Add RFC3339 format validation to date-related input variables

deployment/modules/gcp/gce/tesseract/tests/variables_validation.tftest.hcl

@@ -0,0 +1,150 @@
+provider "google" {
+  project = "dummy-project"
+}
+
+variables {
+  project_id                                 = "dummy-project"
+  base_name                                  = "dummy-base"
+  origin                                     = "dummy-origin"
+  location                                   = "us-central1"
+  env                                        = "dev"
+  docker_repo                                = "gcr.io/dummy"
+  server_docker_image                        = "dummy-image:latest"
+  bucket                                     = "dummy-bucket"
+  log_spanner_instance                       = "dummy-instance"
+  log_spanner_db                             = "dummy-db"
+  antispam_spanner_db                        = "dummy-antispam-db"
+  additional_signer_private_key_secret_names = []
+  signer_public_key_secret_name              = "projects/dummy/secrets/pub/versions/1"
+  signer_private_key_secret_name             = "projects/dummy/secrets/priv/versions/1"
+}
+
+run "valid_dates" {
+  command = plan
+
+  variables {
+    not_after_start = "2024-01-01T00:00:00Z"
+    not_after_limit = "2024-01-02T00:00:00Z"
+  }
+}
+
+run "invalid_dates_not_after_start_format" {
+  command = plan
+
+  variables {
+    not_after_start = "2024-01-01"
+  }
+
+  expect_failures = [
+    var.not_after_start,
+  ]
+}
+
+run "invalid_dates_not_after_limit_format" {
+  command = plan
+
+  variables {
+    not_after_limit = "2024-01-02T00:00:00Z]"
+  }
+
+  expect_failures = [
+    var.not_after_limit,
+  ]
+}
+
+run "invalid_dates_start_after_limit" {
+  command = plan
+
+  variables {
+    not_after_start = "2024-01-02T00:00:00Z"
+    not_after_limit = "2024-01-01T00:00:00Z"
+  }
+
+  expect_failures = [
+    var.not_after_limit,
+  ]
+}
+
+run "invalid_dates_equal" {
+  command = plan
+
+  variables {
+    not_after_start = "2024-01-01T00:00:00Z"
+    not_after_limit = "2024-01-01T00:00:00Z"
+  }
+
+  expect_failures = [
+    var.not_after_limit,
+  ]
+}
+
+run "valid_dates_start_empty" {
+  command = plan
+
+  variables {
+    not_after_start = ""
+    not_after_limit = "2024-01-02T00:00:00Z"
+  }
+}
+
+run "valid_dates_limit_empty" {
+  command = plan
+
+  variables {
+    not_after_start = "2024-01-01T00:00:00Z"
+    not_after_limit = ""
+  }
+}
+
+run "valid_dates_both_empty" {
+  command = plan
+
+  variables {
+    not_after_start = ""
+    not_after_limit = ""
+  }
+}
+
+run "valid_dates_fractional_seconds" {
+  command = plan
+
+  variables {
+    not_after_start = "2024-01-01T00:00:00.123Z"
+    not_after_limit = "2024-01-02T00:00:00.456Z"
+  }
+}
+
+run "valid_dates_offsets" {
+  command = plan
+
+  variables {
+    not_after_start = "2024-01-01T00:00:00+01:00"
+    not_after_limit = "2024-01-02T00:00:00-05:00"
+  }
+}
+
+run "invalid_dates_not_after_start_lowercase" {
+  command = plan
+
+  variables {
+    not_after_start = "2024-01-01t00:00:00z"
+    not_after_limit = "2024-01-02T00:00:00Z"
+  }
+
+  expect_failures = [
+    var.not_after_start,
+  ]
+}
+
+run "invalid_dates_not_after_limit_lowercase" {
+  command = plan
+
+  variables {
+    not_after_start = "2024-01-01T00:00:00Z"
+    not_after_limit = "2024-01-02t00:00:00z"
+  }
+
+  expect_failures = [
+    var.not_after_limit,
+  ]
+}

deployment/modules/gcp/gce/tesseract/variables.tf

@@ -75,15 +75,30 @@ variable "signer_private_key_secret_name" {
 }
 
 variable "not_after_start" {
-  description = "Start of the range of acceptable NotAfter values, inclusive. Leaving this empty implies no lower bound to the range. RFC3339 UTC format, e.g: 2024-01-02T15:04:05Z."
+  description = "Start of the range of acceptable NotAfter values, inclusive. Leaving this empty implies no lower bound to the range. RFC3339 format, e.g: 2024-01-02T15:04:05Z."
   default     = ""
   type        = string
+
+  validation {
+    condition     = var.not_after_start == "" || can(regex("^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d+)?(Z|[+-]\\d{2}:\\d{2})$", var.not_after_start))
+    error_message = "not_after_start must be in RFC3339 format (e.g., 2024-01-02T15:04:05Z, 2024-01-02T15:04:05.123Z, or 2024-01-02T15:04:05+01:00) or empty."
+  }
 }
 
 variable "not_after_limit" {
-  description = "Cut off point of notAfter dates - only notAfter dates strictly *before* notAfterLimit will be accepted. Leaving this empty means no upper bound on the accepted range. RFC3339 UTC format, e.g: 2024-01-02T15:04:05Z."
+  description = "Cut off point of notAfter dates - only notAfter dates strictly *before* notAfterLimit will be accepted. Leaving this empty means no upper bound on the accepted range. RFC3339 format, e.g: 2024-01-02T15:04:05Z."
   default     = ""
   type        = string
+
+  validation {
+    condition     = var.not_after_limit == "" || can(regex("^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d+)?(Z|[+-]\\d{2}:\\d{2})$", var.not_after_limit))
+    error_message = "not_after_limit must be in RFC3339 format (e.g., 2024-01-02T15:04:05Z, 2024-01-02T15:04:05.123Z, or 2024-01-02T15:04:05+01:00) or empty."
+  }
+
+  validation {
+    condition     = var.not_after_start == "" || var.not_after_limit == "" || timecmp(var.not_after_start, var.not_after_limit) < 0
+    error_message = "not_after_start must be strictly before not_after_limit."
+  }
 }
 
 variable "trace_fraction" {