fix: error if the container image uri has an account id that doesn't match the current account (#10634)

* error if account id is for a different account

* changeset

* lint

* Apply suggestions from code review

* Update packages/containers-shared/src/images.ts

Co-authored-by: Dario Piotrowicz <[email protected]>

---------

Co-authored-by: Dario Piotrowicz <[email protected]>

Author: emily-shen

.changeset/loose-camels-punch.md

@@ -0,0 +1,6 @@
+---
+"@cloudflare/containers-shared": patch
+"wrangler": patch
+---
+
+fix: error if the container image uri has an account id that doesn't match the current account

packages/containers-shared/src/images.ts

@@ -143,11 +143,22 @@ export function resolveImageName(accountId: string, image: string): string {
 	if (url.hostname !== getCloudflareContainerRegistry()) {
 		return image;
 	}
-
 	// is managed registry and has the account id, passthrough
 	if (url.pathname.startsWith(`/${accountId}`)) {
 		return image;
 	}
+	// check if already looks like it has an account id (32 char hex string)
+	const accountIdPattern = /^\/([a-f0-9]{32})\//;
+	const match = accountIdPattern.exec(url.pathname);
+	if (match) {
+		const foundAccountId = match[1];
+		if (foundAccountId !== accountId) {
+			throw new Error(
+				`Image "${image}" does not belong to your account\nImage appears to belong to account: "${foundAccountId}"\nCurrent account: "${accountId}"`
+			);
+		}
+		return image;
+	}
 
 	// is managed registry and doesn't have the account id,add it to the path
 	return `${url.hostname}/${accountId}${url.pathname}`;

packages/wrangler/src/__tests__/containers/deploy.test.ts

@@ -69,6 +69,25 @@ describe("wrangler deploy with containers", () => {
 		`
 		);
 	});
+	it("should fail early if the account id doesn't match the account id in the image uri", async () => {
+		writeWranglerConfig({
+			...DEFAULT_DURABLE_OBJECTS,
+			containers: [
+				{
+					name: "my-container",
+					class_name: "ExampleDurableObject",
+					image:
+						"registry.cloudflare.com/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/hello:world",
+				},
+			],
+		});
+		await expect(runWrangler("deploy index.js")).rejects
+			.toThrowErrorMatchingInlineSnapshot(`
+			[Error: Image "registry.cloudflare.com/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/hello:world" does not belong to your account
+			Image appears to belong to account: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+			Current account: "some-account-id"]
+		`);
+	});
 	it("should be able to deploy a new container from a dockerfile", async () => {
 		mockGetVersion("Galaxy-Class");
 		setupDockerMocks("my-container", "Galaxy");