operator profiles - import, reorderable

lib/services/deep_link_service.dart

@@ -3,8 +3,11 @@ import 'package:app_links/app_links.dart';
 import 'package:flutter/material.dart';
 
 import '../models/node_profile.dart';
+import '../models/operator_profile.dart';
 import 'profile_import_service.dart';
+import 'operator_profile_import_service.dart';
 import '../screens/profile_editor.dart';
+import '../screens/operator_profile_editor.dart';
 
 class DeepLinkService {
   static final DeepLinkService _instance = DeepLinkService._internal();
@@ -86,8 +89,16 @@ class DeepLinkService {
     }
   }
   
-  /// Handle profile add deep link: `deflockapp://profiles/add?p=<base64>`
+  /// Handle profile add deep link: `deflockapp://profiles/add?p=<base64>` or `deflockapp://profiles/add?op=<base64>`
   void _handleAddProfileLink(Uri uri) {
+    // Check for operator profile parameter first
+    final operatorBase64Data = uri.queryParameters['op'];
+    if (operatorBase64Data != null && operatorBase64Data.isNotEmpty) {
+      _handleOperatorProfileImport(operatorBase64Data);
+      return;
+    }
+    
+    // Otherwise check for device profile parameter
     final base64Data = uri.queryParameters['p'];
     
     if (base64Data == null || base64Data.isEmpty) {
@@ -107,6 +118,20 @@ class DeepLinkService {
     _navigateToProfileEditor(profile);
   }
   
+  /// Handle operator profile import from deep link
+  void _handleOperatorProfileImport(String base64Data) {
+    // Parse operator profile from base64
+    final operatorProfile = OperatorProfileImportService.parseProfileFromBase64(base64Data);
+    
+    if (operatorProfile == null) {
+      _showError('Invalid operator profile data');
+      return;
+    }
+    
+    // Navigate to operator profile editor with the imported profile
+    _navigateToOperatorProfileEditor(operatorProfile);
+  }
+  
   /// Navigate to profile editor with pre-filled profile data
   void _navigateToProfileEditor(NodeProfile profile) {
     final context = _navigatorKey?.currentContext;
@@ -124,6 +149,23 @@ class DeepLinkService {
     );
   }
   
+  /// Navigate to operator profile editor with pre-filled operator profile data
+  void _navigateToOperatorProfileEditor(OperatorProfile operatorProfile) {
+    final context = _navigatorKey?.currentContext;
+    
+    if (context == null) {
+      debugPrint('[DeepLinkService] No navigator context available');
+      return;
+    }
+    
+    Navigator.push(
+      context,
+      MaterialPageRoute(
+        builder: (_) => OperatorProfileEditor(profile: operatorProfile),
+      ),
+    );
+  }
+  
   /// Show error message to user
   void _showError(String message) {
     final context = _navigatorKey?.currentContext;

lib/services/operator_profile_import_service.dart

@@ -0,0 +1,100 @@
+import 'dart:convert';
+import 'package:flutter/foundation.dart';
+import 'package:uuid/uuid.dart';
+
+import '../models/operator_profile.dart';
+
+class OperatorProfileImportService {
+  // Maximum size for base64 encoded profile data (approx 50KB decoded)
+  static const int maxBase64Length = 70000;
+  
+  /// Parse and validate an operator profile from a base64-encoded JSON string
+  /// Returns null if parsing/validation fails
+  static OperatorProfile? parseProfileFromBase64(String base64Data) {
+    try {
+      // Basic size validation before expensive decode
+      if (base64Data.length > maxBase64Length) {
+        debugPrint('[OperatorProfileImportService] Base64 data too large: ${base64Data.length} characters');
+        return null;
+      }
+
+      // Decode base64
+      final jsonBytes = base64Decode(base64Data);
+      final jsonString = utf8.decode(jsonBytes);
+      
+      // Parse JSON
+      final jsonData = jsonDecode(jsonString) as Map<String, dynamic>;
+      
+      // Validate and sanitize the profile data
+      final sanitizedProfile = _validateAndSanitizeProfile(jsonData);
+      return sanitizedProfile;
+      
+    } catch (e) {
+      debugPrint('[OperatorProfileImportService] Failed to parse profile from base64: $e');
+      return null;
+    }
+  }
+  
+  /// Validate operator profile structure and sanitize all string values
+  static OperatorProfile? _validateAndSanitizeProfile(Map<String, dynamic> data) {
+    try {
+      // Extract and sanitize required fields
+      final name = _sanitizeString(data['name']);
+      if (name == null || name.isEmpty) {
+        debugPrint('[OperatorProfileImportService] Operator profile name is required');
+        return null;
+      }
+      
+      // Extract and sanitize tags
+      final tagsData = data['tags'];
+      if (tagsData is! Map<String, dynamic>) {
+        debugPrint('[OperatorProfileImportService] Operator profile tags must be a map');
+        return null;
+      }
+      
+      final sanitizedTags = <String, String>{};
+      for (final entry in tagsData.entries) {
+        final key = _sanitizeString(entry.key);
+        final value = _sanitizeString(entry.value);
+        
+        if (key != null && key.isNotEmpty) {
+          // Allow empty values for refinement purposes
+          sanitizedTags[key] = value ?? '';
+        }
+      }
+      
+      if (sanitizedTags.isEmpty) {
+        debugPrint('[OperatorProfileImportService] Operator profile must have at least one valid tag');
+        return null;
+      }
+      
+      return OperatorProfile(
+        id: const Uuid().v4(), // Always generate new ID for imported profiles
+        name: name,
+        tags: sanitizedTags,
+      );
+      
+    } catch (e) {
+      debugPrint('[OperatorProfileImportService] Failed to validate operator profile: $e');
+      return null;
+    }
+  }
+  
+  /// Sanitize a string value by trimming and removing potentially harmful characters
+  static String? _sanitizeString(dynamic value) {
+    if (value == null) return null;
+    
+    final str = value.toString().trim();
+    
+    // Remove control characters and limit length
+    final sanitized = str.replaceAll(RegExp(r'[\x00-\x1F\x7F]'), '');
+    
+    // Limit length to prevent abuse
+    const maxLength = 500;
+    if (sanitized.length > maxLength) {
+      return sanitized.substring(0, maxLength);
+    }
+    
+    return sanitized;
+  }
+}