fix: relax filepath validation on schemaFile key (#652)

Co-authored-by: Maria Ines Parnisari <maria.ines.parnisari@authzed.com>

Author: tstirrat15

go.mod

@@ -15,7 +15,7 @@ require (
 	github.com/TylerBrock/colorjson v0.0.0-20200706003622-8a50f05110d2
 	github.com/authzed/authzed-go v1.8.0
 	github.com/authzed/grpcutil v0.0.0-20240123194739-2ea1e3d2d98b
-	github.com/authzed/spicedb v1.50.1-0.20260323205516-b041b8f844df
+	github.com/authzed/spicedb v1.51.0
 	github.com/brianvoe/gofakeit/v6 v6.28.0
 	github.com/ccoveille/go-safecast/v2 v2.0.0
 	github.com/cenkalti/backoff/v4 v4.3.0

go.sum

@@ -744,8 +744,8 @@ github.com/authzed/grpcutil v0.0.0-20240123194739-2ea1e3d2d98b h1:wbh8IK+aMLTCey
 github.com/authzed/grpcutil v0.0.0-20240123194739-2ea1e3d2d98b/go.mod h1:s3qC7V7XIbiNWERv7Lfljy/Lx25/V1Qlexb0WJuA8uQ=
 github.com/authzed/jitterbug v0.0.0-20260128162915-e97d76daaa24 h1:BXaWSanmHFu3P0xWfTDPpwcJIQ/oSol29+CWe4lSGSU=
 github.com/authzed/jitterbug v0.0.0-20260128162915-e97d76daaa24/go.mod h1:WvEk4YHnUsmbUaWA/VseQty3X91f6/jEHek5mjYDZUg=
-github.com/authzed/spicedb v1.50.1-0.20260323205516-b041b8f844df h1:a/75Y/B8eTFBl4GSYBfJvwt5itjycEQqBI/7VLccZuI=
-github.com/authzed/spicedb v1.50.1-0.20260323205516-b041b8f844df/go.mod h1:v1Nn+0sDO42tP6D3fpt1Spz9Ai0+957cyv+G42Nt9f0=
+github.com/authzed/spicedb v1.51.0 h1:Nx202o/6vEXibw+GlPOHX5DwFHu8gYB9vYM5+UXHzvo=
+github.com/authzed/spicedb v1.51.0/go.mod h1:v1Nn+0sDO42tP6D3fpt1Spz9Ai0+957cyv+G42Nt9f0=
 github.com/aws/aws-sdk-go-v2 v1.40.1 h1:difXb4maDZkRH0x//Qkwcfpdg1XQVXEAEs2DdXldFFc=
 github.com/aws/aws-sdk-go-v2 v1.40.1/go.mod h1:MayyLB8y+buD9hZqkCW3kX1AKq07Y5pXxtgB+rRFhz0=
 github.com/aws/aws-sdk-go-v2/config v1.32.3 h1:cpz7H2uMNTDa0h/5CYL5dLUEzPSLo2g0NkbxTRJtSSU=

internal/cmd/import.go

@@ -4,7 +4,6 @@ import (
 	"bufio"
 	"context"
 	"fmt"
-	"net/url"
 	"strings"
 
 	"github.com/jzelinskie/cobrautil/v2"
@@ -58,16 +57,12 @@ func registerImportCmd(rootCmd *cobra.Command) {
 			if err != nil {
 				return err
 			}
-			u, err := url.Parse(args[0])
-			if err != nil {
-				return err
-			}
 			prefix, err := determinePrefixForSchema(cmd.Context(), cobrautil.MustGetString(cmd, "schema-definition-prefix"), client, nil)
 			if err != nil {
 				return err
 			}
 			log.Trace().Msgf("using prefix: %s", prefix)
-			return importCmdFunc(cmd, client, client, prefix, u)
+			return importCmdFunc(cmd, client, client, prefix, args[0])
 		},
 	}
 
@@ -79,13 +74,9 @@ func registerImportCmd(rootCmd *cobra.Command) {
 	importCmd.Flags().String("schema-definition-prefix", "", "prefix to add to the schema's definition(s) before importing")
 }
 
-func importCmdFunc(cmd *cobra.Command, schemaClient v1.SchemaServiceClient, relationshipsClient v1.PermissionsServiceClient, prefix string, u *url.URL) error {
+func importCmdFunc(cmd *cobra.Command, schemaClient v1.SchemaServiceClient, relationshipsClient v1.PermissionsServiceClient, prefix, filename string) error {
 	prefix = strings.TrimRight(prefix, "/")
-	d, err := decode.DecoderFromURL(u)
-	if err != nil {
-		return err
-	}
-	p, err := d.UnmarshalYAMLValidationFile()
+	p, _, err := decode.ValidationFileFromFilename(filename, decode.FileTypeYaml)
 	if err != nil {
 		return err
 	}

internal/cmd/import_test.go

@@ -1,7 +1,6 @@
 package cmd
 
 import (
-	"net/url"
 	"path/filepath"
 	"testing"
 
@@ -74,11 +73,8 @@ func TestImportCmd(t *testing.T) {
 			c, err := zedtesting.ClientFromConn(conn)(cmd)
 			require.NoError(err)
 
-			u, err := url.Parse(f)
-			require.NoError(err)
-
 			// Run the import and assert we don't have errors
-			err = importCmdFunc(cmd, c, c, test.prefix, u)
+			err = importCmdFunc(cmd, c, c, test.prefix, f)
 			require.NoError(err)
 
 			// Run a check with full consistency to assert that the relationships

internal/cmd/validate-test/sibling-folders/schema/domain.zed

@@ -0,0 +1,3 @@
+definition domain {
+  relation read: user
+}

internal/cmd/validate-test/sibling-folders/schema/root.zed

@@ -0,0 +1,5 @@
+use import
+
+import "./domain.zed"
+
+definition user {}

internal/cmd/validate-test/sibling-folders/tests/validation.yaml

@@ -0,0 +1,5 @@
+---
+# This test is mostly asserting that path walking and
+# schema validation work correctly, so we don't have any
+# relations or assertions.
+schemaFile: "../schema/root.zed"

internal/cmd/validate-test/upwards-walk-schema-with-nonexistant-import/validation.yaml

@@ -0,0 +1,7 @@
+---
+schemaFile: "../nonexistant-import.zed"
+relationships: >-
+  resource:1#user@user:1
+assertions:
+  assertTrue:
+    - "resource:1#user@user:1"

…alidate-test/external-schema-escape.yaml …lidate-test/upwards-walk/validation.yamlinternal/cmd/validate-test/external-schema-escape.yaml renamed to internal/cmd/validate-test/upwards-walk/validation.yaml internal/cmd/validate-test/external-schema-escape.yaml renamed to internal/cmd/validate-test/upwards-walk/validation.yaml

@@ -1,5 +1,5 @@
 ---
-schemaFile: "../some-schema.zed"
+schemaFile: "../external-schema.zed"
 relationships: >-
   resource:1#user@user:1
 assertions:

internal/cmd/validate.go

@@ -1,10 +1,8 @@
 package cmd
 
 import (
-	"errors"
 	"fmt"
 	"io/fs"
-	"net/url"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -19,7 +17,6 @@ import (
 	"github.com/authzed/spicedb/pkg/development"
 	core "github.com/authzed/spicedb/pkg/proto/core/v1"
 	devinterface "github.com/authzed/spicedb/pkg/proto/developer/v1"
-	"github.com/authzed/spicedb/pkg/validationfile"
 
 	"github.com/authzed/zed/internal/commands"
 	"github.com/authzed/zed/internal/console"
@@ -145,44 +142,11 @@ func validateCmdFunc(cmd *cobra.Command, filenames []string) (string, bool, erro
 			toPrint.WriteString(filename + "\n")
 		}
 
-		u, err := url.Parse(filename)
+		parsed, contents, err := decode.ValidationFileFromFilename(filename, fileType)
 		if err != nil {
 			return "", true, err
 		}
 
-		d, err := decode.DecoderFromURL(u)
-		if err != nil {
-			return "", true, err
-		}
-		validateContents := d.Contents
-
-		// Root the filesystem at the directory containing the schema file, so
-		// that relative imports resolve correctly.
-		fileDir := filepath.Dir(filename)
-		if fileDir == "" {
-			fileDir = "."
-		}
-		filesystem := os.DirFS(fileDir)
-
-		var parsed *validationfile.ValidationFile
-		switch fileType {
-		case decode.FileTypeYaml:
-			parsed, err = d.UnmarshalYAMLValidationFile()
-		case decode.FileTypeZed:
-			parsed = d.UnmarshalSchemaValidationFile()
-		default:
-			parsed, err = d.UnmarshalAsYAMLOrSchema()
-		}
-		// This block handles the error regardless of which case statement is hit
-		if err != nil {
-			return "", true, err
-		}
-
-		// Ensure that either schema or schemaFile is present
-		if parsed.Schema.Schema == "" && parsed.SchemaFile == "" {
-			return "", false, errors.New("either schema or schemaFile must be present")
-		}
-
 		// This logic will use the zero value of the struct, so we don't need
 		// to do it conditionally.
 		tuples := make([]*core.RelationTuple, 0)
@@ -193,6 +157,20 @@ func validateCmdFunc(cmd *cobra.Command, filenames []string) (string, bool, erro
 			tuples = append(tuples, rel.ToCoreTuple())
 		}
 
+		// Root the filesystem at the directory containing the schema file, so
+		// that relative schema imports resolve correctly.
+		fileDir := filepath.Dir(filename)
+		if fileDir == "" {
+			fileDir = "."
+		}
+		if parsed.SchemaFile != "" {
+			// If the schemaFile is nonempty, we want to make sure that the import
+			// filesystem is rooted in the dir of that schemafile.
+			// TODO: it seems like there ought to be a better way to handle this.
+			fileDir = filepath.Join(fileDir, filepath.Dir(parsed.SchemaFile))
+		}
+		filesystem := os.DirFS(fileDir)
+
 		// Create the development context for each run
 		ctx := cmd.Context()
 		devCtx, devErrs, err := development.NewDevContext(ctx, &devinterface.RequestContext{
@@ -204,9 +182,12 @@ func validateCmdFunc(cmd *cobra.Command, filenames []string) (string, bool, erro
 		}
 		if devErrs != nil {
 			schemaOffset := parsed.Schema.SourcePosition.LineNumber
+			if parsed.SchemaFile != "" {
+				contents = []byte(parsed.Schema.Schema)
+			}
 
 			// Output errors
-			outputDeveloperErrorsWithLineOffset(toPrint, validateContents, devErrs.InputErrors, schemaOffset, filesystem)
+			outputDeveloperErrorsWithLineOffset(toPrint, contents, devErrs.InputErrors, schemaOffset, filesystem)
 			return toPrint.String(), true, nil
 		}
 		// Run assertions
@@ -215,7 +196,7 @@ func validateCmdFunc(cmd *cobra.Command, filenames []string) (string, bool, erro
 			return "", false, aerr
 		}
 		if adevErrs != nil {
-			outputDeveloperErrors(toPrint, validateContents, adevErrs, filesystem)
+			outputDeveloperErrors(toPrint, contents, adevErrs, filesystem)
 			return toPrint.String(), true, nil
 		}
 		successfullyValidatedFiles++
@@ -226,7 +207,7 @@ func validateCmdFunc(cmd *cobra.Command, filenames []string) (string, bool, erro
 			return "", false, rerr
 		}
 		if erDevErrs != nil {
-			outputDeveloperErrors(toPrint, validateContents, erDevErrs, filesystem)
+			outputDeveloperErrors(toPrint, contents, erDevErrs, filesystem)
 			return toPrint.String(), true, nil
 		}
 		// Print out any warnings for file
@@ -238,7 +219,7 @@ func validateCmdFunc(cmd *cobra.Command, filenames []string) (string, bool, erro
 		if len(warnings) > 0 {
 			for _, warning := range warnings {
 				fmt.Fprintf(toPrint, "%s%s\n", warningPrefix(), warning.Message)
-				outputForLine(toPrint, validateContents, uint64(warning.Line), warning.SourceCode, uint64(warning.Column)) // warning.LineNumber is 1-indexed
+				outputForLine(toPrint, contents, uint64(warning.Line), warning.SourceCode, uint64(warning.Column)) // warning.LineNumber is 1-indexed
 				toPrint.WriteString("\n")
 			}