field errors and toast notifications that prevent generation with invalid values.
• Improved placeholders and localization guidance for supported formats.
• Added unit tests covering valid and invalid restriction lists.

Walkthrough

Added validation for IP/CIDR and referrer restrictions during standard and legacy API key generation. Invalid values now stop generation, show alerts, and display inline field errors. Error state resets when modals close, restriction types change, or values are edited. Localization strings and placeholders now document supported list, CIDR, and wildcard formats. Unit tests cover valid and invalid restriction inputs.

Sequence Diagram(s)

sequenceDiagram
  participant APIKeyForm
  participant Validator
  participant Alert
  APIKeyForm->>Validator: validate selected restriction
  Validator-->>APIKeyForm: return validation result
  APIKeyForm->>Alert: show error for invalid input
  APIKeyForm-->>APIKeyForm: render inline validation feedback

Loading

Suggested reviewers: ashera96, heshansudarshana, ashera96

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the main change: adding IP and referrer restriction validation in DevPortal.
Description check	✅ Passed	The description matches the implemented change and explains the new validators, UI wiring, and tests.
Linked Issues check	✅ Passed	The changes address #5093 by validating IP and referrer restrictions before API key generation in DevPortal.
Out of Scope Changes check	✅ Passed	The added tests, localization strings, and legacy key flow updates are all consistent with the validation work.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install failed: one or more packages not found in the registry.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}