Separate configuration domain validators

internal/config/validate_notarius.go

@@ -0,0 +1,157 @@
+package config
+
+import (
+	"fmt"
+	"path/filepath"
+	"sort"
+	"strings"
+	"time"
+
+	"gitea.maximumdirect.net/eric/narratio/internal/artifactmodel"
+	"gitea.maximumdirect.net/eric/narratio/internal/artifactpolicy"
+	"gitea.maximumdirect.net/eric/narratio/internal/notariusref"
+)
+
+func validateNotarius(cfg *NotariusConfig, scriptorium *ScriptoriumConfig) error {
+	if cfg == nil || !cfg.Enabled {
+		return nil
+	}
+	if strings.TrimSpace(cfg.Binary) == "" {
+		return fmt.Errorf("pipeline.notarius.binary is required when pipeline.notarius.enabled is true")
+	}
+	if strings.TrimSpace(cfg.ConfigPath) == "" {
+		return fmt.Errorf("pipeline.notarius.config_path is required when pipeline.notarius.enabled is true")
+	}
+	if strings.TrimSpace(cfg.PipelineID) == "" {
+		return fmt.Errorf("pipeline.notarius.pipeline_id is required when pipeline.notarius.enabled is true")
+	}
+	if len(cfg.Outputs) == 0 {
+		return fmt.Errorf("pipeline.notarius.outputs must contain at least one output when pipeline.notarius.enabled is true")
+	}
+	duration, err := time.ParseDuration(strings.TrimSpace(cfg.Timeout))
+	if err != nil {
+		return fmt.Errorf("pipeline.notarius.timeout must be a valid duration: %w", err)
+	}
+	if duration <= 0 {
+		return fmt.Errorf("pipeline.notarius.timeout must be positive")
+	}
+	if strings.TrimSpace(cfg.WorkingDirectory) == "" {
+		return fmt.Errorf("pipeline.notarius.working_directory is required when pipeline.notarius.enabled is true")
+	}
+	if len(cfg.References) > MaxNotariusReferenceBindings {
+		return fmt.Errorf("pipeline.notarius.references must contain at most %d bindings", MaxNotariusReferenceBindings)
+	}
+
+	referenceKeys := make([]string, 0, len(cfg.References))
+	for selector := range cfg.References {
+		referenceKeys = append(referenceKeys, selector)
+	}
+	sort.Strings(referenceKeys)
+	var normalizedReferences map[string]string
+	if cfg.References != nil {
+		normalizedReferences = make(map[string]string, len(cfg.References))
+	}
+	referenceOwners := make(map[string]string, len(cfg.References))
+	for _, rawSelector := range referenceKeys {
+		selector, err := notariusref.NormalizeSelector(rawSelector)
+		if err != nil {
+			return fmt.Errorf("pipeline.notarius.references selector %q is invalid: %w", rawSelector, err)
+		}
+		if previous, ok := referenceOwners[selector]; ok {
+			return fmt.Errorf("pipeline.notarius.references selectors %q and %q normalize to %q", previous, rawSelector, selector)
+		}
+		referenceOwners[selector] = rawSelector
+
+		source := strings.TrimSpace(cfg.References[rawSelector])
+		if source == "" {
+			return fmt.Errorf("pipeline.notarius.references.%s source is required", selector)
+		}
+		if _, ok := artifactpolicy.DescribePreparedInputSource(source); !ok {
+			return fmt.Errorf("pipeline.notarius.references.%s source %q is not a supported prepared input source", selector, source)
+		}
+		normalizedReferences[selector] = source
+	}
+
+	reservedSources := map[string]string{}
+	for _, spec := range artifactmodel.RuntimeTranscriptArtifacts() {
+		reservedSources[spec.SourceID] = "built-in source"
+	}
+	reservedSources[artifactpolicy.SourceBoundsSession] = "built-in source"
+	if scriptorium != nil {
+		for key := range scriptorium.Artifacts {
+			normalizedKey := strings.TrimSpace(key)
+			reservedSources[artifactpolicy.ConfiguredSourceID(normalizedKey)] = "configured Scriptorium source"
+			reservedSources[artifactpolicy.PreviousSessionSourceID(normalizedKey)] = "previous-session source"
+		}
+	}
+
+	rawKeys := make([]string, 0, len(cfg.Outputs))
+	for key := range cfg.Outputs {
+		rawKeys = append(rawKeys, key)
+	}
+	sort.Strings(rawKeys)
+	normalizedOutputs := make(map[string]NotariusOutputConfig, len(cfg.Outputs))
+	sourceOwners := map[string]string{}
+	laneOwners := map[string]string{}
+	for _, rawKey := range rawKeys {
+		output := cfg.Outputs[rawKey]
+		key := strings.TrimSpace(rawKey)
+		if !artifactpolicy.IsConfiguredKey(key) {
+			return fmt.Errorf("pipeline.notarius.outputs keys must match ^[a-z][a-z0-9_]*$")
+		}
+		sourceID := artifactpolicy.ExtractionSourceID(key)
+		if previousKey, ok := sourceOwners[sourceID]; ok {
+			return fmt.Errorf("pipeline.notarius.outputs keys %q and %q normalize to duplicate source %q", previousKey, rawKey, sourceID)
+		}
+		if owner, ok := reservedSources[sourceID]; ok {
+			return fmt.Errorf("pipeline.notarius.outputs.%s source %q collides with %s", key, sourceID, owner)
+		}
+		sourceOwners[sourceID] = rawKey
+
+		output.LaneID = strings.TrimSpace(output.LaneID)
+		output.MediaType = strings.TrimSpace(output.MediaType)
+		output.SchemaID = strings.TrimSpace(output.SchemaID)
+		output.SchemaVersion = strings.TrimSpace(output.SchemaVersion)
+		output.ModuleKey = strings.TrimSpace(output.ModuleKey)
+		prefix := "pipeline.notarius.outputs." + key
+		if output.LaneID == "" {
+			return fmt.Errorf("%s.lane_id is required", prefix)
+		}
+		if previousKey, ok := laneOwners[output.LaneID]; ok {
+			return fmt.Errorf("%s.lane_id %q duplicates pipeline.notarius.outputs.%s.lane_id", prefix, output.LaneID, previousKey)
+		}
+		laneOwners[output.LaneID] = key
+		if output.MediaType == "" {
+			return fmt.Errorf("%s.media_type is required", prefix)
+		}
+		if output.SchemaID == "" {
+			return fmt.Errorf("%s.schema_id is required", prefix)
+		}
+		if output.SchemaVersion == "" {
+			return fmt.Errorf("%s.schema_version is required", prefix)
+		}
+		normalizedOutputs[key] = output
+	}
+	cfg.Binary = strings.TrimSpace(cfg.Binary)
+	cfg.ConfigPath = filepath.Clean(cfg.ConfigPath)
+	cfg.PipelineID = strings.TrimSpace(cfg.PipelineID)
+	cfg.Timeout = strings.TrimSpace(cfg.Timeout)
+	cfg.WorkingDirectory = filepath.Clean(cfg.WorkingDirectory)
+	cfg.References = normalizedReferences
+	cfg.Outputs = normalizedOutputs
+	return nil
+}
+
+func notariusOutputKeySet(notarius *NotariusConfig) map[string]struct{} {
+	out := map[string]struct{}{}
+	if notarius == nil {
+		return out
+	}
+	for key := range notarius.Outputs {
+		trimmed := strings.TrimSpace(key)
+		if artifactpolicy.IsConfiguredKey(trimmed) {
+			out[trimmed] = struct{}{}
+		}
+	}
+	return out
+}