Complete platform management workflows

run/protocol/job_validation.go

@@ -23,6 +23,49 @@ func ValidateRunJobAssignment(assignment RunJobAssignment) error {
 			return ValidationError("inputRef is not allowed")
 		}
 	}
+	if IsRemoteCapability(assignment.Capability) {
+		if assignment.ServerInstanceID == "" {
+			return ValidationError("serverInstanceId is required for remote jobs")
+		}
+		if RemoteCapabilityRequiresTargetKey(assignment.Capability) && !ValidLogicalFileKey(assignment.TargetKey) {
+			return ValidationError("targetKey is not allowed")
+		}
+		if RemoteCapabilityRequiresInputRef(assignment.Capability) && !ValidScopedInputRef(assignment.InputRef) {
+			return ValidationError("inputRef is not allowed")
+		}
+	}
+	switch assignment.Capability {
+	case RunCapabilityRunSelfUpdate:
+		if assignment.ServerInstanceID == "" {
+			return ValidationError("serverInstanceId is required for self-update jobs")
+		}
+		if assignment.TargetKey != "run/update" {
+			return ValidationError("targetKey must be run/update")
+		}
+		if !ValidScopedInputRef(assignment.InputRef) || !strings.HasPrefix(assignment.InputRef, "artifact://") {
+			return ValidationError("inputRef must be an artifact ref for self-update")
+		}
+	case RunCapabilityDependenciesCheck, RunCapabilityDependenciesInstall:
+		if assignment.ServerInstanceID == "" {
+			return ValidationError("serverInstanceId is required for dependency jobs")
+		}
+		if !ValidLogicalFileKey(assignment.TargetKey) || !strings.HasPrefix(assignment.TargetKey, "dependencies/") {
+			return ValidationError("targetKey is not allowed for dependency jobs")
+		}
+		if assignment.InputRef != "" {
+			return ValidationError("dependency jobs must not carry arbitrary input refs")
+		}
+	case RunCapabilityLogsBackfill:
+		if assignment.ServerInstanceID == "" {
+			return ValidationError("serverInstanceId is required for log backfill jobs")
+		}
+		if !ValidLogicalFileKey(assignment.TargetKey) || !strings.HasPrefix(assignment.TargetKey, "logs/") {
+			return ValidationError("targetKey is not allowed for log backfill jobs")
+		}
+		if assignment.InputRef != "" && !ValidScopedInputRef(assignment.InputRef) {
+			return ValidationError("inputRef is not allowed for log backfill jobs")
+		}
+	}
 	return nil
 }
 
@@ -56,3 +99,30 @@ func ValidScopedInputRef(ref string) bool {
 	}
 	return strings.HasPrefix(ref, "input://") || strings.HasPrefix(ref, "artifact://")
 }
+
+func IsRemoteCapability(capability string) bool {
+	return strings.HasPrefix(capability, "remote.")
+}
+
+func RemoteCapabilityRequiresTargetKey(capability string) bool {
+	switch capability {
+	case RunCapabilityRemoteRunProcessStart, RunCapabilityRemoteRunProcessStop:
+		return false
+	default:
+		return IsRemoteCapability(capability)
+	}
+}
+
+func RemoteCapabilityRequiresInputRef(capability string) bool {
+	switch capability {
+	case RunCapabilityRemoteFTPWrite,
+		RunCapabilityRemoteRsyncWrite,
+		RunCapabilityRemoteRunFilesWrite,
+		RunCapabilityRemoteRunDBMySQLQuery,
+		RunCapabilityRemoteRunDBSQLiteQuery,
+		RunCapabilityRemoteRunRCONCommand:
+		return true
+	default:
+		return false
+	}
+}