Documentation
¶
Overview ¶
Package validate provides reusable, deterministic validators for user-supplied CLI inputs. It exists to make the CLI a safe target for AI agents and scripts, which can produce malformed or hostile input — control characters, path traversal, percent-encoding, embedded query parameters, shell metacharacters — in ways humans rarely do.
Validators return an *Error carrying a machine-classifiable Rule so callers can surface a precise, stable reason (and, in JSON output mode, a stable error code) instead of a generic "invalid input" message. Error() returns the bare reason so it composes cleanly when wrapped with caller context.
Index ¶
- Constants
- func AWSAccountID(value string) error
- func AuthToken(value string) error
- func ContainerName(value string) error
- func EnvVarName(name string) error
- func ExtensionName(value string) error
- func ImageReference(value string) error
- func NoControlChars(field, value string) error
- func PodName(value string) error
- func ServiceList(value string) ([]string, error)
- func SessionID(value string) error
- type Error
Constants ¶
const ( RuleEmpty = "empty" RuleControlChars = "control_chars" RuleEncoding = "encoding" RuleEmbedded = "embedded" RuleMetachars = "metachars" RuleFormat = "format" RuleRange = "range" )
Rule classifies why a value was rejected. The values are stable and intended to be surfaced as machine-readable error codes.
Variables ¶
This section is empty.
Functions ¶
func AWSAccountID ¶ added in v0.22.0
AWSAccountID validates a user-supplied AWS account id. Like PodName it runs ordered deny-checks so the most specific reason wins: a wrong-length value is a range failure, a right-length value with non-digits is a format failure.
func AuthToken ¶
AuthToken validates a LocalStack auth token. The character set is intentionally not restricted — tokens are opaque — so only clearly malformed values are rejected: control characters, embedded whitespace, or an implausible length. An empty token is allowed (it means none is set). Callers should TrimSpace first, since environment injection (e.g. CI secrets) commonly appends a trailing newline.
func ContainerName ¶ added in v0.21.0
ContainerName validates a user-supplied Docker container name. Like PodName it runs ordered deny-checks so the most specific reason wins, then the allow-list. The 128-character cap is a local sanity limit against absurd inputs, not a Docker rule.
func EnvVarName ¶
EnvVarName validates an environment variable name (the key of a KEY=VALUE pair).
func ExtensionName ¶ added in v1.2.0
ExtensionName validates an extension command name taken from the bundled descriptions file (lstk-extensions.toml). Although that file ships with lstk rather than being typed by a user, TOML quoted keys make any string a valid key, so the parser cannot be relied on to reject an undispatchable name. Like PodName it runs ordered deny-checks so the most specific reason wins, then the allow-list. The 64-character cap is a local sanity limit, not a contract.
func ImageReference ¶ added in v1.3.0
ImageReference validates a Docker image reference. The value is not normalized.
func NoControlChars ¶
func PodName ¶
PodName validates a Cloud Pod name against the platform's contract. The platform pattern has no length bound; the 128-character cap here is a local sanity limit against absurd inputs, not part of the platform contract. It runs ordered deny-checks so the most specific reason wins, then the allow-list. The deny-checks exist to give precise, machine-classifiable feedback; the allow-list alone would reject every invalid value.
func ServiceList ¶
ServiceList validates and parses a comma-separated --services value. An empty string means "no filter" and returns (nil, nil) — equivalent to omitting the flag. Each item is trimmed of surrounding whitespace; duplicates are preserved (not deduplicated), matching the legacy CLI.
Source Files