stabilizaiton work - projects rework for maintenanceability and ui livening

src/__Libraries/StellaOps.Configuration/AuthorityServiceAccountSeedOptions.Validation.cs

@@ -0,0 +1,55 @@
+using System;
+using System.Collections.Generic;
+using System.Text.RegularExpressions;
+
+namespace StellaOps.Configuration;
+
+public sealed partial class AuthorityServiceAccountSeedOptions
+{
+    private static readonly Regex _accountIdRegex = new("^[a-z0-9][a-z0-9:_-]{2,63}$", RegexOptions.Compiled | RegexOptions.CultureInvariant);
+    private static readonly HashSet<string> _allowedAttributeKeys = new(new[]
+    {
+        "env",
+        "owner",
+        "business_tier"
+    }, StringComparer.OrdinalIgnoreCase);
+
+    internal void Validate(ISet<string> tenantIds)
+    {
+        if (string.IsNullOrWhiteSpace(AccountId))
+        {
+            throw new InvalidOperationException("Delegation service account seeds require an accountId.");
+        }
+
+        if (!_accountIdRegex.IsMatch(AccountId))
+        {
+            throw new InvalidOperationException($"Service account id '{AccountId}' must contain lowercase letters, digits, colon, underscore, or hyphen.");
+        }
+
+        if (string.IsNullOrWhiteSpace(Tenant))
+        {
+            throw new InvalidOperationException($"Service account '{AccountId}' requires a tenant assignment.");
+        }
+
+        if (tenantIds.Count > 0 && !tenantIds.Contains(Tenant))
+        {
+            throw new InvalidOperationException($"Service account '{AccountId}' references unknown tenant '{Tenant}'.");
+        }
+
+        if (AllowedScopes.Count == 0)
+        {
+            throw new InvalidOperationException($"Service account '{AccountId}' must specify at least one allowed scope.");
+        }
+
+        if (Attributes.Count > 0)
+        {
+            foreach (var attributeName in Attributes.Keys)
+            {
+                if (!_allowedAttributeKeys.Contains(attributeName))
+                {
+                    throw new InvalidOperationException($"Service account '{AccountId}' defines unsupported attribute '{attributeName}'. Allowed attributes: env, owner, business_tier.");
+                }
+            }
+        }
+    }
+}