Define cleanup authorization and targets

internal/artifacts/remote_object_key.go

@@ -66,6 +66,32 @@ func ParsePublishedOutputObjectKey(sessionPrefix, key string) (PublishedOutputOb
 	return PublishedOutputObjectKey{RunID: identity.RunID, Destination: destination}, nil
 }
 
+// ValidateRemoteSessionPrefixIdentity proves that a canonical remote session
+// prefix names the expected campaign and session.
+func ValidateRemoteSessionPrefixIdentity(sessionPrefix, campaign, sessionID string) error {
+	if err := validateRemoteSessionPrefix(sessionPrefix); err != nil {
+		return err
+	}
+	if err := ValidateSessionIdentity(campaign, sessionID); err != nil {
+		return err
+	}
+
+	parts := strings.Split(strings.TrimSuffix(sessionPrefix, "/"), "/")
+	prefixCampaign := parts[len(parts)-3]
+	prefixSessionID := parts[len(parts)-1]
+	if prefixCampaign != campaign || prefixSessionID != sessionID {
+		return fmt.Errorf(
+			"session prefix %q identifies campaign/session %q/%q, want %q/%q",
+			sessionPrefix,
+			prefixCampaign,
+			prefixSessionID,
+			campaign,
+			sessionID,
+		)
+	}
+	return nil
+}
+
 func validateCanonicalPublishSource(source string) error {
 	classified, err := artifactpolicy.ClassifySource(source)
 	if err != nil || classified.Kind == artifactpolicy.SourceKindPreviousArtifact {