Merge pull request #561 from dbt-labs/tomighita/env-schema-validation

tomighita · web-flow · commit 53c99d4ceebe · 2025-11-20T14:38:14.000+02:00
Add schema validation following the cloud-ui logic
diff --git a/.changes/unreleased/Changes-20251119-173145.yaml b/.changes/unreleased/Changes-20251119-173145.yaml
@@ -0,0 +1,3 @@
+kind: Changes
+body: Add validation to schema names to follow the same rules as in the cloud UI
+time: 2025-11-19T17:31:45.917757+02:00
diff --git a/pkg/framework/objects/athena_credential/schema.go b/pkg/framework/objects/athena_credential/schema.go
@@ -1,6 +1,7 @@
 package athena_credential
 
 import (
+	"github.com/dbt-labs/terraform-provider-dbtcloud/pkg/helper"
 	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
 	datasource_schema "github.com/hashicorp/terraform-plugin-framework/datasource/schema"
 	resource_schema "github.com/hashicorp/terraform-plugin-framework/resource/schema"
@@ -53,6 +54,9 @@ var resourceSchema = resource_schema.Schema{
 		"schema": resource_schema.StringAttribute{
 			Required:    true,
 			Description: "The schema where to create models",
+			Validators: []validator.String{
+				helper.SchemaNameValidator(),
+			},
 		},
 	},
 }
diff --git a/pkg/framework/objects/bigquery_credential/schema.go b/pkg/framework/objects/bigquery_credential/schema.go
@@ -1,12 +1,14 @@
 package bigquery_credential
 
 import (
+	"github.com/dbt-labs/terraform-provider-dbtcloud/pkg/helper"
 	datasource_schema "github.com/hashicorp/terraform-plugin-framework/datasource/schema"
 	resource_schema "github.com/hashicorp/terraform-plugin-framework/resource/schema"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema/booldefault"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema/int64planmodifier"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
 )
 
 var BigQueryResourceSchema = resource_schema.Schema{
@@ -42,6 +44,9 @@ var BigQueryResourceSchema = resource_schema.Schema{
 		"dataset": resource_schema.StringAttribute{
 			Required:    true,
 			Description: "Default dataset name",
+			Validators: []validator.String{
+				helper.SchemaNameValidator(),
+			},
 		},
 		"num_threads": resource_schema.Int64Attribute{
 			Required:    true,
diff --git a/pkg/framework/objects/databricks_credential/schema.go b/pkg/framework/objects/databricks_credential/schema.go
@@ -1,7 +1,7 @@
 package databricks_credential
 
 import (
-	sl_cred_validator "github.com/dbt-labs/terraform-provider-dbtcloud/pkg/helper"
+	"github.com/dbt-labs/terraform-provider-dbtcloud/pkg/helper"
 	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
 	datasource_schema "github.com/hashicorp/terraform-plugin-framework/datasource/schema"
 	resource_schema "github.com/hashicorp/terraform-plugin-framework/resource/schema"
@@ -99,7 +99,8 @@ var DatabricksResourceSchema = resource_schema.Schema{
 			Computed:    true,
 			Default:     stringdefault.StaticString("default_schema"),
 			Validators: []validator.String{
-				sl_cred_validator.SemanticLayerCredentialValidator{FieldName: "schema"},
+				helper.SemanticLayerCredentialValidator{FieldName: "schema"},
+				helper.SchemaNameValidator(),
 			},
 		},
 		"adapter_type": resource_schema.StringAttribute{
@@ -113,7 +114,7 @@ var DatabricksResourceSchema = resource_schema.Schema{
 			},
 			Validators: []validator.String{
 				stringvalidator.OneOf("databricks", "spark"),
-				sl_cred_validator.SemanticLayerCredentialValidator{FieldName: "adapter_type"},
+				helper.SemanticLayerCredentialValidator{FieldName: "adapter_type"},
 			},
 		},
 		"semantic_layer_credential": resource_schema.BoolAttribute{
diff --git a/pkg/framework/objects/fabric_credential/schema.go b/pkg/framework/objects/fabric_credential/schema.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 
+	"github.com/dbt-labs/terraform-provider-dbtcloud/pkg/helper"
 	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
 	"github.com/hashicorp/terraform-plugin-framework/path"
 	resource_schema "github.com/hashicorp/terraform-plugin-framework/resource/schema"
@@ -99,6 +100,9 @@ var resourceSchema = resource_schema.Schema{
 		"schema": resource_schema.StringAttribute{
 			Required:    true,
 			Description: "The schema where to create the dbt models",
+			Validators: []validator.String{
+				helper.SchemaNameValidator(),
+			},
 		},
 		"schema_authorization": resource_schema.StringAttribute{
 			Optional:    true,
diff --git a/pkg/framework/objects/postgres_credential/schema.go b/pkg/framework/objects/postgres_credential/schema.go
@@ -1,7 +1,7 @@
 package postgres_credential
 
 import (
-	sl_cred_validator "github.com/dbt-labs/terraform-provider-dbtcloud/pkg/helper"
+	"github.com/dbt-labs/terraform-provider-dbtcloud/pkg/helper"
 	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
 	datasource_schema "github.com/hashicorp/terraform-plugin-framework/datasource/schema"
 	resource_schema "github.com/hashicorp/terraform-plugin-framework/resource/schema"
@@ -83,7 +83,7 @@ var PostgresResourceSchema = resource_schema.Schema{
 				stringvalidator.OneOf(
 					warehouseTypes...,
 				),
-				sl_cred_validator.SemanticLayerCredentialValidator{FieldName: "type"},
+				helper.SemanticLayerCredentialValidator{FieldName: "type"},
 			},
 		},
 		"default_schema": resource_schema.StringAttribute{
@@ -92,7 +92,8 @@ var PostgresResourceSchema = resource_schema.Schema{
 			Default:     stringdefault.StaticString("default_schema"),
 			Description: "Default schema name. Optional only when semantic_layer_credential is set to true; otherwise, this field is required.",
 			Validators: []validator.String{
-				sl_cred_validator.SemanticLayerCredentialValidator{FieldName: "default_schema"},
+				helper.SemanticLayerCredentialValidator{FieldName: "default_schema"},
+				helper.SchemaNameValidator(),
 			},
 		},
 		"target_name": resource_schema.StringAttribute{
diff --git a/pkg/framework/objects/redshift_credential/schema.go b/pkg/framework/objects/redshift_credential/schema.go
@@ -1,13 +1,15 @@
 package redshift_credential
 
 import (
+	"github.com/dbt-labs/terraform-provider-dbtcloud/pkg/helper"
 	datasource_schema "github.com/hashicorp/terraform-plugin-framework/datasource/schema"
 	resource_schema "github.com/hashicorp/terraform-plugin-framework/resource/schema"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema/booldefault"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema/int64planmodifier"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringdefault"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
 )
 
 var RedshiftResourceSchema = resource_schema.Schema{
@@ -57,6 +59,9 @@ var RedshiftResourceSchema = resource_schema.Schema{
 		"default_schema": resource_schema.StringAttribute{
 			Required:    true,
 			Description: "Default schema name",
+			Validators: []validator.String{
+				helper.SchemaNameValidator(),
+			},
 		},
 		"num_threads": resource_schema.Int64Attribute{
 			Required:    true,
diff --git a/pkg/framework/objects/snowflake_credential/schema.go b/pkg/framework/objects/snowflake_credential/schema.go
@@ -2,6 +2,7 @@ package snowflake_credential
 
 import (
 	snowflake_credential "github.com/dbt-labs/terraform-provider-dbtcloud/pkg/framework/objects/snowflake_credential/validators"
+	"github.com/dbt-labs/terraform-provider-dbtcloud/pkg/helper"
 	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
 	datasource_schema "github.com/hashicorp/terraform-plugin-framework/datasource/schema"
 	resource_schema "github.com/hashicorp/terraform-plugin-framework/resource/schema"
@@ -105,6 +106,9 @@ var SnowflakeCredentialResourceSchema = resource_schema.Schema{
 			Computed:    true,
 			Default:     stringdefault.StaticString("default_schema"),
 			Description: "The schema where to create models. This is an optional field ONLY if the credential is used for Semantic Layer configuration, otherwise it is required.",
+			Validators: []validator.String{
+				helper.SchemaNameValidator(),
+			},
 		},
 		"user": resource_schema.StringAttribute{
 			Optional:    true,
diff --git a/pkg/framework/objects/starburst_credential/schema.go b/pkg/framework/objects/starburst_credential/schema.go
@@ -1,6 +1,7 @@
 package starburst_credential
 
 import (
+	"github.com/dbt-labs/terraform-provider-dbtcloud/pkg/helper"
 	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
 	datasource_schema "github.com/hashicorp/terraform-plugin-framework/datasource/schema"
 	resource_schema "github.com/hashicorp/terraform-plugin-framework/resource/schema"
@@ -56,6 +57,9 @@ var resourceSchema = resource_schema.Schema{
 		"schema": resource_schema.StringAttribute{
 			Required:    true,
 			Description: "The schema where to create models",
+			Validators: []validator.String{
+				helper.SchemaNameValidator(),
+			},
 		},
 	},
 }
diff --git a/pkg/framework/objects/synapse_credential/schema.go b/pkg/framework/objects/synapse_credential/schema.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 
+	"github.com/dbt-labs/terraform-provider-dbtcloud/pkg/helper"
 	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
 	datasource_schema "github.com/hashicorp/terraform-plugin-framework/datasource/schema"
 	"github.com/hashicorp/terraform-plugin-framework/path"
@@ -153,6 +154,9 @@ var resourceSchema = resource_schema.Schema{
 		"schema": resource_schema.StringAttribute{
 			Required:    true,
 			Description: "The schema where to create the dbt models",
+			Validators: []validator.String{
+				helper.SchemaNameValidator(),
+			},
 		},
 		"schema_authorization": resource_schema.StringAttribute{
 			Optional:    true,
diff --git a/pkg/framework/objects/teradata_credential/schema.go b/pkg/framework/objects/teradata_credential/schema.go
@@ -1,6 +1,7 @@
 package teradata_credential
 
 import (
+	"github.com/dbt-labs/terraform-provider-dbtcloud/pkg/helper"
 	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
 	datasource_schema "github.com/hashicorp/terraform-plugin-framework/datasource/schema"
 	resource_schema "github.com/hashicorp/terraform-plugin-framework/resource/schema"
@@ -53,6 +54,9 @@ var resourceSchema = resource_schema.Schema{
 		"schema": resource_schema.StringAttribute{
 			Required:    true,
 			Description: "The schema where to create models",
+			Validators: []validator.String{
+				helper.SchemaNameValidator(),
+			},
 		},
 		"threads": resource_schema.Int64Attribute{
 			Optional:    true,
diff --git a/pkg/helper/schema_name_validator.go b/pkg/helper/schema_name_validator.go
@@ -0,0 +1,21 @@
+package helper
+
+import (
+	"regexp"
+
+	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+)
+
+// Pre-compiled regex for performance
+var schemaNamePattern = regexp.MustCompile(`^[a-zA-Z0-9_()"'{} ]*$`)
+
+// SchemaNameValidator returns a validator that ensures schema names contain only allowed characters:
+// letters, numbers, underscore, parentheses, quotes, curly braces, and space.
+func SchemaNameValidator() validator.String {
+	return stringvalidator.RegexMatches(
+		schemaNamePattern,
+		"The schema name contains invalid characters. "+
+			"Only letters, numbers, underscores, parentheses, quotes, curly braces, and spaces are allowed.",
+	)
+}
diff --git a/pkg/helper/schema_name_validator_test.go b/pkg/helper/schema_name_validator_test.go
@@ -0,0 +1,140 @@
+package helper
+
+import (
+	"context"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+)
+
+func TestSchemaNameValidator(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		name        string
+		val         types.String
+		expectError bool
+	}
+
+	testCases := []testCase{
+		{
+			name:        "valid schema name - simple",
+			val:         types.StringValue("my_schema"),
+			expectError: false,
+		},
+		{
+			name:        "valid schema name - with numbers",
+			val:         types.StringValue("schema123"),
+			expectError: false,
+		},
+		{
+			name:        "valid schema name - mixed case",
+			val:         types.StringValue("MySchema"),
+			expectError: false,
+		},
+		{
+			name:        "valid schema name - with parentheses",
+			val:         types.StringValue("schema(test)"),
+			expectError: false,
+		},
+		{
+			name:        "valid schema name - with quotes",
+			val:         types.StringValue(`schema"test"`),
+			expectError: false,
+		},
+		{
+			name:        "valid schema name - with single quotes",
+			val:         types.StringValue("schema'test'"),
+			expectError: false,
+		},
+		{
+			name:        "valid schema name - with curly braces",
+			val:         types.StringValue("schema{test}"),
+			expectError: false,
+		},
+		{
+			name:        "valid schema name - with space",
+			val:         types.StringValue("my schema"),
+			expectError: false,
+		},
+		{
+			name:        "invalid schema name - with dot",
+			val:         types.StringValue("schema.test"),
+			expectError: true,
+		},
+		{
+			name:        "invalid schema name - with forward slash",
+			val:         types.StringValue("dbt_prod_schema_databricks_user/token"),
+			expectError: true,
+		},
+		{
+			name:        "invalid schema name - with backslash",
+			val:         types.StringValue("schema\\test"),
+			expectError: true,
+		},
+		{
+			name:        "invalid schema name - with at sign",
+			val:         types.StringValue("schema@test"),
+			expectError: true,
+		},
+		{
+			name:        "invalid schema name - with hash",
+			val:         types.StringValue("schema#test"),
+			expectError: true,
+		},
+		{
+			name:        "invalid schema name - with dollar sign",
+			val:         types.StringValue("schema$test"),
+			expectError: true,
+		},
+		{
+			name:        "invalid schema name - with percent",
+			val:         types.StringValue("schema%test"),
+			expectError: true,
+		},
+		{
+			name:        "invalid schema name - with ampersand",
+			val:         types.StringValue("schema&test"),
+			expectError: true,
+		},
+		{
+			name:        "null value - no error",
+			val:         types.StringNull(),
+			expectError: false,
+		},
+		{
+			name:        "unknown value - no error",
+			val:         types.StringUnknown(),
+			expectError: false,
+		},
+		{
+			name:        "empty string - no error",
+			val:         types.StringValue(""),
+			expectError: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+
+			request := validator.StringRequest{
+				Path:           path.Root("test"),
+				PathExpression: path.MatchRoot("test"),
+				ConfigValue:    tc.val,
+			}
+			response := validator.StringResponse{}
+
+			SchemaNameValidator().ValidateString(context.Background(), request, &response)
+
+			if tc.expectError && !response.Diagnostics.HasError() {
+				t.Fatalf("expected error for value %s, but got none", tc.val.ValueString())
+			}
+
+			if !tc.expectError && response.Diagnostics.HasError() {
+				t.Fatalf("unexpected error for value %s: %s", tc.val.ValueString(), response.Diagnostics.Errors()[0].Summary())
+			}
+		})
+	}
+}

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+kind: Changes`
	`2`	`+body: Add validation to schema names to follow the same rules as in the cloud UI`
	`3`	`+time: 2025-11-19T17:31:45.917757+02:00`