Fix remote policy ref resolution for plugins (#3992)

Author: emcfarlane

private/buf/bufctl/controller.go

@@ -1621,6 +1621,18 @@ func newStaticPolicyPluginKeyProviderForPolicyConfigs(
 	policyConfigs []bufconfig.PolicyConfig,
 	policyNameToRemotePluginKeys map[string][]bufplugin.PluginKey,
 ) (bufpolicy.PolicyPluginKeyProvider, error) {
+	policyNames, err := xslices.ToUniqueValuesMap(policyConfigs, func(policyConfig bufconfig.PolicyConfig) string {
+		policyName := policyConfig.Name()
+		if policyConfig.Ref() != nil {
+			// Remote policies are required to be referenced by their full name.
+			// The buf.lock stores the name.
+			policyName = policyConfig.Ref().FullName().String()
+		}
+		return policyName
+	})
+	if err != nil {
+		return nil, fmt.Errorf("failed to validate policy names in policy configs: %w", err)
+	}
 	// We do not validate that all remote PolicyConfig plugins are present in the buf.lock file.
 	// This would require loading the PolicyConfig data. Check is defered to the runtime.
 	for policyName, remotePluginKeys := range policyNameToRemotePluginKeys {
@@ -1630,6 +1642,9 @@ func newStaticPolicyPluginKeyProviderForPolicyConfigs(
 		if err != nil {
 			return nil, fmt.Errorf("failed to validate remote PluginKeys for Policy %q: %w", policyName, err)
 		}
+		if _, ok := policyNames[policyName]; !ok {
+			return nil, fmt.Errorf("remote plugins configured for unknown policy %q", policyName)
+		}
 	}
 	return bufpolicy.NewStaticPolicyPluginKeyProvider(policyNameToRemotePluginKeys)
 }

private/bufpkg/bufpolicy/policy_plugin_data_provider.go

@@ -15,6 +15,11 @@
 package bufpolicy
 
 import (
+	"context"
+	"fmt"
+	"io/fs"
+
+	"github.com/bufbuild/buf/private/bufpkg/bufparse"
 	"github.com/bufbuild/buf/private/bufpkg/bufplugin"
 )
 
@@ -68,5 +73,29 @@ func (s staticPolicyPluginDataProvider) GetPluginDataProviderForPolicy(policyNam
 	if pluginDataProvider, ok := s.policyNameToPluginDataProvider[policyName]; ok {
 		return pluginDataProvider
 	}
-	return bufplugin.NopPluginDataProvider
+	// Check if the policyName is a valid ref. If so, also check by full name.
+	// Remote policies are cached by full name in the buf.lock file.
+	if ref, err := bufparse.ParseRef(policyName); err == nil && ref.Ref() != "" {
+		if pluginDataProvider, ok := s.policyNameToPluginDataProvider[ref.FullName().String()]; ok {
+			return pluginDataProvider
+		}
+	}
+	return newNopPluginDataProviderForPolicy(policyName)
+}
+
+type nopPluginDataProviderForPolicy struct {
+	policyName string
+}
+
+func newNopPluginDataProviderForPolicy(policyName string) bufplugin.PluginDataProvider {
+	return &nopPluginDataProviderForPolicy{
+		policyName: policyName,
+	}
+}
+
+func (p *nopPluginDataProviderForPolicy) GetPluginDatasForPluginKeys(
+	context.Context,
+	[]bufplugin.PluginKey,
+) ([]bufplugin.PluginData, error) {
+	return nil, fmt.Errorf("no plugins configured for policy %q: %w", p.policyName, fs.ErrNotExist)
 }

private/bufpkg/bufpolicy/policy_plugin_key_provider.go

@@ -15,8 +15,11 @@
 package bufpolicy
 
 import (
+	"context"
 	"fmt"
+	"io/fs"
 
+	"github.com/bufbuild/buf/private/bufpkg/bufparse"
 	"github.com/bufbuild/buf/private/bufpkg/bufplugin"
 )
 
@@ -78,5 +81,30 @@ func (s staticPolicyPluginKeyProvider) GetPluginKeyProviderForPolicy(policyName
 	if pluginKeyProvider, ok := s.policyNameToPluginKeyProvider[policyName]; ok {
 		return pluginKeyProvider
 	}
-	return bufplugin.NopPluginKeyProvider
+	// Check if the policyName is a valid ref. If so, also check by full name.
+	// Remote policies are cached by full name in the buf.lock file.
+	if ref, err := bufparse.ParseRef(policyName); err == nil && ref.Ref() != "" {
+		if pluginKeyProvider, ok := s.policyNameToPluginKeyProvider[ref.FullName().String()]; ok {
+			return pluginKeyProvider
+		}
+	}
+	return newNopPluginKeyProviderForPolicy(policyName)
+}
+
+type nopPluginKeyProviderForPolicy struct {
+	policyName string
+}
+
+func newNopPluginKeyProviderForPolicy(policyName string) bufplugin.PluginKeyProvider {
+	return &nopPluginKeyProviderForPolicy{
+		policyName: policyName,
+	}
+}
+
+func (p *nopPluginKeyProviderForPolicy) GetPluginKeysForPluginRefs(
+	context.Context,
+	[]bufparse.Ref,
+	bufplugin.DigestType,
+) ([]bufplugin.PluginKey, error) {
+	return nil, fmt.Errorf("no plugins configured for policy %q: %w", p.policyName, fs.ErrNotExist)
 }