validation.go RawHistoryFolder

1package auto
2
3import "strings"
4
5// MatchesDomainAllowlist reports whether domain matches any of the given patterns.
6// Patterns may be exact domains, wildcard subdomains (*.example.com), or "*" to
7// allow everything. Wildcard patterns match a single subdomain level only, per
8// DNS/TLS conventions.
9func MatchesDomainAllowlist(domain string, patterns []string) bool {
10	domain = strings.ToLower(domain)
11	for _, pattern := range patterns {
12		pattern = strings.ToLower(strings.TrimSpace(pattern))
13		if pattern == "" {
14			continue
15		}
16		if pattern == "*" {
17			return true
18		}
19		if pattern == domain {
20			return true
21		}
22		if !strings.HasPrefix(pattern, "*.") {
23			continue
24		}
25		// Wildcard patterns match single-level subdomains only (per DNS/TLS conventions).
26		// e.g., "*.example.com" matches "foo.example.com" but not "bar.foo.example.com"
27		suffix := strings.TrimPrefix(pattern, "*.")
28		if !strings.HasSuffix(domain, "."+suffix) {
29			continue
30		}
31		prefix := strings.TrimSuffix(domain, "."+suffix)
32		if prefix != "" && !strings.Contains(prefix, ".") {
33			return true
34		}
35	}
36	return false
37}
38
39// ExtractRepoName strips the registry domain, tag, and digest from an image
40// reference and returns the bare repository name (e.g. "org/myapp").
41func ExtractRepoName(imageRef, registryDomain string) string {
42	imageRef = strings.ToLower(imageRef)
43	if idx := strings.Index(imageRef, "@"); idx != -1 {
44		imageRef = imageRef[:idx]
45	}
46	if idx := strings.LastIndex(imageRef, ":"); idx != -1 {
47		slashIdx := strings.LastIndex(imageRef, "/")
48		if idx > slashIdx {
49			imageRef = imageRef[:idx]
50		}
51	}
52	registryPrefix := strings.ToLower(strings.TrimSuffix(registryDomain, "/"))
53	if registryPrefix != "" {
54		prefix := registryPrefix + "/"
55		imageRef = strings.TrimPrefix(imageRef, prefix)
56	}
57	return imageRef
58}