Expand role resource name validation to support full enum range (#56)

Updates role validation pattern from [123456][0-9]{6} to [1-9][0-9]{6}
to allow role enum values across the full [1000000, 9999999] range,
supporting future role additions beyond the 6000000 limit.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude <noreply@anthropic.com>

Author: BRBussy

go/iam/api_user/v1/api_user.pb.go

@@ -21,25 +21,25 @@ func TestAPIUser_ValidationUpdated(t *testing.T) {
 		{
 			name: "valid API user with all fields",
 			apiUser: &APIUser{
-				Owner:       "groups/test-group-123",
+				Owner:       "groups/01ARZ3NDEKTSV4RRFFQ69G5FAV",
 				DisplayName: "Test API User",
 				State:       APIUserState_API_USER_STATE_ACTIVE,
-				Roles:       []string{"groups/test-group-123/ROLE_IAM_VIEWER"},
+				Roles:       []string{"groups/01ARZ3NDEKTSV4RRFFQ69G5FAV/3000001"},
 			},
 			wantValid: true,
 		},
 		{
 			name: "valid API user with minimal required fields",
 			apiUser: &APIUser{
-				Owner:       "groups/test-group-123",
+				Owner:       "groups/01ARZ3NDEKTSV4RRFFQ69G5FAV",
 				DisplayName: "Test API User",
 			},
 			wantValid: true,
 		},
 		{
 			name: "valid API user with empty system-set fields",
 			apiUser: &APIUser{
-				Owner:       "groups/test-group-123",
+				Owner:       "groups/01ARZ3NDEKTSV4RRFFQ69G5FAV",
 				DisplayName: "Test API User",
 				State:       APIUserState_API_USER_STATE_UNSPECIFIED, // System set, can be unspecified
 				Roles:       []string{},                              // Can be empty (0 roles allowed)
@@ -49,7 +49,7 @@ func TestAPIUser_ValidationUpdated(t *testing.T) {
 		{
 			name: "valid API user with no roles",
 			apiUser: &APIUser{
-				Owner:       "groups/test-group-123",
+				Owner:       "groups/01ARZ3NDEKTSV4RRFFQ69G5FAV",
 				DisplayName: "Test API User",
 				Roles:       []string{}, // 0 roles allowed
 			},
@@ -62,7 +62,7 @@ func TestAPIUser_ValidationUpdated(t *testing.T) {
 				DisplayName: "Test API User",
 			},
 			wantValid: false,
-			wantError: "owner is required",
+			wantError: "required",
 		},
 		{
 			name: "invalid owner format - missing groups prefix",
@@ -71,7 +71,7 @@ func TestAPIUser_ValidationUpdated(t *testing.T) {
 				DisplayName: "Test API User",
 			},
 			wantValid: false,
-			wantError: "owner must be in format groups/{group_id}",
+			wantError: "pattern",
 		},
 		{
 			name: "invalid owner format - invalid group ID characters",
@@ -80,37 +80,37 @@ func TestAPIUser_ValidationUpdated(t *testing.T) {
 				DisplayName: "Test API User",
 			},
 			wantValid: false,
-			wantError: "group_id contains only alphanumeric characters",
+			wantError: "pattern",
 		},
 		{
-			name: "valid owner with underscores and hyphens",
+			name: "valid owner with proper ULIDv2 format",
 			apiUser: &APIUser{
-				Owner:       "groups/test_group-123",
+				Owner:       "groups/01ARZ3NDEKTSV4RRFFQ69G5FAV",
 				DisplayName: "Test API User",
 			},
 			wantValid: true,
 		},
 		{
 			name: "owners field accepts any values since no validation defined",
 			apiUser: &APIUser{
-				Owner:       "groups/test-group-123",
+				Owner:       "groups/01ARZ3NDEKTSV4RRFFQ69G5FAV",
 				DisplayName: "Test API User",
 			},
 			wantValid: true, // No validation rules defined for owners field in proto
 		},
 		{
 			name: "empty display name - should fail (required field)",
 			apiUser: &APIUser{
-				Owner:       "groups/test-group-123",
+				Owner:       "groups/01ARZ3NDEKTSV4RRFFQ69G5FAV",
 				DisplayName: "",
 			},
 			wantValid: false,
-			wantError: "display name is required",
+			wantError: "required",
 		},
 		{
 			name: "display name too long",
 			apiUser: &APIUser{
-				Owner:       "groups/test-group-123",
+				Owner:       "groups/01ARZ3NDEKTSV4RRFFQ69G5FAV",
 				DisplayName: string(make([]byte, 256)), // 256 characters
 			},
 			wantValid: false,
@@ -119,7 +119,7 @@ func TestAPIUser_ValidationUpdated(t *testing.T) {
 		{
 			name: "valid state when specified",
 			apiUser: &APIUser{
-				Owner:       "groups/test-group-123",
+				Owner:       "groups/01ARZ3NDEKTSV4RRFFQ69G5FAV",
 				DisplayName: "Test API User",
 				State:       APIUserState_API_USER_STATE_ACTIVE,
 			},
@@ -128,7 +128,7 @@ func TestAPIUser_ValidationUpdated(t *testing.T) {
 		{
 			name: "valid unspecified state (system can set this)",
 			apiUser: &APIUser{
-				Owner:       "groups/test-group-123",
+				Owner:       "groups/01ARZ3NDEKTSV4RRFFQ69G5FAV",
 				DisplayName: "Test API User",
 				State:       APIUserState_API_USER_STATE_UNSPECIFIED,
 			},
@@ -137,20 +137,21 @@ func TestAPIUser_ValidationUpdated(t *testing.T) {
 		{
 			name: "multiple valid roles",
 			apiUser: &APIUser{
-				Owner:       "groups/test-group-123",
+				Owner:       "groups/01ARZ3NDEKTSV4RRFFQ69G5FAV",
 				DisplayName: "Test API User",
-				Roles:       []string{"groups/test-group-123/ROLE_IAM_VIEWER", "groups/test-group-123/ROLE_IAM_ADMIN"},
+				Roles:       []string{"groups/01ARZ3NDEKTSV4RRFFQ69G5FAV/3000001", "groups/01ARZ3NDEKTSV4RRFFQ69G5FAV/3000000"},
 			},
 			wantValid: true,
 		},
 		{
 			name: "invalid role format when roles provided",
 			apiUser: &APIUser{
-				Owner:       "groups/test-group-123",
+				Owner:       "groups/01ARZ3NDEKTSV4RRFFQ69G5FAV",
 				DisplayName: "Test API User",
-				Roles:       []string{"invalid-role-format"}, // Invalid role format
+				Roles:       []string{"invalid-role-format"},
 			},
-			wantValid: true, // Currently no validation on role format in proto
+			wantValid: false, // Role validation is enforced
+			wantError: "pattern",
 		},
 	}
 
@@ -174,29 +175,21 @@ func TestAPIUser_ValidationOwnerFormatsUpdated(t *testing.T) {
 	validator, err := protovalidate.New()
 	require.NoError(t, err)
 
+	// Valid ULIDv2 formats
 	validOwnerFormats := []string{
-		"groups/a",                    // single character
-		"groups/abc123",               // alphanumeric
-		"groups/test-group-123",       // with hyphens
-		"groups/test_group_123",       // with underscores
-		"groups/group-with_mixed-123", // mixed separators
-		"groups/ABC123",               // uppercase
-		"groups/a1b2c3",               // mixed case
+		"groups/01ARZ3NDEKTSV4RRFFQ69G5FAV", // Standard ULIDv2
+		"groups/01BX5ZZKBKACTAV9WEVGEMMVRZ", // Another valid ULIDv2
 	}
 
+	// Invalid owner formats
 	invalidOwnerFormats := []string{
-		"",                // empty (required field)
-		"groups/",         // missing group ID
-		"groups/-invalid", // starts with hyphen
-		"groups/invalid-", // ends with hyphen
-		"groups/_invalid", // starts with underscore
-		"groups/invalid_", // ends with underscore
-		"groups/inv@lid",  // invalid character @
-		"groups/inv!lid",  // invalid character !
-		"groups/inv lid",  // space
-		"groups/inv.lid",  // dot
-		"group/test",      // wrong prefix
-		"test-group-123",  // no prefix
+		"",                                    // empty (required field)
+		"groups/",                             // missing group ID
+		"groups/01ARZ3NDEKTSV4RRFFQ69G5FIL",  // Contains 'I' and 'L' (invalid in ULIDv2)
+		"groups/01ARZ3NDEKTSV4RRFFQ69G5FA",   // Too short (25 chars instead of 26)
+		"groups/01ARZ3NDEKTSV4RRFFQ69G5FAVX", // Too long (27 chars instead of 26)
+		"group/01ARZ3NDEKTSV4RRFFQ69G5FAV",   // Wrong prefix (missing 's')
+		"test-group-123",                      // No prefix
 	}
 
 	// Test valid formats
@@ -233,7 +226,7 @@ func TestAPIUser_SystemSetFieldsOptional(t *testing.T) {
 	t.Run("all system-set fields can be empty/unspecified", func(t *testing.T) {
 		apiUser := &APIUser{
 			// Only required fields
-			Owner:       "groups/test-group-123",
+			Owner:       "groups/01ARZ3NDEKTSV4RRFFQ69G5FAV",
 			DisplayName: "Test API User",
 
 			// System-set fields can be empty/unspecified
@@ -249,7 +242,7 @@ func TestAPIUser_SystemSetFieldsOptional(t *testing.T) {
 
 	t.Run("system-set fields are validated when present", func(t *testing.T) {
 		apiUser := &APIUser{
-			Owner:       "groups/test-group-123",
+			Owner:       "groups/01ARZ3NDEKTSV4RRFFQ69G5FAV",
 			DisplayName: "Test API User",
 		}
 

go/iam/api_user/v1/api_user_validation_test.go

@@ -568,13 +568,13 @@ func TestAssignRoleToAPIUserRequest_Validation(t *testing.T) {
 		},
 		// name field tests
 		{
-			name: "empty name - should fail due to length validation",
+			name: "empty name - should fail (required field)",
 			request: &AssignRoleToAPIUserRequest{
 				Name: "",
 				Role: "groups/01ARZ3NDEKTSV4RRFFQ69G5FAV/1234567",
 			},
-			wantValid: false, // Empty string fails length validation (expects exactly 36 chars)
-			wantError: "len",
+			wantValid: false,
+			wantError: "required",
 		},
 		{
 			name: "invalid name format - users prefix (wrong resource type)",
@@ -650,13 +650,12 @@ func TestAssignRoleToAPIUserRequest_Validation(t *testing.T) {
 			wantError: "len",
 		},
 		{
-			name: "invalid role format - role_id doesn't start with 1",
+			name: "valid role format - role_id starts with 2",
 			request: &AssignRoleToAPIUserRequest{
 				Name: "api_users/01ARZ3NDEKTSV4RRFFQ69G5FAV", // Corrected to api_users/
-				Role: "groups/01ARZ3NDEKTSV4RRFFQ69G5FAV/2234567", // Must start with 1
+				Role: "groups/01ARZ3NDEKTSV4RRFFQ69G5FAV/2234567", // Valid under new pattern [1-9][0-9]{6}
 			},
-			wantValid: false,
-			wantError: "pattern",
+			wantValid: true,
 		},
 		{
 			name: "invalid role format - role_id contains letters",

go/iam/api_user/v1/service.pb.go

@@ -164,13 +164,12 @@ func TestAssignRoleToUserRequest_Validation(t *testing.T) {
 			wantError: "pattern",
 		},
 		{
-			name: "invalid role format - wrong role ID format (not starting with 1)",
+			name: "valid role format - role ID starting with 2",
 			request: &AssignRoleToUserRequest{
 				Name: "users/01ARZ3NDEKTSV4RRFFQ69G5FAV",
-				Role: "groups/01ARZ3NDEKTSV4RRFFQ69G5FAV/2234567", // Starts with 2, 41 chars
+				Role: "groups/01ARZ3NDEKTSV4RRFFQ69G5FAV/2234567", // Starts with 2, valid under new pattern [1-9][0-9]{6}
 			},
-			wantValid: false,
-			wantError: "pattern",
+			wantValid: true,
 		},
 		{
 			name: "invalid role format - wrong role ID format (non-numeric)",
@@ -326,7 +325,6 @@ func TestAssignRoleToUserRequest_RoleFieldValidation(t *testing.T) {
 		"groups/01arz3ndektsv4rrffq69g5fav/1234567",   // Lowercase not allowed
 		"groups/01ARZ3NDEKTSV4RRFFQ69G5FA/1234567",    // Group too short (40 chars total)
 		"groups/01ARZ3NDEKTSV4RRFFQ69G5FAVX/1234567",  // Too long overall (42 chars)
-		"groups/01ARZ3NDEKTSV4RRFFQ69G5FAV/2234567",   // Role ID starts with 2
 		"groups/01ARZ3NDEKTSV4RRFFQ69G5FAV/0234567",   // Role ID starts with 0
 		"groups/01ARZ3NDEKTSV4RRFFQ69G5FAV/123456A",   // Non-numeric role ID
 		"groups/01ARZ3NDEKTSV4RRFFQ69G5FAV/123456",    // Role ID too short (6 digits)

go/iam/api_user/v1/service_validation_test.go

@@ -143,18 +143,18 @@ func TestUser_Validation(t *testing.T) {
 			wantValid: true,
 		},
 		{
-			name: "invalid owners item - wrong format",
+			name: "invalid owner - wrong format",
 			user: &User{
-				Owner: "groups/01ARZ3NDEKTSV4RRFFQ69G5FAV",
+				Owner: "group/01ARZ3NDEKTSV4RRFFQ69G5FAV", // Missing 's' in 'groups'
 				Email: "test@example.com",
 			},
 			wantValid: false,
 			wantError: "pattern",
 		},
 		{
-			name: "invalid owners item - wrong length",
+			name: "invalid owner - wrong length",
 			user: &User{
-				Owner: "groups/01ARZ3NDEKTSV4RRFFQ69G5FAV",
+				Owner: "groups/01ARZ3NDEKTSV4RRFFQ69G5FA", // 32 chars instead of 33
 				Email: "test@example.com",
 			},
 			wantValid: false,