opentdf / platform

Persistent data centric security that extends owner control wherever data travels
BSD 3-Clause Clear License
19 stars 11 forks source link

Create namespace buf validation regex does not support allowed values such as `example.com` #1361

Closed ryanulit closed 3 months ago

ryanulit commented 3 months ago

https://github.com/opentdf/platform/blob/e6c76ee415e08ec8681ae4ff8fb9d5d04ea7d2bb/service/policy/namespaces/namespaces.proto#L49

The regex pattern used in our buf validate rule does not support all allowed namespaces, as seen with regex101.com tests:

image

strantalis commented 3 months ago

@ryanulit Are you seeing an error. I think I remember playing around with when we originally started the project.

strantalis commented 3 months ago

I just tested this and example.com worked. One thing to note is the validation library uses googles re2 syntax which has some differences.

https://github.com/google/re2/wiki/Syntax

Message

{
    "name": "example.com"
}

Response

{
    "namespace": {
        "grants": [],
        "id": "792e21a3-6ab0-44f9-8c00-f45cbb19ae84",
        "name": "example.com",
        "fqn": "",
        "active": {
            "value": true
        },
        "metadata": {
            "labels": {},
            "created_at": {
                "seconds": "1723806544",
                "nanos": 739924000
            },
            "updated_at": {
                "seconds": "1723806544",
                "nanos": 739924000
            }
        }
    }
}

But if I do something without a .com for example I get

validation error: - name: Namespace must be a valid hostname. It should include at least one dot, with each segment (label) starting and ending with an alphanumeric character. Each label must be 1 to 63 characters long, allowing hyphens but not as the first or last character. The top-level domain (the last segment after the final dot) must consist of at least two alphabetic characters. The stored namespace will be normalized to lower case. [namespace_format]

https://github.com/opentdf/platform/blob/42a3d747f7271b3861ee210b621a5502b8f07174/service/policy/namespaces/namespaces_test.go#L22-L47

https://github.com/opentdf/platform/blob/42a3d747f7271b3861ee210b621a5502b8f07174/service/policy/namespaces/namespaces_test.go#L77-L100

ryanulit commented 3 months ago

Ah ok, false alarm then. Was not aware of the re2 usage. And you are correct, it works as intended in my testing with the CLI below. I was intending to use it within Go code, which is a separate discussion anyways. Closing this issue now.

image