Update buf and use protovalidate (#2596)

Author: tstirrat15

buf.gen.yaml

@@ -1,34 +1,31 @@
-#!/usr/bin/env -S buf generate -o pkg/proto proto/internal --template
 ---
-version: "v1"
+version: "v2"
 managed:
   enabled: true
-  go_package_prefix:
-    default: "github.com/authzed/spicedb/pkg/proto"
-    except:
-      - "buf.build/envoyproxy/protoc-gen-validate"
-      - "buf.build/authzed/api"
-      - "buf.build/googleapis/googleapis"
+  disable:
+    - file_option: "go_package"
+      module: "buf.build/authzed/api"
+    - file_option: "go_package"
+      module: "buf.build/googleapis/googleapis"
+    - file_option: "go_package"
+      module: "buf.build/bufbuild/protovalidate"
+  override:
+    - file_option: "go_package_prefix"
+      value: "github.com/authzed/spicedb/pkg/proto"
 plugins:
-  - name: "go"
-    path: ["go", "run", "google.golang.org/protobuf/cmd/protoc-gen-go"]
-    out: "."
+  - remote: "buf.build/protocolbuffers/go:v1.36.10"
+    out: "pkg/proto"
     opt: "paths=source_relative"
-  - name: "go-grpc"
-    out: "."
-    path: ["go", "run", "google.golang.org/grpc/cmd/protoc-gen-go-grpc"]
+  - remote: "buf.build/grpc/go:v1.5.1"
+    out: "pkg/proto"
     opt: "paths=source_relative"
-  - name: "go-vtproto"
-    path:
+    # NOTE: we use the local vs remote here because we use a more recent version of vtproto than is available
+    # in the buf registry.
+  - local:
       [
         "go",
         "run",
         "github.com/planetscale/vtprotobuf/cmd/protoc-gen-go-vtproto",
       ]
-    out: "."
-    # To generate pooling methods, you must add an additional `pool=fully/qualified.ProtoMessageType`
+    out: "pkg/proto"
     opt: "paths=source_relative,features=marshal+unmarshal+size+clone+pool+equal"
-  - name: "validate"
-    path: ["go", "run", "github.com/envoyproxy/protoc-gen-validate"]
-    out: "."
-    opt: "paths=source_relative,lang=go"

buf.lock

@@ -0,0 +1,18 @@
+# Generated by buf. DO NOT EDIT.
+version: v2
+deps:
+  - name: buf.build/authzed/api
+    commit: 53f3e981ed3346bab8c050c597f74602
+    digest: b5:fb42f996d63c02edd4d890058000bae6a6fc5a07b984bd8f8544a203a295506254170a89dfad32f973190753f7f8f0b9b45edab9c13e5f5485e293933f26f014
+  - name: buf.build/bufbuild/protovalidate
+    commit: 52f32327d4b045a79293a6ad4e7e1236
+    digest: b5:cbabc98d4b7b7b0447c9b15f68eeb8a7a44ef8516cb386ac5f66e7fd4062cd6723ed3f452ad8c384b851f79e33d26e7f8a94e2b807282b3def1cd966c7eace97
+  - name: buf.build/envoyproxy/protoc-gen-validate
+    commit: 45685e052c7e406b9fbd441fc7a568a5
+    digest: b5:63939effe0c64a94cd3151770b73007e43c9aeff31dcb24737fb11750dcaaca99338df3c1e5513828a685c743712e59ce283e046c27725e96928d200492bb6ec
+  - name: buf.build/googleapis/googleapis
+    commit: 711e289f6a384c4caeebaff7c6931ade
+    digest: b5:968b318852fd6a5275af38047f71727d2406fb4a401912069359cd5551ee22fe4397d0e397d5e4a952eb4c96c467b82bd3c0a564fb9a48d7dfe668e4c0047c61
+  - name: buf.build/grpc-ecosystem/grpc-gateway
+    commit: bc28b723cd774c32b6fbc77621518765
+    digest: b5:a613f827fa6ff35a4f5e87e80e35ac6b35e5792cc9c5a658351072777d88c6d4df785a0c14889090db11667cf5463d122c7193b3719c7861d3e5747c22ce1381

buf.work.yaml

@@ -1,19 +1,24 @@
 ---
-version: "v1"
+version: "v2"
+modules:
+  - path: "proto/internal"
 deps:
-  - "buf.build/envoyproxy/protoc-gen-validate:bb405eae115246f0b5ccf8997136e3d8"
   - "buf.build/authzed/api:53f3e981ed3346bab8c050c597f74602"
+  - "buf.build/bufbuild/protovalidate:v1.0.0"
   - "buf.build/googleapis/googleapis:4d230ddc6b6d28ad7d2503926a97c6f7fa15483d"
 lint:
   except:
     - "ENUM_VALUE_PREFIX"
     - "ENUM_ZERO_VALUE_SUFFIX"
   ignore_only:
     FIELD_LOWER_SNAKE_CASE:
-      - "core/v1/core.proto" # TODO: Remove after v0 api removed
+      - "proto/internal/core/v1/core.proto"
+  disallow_comment_ignores: true
 breaking:
   use:
     - "WIRE"
+  except:
+    - "FIELD_SAME_DEFAULT"
   ignore_only:
     FIELD_WIRE_COMPATIBLE_TYPE:
-      - "dispatch/v1/dispatch.proto" # TODO: Remove after core v1 is merged
+      - "proto/internal/dispatch/v1/dispatch.proto"

proto/internal/buf.yaml buf.yamlproto/internal/buf.yaml renamed to buf.yaml

@@ -18,6 +18,7 @@ replace github.com/influxdata/tdigest => github.com/hdrodz/tdigest v0.0.0-202304
 replace github.com/docker/docker => github.com/docker/docker v28.0.0+incompatible
 
 require (
+	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.10-20251209175733-2a1774d88802.1
 	buf.build/gen/go/prometheus/prometheus/protocolbuffers/go v1.36.10-20251118093737-4105057cc7d4.1
 	buf.build/go/protovalidate v1.1.0
 	cloud.google.com/go/spanner v1.86.1
@@ -48,7 +49,6 @@ require (
 	github.com/dlmiddlecote/sqlstats v1.0.2
 	github.com/dustin/go-humanize v1.0.1
 	github.com/emirpasic/gods v1.18.1
-	github.com/envoyproxy/protoc-gen-validate v1.3.0
 	github.com/ettle/strcase v0.2.0
 	github.com/exaring/otelpgx v0.9.3
 	github.com/fatih/color v1.18.0
@@ -149,7 +149,6 @@ tool (
 require (
 	4d63.com/gocheckcompilerdirectives v1.3.0 // indirect
 	4d63.com/gochecknoglobals v0.2.2 // indirect
-	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.10-20251209175733-2a1774d88802.1 // indirect
 	buf.build/gen/go/gogo/protobuf/protocolbuffers/go v1.36.10-20240617172848-e1dbca2775a7.1 // indirect
 	cel.dev/expr v0.24.0 // indirect
 	cloud.google.com/go v0.122.0 // indirect
@@ -243,6 +242,7 @@ require (
 	github.com/ecordell/optgen v0.2.3 // indirect
 	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
 	github.com/envoyproxy/go-control-plane/envoy v1.35.0 // indirect
+	github.com/envoyproxy/protoc-gen-validate v1.3.0 // indirect
 	github.com/fatih/structtag v1.2.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/firefart/nonamedreturns v1.0.6 // indirect

go.mod

@@ -1,3 +1,4 @@
+---
 schema: |+
   use expiration
 

internal/services/steelthreadtesting/testdata/real-schema-and-data-with-many-relations.yaml

@@ -4,6 +4,8 @@ import (
 	"context"
 	"fmt"
 
+	"buf.build/go/protovalidate"
+
 	v1 "github.com/authzed/authzed-go/proto/authzed/api/v1"
 
 	"github.com/authzed/spicedb/pkg/datastore"
@@ -61,7 +63,7 @@ func (vsr validatingSnapshotReader) LegacyListAllNamespaces(
 	}
 
 	for _, ns := range read {
-		err := ns.Definition.Validate()
+		err := protovalidate.Validate(ns.Definition)
 		if err != nil {
 			return nil, err
 		}
@@ -80,7 +82,7 @@ func (vsr validatingSnapshotReader) LegacyLookupNamespacesWithNames(
 	}
 
 	for _, ns := range read {
-		err := ns.Definition.Validate()
+		err := protovalidate.Validate(ns.Definition)
 		if err != nil {
 			return nil, err
 		}
@@ -118,7 +120,7 @@ func (vsr validatingSnapshotReader) LegacyReadNamespaceByName(
 		return read, createdAt, err
 	}
 
-	err = read.Validate()
+	err = protovalidate.Validate(read)
 	return read, createdAt, err
 }
 
@@ -149,7 +151,7 @@ func (vsr validatingSnapshotReader) LegacyReadCaveatByName(ctx context.Context,
 		return read, createdAt, err
 	}
 
-	err = read.Validate()
+	err = protovalidate.Validate(read)
 	return read, createdAt, err
 }
 
@@ -160,7 +162,7 @@ func (vsr validatingSnapshotReader) LegacyLookupCaveatsWithNames(ctx context.Con
 	}
 
 	for _, caveat := range read {
-		err := caveat.Definition.Validate()
+		err := protovalidate.Validate(caveat.Definition)
 		if err != nil {
 			return nil, err
 		}
@@ -176,7 +178,7 @@ func (vsr validatingSnapshotReader) LegacyListAllCaveats(ctx context.Context) ([
 	}
 
 	for _, caveat := range read {
-		err := caveat.Definition.Validate()
+		err := protovalidate.Validate(caveat.Definition)
 		if err != nil {
 			return nil, err
 		}
@@ -191,7 +193,7 @@ type validatingReadWriteTransaction struct {
 }
 
 func (vrwt validatingReadWriteTransaction) RegisterCounter(ctx context.Context, name string, filter *core.RelationshipFilter) error {
-	if err := filter.Validate(); err != nil {
+	if err := protovalidate.Validate(filter); err != nil {
 		return err
 	}
 
@@ -208,7 +210,7 @@ func (vrwt validatingReadWriteTransaction) StoreCounterValue(ctx context.Context
 
 func (vrwt validatingReadWriteTransaction) LegacyWriteNamespaces(ctx context.Context, newConfigs ...*core.NamespaceDefinition) error {
 	for _, newConfig := range newConfigs {
-		if err := newConfig.Validate(); err != nil {
+		if err := protovalidate.Validate(newConfig); err != nil {
 			return err
 		}
 	}
@@ -236,7 +238,7 @@ func (vrwt validatingReadWriteTransaction) WriteRelationships(ctx context.Contex
 }
 
 func (vrwt validatingReadWriteTransaction) DeleteRelationships(ctx context.Context, filter *v1.RelationshipFilter, options ...options.DeleteOptionsOption) (uint64, bool, error) {
-	if err := filter.Validate(); err != nil {
+	if err := protovalidate.Validate(filter); err != nil {
 		return 0, false, err
 	}
 

internal/testfixtures/validating.go

@@ -28,7 +28,7 @@ func (Gen) Go() error {
 func (Gen) Proto() error {
 	fmt.Println("generating buf")
 	return RunSh("go", Tool())("run", "github.com/bufbuild/buf/cmd/buf",
-		"generate", "-o", "../pkg/proto", "../proto/internal", "--template", "../buf.gen.yaml")
+		"generate", "--template", "../buf.gen.yaml", "-o", "..", "..")
 }
 
 func (Gen) Completions() error {

magefiles/gen.go

@@ -769,7 +769,7 @@ func TestCompile(t *testing.T) {
 			"invalid definition name",
 			nilPrefix,
 			`definition someTenant/fo {}`,
-			"parse error in `invalid definition name`, line 1, column 1: error in object definition someTenant/fo: invalid NamespaceDefinition.Name: value does not match regex pattern \"^([a-z][a-z0-9_]{1,62}[a-z0-9]/)*[a-z][a-z0-9_]{1,62}[a-z0-9]$\"",
+			"parse error in `invalid definition name`, line 1, column 1: error in object definition someTenant/fo: validation error: name: value does not match regex pattern `^([a-z][a-z0-9_]{1,62}[a-z0-9]/)*[a-z][a-z0-9_]{1,62}[a-z0-9]$`",
 			[]SchemaDefinition{},
 		},
 		{
@@ -778,7 +778,7 @@ func TestCompile(t *testing.T) {
 			`definition some_tenant/foos {
 				relation ab: some_tenant/foos
 			}`,
-			"parse error in `invalid relation name`, line 2, column 5: error in relation ab: invalid Relation.Name: value does not match regex pattern \"^[a-z][a-z0-9_]{1,62}[a-z0-9]$\"",
+			"parse error in `invalid relation name`, line 2, column 5: error in relation ab: validation error: name: value does not match regex pattern `^[a-z][a-z0-9_]{1,62}[a-z0-9]$`",
 			[]SchemaDefinition{},
 		},
 		{

pkg/composableschemadsl/compiler/compiler_test.go

@@ -9,6 +9,7 @@ import (
 	"path/filepath"
 	"strings"
 
+	"buf.build/go/protovalidate"
 	"github.com/ccoveille/go-safecast/v2"
 	"github.com/jzelinskie/stringz"
 
@@ -265,7 +266,7 @@ func translateObjectDefinition(tctx *translationContext, defNode *dslNode) (*cor
 		ns.SourcePosition = getSourcePosition(defNode, tctx.mapper)
 
 		if !tctx.skipValidate {
-			if err = ns.Validate(); err != nil {
+			if err = protovalidate.Validate(ns); err != nil {
 				return nil, defNode.Errorf("error in object definition %s: %w", nspath, err)
 			}
 		}
@@ -278,7 +279,7 @@ func translateObjectDefinition(tctx *translationContext, defNode *dslNode) (*cor
 	ns.SourcePosition = getSourcePosition(defNode, tctx.mapper)
 
 	if !tctx.skipValidate {
-		if err := ns.Validate(); err != nil {
+		if err := protovalidate.Validate(ns); err != nil {
 			return nil, defNode.Errorf("error in object definition %s: %w", nspath, err)
 		}
 	}
@@ -418,7 +419,7 @@ func translateRelation(tctx *translationContext, relationNode *dslNode) (*core.R
 	}
 
 	if !tctx.skipValidate {
-		if err := relation.Validate(); err != nil {
+		if err := protovalidate.Validate(relation); err != nil {
 			return nil, relationNode.Errorf("error in relation %s: %w", relationName, err)
 		}
 	}
@@ -448,7 +449,7 @@ func translatePermission(tctx *translationContext, permissionNode *dslNode) (*co
 	}
 
 	if !tctx.skipValidate {
-		if err := permission.Validate(); err != nil {
+		if err := protovalidate.Validate(permission); err != nil {
 			return nil, permissionNode.Errorf("error in permission %s: %w", permissionName, err)
 		}
 	}
@@ -704,7 +705,7 @@ func translateSpecificTypeReference(tctx *translationContext, typeRefNode *dslNo
 	}
 
 	if !tctx.skipValidate {
-		if err := ref.Validate(); err != nil {
+		if err := protovalidate.Validate(ref); err != nil {
 			return nil, typeRefNode.Errorf("invalid type relation: %w", err)
 		}
 	}