Add validation for queries

pkg/bsql/config.go

@@ -13,6 +13,10 @@ import (
 	v2 "github.com/conductorone/baton-sdk/pb/c1/connector/v2"
 )
 
+type staticValidator interface {
+	StaticValidate(ctx context.Context, s *SQLSyncer) error
+}
+
 // Config represents the overall connector configuration.
 type Config struct {
 	// AppName is the application name that identifies the connector.
@@ -42,27 +46,27 @@ type DatabaseConfig struct {
 	// DSN is the Database Source Name connection string (optional if using structured fields).
 	// Supports environment variable expansion via ${VAR_NAME} syntax.
 	// Example: "postgres://${DB_HOST}:${DB_PORT}/${DB_DATABASE}?sslmode=disable"
-	DSN string `yaml:"dsn" json:"dsn"`
+	DSN string `yaml:"dsn" json:"dsn" validate:"required"`
 
 	// Structured connection fields (optional, override DSN components when set)
 
 	// Scheme is the database type (e.g., "postgres", "mysql", "sqlserver", "oracle", "hdb")
-	Scheme string `yaml:"scheme" json:"scheme"`
+	Scheme string `yaml:"scheme" json:"scheme" validate:"required"`
 
 	// Host is the database server hostname or IP address (may include port for some databases)
-	Host string `yaml:"host" json:"host"`
+	Host string `yaml:"host" json:"host" validate:"required"`
 
 	// Port is the database server port number
-	Port string `yaml:"port" json:"port"`
+	Port string `yaml:"port" json:"port" validate:"required"`
 
 	// Database is the name of the database to connect to
-	Database string `yaml:"database" json:"database"`
+	Database string `yaml:"database" json:"database" validate:"required"`
 
 	// User is the database username used for authentication
-	User string `yaml:"user" json:"user"`
+	User string `yaml:"user" json:"user" validate:"required"`
 
 	// Password is the database password used for authentication
-	Password string `yaml:"password" json:"password"`
+	Password string `yaml:"password" json:"password" validate:"required"`
 
 	// Params contains additional connection parameters (e.g., {"sslmode": "disable", "timeout": "30s"})
 	Params map[string]string `yaml:"params" json:"params"`
@@ -105,7 +109,7 @@ type ListQuery struct {
 	Vars map[string]string `yaml:"vars,omitempty" json:"vars,omitempty"`
 
 	// Query is the SQL statement used to fetch a list of resources.
-	Query string `yaml:"query" json:"query"`
+	Query string `yaml:"query" json:"query" validate:"required"`
 
 	// Pagination defines the pagination strategy and settings for the list query.
 	Pagination *Pagination `yaml:"pagination" json:"pagination"`
@@ -241,7 +245,7 @@ type EntitlementsQuery struct {
 	Vars map[string]string `yaml:"vars,omitempty" json:"vars,omitempty"`
 
 	// Query is the SQL statement used to fetch dynamic entitlements.
-	Query string `yaml:"query" json:"query"`
+	Query string `yaml:"query" json:"query" validate:"required"`
 
 	// Pagination defines how pagination should be handled for the entitlements query.
 	Pagination *Pagination `yaml:"pagination" json:"pagination"`

pkg/bsql/query.go

@@ -95,6 +95,20 @@ func parseToken(token string) (*queryTokenOpts, error) {
 	return opts, nil
 }
 
+func (s *SQLSyncer) queryVars(query string) ([]string, error) {
+	result := make([]string, 0)
+
+	for _, token := range queryOptRegex.FindAllString(query, -1) {
+		opts, err := parseToken(token)
+		if err != nil {
+			return nil, err
+		}
+		result = append(result, opts.Key)
+	}
+
+	return result, nil
+}
+
 func (s *SQLSyncer) parseQueryOpts(pCtx *paginationContext, query string, vars map[string]any) (string, []interface{}, bool, error) {
 	if vars == nil {
 		vars = make(map[string]any)

pkg/bsql/sql_syncer.go

@@ -3,6 +3,7 @@ package bsql
 import (
 	"context"
 	"database/sql"
+	"fmt"
 
 	v2 "github.com/conductorone/baton-sdk/pb/c1/connector/v2"
 	"github.com/conductorone/baton-sdk/pkg/connectorbuilder"
@@ -68,3 +69,71 @@ func NewActionSyncer(ctx context.Context, db *sql.DB, dbEngine database.DbEngine
 		fullConfig:   fullConfig,
 	}, nil
 }
+
+func (s *SQLSyncer) validateInternal(ctx context.Context, anyV any) error {
+	if anyV == nil {
+		return nil
+	}
+
+	if v, ok := anyV.(staticValidator); ok {
+		err := v.StaticValidate(ctx, s)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (s *SQLSyncer) validateFormatErr(field string, err error) error {
+	rsTypeId := s.resourceType.Id
+
+	return fmt.Errorf("validation error for resource type %q, field %q: %w", rsTypeId, field, err)
+}
+
+func (s *SQLSyncer) Validate(ctx context.Context) error {
+	if s.fullConfig.Actions != nil {
+		for key, action := range s.fullConfig.Actions {
+			err := s.validateInternal(ctx, &action)
+			if err != nil {
+				return s.validateFormatErr(fmt.Sprintf("Action[%s]", key), err)
+			}
+		}
+	}
+
+	if err := s.validateInternal(ctx, s.config.List); err != nil {
+		return s.validateFormatErr("list", err)
+	}
+
+	if s.config.Entitlements != nil {
+		if err := s.validateInternal(ctx, s.config.Entitlements); err != nil {
+			return s.validateFormatErr("entitlements", err)
+		}
+	}
+
+	if s.config.StaticEntitlements != nil {
+		if err := s.validateInternal(ctx, s.config.StaticEntitlements); err != nil {
+			return s.validateFormatErr("static_entitlements", err)
+		}
+	}
+
+	if s.config.Grants != nil {
+		if err := s.validateInternal(ctx, s.config.Grants); err != nil {
+			return s.validateFormatErr("grants", err)
+		}
+	}
+
+	if s.config.AccountProvisioning != nil {
+		if err := s.validateInternal(ctx, s.config.AccountProvisioning); err != nil {
+			return s.validateFormatErr("account_provisioning", err)
+		}
+	}
+
+	if s.config.CredentialRotation != nil {
+		if err := s.validateInternal(ctx, s.config.CredentialRotation); err != nil {
+			return s.validateFormatErr("credential_rotation", err)
+		}
+	}
+
+	return nil
+}

pkg/bsql/validate.go

@@ -0,0 +1,146 @@
+package bsql
+
+import (
+	"context"
+	"errors"
+	"fmt"
+)
+
+func validateVarsInQuery(s *SQLSyncer, query string, vars map[string]string) error {
+	if query == "" {
+		return fmt.Errorf("list query is required")
+	}
+
+	usedVars, err := s.queryVars(query)
+	if err != nil {
+		return fmt.Errorf("failed to parse list query for variables: %w", err)
+	}
+
+	if vars == nil {
+		vars = make(map[string]string)
+	}
+
+	for _, v := range usedVars {
+		if _, ok := vars[v]; !ok {
+			if v == "limit" || v == "offset" || v == "cursor" {
+				continue
+			}
+			return fmt.Errorf("list query uses variable '%s' which is not defined in vars", v)
+		}
+	}
+
+	return nil
+}
+
+func (l *ListQuery) StaticValidate(ctx context.Context, s *SQLSyncer) error {
+	return validateVarsInQuery(s, l.Query, l.Vars)
+}
+
+func (l *EntitlementsQuery) StaticValidate(ctx context.Context, s *SQLSyncer) error {
+	return validateVarsInQuery(s, l.Query, l.Vars)
+}
+
+func (l *EntitlementMapping) StaticValidate(ctx context.Context, s *SQLSyncer) error {
+	if l.Provisioning == nil {
+		return nil
+	}
+
+	if l.Provisioning.Grant != nil {
+		for _, query := range l.Provisioning.Grant.Queries {
+			err := validateVarsInQuery(s, query, l.Provisioning.Vars)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	if l.Provisioning.Revoke != nil {
+		for _, query := range l.Provisioning.Revoke.Queries {
+			err := validateVarsInQuery(s, query, l.Provisioning.Vars)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+func (l *GrantsQuery) StaticValidate(ctx context.Context, s *SQLSyncer) error {
+	return validateVarsInQuery(s, l.Query, l.Vars)
+}
+
+func (l *AccountProvisioning) StaticValidate(ctx context.Context, s *SQLSyncer) error {
+
+	if l.Credentials == nil {
+		return errors.New("no credentials defined")
+	}
+
+	if l.Credentials.EncryptedPassword == nil &&
+		l.Credentials.RandomPassword == nil &&
+		l.Credentials.NoPassword == nil {
+		return errors.New("no credential method defined")
+	}
+
+	if l.Credentials.RandomPassword != nil {
+		if l.Credentials.RandomPassword.MaxLength <= 0 {
+			return errors.New("random password max_length must be greater than zero")
+		}
+
+		if l.Credentials.RandomPassword.MinLength <= 0 {
+			return errors.New("random password min_length must be greater than zero")
+		}
+
+		if l.Credentials.RandomPassword.MinLength > l.Credentials.RandomPassword.MaxLength {
+			return errors.New("random password min_length cannot be greater than max_length")
+		}
+	}
+
+	if l.Create == nil {
+		return errors.New("no create functions defined")
+	}
+
+	for _, query := range l.Create.Queries {
+		err := validateVarsInQuery(s, query, l.Create.Vars)
+		if err != nil {
+			return err
+		}
+	}
+
+	if l.Validate == nil {
+		return errors.New("no validate functions defined")
+	}
+
+	err := validateVarsInQuery(s, l.Validate.Query, l.Validate.Vars)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (l *CredentialRotation) StaticValidate(ctx context.Context, s *SQLSyncer) error {
+	if l.Update != nil {
+		for _, query := range l.Update.Queries {
+			err := validateVarsInQuery(s, query, l.Update.Vars)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+func (l *ActionConfig) StaticValidate(ctx context.Context, s *SQLSyncer) error {
+	availableVars := make(map[string]string)
+	for k, v := range l.Vars {
+		availableVars[k] = v
+	}
+
+	for k, config := range l.Arguments {
+		availableVars[k] = config.Name
+	}
+
+	return validateVarsInQuery(s, l.Query, availableVars)
+}

pkg/bsql/validate_test.go

@@ -0,0 +1,51 @@
+package bsql
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestValidate(t *testing.T) {
+	tcases := []struct {
+		name      string
+		validator staticValidator
+		expectErr bool
+	}{
+		{
+			name: "valid list query",
+			validator: &ListQuery{
+				Query: "SELECT * FROM users WHERE id = ?<userid> LIMIT ?<Limit> OFFSET ?<Offset>",
+				Vars: map[string]string{
+					"userid": "string",
+				},
+			},
+			expectErr: false,
+		},
+		{
+			name: "invalid list query",
+			validator: &ListQuery{
+				Query: "SELECT * FROM users WHERE id = ?<unknown> LIMIT ?<Limit> OFFSET ?<Offset>",
+				Vars: map[string]string{
+					"userid": "string",
+				},
+			},
+			expectErr: true,
+		},
+	}
+
+	for _, tc := range tcases {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := t.Context()
+
+			syncer := &SQLSyncer{}
+
+			err := tc.validator.StaticValidate(ctx, syncer)
+			if tc.expectErr {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}

pkg/connector/connector.go

@@ -76,7 +76,23 @@ func (c *Connector) Metadata(ctx context.Context) (*v2.ConnectorMetadata, error)
 // Validate is called to ensure that the connector is properly configured. It should exercise any API credentials
 // to be sure that they are valid.
 func (c *Connector) Validate(ctx context.Context) (annotations.Annotations, error) {
-	err := c.db.PingContext(ctx)
+	syncers, err := c.config.GetSQLSyncers(ctx, c.db, c.dbEngine, c.celEnv)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, syncer := range syncers {
+		if v, ok := syncer.(interface {
+			Validate(ctx context.Context) error
+		}); ok {
+			err := v.Validate(ctx)
+			if err != nil {
+				return nil, err
+			}
+		}
+	}
+
+	err = c.db.PingContext(ctx)
 	if err != nil {
 		return nil, err
 	}