Validate portable workspace identifiers

internal/config/validate.go

@@ -53,6 +53,9 @@ func validateCampaign(cfg *CampaignConfig) error {
 	if CampaignID(cfg) == "" {
 		return fmt.Errorf("campaign.campaign_id is required")
 	}
+	if err := pathsafe.ValidateOpaqueSegment(cfg.CampaignID); err != nil {
+		return fmt.Errorf("campaign.campaign_id: %w", err)
+	}
 	if strings.TrimSpace(cfg.Inputs.SpeakersFile) == "" {
 		return fmt.Errorf("campaign.inputs.speakers_file is required")
 	}
@@ -75,6 +78,11 @@ func validatePipeline(cfg *PipelineConfig) error {
 	if strings.TrimSpace(cfg.Workspace.Root) == "" {
 		return fmt.Errorf("pipeline.workspace.root is required")
 	}
+	if campaignID := cfg.Campaigns.DefaultCampaignID; campaignID != "" {
+		if err := pathsafe.ValidateOpaqueSegment(campaignID); err != nil {
+			return fmt.Errorf("pipeline.campaigns.default_campaign_id: %w", err)
+		}
+	}
 	if err := validateSecrets(cfg.Secrets); err != nil {
 		return err
 	}
@@ -717,6 +725,9 @@ func validateSession(cfg *SessionConfig) error {
 	if strings.TrimSpace(cfg.Campaign) == "" {
 		return fmt.Errorf("session.campaign is required")
 	}
+	if err := pathsafe.ValidateOpaqueSegment(cfg.Campaign); err != nil {
+		return fmt.Errorf("session.campaign: %w", err)
+	}
 
 	if strings.TrimSpace(cfg.Inputs.SpeakersFile) == "" {
 		return fmt.Errorf("session.inputs.speakers_file is required")
@@ -762,6 +773,9 @@ func validateSessionIdentifier(fieldName, value string, required bool) error {
 		}
 		return nil
 	}
+	if err := pathsafe.ValidateOpaqueSegment(value); err != nil {
+		return fmt.Errorf("%s: %w", fieldName, err)
+	}
 	return nil
 }