nxd_core/domain/contract/

validation.rs

use super::{
	CanonicalConfig, PROVIDER_PROTOCOL_V1, Resource, SECRET_PROTOCOL_V1, SecretResolverInstance,
	resource_depends_on, resource_id,
};
use std::collections::{BTreeMap, BTreeSet};

#[derive(Clone, Debug, PartialEq, Eq)]
pub struct ContractValidationError(pub String);

pub fn validate_canonical_config(config: &CanonicalConfig) -> Result<(), ContractValidationError> {
	let mut providers = BTreeMap::new();
	for provider in &config.spec.provider_instances {
		if provider.id.is_empty()
			|| provider.kind.is_empty()
			|| provider.id.chars().any(char::is_control)
			|| provider.kind.chars().any(char::is_control)
		{
			return Err(ContractValidationError(format!(
				"provider instance {} has an invalid id or kind",
				provider.id
			)));
		}
		if providers.insert(provider.id.as_str(), provider.kind.as_str()).is_some() {
			return Err(ContractValidationError(format!(
				"duplicate provider instance id {}",
				provider.id
			)));
		}
		validate_provider_executable_declaration(provider)?;
	}
	let mut secret_resolvers = BTreeSet::new();
	for resolver in &config.spec.secret_resolvers {
		validate_secret_resolver_declaration(resolver)?;
		if !secret_resolvers.insert(resolver.id.as_str()) {
			return Err(ContractValidationError(format!("duplicate secret resolver id {}", resolver.id)));
		}
	}
	let mut secret_bindings = BTreeSet::new();
	for binding in &config.spec.secret_bindings {
		if !(binding.id.starts_with("secret/") || binding.id.starts_with("public/"))
			|| !secret_bindings.insert(binding.id.as_str())
			|| binding.resolver.is_empty()
			|| binding.reference.is_empty()
			|| binding.reference.chars().any(char::is_control)
			|| binding.reference.contains("PVEAPIToken=")
		{
			return Err(ContractValidationError(format!(
				"secret binding {} has an invalid ID, resolver, or reference",
				binding.id
			)));
		}
		// When secret resolvers are declared, every binding must name one.
		// Empty secretResolvers remains valid for pure fixture configs that do
		// not compose an external secret executable.
		if !secret_resolvers.is_empty() && !secret_resolvers.contains(binding.resolver.as_str()) {
			return Err(ContractValidationError(format!(
				"secret binding {} references unknown secret resolver {}",
				binding.id, binding.resolver
			)));
		}
	}
	for provider in &config.spec.provider_instances {
		let mut provider_bindings = BTreeSet::new();
		for binding_id in &provider.secret_bindings {
			if !binding_id.starts_with("secret/")
				|| !provider_bindings.insert(binding_id.as_str())
				|| !secret_bindings.contains(binding_id.as_str())
			{
				return Err(ContractValidationError(format!(
					"provider instance {} has an unknown or duplicate secret binding {}",
					provider.id, binding_id
				)));
			}
		}
	}
	let mut resources = BTreeMap::new();
	for resource in &config.spec.resources {
		let id = resource_id(resource);
		if resources.insert(id, resource).is_some() {
			return Err(ContractValidationError(format!("duplicate resource ID {id}")));
		}
	}
	for resource in &config.spec.resources {
		let rid = resource_id(resource);
		let dependencies = resource_depends_on(resource);
		if !dependencies.is_empty()
			&& dependencies
				.iter()
				.any(|dependency| dependency == rid || !resources.contains_key(dependency.as_str()))
		{
			return Err(ContractValidationError(format!("resource {rid} has an invalid dependency")));
		}
		if let Resource::ProviderOwned(value) = resource {
			if value.id.is_empty() || value.resource_kind.is_empty() {
				return Err(ContractValidationError(format!(
					"provider-owned resource {} has invalid identity",
					value.id
				)));
			}
			if value.provider.is_empty() {
				return Err(ContractValidationError(format!(
					"provider-owned resource {} is missing provider",
					value.id
				)));
			}
			if !providers.contains_key(value.provider.as_str()) {
				return Err(ContractValidationError(format!(
					"provider-owned resource {} references unknown provider {}",
					value.id, value.provider
				)));
			}
			// Executable command/protocol pairing is composition-time
			// (packaging fills optional packaged providers). Canonical validate
			// only requires the provider instance to exist.
			if let Some(binding) = value.secret_binding.as_ref()
				&& !secret_bindings.contains(binding.as_str())
			{
				return Err(ContractValidationError(format!(
					"provider-owned resource {} references unknown secret binding {binding}",
					value.id
				)));
			}
			if let Some(target) = value.deployment_target.as_ref()
				&& !target.starts_with("deployment-target/")
			{
				return Err(ContractValidationError(format!(
					"provider-owned resource {} has invalid deploymentTarget {target}",
					value.id
				)));
			}
			// Vendor field schemas are provider-owned (handshake resource_kinds).
			if value.resource_kind == "headscalePreauthKey" && value.secret_binding.is_some() {
				return Err(ContractValidationError(format!(
					"headscalePreauthKey resource {} specifies secretBinding; preauth keys deliver single-use keys to ephemeral run bindings",
					value.id
				)));
			}
			if matches!(value.resource_kind.as_str(), "sshHostIdentity" | "trustAnchor") {
				if providers.get(value.provider.as_str()).copied() != Some("identity") {
					return Err(ContractValidationError(format!(
						"managed identity resource {} must be owned by an identity provider",
						value.id
					)));
				}
				let expected_prefix = if value.resource_kind == "sshHostIdentity" {
					"ssh-host-identity/"
				} else {
					"trust-anchor/"
				};
				if !value.id.starts_with(expected_prefix) {
					return Err(ContractValidationError(format!(
						"managed identity resource {} has the wrong ID namespace",
						value.id
					)));
				}
				if value.resource_kind == "sshHostIdentity" {
					let public =
						value.desired.get("publicBinding").and_then(|field| field.as_str()).ok_or_else(
							|| {
								ContractValidationError(format!(
									"managed identity resource {} has no publicBinding",
									value.id
								))
							},
						)?;
					if !public.starts_with("public/") || !secret_bindings.contains(public) {
						return Err(ContractValidationError(format!(
							"managed identity resource {} references unknown public binding {public}",
							value.id
						)));
					}
				}
			}
		}
	}
	for (name, operation_set) in &config.spec.operation_sets {
		if invalid_safe_id_segment(name)
			|| operation_set.selectors.is_empty()
			|| operation_set.selectors.iter().any(|selector| selector.trim().is_empty())
		{
			return Err(ContractValidationError(format!("operation set {name} is invalid")));
		}
		let mut unique = BTreeSet::new();
		if operation_set.selectors.iter().any(|selector| !unique.insert(selector)) {
			return Err(ContractValidationError(format!("operation set {name} repeats a selector")));
		}
		if operation_set.selectors.iter().any(|selector| selector.starts_with("operation:")) {
			return Err(ContractValidationError(format!(
				"operation set {name} may not include another operation set"
			)));
		}
		for selector in &operation_set.selectors {
			let exact_resource_id = selector.contains('/')
				&& !selector.contains('*')
				&& !selector.contains('?')
				&& !selector.starts_with("label:");
			if exact_resource_id && !resources.contains_key(selector.as_str()) {
				return Err(ContractValidationError(format!(
					"operation set {name} refers to unknown resource {selector}"
				)));
			}
		}
		if let Some(ref intent) = operation_set.lifecycle_intent {
			if *intent == crate::domain::host_lifecycle::LifecycleIntent::Install
				&& operation_set.artifact_set.is_some()
			{
				let art_id = operation_set.artifact_set.as_ref().ok_or_else(|| {
					ContractValidationError(format!(
						"operation set {name} has intent {} but is missing an artifactSet",
						intent.as_str()
					))
				})?;
				let artifact_set = config.spec.artifact_sets.iter().find(|art| &art.id == art_id);
				if artifact_set.is_none() {
					return Err(ContractValidationError(format!(
						"operation set {name} refers to unknown artifactSet {art_id}"
					)));
				}
				let artifact_set = artifact_set.expect("artifact set presence checked");
				if *intent == crate::domain::host_lifecycle::LifecycleIntent::Install
					&& artifact_set.installer.is_none()
				{
					return Err(ContractValidationError(format!(
						"operation set {name} has install intent but artifactSet {art_id} has no installer"
					)));
				}
			} else if operation_set.artifact_set.is_some() {
				return Err(ContractValidationError(format!(
					"operation set {name} has intent {} which does not support artifactSet",
					intent.as_str()
				)));
			}
		} else if operation_set.artifact_set.is_some() {
			return Err(ContractValidationError(format!(
				"operation set {name} has no lifecycle intent but specifies an artifactSet"
			)));
		}
	}

	for resource in &config.spec.resources {
		if let Resource::DeploymentTarget(target) = resource {
			let name = target.id.strip_prefix("deployment-target/").unwrap_or("");
			let metadata = &target.metadata;
			let is_valid_system = ["x86_64-linux", "aarch64-linux", "x86_64-darwin", "aarch64-darwin"]
				.contains(&metadata.system.as_str());
			if invalid_safe_id_segment(name)
				|| invalid_text(&metadata.user, 64)
				|| !is_valid_system
				|| !["nixos", "darwin", "home-manager", "wsl", "installer", ""]
					.contains(&metadata.class.as_str())
			{
				return Err(ContractValidationError(format!(
					"deployment target {} has invalid identity or typed metadata",
					target.id
				)));
			}
		}
		// PVE/PBS/Headscale kinds are provider-owned envelopes; field schemas are
		// enforced at plan time via advertised resource_kinds. Core only checks
		// deployment-target identity above and common envelope identity earlier.
	}
	Ok(())
}

fn validate_provider_executable_declaration(
	provider: &super::ProviderInstance,
) -> Result<(), ContractValidationError> {
	match (&provider.command, &provider.protocol) {
		(None, None) => {}
		(Some(command), Some(protocol)) => {
			if invalid_absolute_command(command) {
				return Err(ContractValidationError(format!(
					"provider {} command must be an absolute executable path",
					provider.id
				)));
			}
			if protocol != PROVIDER_PROTOCOL_V1 {
				return Err(ContractValidationError(format!(
					"provider {} protocol must be {PROVIDER_PROTOCOL_V1}",
					provider.id
				)));
			}
		}
		_ => {
			return Err(ContractValidationError(format!(
				"provider {} must declare both command and protocol for external execution",
				provider.id
			)));
		}
	}
	for argument in &provider.arguments {
		if argument.is_empty() || argument.chars().any(char::is_control) {
			return Err(ContractValidationError(format!(
				"provider {} has an invalid fixed argument",
				provider.id
			)));
		}
	}
	Ok(())
}

fn validate_secret_resolver_declaration(
	resolver: &SecretResolverInstance,
) -> Result<(), ContractValidationError> {
	if resolver.id.is_empty()
		|| resolver.id.chars().any(char::is_control)
		|| invalid_absolute_command(&resolver.command)
	{
		return Err(ContractValidationError(format!(
			"secret resolver {} has an invalid id or absolute command",
			resolver.id
		)));
	}
	if resolver.protocol != SECRET_PROTOCOL_V1 {
		return Err(ContractValidationError(format!(
			"secret resolver {} protocol must be {SECRET_PROTOCOL_V1}",
			resolver.id
		)));
	}
	for argument in &resolver.arguments {
		if argument.is_empty() || argument.chars().any(char::is_control) {
			return Err(ContractValidationError(format!(
				"secret resolver {} has an invalid fixed argument",
				resolver.id
			)));
		}
	}
	Ok(())
}

fn invalid_absolute_command(command: &str) -> bool {
	command.is_empty()
		|| !command.starts_with('/')
		|| command.chars().any(char::is_control)
		|| command.contains('\0')
}

fn invalid_text(value: &str, max_len: usize) -> bool {
	value.is_empty() || value.len() > max_len || value.chars().any(char::is_control)
}

fn invalid_safe_id_segment(value: &str) -> bool {
	value.is_empty()
		|| value.len() > 128
		|| !value
			.chars()
			.all(|character| character.is_ascii_alphanumeric() || "._-".contains(character))
}