package daemon

import (
	"fmt"
	"regexp"
	"strings"
)

// idPattern constrains path IDs to a safe subset: alphanumerics, hyphens,
// and underscores. UUIDs and our internal IDs both fit. We reject anything
// that smells like a path-traversal, control character, or shell metachar.
var idPattern = regexp.MustCompile(`^[A-Za-z0-9_-]{1,128}$`)

// validateID checks that an ID is well-formed and within length limits.
// It exists primarily as a defense-in-depth measure against path traversal
// and accidental log-injection when the ID is echoed back in error messages.
func validateID(id string) error {
	if id == "" {
		return fmt.Errorf("id required")
	}
	if strings.ContainsAny(id, "\r\n\t\x00") {
		return fmt.Errorf("invalid id")
	}
	if !idPattern.MatchString(id) {
		return fmt.Errorf("invalid id format")
	}
	return nil
}