Documentation
¶
Overview ¶
Package validate provides reusable, deterministic validators for user-supplied CLI inputs. It exists to make the CLI a safe target for AI agents and scripts, which can produce malformed or hostile input — control characters, path traversal, percent-encoding, embedded query parameters, shell metacharacters — in ways humans rarely do.
Validators return an *Error carrying a machine-classifiable Rule so callers can surface a precise, stable reason (and, in JSON output mode, a stable error code) instead of a generic "invalid input" message. Error() returns the bare reason so it composes cleanly when wrapped with caller context.
Index ¶
Constants ¶
const ( RuleEmpty = "empty" RuleControlChars = "control_chars" RuleEncoding = "encoding" RuleEmbedded = "embedded" RuleMetachars = "metachars" RuleFormat = "format" RuleRange = "range" )
Rule classifies why a value was rejected. The values are stable and intended to be surfaced as machine-readable error codes.
Variables ¶
This section is empty.
Functions ¶
func AuthToken ¶
AuthToken validates a LocalStack auth token. The character set is intentionally not restricted — tokens are opaque — so only clearly malformed values are rejected: control characters, embedded whitespace, or an implausible length. An empty token is allowed (it means none is set). Callers should TrimSpace first, since environment injection (e.g. CI secrets) commonly appends a trailing newline.
func EnvVarName ¶
EnvVarName validates an environment variable name (the key of a KEY=VALUE pair).
func NoControlChars ¶
func PodName ¶
PodName validates a Cloud Pod name against the platform's contract. The platform pattern has no length bound; the 128-character cap here is a local sanity limit against absurd inputs, not part of the platform contract. It runs ordered deny-checks so the most specific reason wins, then the allow-list. The deny-checks exist to give precise, machine-classifiable feedback; the allow-list alone would reject every invalid value.
func ServiceList ¶
ServiceList validates and parses a comma-separated --services value. An empty string means "no filter" and returns (nil, nil) — equivalent to omitting the flag. Each item is trimmed of surrounding whitespace; duplicates are preserved (not deduplicated), matching the legacy CLI.
Source Files