schema

func ConvertToOpenAPISchema ¶

func ConvertToOpenAPISchema(schemaData any) (*openapi3.Schema, error)

ConvertToOpenAPISchema converts the schema any to OpenAPI schema

func ExtractSensitiveFieldPaths ¶ added in v0.55.0

func ExtractSensitiveFieldPaths(schema map[string]any, prefix string) []string

ExtractSensitiveFieldPaths recursively walks the schema and returns paths to fields marked with x-radius-sensitive. The prefix parameter builds up the path as we traverse nested objects. Supports object properties, array items, and additionalProperties (maps). If a field is marked sensitive, its nested properties are not checked since the entire field is considered sensitive.

func GetSchema ¶ added in v0.55.0

func GetSchema(ctx context.Context, ucpClient *v20231001preview.ClientFactory, resourceID string, resourceType string, apiVersion string) (map[string]any, error)

GetSchema fetches the OpenAPI schema for a resource type and api version. Returns nil if the schema is not found or the client is nil.

func GetSecretsBlock ¶

func GetSecretsBlock(schema map[string]any) ([]string, bool)

GetSecretsBlock inspects a resource type OpenAPI schema and returns the names of the recipe secret output keys declared under the top-level `secrets` object property. The second return value reports whether a `secrets` block is present at all. The returned keys are sorted for deterministic ordering.

A resource type declares its recipe secret outputs like this:

properties:
  secrets:
    type: object
    properties:
      name:
        type: string
        readOnly: true
      connectionString:
        type: string
        readOnly: true

For the schema above GetSecretsBlock returns (["connectionString"], true): the reserved `name` reference is excluded, and only readOnly sub-properties are returned (they are recipe secret outputs to materialize). Writable sub-properties are reserved for future secret inputs and are not returned here. The `secrets` block itself is intentionally not required to be readOnly.

func GetSensitiveFieldPaths ¶ added in v0.55.0

func GetSensitiveFieldPaths(ctx context.Context, ucpClient *v20231001preview.ClientFactory, resourceID string, resourceType string, apiVersion string) ([]string, error)

GetSensitiveFieldPaths fetches the schema for a resource and returns paths to fields marked with x-radius-sensitive. Paths are in dot notation, e.g., "credentials.password" or "config.apiKey".

Parameters:

• ctx: The request context
• ucpClient: UCP client factory for fetching the schema
• resourceID: The full resource ID (e.g., "/planes/radius/local/resourceGroups/test/providers/Foo.Bar/myResources/test")
• resourceType: The resource type (e.g., "Foo.Bar/myResources")
• apiVersion: The API version to fetch the schema for

Returns:

• []string: Paths to sensitive fields, or empty slice if none found
• error: Any error encountered while fetching the schema

func HasSecretsBlock ¶

func HasSecretsBlock(schema map[string]any) bool

HasSecretsBlock reports whether the given resource type schema declares a `secrets` block.

func RedactFields ¶ added in v0.55.0

func RedactFields(data map[string]any, paths []string)

RedactFields sets the values at the given field paths to nil in the data map. Paths support dot notation, wildcards [*], and array indices [N]. Missing fields and invalid paths are silently skipped.

func ValidateResourceAgainstSchema ¶ added in v0.50.0

func ValidateResourceAgainstSchema(ctx context.Context, resourceData map[string]any, schemaData any) error

ValidateResourceAgainstSchema validates resource data against an OpenAPI 3.0 schema. It converts the schema data to OpenAPI format, creates a minimal OpenAPI document for validation, and then validates the resource data against the schema using OpenAPI's built-in validation.

func ValidateSecretsBlock ¶

func ValidateSecretsBlock(schema map[string]any) error

ValidateSecretsBlock validates the shape of the `secrets` block in a resource type schema, if present. The block must be an object. Every declared sub-property must be a string. The reserved `name` reference sub-property, if present, must be readOnly. The block itself is intentionally not required to be readOnly, and data sub-properties are not required to be readOnly, so the block can hold both recipe secret outputs (readOnly) and, in future, writable secret inputs. It returns nil when no `secrets` block is declared.