diff --git a/src/creative_agent/server.py b/src/creative_agent/server.py index 952d6b7..70d3924 100644 --- a/src/creative_agent/server.py +++ b/src/creative_agent/server.py @@ -172,6 +172,19 @@ def preview_creative( indent=2, ) + # Validate manifest assets + from .validation import validate_manifest_assets + + validation_errors = validate_manifest_assets(request.creative_manifest, check_remote_mime=False) + if validation_errors: + return json.dumps( + { + "error": "Asset validation failed", + "validation_errors": validation_errors, + }, + indent=2, + ) + # Generate preview variants previews = [] preview_id = str(uuid.uuid4()) @@ -668,6 +681,20 @@ def is_safe_url(url: str) -> bool: asset_data["url"] = generated_images[image_index] image_index += 1 + # Validate generated manifest assets + from .validation import validate_manifest_assets + + validation_errors = validate_manifest_assets(manifest_data, check_remote_mime=False) + if validation_errors: + return json.dumps( + { + "error": "AI-generated creative failed validation", + "validation_errors": validation_errors, + "hint": "The AI generated invalid assets. Please try again with more specific instructions.", + }, + indent=2, + ) + # Generate session context ID session_context_id = request.context_id or str(uuid.uuid4()) diff --git a/src/creative_agent/validation.py b/src/creative_agent/validation.py new file mode 100644 index 0000000..4054ada --- /dev/null +++ b/src/creative_agent/validation.py @@ -0,0 +1,301 @@ +"""Asset validation for creative manifests.""" + +import re +from typing import Any +from urllib.parse import urlparse + +import httpx + + +class AssetValidationError(ValueError): + """Raised when asset validation fails.""" + + +def validate_html_content(content: str) -> None: + """Validate HTML content is actually HTML. + + Args: + content: HTML string to validate + + Raises: + AssetValidationError: If content is not valid HTML + """ + if not content or not isinstance(content, str): + raise AssetValidationError("HTML content cannot be empty") + + content_lower = content.lower().strip() + + # Check for basic HTML structure + has_html_tag = "" in content_lower + has_body_tag = "", content_lower)) + + if not has_any_html_tag: + raise AssetValidationError("HTML content must contain valid HTML tags") + + # If it claims to be a full document, validate structure + if has_html_tag and not has_body_tag: + raise AssetValidationError("HTML document must contain tag") + + +def validate_css_content(content: str) -> None: + """Validate CSS content has basic CSS syntax. + + Args: + content: CSS string to validate + + Raises: + AssetValidationError: If content is not valid CSS + """ + if not content or not isinstance(content, str): + raise AssetValidationError("CSS content cannot be empty") + + # Basic CSS syntax check - look for selectors and rules + has_rule = bool(re.search(r"[^{}]+\{[^{}]*\}", content)) + + if not has_rule: + raise AssetValidationError("CSS content must contain at least one valid rule") + + +def validate_javascript_content(content: str) -> None: + """Validate JavaScript content is not empty and looks like JS. + + Args: + content: JavaScript string to validate + + Raises: + AssetValidationError: If content is not valid JavaScript + """ + if not content or not isinstance(content, str): + raise AssetValidationError("JavaScript content cannot be empty") + + # Very basic check - must have some code-like content + content_stripped = content.strip() + if len(content_stripped) < 5: + raise AssetValidationError("JavaScript content is too short to be valid") + + +def validate_text_content(content: str) -> None: + """Validate text content is not empty. + + Args: + content: Text string to validate + + Raises: + AssetValidationError: If content is invalid + """ + if not isinstance(content, str): + raise AssetValidationError("Text content must be a string") + + if not content.strip(): + raise AssetValidationError("Text content cannot be empty") + + +def validate_url(url: str) -> None: + """Validate URL is properly formatted and safe. + + Args: + url: URL string to validate + + Raises: + AssetValidationError: If URL is invalid or unsafe + """ + if not url or not isinstance(url, str): + raise AssetValidationError("URL cannot be empty") + + # Block dangerous URL schemes + url_lower = url.lower() + if url_lower.startswith(("javascript:", "vbscript:", "file:", "about:")): + raise AssetValidationError(f"URL scheme not allowed: {url.split(':')[0]}") + + # Parse URL structure + try: + parsed = urlparse(url) + if not parsed.scheme or not parsed.netloc: + # Allow data URIs for images + if url_lower.startswith("data:image/"): + validate_data_uri(url) + return + raise AssetValidationError("URL must have scheme and host") + + if parsed.scheme not in ["http", "https"]: + raise AssetValidationError(f"URL scheme must be http or https, got: {parsed.scheme}") + + except Exception as e: + raise AssetValidationError(f"Invalid URL format: {e}") from e + + +def validate_data_uri(uri: str) -> None: + """Validate data URI format and size. + + Args: + uri: Data URI to validate + + Raises: + AssetValidationError: If data URI is invalid + """ + if not uri.startswith("data:"): + raise AssetValidationError("Data URI must start with 'data:'") + + # Check format: data:MIME;encoding,data + if "," not in uri: + raise AssetValidationError("Data URI must contain comma separator") + + header, data = uri.split(",", 1) + + # Validate MIME type for images + mime_part = header.split(";")[0].replace("data:", "") + allowed_image_mimes = ["image/png", "image/jpeg", "image/jpg", "image/gif", "image/webp", "image/svg+xml"] + + if not any(mime_part == mime for mime in allowed_image_mimes): + raise AssetValidationError(f"Data URI MIME type not allowed: {mime_part}") + + # Check size (limit to 10MB for data URIs) + if len(data) > 10 * 1024 * 1024: + raise AssetValidationError("Data URI exceeds 10MB size limit") + + +def validate_image_url(url: str, check_mime: bool = False) -> None: + """Validate image URL and optionally verify MIME type. + + Args: + url: Image URL to validate + check_mime: If True, make HTTP HEAD request to verify content-type + + Raises: + AssetValidationError: If image URL is invalid + """ + # Handle data URIs + if url.startswith("data:"): + validate_data_uri(url) + return + + # Validate URL structure + validate_url(url) + + # Optional MIME type verification + if check_mime: + try: + response = httpx.head(url, timeout=5.0, follow_redirects=True) + content_type = response.headers.get("content-type", "").lower() + + if not content_type.startswith("image/"): + raise AssetValidationError(f"URL does not return image content-type: {content_type}") + + except httpx.TimeoutException as e: + raise AssetValidationError(f"Timeout verifying image URL: {url}") from e + except httpx.HTTPError as e: + raise AssetValidationError(f"Error verifying image URL: {e}") from e + + +def validate_asset(asset_data: dict[str, Any], check_remote_mime: bool = False) -> None: + """Validate a single asset based on its type. + + Args: + asset_data: Asset dictionary with asset_type and content + check_remote_mime: If True, verify MIME types for remote URLs (slower) + + Raises: + AssetValidationError: If asset validation fails + """ + if not isinstance(asset_data, dict): + raise AssetValidationError("Asset must be a dictionary") + + asset_type = asset_data.get("asset_type") + if not asset_type: + raise AssetValidationError("Asset must have asset_type field") + + # Validate based on asset type + if asset_type == "html": + content = asset_data.get("content") + if not isinstance(content, str): + raise AssetValidationError("HTML asset must have string content") + validate_html_content(content) + + elif asset_type == "css": + content = asset_data.get("content") + if not isinstance(content, str): + raise AssetValidationError("CSS asset must have string content") + validate_css_content(content) + + elif asset_type == "javascript": + content = asset_data.get("content") + if not isinstance(content, str): + raise AssetValidationError("JavaScript asset must have string content") + validate_javascript_content(content) + + elif asset_type == "text": + content = asset_data.get("content") + if not isinstance(content, str): + raise AssetValidationError("Text asset must have string content") + validate_text_content(content) + + elif asset_type == "url": + url = asset_data.get("url") + if not isinstance(url, str): + raise AssetValidationError("URL asset must have string url") + validate_url(url) + + elif asset_type == "image": + url = asset_data.get("url") + if not isinstance(url, str): + raise AssetValidationError("Image asset must have string url") + validate_image_url(url, check_mime=check_remote_mime) + + # Validate dimensions if provided + width = asset_data.get("width") + height = asset_data.get("height") + + if width is not None and (not isinstance(width, int) or width < 1): + raise AssetValidationError("Image width must be a positive integer") + + if height is not None and (not isinstance(height, int) or height < 1): + raise AssetValidationError("Image height must be a positive integer") + + # Validate format if provided + img_format = asset_data.get("format") + if img_format: + allowed_formats = ["jpg", "jpeg", "png", "gif", "webp", "svg"] + if img_format.lower() not in allowed_formats: + raise AssetValidationError(f"Image format not allowed: {img_format}") + + elif asset_type in ("video", "audio"): + url = asset_data.get("url") + if not isinstance(url, str): + raise AssetValidationError(f"{asset_type.capitalize()} asset must have string url") + validate_url(url) + + else: + raise AssetValidationError(f"Unknown asset_type: {asset_type}") + + +def validate_manifest_assets(manifest: Any, check_remote_mime: bool = False) -> list[str]: + """Validate all assets in a creative manifest. + + Args: + manifest: Creative manifest (should be dictionary with assets field) + check_remote_mime: If True, verify MIME types for remote URLs (slower) + + Returns: + List of validation error messages (empty if all valid) + """ + errors: list[str] = [] + + if not isinstance(manifest, dict): + return ["Manifest must be a dictionary"] + + assets = manifest.get("assets") + if not assets: + return ["Manifest must contain assets field"] + + if not isinstance(assets, dict): + return ["Manifest assets must be a dictionary"] + + # Validate each asset + for asset_role, asset_data in assets.items(): + try: + validate_asset(asset_data, check_remote_mime=check_remote_mime) + except AssetValidationError as e: + errors.append(f"Asset '{asset_role}': {e}") + + return errors diff --git a/tests/validation/__init__.py b/tests/validation/__init__.py new file mode 100644 index 0000000..1c130bf --- /dev/null +++ b/tests/validation/__init__.py @@ -0,0 +1 @@ +"""Tests for validation module.""" diff --git a/tests/validation/test_asset_validation.py b/tests/validation/test_asset_validation.py new file mode 100644 index 0000000..91a8ee5 --- /dev/null +++ b/tests/validation/test_asset_validation.py @@ -0,0 +1,380 @@ +"""Tests for asset validation.""" + +import pytest + +from creative_agent.validation import ( + AssetValidationError, + validate_asset, + validate_css_content, + validate_data_uri, + validate_html_content, + validate_image_url, + validate_javascript_content, + validate_manifest_assets, + validate_text_content, + validate_url, +) + + +class TestHTMLValidation: + """Test HTML content validation.""" + + def test_valid_html_document(self): + """Valid HTML document should pass.""" + html = "

Test

" + validate_html_content(html) + + def test_valid_html_snippet(self): + """Valid HTML snippet should pass.""" + html = "

Test content

" + validate_html_content(html) + + def test_empty_html_fails(self): + """Empty HTML should fail.""" + with pytest.raises(AssetValidationError, match="cannot be empty"): + validate_html_content("") + + def test_non_html_text_fails(self): + """Plain text without HTML tags should fail.""" + with pytest.raises(AssetValidationError, match="must contain valid HTML tags"): + validate_html_content("This is just plain text") + + def test_html_without_body_fails(self): + """HTML document without body tag should fail.""" + with pytest.raises(AssetValidationError, match="must contain tag"): + validate_html_content("") + + +class TestCSSValidation: + """Test CSS content validation.""" + + def test_valid_css(self): + """Valid CSS should pass.""" + css = "body { margin: 0; padding: 0; }" + validate_css_content(css) + + def test_valid_css_multiple_rules(self): + """CSS with multiple rules should pass.""" + css = """ + body { margin: 0; } + .container { width: 100%; } + #main { color: red; } + """ + validate_css_content(css) + + def test_empty_css_fails(self): + """Empty CSS should fail.""" + with pytest.raises(AssetValidationError, match="cannot be empty"): + validate_css_content("") + + def test_invalid_css_fails(self): + """Text without CSS rules should fail.""" + with pytest.raises(AssetValidationError, match="must contain at least one valid rule"): + validate_css_content("This is not CSS") + + +class TestJavaScriptValidation: + """Test JavaScript content validation.""" + + def test_valid_javascript(self): + """Valid JavaScript should pass.""" + js = "console.log('hello world');" + validate_javascript_content(js) + + def test_valid_javascript_function(self): + """JavaScript function should pass.""" + js = "function test() { return true; }" + validate_javascript_content(js) + + def test_empty_javascript_fails(self): + """Empty JavaScript should fail.""" + with pytest.raises(AssetValidationError, match="cannot be empty"): + validate_javascript_content("") + + def test_too_short_javascript_fails(self): + """Very short JavaScript should fail.""" + with pytest.raises(AssetValidationError, match="too short"): + validate_javascript_content("x=1") + + +class TestTextValidation: + """Test text content validation.""" + + def test_valid_text(self): + """Valid text should pass.""" + validate_text_content("This is valid text content") + + def test_empty_text_fails(self): + """Empty text should fail.""" + with pytest.raises(AssetValidationError, match="cannot be empty"): + validate_text_content("") + + def test_whitespace_only_fails(self): + """Whitespace-only text should fail.""" + with pytest.raises(AssetValidationError, match="cannot be empty"): + validate_text_content(" \n \t ") + + +class TestURLValidation: + """Test URL validation.""" + + def test_valid_http_url(self): + """Valid HTTP URL should pass.""" + validate_url("http://example.com/image.png") + + def test_valid_https_url(self): + """Valid HTTPS URL should pass.""" + validate_url("https://example.com/image.png") + + def test_javascript_url_fails(self): + """JavaScript URL should fail.""" + with pytest.raises(AssetValidationError, match="scheme not allowed"): + validate_url("javascript:alert('xss')") + + def test_vbscript_url_fails(self): + """VBScript URL should fail.""" + with pytest.raises(AssetValidationError, match="scheme not allowed"): + validate_url("vbscript:alert('xss')") + + def test_file_url_fails(self): + """File URL should fail.""" + with pytest.raises(AssetValidationError, match="scheme not allowed"): + validate_url("file:///etc/passwd") + + def test_invalid_url_fails(self): + """Invalid URL format should fail.""" + with pytest.raises(AssetValidationError, match="must have scheme and host"): + validate_url("not-a-url") + + def test_empty_url_fails(self): + """Empty URL should fail.""" + with pytest.raises(AssetValidationError, match="cannot be empty"): + validate_url("") + + +class TestDataURIValidation: + """Test data URI validation.""" + + def test_valid_png_data_uri(self): + """Valid PNG data URI should pass.""" + uri = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==" + validate_data_uri(uri) + + def test_valid_jpeg_data_uri(self): + """Valid JPEG data URI should pass.""" + uri = "data:image/jpeg;base64,/9j/4AAQSkZJRgABAQEAYABgAAD/2wBD" + validate_data_uri(uri) + + def test_invalid_mime_type_fails(self): + """Data URI with invalid MIME type should fail.""" + with pytest.raises(AssetValidationError, match="MIME type not allowed"): + validate_data_uri("data:text/html;base64,PHNjcmlwdD5hbGVydCgneHNzJyk8L3NjcmlwdD4=") + + def test_missing_comma_fails(self): + """Data URI without comma should fail.""" + with pytest.raises(AssetValidationError, match="must contain comma separator"): + validate_data_uri("data:image/pngbase64iVBORw0KGgo") + + def test_size_limit_fails(self): + """Data URI exceeding size limit should fail.""" + large_data = "x" * (11 * 1024 * 1024) # 11MB + uri = f"data:image/png;base64,{large_data}" + with pytest.raises(AssetValidationError, match="exceeds 10MB"): + validate_data_uri(uri) + + +class TestImageURLValidation: + """Test image URL validation.""" + + def test_valid_image_url(self): + """Valid image URL should pass.""" + validate_image_url("https://example.com/image.png", check_mime=False) + + def test_valid_data_uri_image(self): + """Valid data URI image should pass.""" + uri = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==" + validate_image_url(uri, check_mime=False) + + def test_javascript_image_url_fails(self): + """JavaScript URL should fail even for images.""" + with pytest.raises(AssetValidationError, match="scheme not allowed"): + validate_image_url("javascript:alert('xss')", check_mime=False) + + +class TestAssetValidation: + """Test full asset validation.""" + + def test_valid_html_asset(self): + """Valid HTML asset should pass.""" + asset = { + "asset_type": "html", + "content": "

Test

", + } + validate_asset(asset) + + def test_valid_css_asset(self): + """Valid CSS asset should pass.""" + asset = { + "asset_type": "css", + "content": "body { margin: 0; }", + } + validate_asset(asset) + + def test_valid_javascript_asset(self): + """Valid JavaScript asset should pass.""" + asset = { + "asset_type": "javascript", + "content": "console.log('test');", + } + validate_asset(asset) + + def test_valid_text_asset(self): + """Valid text asset should pass.""" + asset = { + "asset_type": "text", + "content": "This is a headline", + } + validate_asset(asset) + + def test_valid_url_asset(self): + """Valid URL asset should pass.""" + asset = { + "asset_type": "url", + "url": "https://example.com/landing", + } + validate_asset(asset) + + def test_valid_image_asset(self): + """Valid image asset should pass.""" + asset = { + "asset_type": "image", + "url": "https://example.com/image.png", + "width": 300, + "height": 250, + "format": "png", + } + validate_asset(asset) + + def test_invalid_html_asset_fails(self): + """Invalid HTML asset should fail.""" + asset = { + "asset_type": "html", + "content": "Not HTML content", + } + with pytest.raises(AssetValidationError, match="must contain valid HTML tags"): + validate_asset(asset) + + def test_invalid_image_dimensions_fail(self): + """Image with invalid dimensions should fail.""" + asset = { + "asset_type": "image", + "url": "https://example.com/image.png", + "width": 0, + } + with pytest.raises(AssetValidationError, match="must be a positive integer"): + validate_asset(asset) + + def test_invalid_image_format_fails(self): + """Image with invalid format should fail.""" + asset = { + "asset_type": "image", + "url": "https://example.com/image.png", + "format": "exe", + } + with pytest.raises(AssetValidationError, match="format not allowed"): + validate_asset(asset) + + def test_missing_asset_type_fails(self): + """Asset without asset_type should fail.""" + asset = { + "content": "test", + } + with pytest.raises(AssetValidationError, match="must have asset_type"): + validate_asset(asset) + + def test_unknown_asset_type_fails(self): + """Asset with unknown type should fail.""" + asset = { + "asset_type": "unknown", + } + with pytest.raises(AssetValidationError, match="Unknown asset_type"): + validate_asset(asset) + + +class TestManifestValidation: + """Test full manifest validation.""" + + def test_valid_manifest(self): + """Valid manifest should pass.""" + manifest = { + "format_id": "display_300x250", + "assets": { + "headline": { + "asset_type": "text", + "content": "Buy Now!", + }, + "background": { + "asset_type": "image", + "url": "https://example.com/bg.png", + "width": 300, + "height": 250, + }, + "clickthrough": { + "asset_type": "url", + "url": "https://example.com/landing", + }, + }, + } + errors = validate_manifest_assets(manifest) + assert errors == [] + + def test_manifest_with_invalid_asset(self): + """Manifest with invalid asset should return errors.""" + manifest = { + "format_id": "display_300x250", + "assets": { + "headline": { + "asset_type": "text", + "content": "", # Invalid empty text + }, + }, + } + errors = validate_manifest_assets(manifest) + assert len(errors) == 1 + assert "headline" in errors[0] + assert "cannot be empty" in errors[0] + + def test_manifest_multiple_errors(self): + """Manifest with multiple invalid assets should return all errors.""" + manifest = { + "format_id": "display_300x250", + "assets": { + "headline": { + "asset_type": "text", + "content": "", # Invalid + }, + "background": { + "asset_type": "image", + "url": "javascript:alert('xss')", # Invalid + }, + }, + } + errors = validate_manifest_assets(manifest) + assert len(errors) == 2 + assert any("headline" in err for err in errors) + assert any("background" in err for err in errors) + + def test_manifest_without_assets_fails(self): + """Manifest without assets field should fail.""" + manifest = { + "format_id": "display_300x250", + } + errors = validate_manifest_assets(manifest) + assert len(errors) == 1 + assert "must contain assets" in errors[0] + + def test_invalid_manifest_type_fails(self): + """Non-dict manifest should fail.""" + errors = validate_manifest_assets("not a dict") + assert len(errors) == 1 + assert "must be a dictionary" in errors[0]