validate.go

package kployconfig

import (
	"errors"
	"fmt"
	"net/mail"
	"regexp"
	"strings"
	"text/template"
)

var (
	// projectNameRE: 3–13 chars, leading lowercase letter, then
	// lowercase alphanumeric or dashes. Constrains the project name
	// since it becomes part of namespace names ("foo-pr-42") and
	// hostnames ("foo-pr-42.bitcomplete.dev") that must remain RFC 1123
	// compliant and short.
	projectNameRE = regexp.MustCompile(`^[a-z][a-z0-9-]{2,12}$`)

	// k8sNameRE: RFC 1123 DNS label (Kubernetes name format).
	k8sNameRE = regexp.MustCompile(`^[a-z]([-a-z0-9]*[a-z0-9])?$`)

	// envVarRE: shell-style upper snake case (e.g. AUTH_SECRET).
	envVarRE = regexp.MustCompile(`^[A-Z][A-Z0-9_]*$`)
)

// Validate runs all schema rules over cfg. Returns ValidationErrors
// (non-nil) if any rule fails; nil otherwise.
//
// Rules are accumulated rather than short-circuiting so callers see
// every problem at once (matters for CLI UX).
func Validate(cfg *Config) error {
	if cfg == nil {
		return errors.New("nil config")
	}
	var errs ValidationErrors

	if cfg.Project == "" {
		errs = append(errs, ValidationError{"project", "required"})
	} else if !projectNameRE.MatchString(cfg.Project) {
		errs = append(errs, ValidationError{
			"project",
			fmt.Sprintf("must match %s (got %q)", projectNameRE, cfg.Project),
		})
	}

	if cfg.Hostname != nil && cfg.Hostname.Template != "" {
		if _, err := template.New("hostname").Parse(cfg.Hostname.Template); err != nil {
			errs = append(errs, ValidationError{
				"hostname.template",
				"invalid Go template: " + err.Error(),
			})
		}
	}

	if cfg.Preview != nil && cfg.Preview.Enabled {
		errs = append(errs, validatePreviewEnabled(cfg)...)
	}

	if len(errs) > 0 {
		return errs
	}
	return nil
}

func validatePreviewEnabled(cfg *Config) ValidationErrors {
	var errs ValidationErrors
	p := cfg.Preview

	if len(cfg.Admins) == 0 {
		errs = append(errs, ValidationError{
			"admins",
			"required when preview.enabled is true",
		})
	}
	for i, addr := range cfg.Admins {
		if _, err := mail.ParseAddress(addr); err != nil {
			errs = append(errs, ValidationError{
				fmt.Sprintf("admins[%d]", i),
				"invalid email: " + err.Error(),
			})
		}
	}

	if p.Template == "" {
		errs = append(errs, ValidationError{
			"preview.template",
			"required when preview.enabled is true",
		})
	}

	if len(p.Ingress) == 0 {
		errs = append(errs, ValidationError{
			"preview.ingress",
			"must have at least one entry when preview.enabled is true",
		})
	}
	for i, ing := range p.Ingress {
		base := fmt.Sprintf("preview.ingress[%d]", i)
		if ing.Service.Name == "" {
			errs = append(errs, ValidationError{base + ".service.name", "required"})
		} else if !k8sNameRE.MatchString(ing.Service.Name) {
			errs = append(errs, ValidationError{
				base + ".service.name",
				"must be a valid RFC 1123 DNS label",
			})
		}
		if ing.Service.Port < 1 || ing.Service.Port > 65535 {
			errs = append(errs, ValidationError{
				base + ".service.port",
				fmt.Sprintf("must be in range 1-65535 (got %d)", ing.Service.Port),
			})
		}
	}

	if p.ImageTagPattern != "" &&
		!strings.Contains(p.ImageTagPattern, "{number}") &&
		!strings.Contains(p.ImageTagPattern, "{sha7}") {
		errs = append(errs, ValidationError{
			"preview.imageTagPattern",
			"must contain at least one of {number} or {sha7}",
		})
	}

	for i, s := range p.InheritSecrets {
		if !k8sNameRE.MatchString(s) {
			errs = append(errs, ValidationError{
				fmt.Sprintf("preview.inheritSecrets[%d]", i),
				"must be a valid RFC 1123 DNS label",
			})
		}
	}

	for i, s := range p.GeneratedSecrets {
		if !envVarRE.MatchString(s) {
			errs = append(errs, ValidationError{
				fmt.Sprintf("preview.generatedSecrets[%d]", i),
				fmt.Sprintf("must match %s", envVarRE),
			})
		}
	}

	return errs
}