Add preflight validation for selected community Nuclei templates

app/main.py

@@ -116,6 +116,28 @@ async def nuclei_template_defaults():
     }
 
 
+class NucleiTemplateCheckRequest(BaseModel):
+    paths: list[str] = Field(default_factory=list, max_length=config.NUCLEI_COMMUNITY_MAX)
+
+
+@app.post("/api/nuclei/check", dependencies=[Depends(authorize)])
+async def check_nuclei_community_templates(payload: NucleiTemplateCheckRequest):
+    if not payload.paths or len(payload.paths) != len(set(payload.paths)):
+        raise HTTPException(422, "Select distinct community template paths")
+    try:
+        nuclei_catalog.validate_selection([], payload.paths, [])
+    except ValueError as exc:
+        raise HTTPException(422, str(exc))
+    compatible, rejected = [], []
+    for path in payload.paths:
+        try:
+            await nuclei_catalog.community_files([path])
+            compatible.append(path)
+        except (ValueError, httpx.HTTPError) as exc:
+            rejected.append({"path": path, "reason": str(exc)[:180]})
+    return {"compatible": compatible, "rejected": rejected}
+
+
 @app.get("/api/nuclei/templates", dependencies=[Depends(authorize)])
 async def search_nuclei_templates(q: str = "", page: int = 1):
     try:

tests/test_nuclei_check_api.py

@@ -0,0 +1,28 @@
+from unittest.mock import patch
+from fastapi.testclient import TestClient
+from app import main
+
+
+def test_nuclei_template_check_reports_supported_and_unsupported():
+    async def fake(paths):
+        if paths[0].endswith("bad.yaml"):
+            raise ValueError("Only GET/HEAD templates supported")
+        return {paths[0]: "safe"}
+    with patch.object(main.nuclei_catalog, "community_files", fake):
+        with TestClient(main.app) as client:
+            res=client.post("/api/nuclei/check",json={"paths":["http/web/a.yaml","http/web/bad.yaml"]})
+    assert res.status_code==200
+    assert res.json()["compatible"]==["http/web/a.yaml"]
+    assert len(res.json()["rejected"])==1
+
+
+def test_nuclei_template_check_rejects_disallowed_repo_paths():
+    with TestClient(main.app) as client:
+        response=client.post("/api/nuclei/check",json={"paths":["http/../../etc/passwd"]})
+    assert response.status_code==422
+
+
+def test_nuclei_template_check_rejects_duplicate_paths():
+    with TestClient(main.app) as client:
+        response=client.post("/api/nuclei/check",json={"paths":["http/a.yaml","http/a.yaml"]})
+    assert response.status_code==422