feat(validator): add settings constraint validation pilot

[somethingwithproof]

Fourth in the Symfony adoption series on develop. This now combines the shared CactiValidator helper with the settings-constraint pilot, superseding #7125 so reviewers can evaluate the abstraction and first consumer together.

What it adds

• lib/CactiValidator.php — shared helpers around Symfony Validator for reusable value checks plus raw violation access.
• lib/CactiSettings.php — single static method validate(array $posted, array $definitions): array. Returns a map of {setting_name => first violation message} and delegates validation through CactiValidator.
• 'constraints' key on 12 settings in include/global_settings.php. Constraints are closure-wrapped so global_settings.php can load before Composer autoload is available.
• settings.php save handler runs CactiSettings::validate($_POST, $settings) first, surfaces violations via the existing raise_message() pattern with MESSAGE_LEVEL_ERROR, and short-circuits before any DB write.

Settings covered in the pilot

Path/binary checks: path_rrdtool, path_php_binary, path_snmpget, path_snmpwalk, realtime_cache_path.

Numeric range checks: snmp_timeout, snmp_retries, settings_smtp_port, default_rra_id.

Enum / choice checks: poller_interval, cron_interval.

Non-blank: settings_smtp_host.

Constraint types exercised: NotBlank, Length, Range, Choice, Regex, Positive. Each has at least one positive and one negative test.

Why

The same setting is currently validated multiple ways depending on entry path. Declarative constraints plus one validator pass at save time gives us a single pattern and surfaces invalid values before downstream failures.

What this is NOT

• Not a wholesale migration. 200+ settings remain on the implicit form-render checks. The pilot demonstrates the pattern; subsequent PRs can extend coverage one cluster at a time.
• Not a replacement for downstream validation. Existing form-render and consumer-side checks still run.

Tests

• tests/Unit/CactiSettingsTest.php
• tests/Unit/CactiValidatorTest.php

Vendor

Composer metadata adds symfony/validator; vendored dependency refresh remains out of band.

Migration template

docs/security/settings-validation.md shows how to add constraints to a new setting.

Rollback

Per-setting: drop the 'constraints' key. Whole-feature: revert this PR. Either way no downstream code change is required because the validator pass is additive.

[Copilot]

Pull request overview

Adds a Symfony Validator–backed “settings constraints” pilot to centralize and enforce validation for a targeted subset of high-value settings at save time in the Cacti web UI.

Changes:

• Introduces lib/CactiSettings::validate() to run Symfony constraints declared alongside settings definitions.
• Adds constraints declarations to selected entries in include/global_settings.php and validates in settings.php before any DB writes.
• Adds unit tests for validation behavior plus a short migration/how-to doc.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
composer.json	Adds symfony/validator dependency.
lib/CactiSettings.php	New validator wrapper: flattens settings definitions and returns first violation per setting.
include/global_settings.php	Adds Assert constraints to selected settings definitions.
settings.php	Runs validation before persisting settings; surfaces violations via raise_message().
tests/Unit/CactiSettingsTest.php	Pest unit coverage for input shapes and constraint types.
docs/security/settings-validation.md	Documents the new constraints pattern and how to extend it.

[Copilot]

include/global.php requires include/global_settings.php before include/vendor/autoload.php. These new Symfony Constraint instantiations will therefore fatal with ClassNotFound during bootstrap. Load Composer autoload before global_settings.php (preferred), or add an explicit autoload require before using Assert constraints here.

Suggested change

	if (file_exists(CACTI_PATH_INCLUDE . '/vendor/autoload.php')) {
	require_once(CACTI_PATH_INCLUDE . '/vendor/autoload.php');
	}

[somethingwithproof]

Fixed — global_settings.php guards its own require_once of vendor/autoload.php before instantiating any Symfony constraints.

[Copilot]

These custom constraint messages are user-facing but not wrapped with Cacti i18n helpers. Consider wrapping them with __('...') (or __esc at render time) so translated UIs don't show raw English strings.

[somethingwithproof]

Fixed — all custom constraint messages now use __().

[Copilot]

These Assert\Choice lists duplicate the canonical interval values already held in $poller_intervals. Hard-coding the choices here risks drift if the array changes; consider deriving the allowed choices from array_keys($poller_intervals) (string+int forms) instead.

[somethingwithproof]

Fixed — choices now derived from array_keys($GLOBALS['poller_intervals']) with string coercion, so they track the canonical array.

[Copilot]

These Assert\Choice lists duplicate the canonical interval values already held in $cron_intervals. Hard-coding the choices here risks drift if the array changes; consider deriving the allowed choices from array_keys($cron_intervals) (string+int forms) instead.

[somethingwithproof]

Fixed — same pattern applied for cron_intervals.

[Copilot]

This custom constraint message is user-facing but not wrapped with Cacti i18n helpers. Consider message: __('...') so translated UIs don't show raw English strings.

Suggested change

	new Assert\Regex(pattern: '/^\d+$/', message: 'must be a positive integer id.'),
	new Assert\Regex(pattern: '/^\d+$/', message: __('must be a positive integer id.')),

[somethingwithproof]

Fixed.

[Copilot]

Validation::createValidator() is built without a Translator, so any default Symfony constraint messages (e.g. NotBlank/Length/Range) will render in English regardless of Cacti locale. If these messages are intended to be user-facing in settings.php, consider either supplying translated 'message'/'*Message' options (using __()) for every constraint, or wiring a Translator into the validator builder.

[somethingwithproof]

Acknowledged — wiring a Translator is deferred; a code comment documents the limitation and the planned follow-up.

[Copilot]

These custom constraint messages are user-facing but not wrapped with Cacti i18n helpers. Consider wrapping them with __('...') so translated UIs don't show raw English strings.

[somethingwithproof]

Fixed — __() wrappers added throughout.

[Copilot]

This regex constraint uses a custom user-facing message that's not wrapped for translation. Consider message: __('...') so it participates in Cacti i18n.

Suggested change

	new Assert\Regex(pattern: '#^([A-Za-z]:\\\\|/)#', message: 'must be an absolute path.'),
	new Assert\Regex(pattern: '#^([A-Za-z]:\\\\|/)#', message: __('must be an absolute path.')),

[somethingwithproof]

Fixed.

[Copilot]

These custom constraint messages are user-facing but not wrapped with Cacti i18n helpers. Consider wrapping them with __('...') so translated UIs don't show raw English strings.

Suggested change

	new Assert\Regex(pattern: '/^\d+$/', message: 'must be a positive integer.'),
	new Assert\Regex(pattern: '/^\d+$/', message: __('must be a positive integer.')),

[somethingwithproof]

Fixed.

[Copilot]

This introduces direct $_POST access in the web save handler, while the rest of settings.php uses the request-var helpers (grv/gnrv/isrv) and their caching/normalization. Consider passing a request-var map built from gnrv()/get_nfilter_request_var() (or at least $_REQUEST) into CactiSettings::validate() and using the same source when storing sess_field_values.

Suggested change

	$errors = [];
	$inserts = [];
	require_once(CACTI_PATH_LIBRARY . '/CactiSettings.php');
	$violations = CactiSettings::validate($_POST, $settings);
	if (cacti_sizeof($violations) > 0) {
	foreach ($violations as $name => $message) {
	$_SESSION['sess_error_fields'][$name] = $name;
	$_SESSION['sess_field_values'][$name] = isset($_POST[$name]) && is_scalar($_POST[$name]) ? $_POST[$name] : '';
	$errors = [];
	$inserts = [];
	$request_vars = [];
	require_once(CACTI_PATH_LIBRARY . '/CactiSettings.php');
	foreach ($settings as $tab => $page) {
	foreach ($page as $field_name => $field_array) {
	if (isrv($field_name)) {
	$request_vars[$field_name] = gnrv($field_name);
	}
	}
	}
	$violations = CactiSettings::validate($request_vars, $settings);
	if (cacti_sizeof($violations) > 0) {
	foreach ($violations as $name => $message) {
	$_SESSION['sess_error_fields'][$name] = $name;
	$_SESSION['sess_field_values'][$name] = isset($request_vars[$name]) && is_scalar($request_vars[$name]) ? $request_vars[$name] : '';

[somethingwithproof]

Fixed — settings.php save handler uses gnrv() throughout; no direct $_POST access.

[somethingwithproof]

Queue note: this should follow #7125. After #7125 lands, rebase this settings validation pilot onto the shared CactiValidator helper/dependency and remove duplicate composer/baseline churn.