Add Notarius configuration and extraction source policy

internal/artifactpolicy/policy.go

@@ -18,11 +18,14 @@ const (
 	SourceInputGlossary = "narratio.input.glossary"
 
 	configuredSourcePrefix      = "narratio.artifact."
+	extractionSourcePrefix      = "narratio.extraction."
 	previousConfiguredSrcPrefix = "narratio.previous_session.artifact."
 )
 
 var configuredSourceRE = regexp.MustCompile(`^narratio\.artifact\.([a-z][a-z0-9_]*)$`)
+var extractionSourceRE = regexp.MustCompile(`^narratio\.extraction\.([a-z][a-z0-9_]*)$`)
 var previousSourceRE = regexp.MustCompile(`^narratio\.previous_session\.artifact\.([a-z][a-z0-9_]*)$`)
+var configuredKeyRE = regexp.MustCompile(`^[a-z][a-z0-9_]*$`)
 
 var (
 	ErrUnsupportedScriptoriumInputSource = errors.New("unsupported scriptorium input source")
@@ -34,6 +37,7 @@ type SourceKind string
 const (
 	SourceKindBuiltIn            SourceKind = "built_in"
 	SourceKindConfiguredArtifact SourceKind = "configured_artifact"
+	SourceKindExtraction         SourceKind = "extraction"
 	SourceKindPreviousArtifact   SourceKind = "previous_session_configured_artifact"
 	SourceKindStableInput        SourceKind = "stable_input"
 )
@@ -67,11 +71,30 @@ func (e *UnknownConfiguredArtifactError) Error() string {
 	return fmt.Sprintf("references unknown artifact %q", e.ConfiguredKey)
 }
 
+// UnknownExtractionArtifactError reports a source that references an undefined extraction key.
+type UnknownExtractionArtifactError struct {
+	ConfiguredKey string
+}
+
+func (e *UnknownExtractionArtifactError) Error() string {
+	return fmt.Sprintf("references unknown extraction output %q", e.ConfiguredKey)
+}
+
+// IsConfiguredKey reports whether a key follows the configured-artifact key grammar.
+func IsConfiguredKey(key string) bool {
+	return configuredKeyRE.MatchString(strings.TrimSpace(key))
+}
+
 // ConfiguredSourceID converts a configured artifact key into source id form.
 func ConfiguredSourceID(key string) string {
 	return configuredSourcePrefix + strings.TrimSpace(key)
 }
 
+// ExtractionSourceID converts an extraction output key into source id form.
+func ExtractionSourceID(key string) string {
+	return extractionSourcePrefix + strings.TrimSpace(key)
+}
+
 // PreviousSessionSourceID converts a configured artifact key into previous-session source id form.
 func PreviousSessionSourceID(key string) string {
 	return previousConfiguredSrcPrefix + strings.TrimSpace(key)
@@ -86,6 +109,15 @@ func ParseConfiguredSource(source string) (string, bool) {
 	return matches[1], true
 }
 
+// ParseExtractionSource extracts configured key from narratio.extraction.<key>.
+func ParseExtractionSource(source string) (string, bool) {
+	matches := extractionSourceRE.FindStringSubmatch(strings.TrimSpace(source))
+	if len(matches) != 2 {
+		return "", false
+	}
+	return matches[1], true
+}
+
 // ParsePreviousSessionSource extracts configured key from narratio.previous_session.artifact.<key>.
 func ParsePreviousSessionSource(source string) (string, bool) {
 	matches := previousSourceRE.FindStringSubmatch(strings.TrimSpace(source))
@@ -110,6 +142,9 @@ func ClassifySource(source string) (Source, error) {
 	if key, ok := ParseConfiguredSource(trimmed); ok {
 		return Source{ID: trimmed, Kind: SourceKindConfiguredArtifact, ConfiguredKey: key}, nil
 	}
+	if key, ok := ParseExtractionSource(trimmed); ok {
+		return Source{ID: trimmed, Kind: SourceKindExtraction, ConfiguredKey: key}, nil
+	}
 	if key, ok := ParsePreviousSessionSource(trimmed); ok {
 		return Source{ID: trimmed, Kind: SourceKindPreviousArtifact, ConfiguredKey: key}, nil
 	}
@@ -186,24 +221,48 @@ func PreviousSessionSourceDescriptorForConfiguredKey(configuredKey string) (Prev
 func ValidateInputConfiguredReference(
 	descriptor ScriptoriumInputSourceDescriptor,
 	configured map[string]struct{},
+) error {
+	return ValidateInputReference(descriptor, configured, nil)
+}
+
+// ValidateInputReference checks that configured and extraction sources are declared
+// by the effective pipeline configuration.
+func ValidateInputReference(
+	descriptor ScriptoriumInputSourceDescriptor,
+	configured map[string]struct{},
+	extractions map[string]struct{},
 ) error {
 	switch descriptor.Source.Kind {
 	case SourceKindConfiguredArtifact, SourceKindPreviousArtifact:
 		if _, ok := configured[descriptor.Source.ConfiguredKey]; !ok {
 			return &UnknownConfiguredArtifactError{ConfiguredKey: descriptor.Source.ConfiguredKey}
 		}
+	case SourceKindExtraction:
+		if _, ok := extractions[descriptor.Source.ConfiguredKey]; !ok {
+			return &UnknownExtractionArtifactError{ConfiguredKey: descriptor.Source.ConfiguredKey}
+		}
 	}
 	return nil
 }
 
 // ValidatePublishSource validates that a source is publish-compatible and references a known configured artifact.
 func ValidatePublishSource(source string, configured map[string]string) (Source, error) {
+	return ValidatePublishSourceWithExtractions(source, configured, nil)
+}
+
+// ValidatePublishSourceWithExtractions validates publish sources against the
+// configured Scriptorium artifacts and extraction outputs.
+func ValidatePublishSourceWithExtractions(
+	source string,
+	configured map[string]string,
+	extractions map[string]struct{},
+) (Source, error) {
 	classified, err := ClassifySource(source)
 	if err != nil {
-		return Source{}, fmt.Errorf("must be a built-in source id or narratio.artifact.<name>")
+		return Source{}, fmt.Errorf("must be a built-in source id, narratio.artifact.<name>, or configured narratio.extraction.<name>")
 	}
 	if classified.Kind == SourceKindPreviousArtifact {
-		return Source{}, fmt.Errorf("must be a built-in source id or narratio.artifact.<name>")
+		return Source{}, fmt.Errorf("must be a built-in source id, narratio.artifact.<name>, or configured narratio.extraction.<name>")
 	}
 	if classified.Kind == SourceKindConfiguredArtifact {
 		if configured == nil {
@@ -213,6 +272,11 @@ func ValidatePublishSource(source string, configured map[string]string) (Source,
 			return Source{}, fmt.Errorf("configured artifact %q is not defined in pipeline.scriptorium.artifacts", classified.ConfiguredKey)
 		}
 	}
+	if classified.Kind == SourceKindExtraction {
+		if _, ok := extractions[classified.ConfiguredKey]; !ok {
+			return Source{}, fmt.Errorf("extraction output %q is not defined in pipeline.notarius.outputs", classified.ConfiguredKey)
+		}
+	}
 	return classified, nil
 }