ASP.NET Core 入力フォームを作る② サーバーで入力を検証する

using System.Globalization;

public static class ProfileValidation
{
    public static (ProfileValues Values, long Version, Dictionary<string, string[]> Errors)
        Validate(ProfileInput input)
    {
        var errors = new Dictionary<string, string[]>();
        var name = input.DisplayName?.Trim() ?? "";
        var bio = input.Bio?.Trim() ?? "";
        var goalText = input.WeeklyGoal?.Trim() ?? "";
        int? goal = null;
        if (name.Length is < 1 or > 40)
            errors["displayName"] = ["表示名は1〜40文字で入力してください。"];
        if (bio.Length > 300)
            errors["bio"] = ["自己紹介は300文字以内で入力してください。"];
        if (goalText.Length > 0)
        {
            if (goalText.Length != 1 || goalText[0] < '1' || goalText[0] > '7')
                errors["weeklyGoal"] = ["目標は半角数字の1〜7、または空欄にしてください。"];
            else goal = goalText[0] - '0';
        }
        if (!long.TryParse(input.ExpectedVersion, NumberStyles.None,
            CultureInfo.InvariantCulture, out var version) || version < 1)
            errors["expectedVersion"] = ["画面を読み直してから保存してください。"];
        return (new(name, bio.Length == 0 ? null : bio, goal), version, errors);
    }
}

using System.Security.Claims;
using Microsoft.AspNetCore.Antiforgery;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

[ApiController]
[Authorize]
[AutoValidateAntiforgeryToken]
[Route("api/me/profile")]
[ResponseCache(NoStore = true, Location = ResponseCacheLocation.None)]
public sealed class ProfileController(IProfileStore store) : ControllerBase
{
    [HttpGet("csrf")]
    public IActionResult Csrf([FromServices] IAntiforgery antiforgery) =>
        Ok(new { token = antiforgery.GetAndStoreTokens(HttpContext).RequestToken });

    [HttpGet]
    public async Task<IActionResult> Get(CancellationToken ct)
    {
        if (!Guid.TryParse(User.FindFirstValue(ClaimTypes.NameIdentifier), out var userId))
            return Unauthorized();
        var row = await store.FindAsync(userId, ct);
        return row is null ? NotFound() : Ok(ProfileResult.From(row));
    }

    [HttpPut]
    public async Task<IActionResult> Save(ProfileInput input, CancellationToken ct)
    {
        if (!Guid.TryParse(User.FindFirstValue(ClaimTypes.NameIdentifier), out var userId))
            return Unauthorized();
        var validated = ProfileValidation.Validate(input);
        if (validated.Errors.Count > 0)
        {
            var problem = new ValidationProblemDetails(validated.Errors)
            {
                Status = 400, Title = "入力内容を確認してください。",
            };
            problem.Extensions["code"] = "validation_failed";
            return new ObjectResult(problem) { StatusCode = 400 };
        }
        var saved = await store.TrySaveAsync(userId, validated.Version, validated.Values, ct);
        if (saved is null)
            return Problem(statusCode: 409, title: "最新の内容を確認してください。");
        return Ok(ProfileResult.From(saved));
    }
}

UPDATE user_profile
SET display_name = @display_name,
    bio = @bio,
    weekly_goal = @weekly_goal,
    version = version + 1
WHERE user_id = @user_id
  AND version = @expected_version
RETURNING user_id, display_name, bio, weekly_goal, version;

builder.Services.AddControllersWithViews();
builder.Services.AddAntiforgery(options =>
{
    options.HeaderName = "X-CSRF-TOKEN";
    options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
});
// IProfileStore の実装を Scoped として登録する。