Documentation
¶
Overview ¶
Package validation provides shared validation primitives used by both the API layer (pkg/secrets) and the in-pod materializer (pkg/agentd/secrets). Keeping validation here prevents drift between the two code paths.
Index ¶
Constants ¶
const EnvVarNameMaxLength = 256
EnvVarNameMaxLength is the maximum length of a workspace env-var name. Matches the existing cap in pkg/agentd/secrets/secrets.go:226 (256).
const EnvVarNamePattern = `^[A-Za-z_][A-Za-z0-9_]*$`
EnvVarNamePattern is the regex pattern (as a string) that POSIX- portable env-var names must match: a letter or underscore, followed by letters, digits, or underscores. Bash, sh, and every common interpreter accept this shape. Matches the existing regex in pkg/agentd/secrets/secrets.go:203 — single source of truth lives here.
const SecretNamePattern = `^[a-z0-9._-]+$`
SecretNamePattern is the regex pattern (as a string) that secret names must match. Frontend teams SHOULD copy this exact string into their client-side validation (e.g., React Hook Form pattern or zod .regex()). This package is the single source of truth — file an issue against pkg/validation if the pattern needs to change.
Variables ¶
var EnvVarNameRE = regexp.MustCompile(EnvVarNamePattern)
EnvVarNameRE is the compiled regex for EnvVarNamePattern.
var ErrEnvVarNameBlocked = errors.New("env var name is on the dangerous-names blocklist")
ErrEnvVarNameBlocked is returned by ValidateEnvVarName when the name is on the dangerous-names blocklist. The error message names the offending variable so the user knows it was an intentional rejection rather than a regex miss.
var SecretNameRE = regexp.MustCompile(SecretNamePattern)
SecretNameRE is the compiled regex for SecretNamePattern. Exported so callers can use it directly in Go.
Functions ¶
func IsBlockedEnvVarName ¶ added in v0.4.0
IsBlockedEnvVarName reports whether name would be rejected by ValidateEnvVarName solely on the dangerous-names blocklist. Useful for callers that want to surface the blocklist reason separately from the regex/length reasons.
func ValidateEnvVarName ¶ added in v0.4.0
ValidateEnvVarName validates a workspace env-var name against three rules:
- POSIX-portable shape: [A-Za-z_][A-Za-z0-9_]* (case-sensitive on the regex; the dangerous-name check below is case-insensitive).
- Length ≤ 256.
- Not on the dangerous-names blocklist (G37) — compared case- insensitively because ld.so and several interpreters accept the lowercase form on some platforms.
Shared between the API layer (api/internal/handlers/workspace_env.go) and the in-pod materializer (pkg/agentd/secrets/secrets.go) so the two layers cannot drift.
func ValidateSecretName ¶
ValidateSecretName validates a secret name against the shared rules. Returns nil if valid, or a descriptive error.
Types ¶
This section is empty.
Source Files