Add storage backends and safety checks

internal/storage/path.go

@@ -0,0 +1,64 @@
+package storage
+
+import (
+	"path"
+	"sort"
+	"strings"
+)
+
+const stateFileName = ".distributor.json"
+
+func ValidatePath(value string) error {
+	if value == "" {
+		return NewError(OpValidatePath, "", value, ErrInvalidPath, nil)
+	}
+	return validateLogicalPath(value)
+}
+
+func ValidatePrefix(value string) error {
+	if value == "" {
+		return nil
+	}
+	return validateLogicalPath(value)
+}
+
+func Join(base, child string) (string, error) {
+	if err := ValidatePrefix(base); err != nil {
+		return "", err
+	}
+	if err := ValidatePath(child); err != nil {
+		return "", err
+	}
+	if base == "" {
+		return child, nil
+	}
+	return base + "/" + child, nil
+}
+
+func StatePath(bundlePath string) (string, error) {
+	if bundlePath == "" {
+		return stateFileName, nil
+	}
+	return Join(bundlePath, stateFileName)
+}
+
+func SortEntries(entries []Entry) {
+	sort.Slice(entries, func(i, j int) bool {
+		return entries[i].Path < entries[j].Path
+	})
+}
+
+func validateLogicalPath(value string) error {
+	if strings.Contains(value, "\\") || strings.HasPrefix(value, "/") {
+		return NewError(OpValidatePath, "", value, ErrInvalidPath, nil)
+	}
+	if path.Clean(value) != value {
+		return NewError(OpValidatePath, "", value, ErrInvalidPath, nil)
+	}
+	for _, segment := range strings.Split(value, "/") {
+		if segment == "" || segment == "." || segment == ".." {
+			return NewError(OpValidatePath, "", value, ErrInvalidPath, nil)
+		}
+	}
+	return nil
+}