nemo-relay 0.10.0

Core Rust SDK for NeMo Relay observability, scope management, and runtime instrumentation.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124

// SPDX-FileCopyrightText: Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
// SPDX-License-Identifier: Apache-2.0

//! Non-interactive dynamic-plugin JSON Schema validation.

use std::path::Path;

use jsonschema::Draft;
use serde_json::Value as Json;

use super::{DynamicPluginManifest, read_regular_file_with_limit};
use crate::plugin::{PluginError, Result};

const MAX_CONFIG_SCHEMA_BYTES: usize = 1024 * 1024;
const DRAFT_7_URIS: [&str; 4] = [
    "http://json-schema.org/draft-07/schema",
    "http://json-schema.org/draft-07/schema#",
    "https://json-schema.org/draft-07/schema",
    "https://json-schema.org/draft-07/schema#",
];
const DRAFT_2020_12_URIS: [&str; 4] = [
    "https://json-schema.org/draft/2020-12/schema",
    "https://json-schema.org/draft/2020-12/schema#",
    "http://json-schema.org/draft/2020-12/schema",
    "http://json-schema.org/draft/2020-12/schema#",
];

/// Validates dynamic component configuration against its manifest-declared local schema.
pub fn validate_dynamic_plugin_config_schema(
    manifest: &DynamicPluginManifest,
    manifest_ref: &str,
    config: &Json,
) -> Result<()> {
    let Some(path) = manifest.resolve_config_schema_path(manifest_ref)? else {
        return Ok(());
    };
    let schema = load_schema(manifest.plugin.id.trim(), &path)?;
    schema.validate(config).map_err(|error| {
        PluginError::InvalidConfig(format!(
            "dynamic plugin '{}' configuration does not satisfy {} at {}: {}",
            manifest.plugin.id,
            path.display(),
            error.instance_path(),
            error
        ))
    })
}

fn load_schema(plugin_id: &str, path: &Path) -> Result<jsonschema::Validator> {
    let bytes = read_regular_file_with_limit(
        path,
        "dynamic plugin config schema",
        MAX_CONFIG_SCHEMA_BYTES as u64,
    )
    .map_err(PluginError::InvalidConfig)?;
    let schema: Json = serde_json::from_slice(&bytes).map_err(|error| {
        PluginError::InvalidConfig(format!(
            "dynamic plugin '{plugin_id}' config schema {} is not valid JSON: {error}",
            path.display()
        ))
    })?;
    reject_nonlocal_references(plugin_id, path, &schema)?;
    let draft = schema
        .get("$schema")
        .and_then(Json::as_str)
        .map(|uri| {
            if DRAFT_7_URIS.contains(&uri) {
                Ok(Draft::Draft7)
            } else if DRAFT_2020_12_URIS.contains(&uri) {
                Ok(Draft::Draft202012)
            } else {
                Err(PluginError::InvalidConfig(format!(
                    "dynamic plugin '{plugin_id}' config schema {} uses unsupported $schema '{uri}'",
                    path.display()
                )))
            }
        })
        .transpose()?
        .unwrap_or(Draft::Draft202012);
    if schema.get("type").and_then(Json::as_str) != Some("object") {
        return Err(PluginError::InvalidConfig(format!(
            "dynamic plugin '{plugin_id}' config schema {} must have object root type",
            path.display()
        )));
    }
    jsonschema::options()
        .with_draft(draft)
        .build(&schema)
        .map_err(|error| {
            PluginError::InvalidConfig(format!(
                "dynamic plugin '{plugin_id}' config schema {} cannot be compiled: {error}",
                path.display()
            ))
        })
}

fn reject_nonlocal_references(plugin_id: &str, path: &Path, value: &Json) -> Result<()> {
    match value {
        Json::Object(object) => {
            if let Some(reference) = object.get("$ref").and_then(Json::as_str)
                && !reference.starts_with('#')
            {
                return Err(PluginError::InvalidConfig(format!(
                    "dynamic plugin '{plugin_id}' config schema {} has forbidden non-local $ref '{reference}'",
                    path.display()
                )));
            }
            for child in object.values() {
                reject_nonlocal_references(plugin_id, path, child)?;
            }
        }
        Json::Array(values) => {
            for child in values {
                reject_nonlocal_references(plugin_id, path, child)?;
            }
        }
        _ => {}
    }
    Ok(())
}

#[cfg(test)]
#[path = "../../../tests/unit/plugin_dynamic_schema_tests.rs"]
mod tests;