Feature/reply option requires https

Test/Altinn.Correspondence.Tests/Factories/CorrespondenceBuilder.cs

@@ -89,6 +89,13 @@ public CorrespondenceBuilder WithAttachments()
             };
             return this;
         }
+
+        public CorrespondenceBuilder WithReplyOptions(List<CorrespondenceReplyOptionExt> replyOptions)
+        {
+            _correspondence.Correspondence.ReplyOptions = replyOptions;
+            return this;
+        }
+
         public CorrespondenceBuilder WithExternalReference()
         {
             _correspondence.Correspondence.ExternalReferences = new List<ExternalReferenceExt>(){

Test/Altinn.Correspondence.Tests/TestingController/Correspondence/CorrespondenceInitializationTests.cs

@@ -499,5 +499,64 @@ public async Task InitializeCorrespondence_RecipientIsReservedButIgnoreReservati
             // Assert
             Assert.Equal(HttpStatusCode.OK, initializeCorrespondenceResponse.StatusCode);
         }
+
+        [Fact]
+        public async Task IntializeCorrespondence_WithValidReplyOptions_ReturnsOK()
+        {
+            // Arrange
+            var payload = new CorrespondenceBuilder()
+                .CreateCorrespondence()
+                .WithReplyOptions(new List<CorrespondenceReplyOptionExt>
+                {
+                    new CorrespondenceReplyOptionExt
+                    {
+                        LinkURL = "https://www.altinn.no",
+                        LinkText = "Altinn"
+                    }
+                })
+                .Build();
+
+            // Act
+            var initializeCorrespondenceResponse = await _senderClient.PostAsJsonAsync("correspondence/api/v1/correspondence", payload);
+
+            // Assert
+            Assert.Equal(HttpStatusCode.OK, initializeCorrespondenceResponse.StatusCode);
+        }
+        [Fact]
+        public async Task InitializeCorrespondence_WithInvalidReplyOptions_ReturnsBadRequest()
+        {
+            // Arrange
+            var payload = new CorrespondenceBuilder()
+                .CreateCorrespondence()
+                .WithReplyOptions(new List<CorrespondenceReplyOptionExt>
+                {
+                    new CorrespondenceReplyOptionExt
+                    {
+                        LinkURL = "http://www.altinn.no",
+                        LinkText = "Altinn"
+                    }
+                })
+                .Build();
+
+            // Act
+            var initializeCorrespondenceResponse = await _senderClient.PostAsJsonAsync("correspondence/api/v1/correspondence", payload);
+            // Assert
+            Assert.Equal(HttpStatusCode.BadRequest, initializeCorrespondenceResponse.StatusCode);
+
+            payload.Correspondence.ReplyOptions.First().LinkURL = "www.altinn.no";
+            initializeCorrespondenceResponse = await _senderClient.PostAsJsonAsync("correspondence/api/v1/correspondence", payload);
+            // Assert
+            Assert.Equal(HttpStatusCode.BadRequest, initializeCorrespondenceResponse.StatusCode);
+
+            payload.Correspondence.ReplyOptions.First().LinkURL = "https://www.al tinn.no";
+            initializeCorrespondenceResponse = await _senderClient.PostAsJsonAsync("correspondence/api/v1/correspondence", payload);
+            // Assert
+            Assert.Equal(HttpStatusCode.BadRequest, initializeCorrespondenceResponse.StatusCode);
+
+            payload.Correspondence.ReplyOptions.First().LinkURL = "C:\\Users\\User\\Desktop";
+            initializeCorrespondenceResponse = await _senderClient.PostAsJsonAsync("correspondence/api/v1/correspondence", payload);
+            // Assert
+            Assert.Equal(HttpStatusCode.BadRequest, initializeCorrespondenceResponse.StatusCode);
+        }
     }
 }

src/Altinn.Correspondence.API/Models/CorrespondenceReplyOptionExt.cs

@@ -1,4 +1,5 @@
 using System.Text.Json.Serialization;
+using System.ComponentModel.DataAnnotations;
 
 namespace Altinn.Correspondence.API.Models
 {
@@ -11,6 +12,7 @@ public class CorrespondenceReplyOptionExt
         /// <summary>
         /// Gets or sets the URL to be used as a reply/response to a correspondence. 
         /// </summary>
+        [IsLink]
         [JsonPropertyName("linkURL")]
         public required string LinkURL { get; set; }
 
@@ -19,5 +21,42 @@ public class CorrespondenceReplyOptionExt
         /// </summary>
         [JsonPropertyName("linkText")]
         public string? LinkText { get; set; }
+
+        [AttributeUsage(AttributeTargets.Property)]
+        internal class IsLinkAttribute : ValidationAttribute
+        {
+            private const int maxLength = 255;
+            private const string httpsPrefix = "https://";
+            private const string httpPrefix = "http://";
+            public IsLinkAttribute()
+            {
+
+            }
+
+            protected override ValidationResult? IsValid(object? value, ValidationContext validationContext)
+            {
+                if (value is not string strValue)
+                {
+                    return new ValidationResult("LinkURL is not of type string");
+                }
+                if (strValue.Length > maxLength)
+                {
+                    return new ValidationResult($"LinkURL  must not exceed {maxLength} characters");
+                }
+                if (!Uri.IsWellFormedUriString((string)value, UriKind.Absolute))
+                {
+                    return new ValidationResult("LinkURL is not a valid URL");
+                }
+                if (strValue.StartsWith(httpPrefix, StringComparison.OrdinalIgnoreCase))
+                {
+                    return new ValidationResult("LinkURL must use HTTPS");
+                }
+                if (!strValue.StartsWith(httpsPrefix, StringComparison.OrdinalIgnoreCase))
+                {
+                    return new ValidationResult($"LinkURL must start with{httpsPrefix}");
+                }
+                return ValidationResult.Success;
+            }
+        }
     }
 }