XC_VM/docs/en/development/input-validation.md

Input Validation Strategy

XC_VM centralizes request pre-validation in InputValidator. It performs required-field checks before business logic execution.

---

Core Contract

InputValidator::validate(string $action, array $data): bool

If validation returns false, the action should be rejected before service/repository calls.

if (!InputValidator::validate($action, $data)) {
    // return validation error
}

---

Validation Patterns

From src/core/Validation/InputValidator.php, current checks are mostly:

• required scalar fields via !empty(...)
• numeric checks via is_numeric(...)
• JSON array checks via is_array(json_decode(..., true))

Examples:

Action	Required fields
scheduleRecording	title, source_id
processProvider	ip, port, username, password, name
processCategory	category_name, category_type
processServer / processProxy	server_name, server_ip
processMAG / processEnigma	mac
processUA	user_agent
processEPG	epg_name, epg_file
processWatchFolder	folder_type, selected_path, server_id

JSON-array actions (representative):

Action	JSON field
massEditStreams / massDeleteStreams	streams
massDeleteMovies	movies
massDeleteLines	lines
massDeleteUsers	users
massDeleteEpisodes	episodes
massEditLines / massEditUsers	users_selected
massEditMags / massEditEnigmas	devices_selected
orderCategories	categories
orderServers	server_order

---

Actions with Minimal Gate

Some actions intentionally pass this layer and are validated deeper in business logic:

• processUser
• processLine
• processHMAC
• editAdminProfile

---

Adding Validation for a New Action

Add a case in src/core/Validation/InputValidator.php:

case 'myNewAction':
    return !empty($rData['required_one'])
        && is_numeric($rData['required_two'] ?? null);

Rules:

• validate only required minimum inputs here
• keep domain rules in service layer
• use JSON decode checks for list payloads

---

Related Files

File	Purpose
src/core/Validation/InputValidator.php	centralized action validation
src/public/Controllers/	callers that execute pre-validation