Documentation
¶
Overview ¶
Package validation provides cross-database validation for TMI models. These validators replace PostgreSQL CHECK constraints to enable consistent validation across all supported databases.
Index ¶
- Variables
- func IsBuiltInGroup(groupUUID string) bool
- func ValidateAssetType(assetType string) error
- func ValidateDiagramType(diagramType string) error
- func ValidateEntityType(entityType string) error
- func ValidateEnum(field, value string, allowed []string) error
- func ValidateEnumPtr(field string, value *string, allowed []string) error
- func ValidateLength(field, value string, minLen, maxLen int) error
- func ValidateMetadataKey(key string) error
- func ValidateMetadataValue(value string) error
- func ValidateNonEmpty(field, value string) error
- func ValidateNotEveryoneGroup(groupUUID string) error
- func ValidateNotEveryoneGroupMember(groupUUID string) error
- func ValidateRepositoryType(repoType string) error
- func ValidateRole(role string) error
- func ValidateScore(score *float64) error
- func ValidateStatusLength(status *string) error
- func ValidateSubjectType(subjectType string) error
- func ValidateSubjectXOR(subjectType string, userUUID, groupUUID *string) error
- func ValidateThreatModelFramework(framework string) error
- func ValidateURI(field, uri string) error
- func ValidateWebSocketURL(url string) error
- func ValidateWebhookDeliveryStatus(status string) error
- func ValidateWebhookPatternType(patternType string) error
- func ValidateWebhookStatus(status string) error
- type ValidationError
Constants ¶
This section is empty.
Variables ¶
var ( // ValidThreatModelFrameworks are the allowed threat modeling frameworks ValidThreatModelFrameworks = []string{"CIA", "STRIDE", "LINDDUN", "DIE", "PLOT4ai"} // ValidDiagramTypes are the allowed diagram types ValidDiagramTypes = []string{"DFD-1.0.0"} // ValidAssetTypes are the allowed asset types ValidAssetTypes = []string{"data", "hardware", "software", "infrastructure", "service", "personnel"} // ValidRepositoryTypes are the allowed repository types ValidRepositoryTypes = []string{"git", "svn", "mercurial", "other"} // ValidRoles are the allowed access roles ValidRoles = []string{"owner", "writer", "reader"} // ValidSubjectTypes are the allowed subject types for access control ValidSubjectTypes = []string{"user", "group"} // ValidWebhookStatuses are the allowed webhook subscription statuses ValidWebhookStatuses = []string{"pending_verification", "active", "pending_delete"} // ValidWebhookDeliveryStatuses are the allowed webhook delivery statuses ValidWebhookDeliveryStatuses = []string{"pending", "delivered", "failed"} // ValidWebhookPatternTypes are the allowed webhook URL deny list pattern types ValidWebhookPatternTypes = []string{"glob", "regex"} // ValidEntityTypes are the allowed metadata entity types ValidEntityTypes = []string{"threat_model", "threat", "diagram", "document", "repository", "cell", "note", "asset", "survey", "survey_response", "team", "project"} // EveryonePseudoGroupUUID is the reserved UUID for the "everyone" pseudo-group EveryonePseudoGroupUUID = "00000000-0000-0000-0000-000000000000" // SecurityReviewersGroupUUID is the well-known UUID for the Security Reviewers group. SecurityReviewersGroupUUID = "00000000-0000-0000-0000-000000000001" // AdministratorsGroupUUID is the well-known UUID for the Administrators built-in group. AdministratorsGroupUUID = "00000000-0000-0000-0000-000000000002" // ConfidentialProjectReviewersGroupUUID is the well-known UUID for the Confidential Project Reviewers group. ConfidentialProjectReviewersGroupUUID = "00000000-0000-0000-0000-000000000003" // TMIAutomationGroupUUID is the well-known UUID for the TMI Automation built-in group. TMIAutomationGroupUUID = "00000000-0000-0000-0000-000000000004" // EmbeddingAutomationGroupUUID is the well-known UUID for the Embedding Automation built-in group. EmbeddingAutomationGroupUUID = "00000000-0000-0000-0000-000000000005" )
Valid enum values for various fields
var BuiltInGroupUUIDs = []string{ EveryonePseudoGroupUUID, SecurityReviewersGroupUUID, AdministratorsGroupUUID, ConfidentialProjectReviewersGroupUUID, TMIAutomationGroupUUID, EmbeddingAutomationGroupUUID, }
BuiltInGroupUUIDs contains the UUIDs of all built-in groups that cannot be deleted or renamed
Functions ¶
func IsBuiltInGroup ¶
IsBuiltInGroup returns true if the given UUID belongs to a built-in group SEM@3d0d5a8cf02fa74fad102f0f99c2b936a164bbea: check whether a group UUID belongs to a built-in system group (pure)
func ValidateAssetType ¶
ValidateAssetType validates the asset type field SEM@acf29174839ed9f1cb1950265092e2bdacdcb5bd: validate an asset type value against allowed asset types (pure)
func ValidateDiagramType ¶
ValidateDiagramType validates the diagram type field SEM@acf29174839ed9f1cb1950265092e2bdacdcb5bd: validate a diagram type value against allowed diagram types (pure)
func ValidateEntityType ¶
ValidateEntityType validates the metadata entity type field SEM@acf29174839ed9f1cb1950265092e2bdacdcb5bd: validate a metadata entity type value against allowed entity types (pure)
func ValidateEnum ¶
ValidateEnum checks if a value is in an allowed list (case-insensitive). SEM@034968fa0e0ba8c15e9af9052b475f4d5dd72d50: validate that a string value belongs to an allowed enum list, case-insensitively (pure)
func ValidateEnumPtr ¶
ValidateEnumPtr validates an optional enum field SEM@acf29174839ed9f1cb1950265092e2bdacdcb5bd: validate an optional enum field, passing nil values (pure)
func ValidateLength ¶
ValidateLength checks string length constraints SEM@7cd4e086ca351285b214de56af06e83e3a2a8807: validate that a string field falls within minimum and maximum length bounds (pure)
func ValidateMetadataKey ¶
ValidateMetadataKey validates a metadata key SEM@acf29174839ed9f1cb1950265092e2bdacdcb5bd: validate a metadata key for non-empty, length, and alphanumeric-plus-hyphen pattern (pure)
func ValidateMetadataValue ¶
ValidateMetadataValue validates a metadata value SEM@acf29174839ed9f1cb1950265092e2bdacdcb5bd: validate a metadata value for non-empty and maximum 65535-character length (pure)
func ValidateNonEmpty ¶
ValidateNonEmpty checks that a string is not empty after trimming SEM@acf29174839ed9f1cb1950265092e2bdacdcb5bd: validate that a string field is non-empty after trimming whitespace (pure)
func ValidateNotEveryoneGroup ¶
ValidateNotEveryoneGroup checks that operations don't target the protected "everyone" group SEM@acf29174839ed9f1cb1950265092e2bdacdcb5bd: reject operations targeting the protected everyone pseudo-group (pure)
func ValidateNotEveryoneGroupMember ¶
ValidateNotEveryoneGroupMember checks that members aren't added to "everyone" group SEM@acf29174839ed9f1cb1950265092e2bdacdcb5bd: reject adding members to the protected everyone pseudo-group (pure)
func ValidateRepositoryType ¶
ValidateRepositoryType validates the repository type field SEM@acf29174839ed9f1cb1950265092e2bdacdcb5bd: validate a repository type value against allowed repository types (pure)
func ValidateRole ¶
ValidateRole validates the access role field SEM@acf29174839ed9f1cb1950265092e2bdacdcb5bd: validate an access role value against allowed roles (pure)
func ValidateScore ¶
ValidateScore validates a threat score (0.0 to 10.0) SEM@acf29174839ed9f1cb1950265092e2bdacdcb5bd: validate an optional threat score is within the 0.0-10.0 range (pure)
func ValidateStatusLength ¶
ValidateStatusLength validates optional status field length (max 128) SEM@acf29174839ed9f1cb1950265092e2bdacdcb5bd: validate an optional status field does not exceed 128 characters (pure)
func ValidateSubjectType ¶
ValidateSubjectType validates the subject type field SEM@acf29174839ed9f1cb1950265092e2bdacdcb5bd: validate a subject type value against allowed subject types (pure)
func ValidateSubjectXOR ¶
ValidateSubjectXOR validates the XOR constraint for subject_type/user_internal_uuid/group_internal_uuid Used by ThreatModelAccess and Administrator models SEM@acf29174839ed9f1cb1950265092e2bdacdcb5bd: validate that exactly one of user or group UUID is set consistent with subject type (pure)
func ValidateThreatModelFramework ¶
ValidateThreatModelFramework validates the threat model framework field SEM@acf29174839ed9f1cb1950265092e2bdacdcb5bd: validate a threat model framework value against allowed frameworks (pure)
func ValidateURI ¶
ValidateURI validates that a URI is not empty SEM@acf29174839ed9f1cb1950265092e2bdacdcb5bd: validate that a URI field is non-empty after trimming (pure)
func ValidateWebSocketURL ¶
ValidateWebSocketURL validates that a WebSocket URL is not empty SEM@acf29174839ed9f1cb1950265092e2bdacdcb5bd: validate that a WebSocket URL is non-empty after trimming (pure)
func ValidateWebhookDeliveryStatus ¶
ValidateWebhookDeliveryStatus validates the webhook delivery status field SEM@acf29174839ed9f1cb1950265092e2bdacdcb5bd: validate a webhook delivery status value against allowed delivery statuses (pure)
func ValidateWebhookPatternType ¶
ValidateWebhookPatternType validates the webhook URL deny list pattern type SEM@acf29174839ed9f1cb1950265092e2bdacdcb5bd: validate a webhook URL deny-list pattern type against allowed pattern types (pure)
func ValidateWebhookStatus ¶
ValidateWebhookStatus validates the webhook subscription status field SEM@acf29174839ed9f1cb1950265092e2bdacdcb5bd: validate a webhook subscription status value against allowed statuses (pure)
Types ¶
type ValidationError ¶
ValidationError represents a validation failure SEM@acf29174839ed9f1cb1950265092e2bdacdcb5bd: structured validation error carrying field name and message (pure)
func NewValidationError ¶
func NewValidationError(field, message string) *ValidationError
NewValidationError creates a new validation error SEM@acf29174839ed9f1cb1950265092e2bdacdcb5bd: build a ValidationError for a named field with a given message (pure)
func (*ValidationError) Error ¶
func (e *ValidationError) Error() string
SEM@acf29174839ed9f1cb1950265092e2bdacdcb5bd: format the validation error as a field-prefixed message string (pure)
Source Files