// In the future, have a SystemOnly property on actions that would define whether they can be executed where an
// external source supplies the name of the action to execute. For non-SystemOnly authorizer-less actions, use
// a controller-supplied default authorizer (probably isSystemAdmin).
if (externalActionSelection && action.getAuthorizationStrategy() == null)
{
throw new InvalidActionException(
"Action must have an authorizer to run when external action selection is allowed.");
}
// Since there's no good way to tell if an action actually needs/uses a principal (just because it's a
// ServiceAction doesn't mean it actually does anything with a principal), the check to prevent
// principal-requiring actions from running where there is no principal has been omitted.