envfile.go RawHistoryFolder

1package domain
2
3import (
4	"encoding/base64"
5	"regexp"
6	"strings"
7)
8
9// envDomainRegex validates domain names used for env-backed secret storage.
10// Allows: alphanumeric, dots, hyphens, colons (for ports), and forward slashes (for paths).
11var envDomainRegex = regexp.MustCompile(`^[a-zA-Z0-9][a-zA-Z0-9.:/-]*[a-zA-Z0-9]$|^[a-zA-Z0-9]$`)
12
13// EnvStorageKey is the domain-level storage identifier used for env-backed secrets.
14// It is deterministic, collision-resistant, and safe to use in file names.
15type EnvStorageKey string
16
17// NewEnvStorageKey validates a route domain and returns the storage-safe identifier
18// used by env/secrets adapters. The identifier is reversible and unique for the input.
19func NewEnvStorageKey(domainName string) (EnvStorageKey, error) {
20	if err := ValidateEnvStorageDomain(domainName); err != nil {
21		return "", err
22	}
23
24	return EnvStorageKey(base64.RawURLEncoding.EncodeToString([]byte(domainName))), nil
25}
26
27// ValidateEnvStorageDomain validates domains used for env-backed secret storage.
28func ValidateEnvStorageDomain(domainName string) error {
29	if domainName == "" {
30		return ErrPathTraversal
31	}
32
33	if strings.Contains(domainName, "..") {
34		return ErrPathTraversal
35	}
36
37	if !envDomainRegex.MatchString(domainName) {
38		return ErrPathTraversal
39	}
40
41	return nil
42}
43
44// FileName returns the on-disk env filename for this storage key.
45func (k EnvStorageKey) FileName() string {
46	return string(k) + ".env"
47}