Embed question verification references

api/QuestionsApi/Services/QuestionValidator.cs

@@ -1,4 +1,5 @@
 using QuestionsApi.Models;
+using System.Globalization;
 
 namespace QuestionsApi.Services;
 
@@ -52,6 +53,45 @@ public static class QuestionValidator
         if (string.IsNullOrWhiteSpace(req.System)) return "system required";
         if (string.IsNullOrWhiteSpace(req.Discipline)) return "discipline required";
         if (req.Difficulty is < 1 or > 5) return "difficulty must be between 1 and 5";
+        var referenceValidation = ValidateReferences(req.References, req.IsPublished);
+        if (referenceValidation is not null) return referenceValidation;
+        return null;
+    }
+
+    public static string? ValidateReferences(IReadOnlyCollection<QuestionReference>? references, bool required)
+    {
+        if (references is null)
+            return "verification references must be an array";
+        if (required && references.Count == 0)
+            return "published questions require at least one verification reference";
+        if (references.Count > 20)
+            return "questions support at most twenty verification references";
+
+        var urls = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        foreach (var reference in references)
+        {
+            if (string.IsNullOrWhiteSpace(reference.Title)
+                || string.IsNullOrWhiteSpace(reference.Publisher)
+                || string.IsNullOrWhiteSpace(reference.Url)
+                || string.IsNullOrWhiteSpace(reference.Supports)
+                || string.IsNullOrWhiteSpace(reference.AccessedOn)
+                || string.IsNullOrWhiteSpace(reference.Reviewer))
+                return "verification reference fields are required";
+
+            var url = reference.Url.Trim();
+            if (!Uri.TryCreate(url, UriKind.Absolute, out var uri) || uri.Scheme != Uri.UriSchemeHttps)
+                return "verification reference urls must be absolute HTTPS urls";
+            if (!urls.Add(url))
+                return "verification reference urls must be unique within a question";
+            if (!DateOnly.TryParseExact(
+                    reference.AccessedOn.Trim(),
+                    "yyyy-MM-dd",
+                    CultureInfo.InvariantCulture,
+                    DateTimeStyles.None,
+                    out _))
+                return "verification reference accessedOn must use YYYY-MM-DD";
+        }
+
         return null;
     }
 }