Definitions reject typos

HCL checks the arguments of a resource against the provider schema. A convention of your own has no schema. Every bucket must carry an owner and a cost_center. The rule becomes a validation block on each variable that must follow it.

variable "tags" {
  type = map(string)
  validation {
    condition     = alltrue([for k in ["owner", "cost_center"] : contains(keys(var.tags), k)])
    error_message = "tags must contain owner and cost_center."
  }
}

The block checks that two keys are present. It does not reject a key it does not list.

CUE has the same gap until you write a shape. Here is a bucket with a misspelt field. Work in an empty directory and write estate.cue.

package estate

logs: {name: "logs", versioning: false, vrsioning: true}

logs: {
	name:       "logs"
	versioning: false
	vrsioning:  true
}

The file is valid and wrong. Versioning stays off, and nothing says so.

A name that starts with # is a definition. A definition is a shape. You build a value from it with &. A definition is closed: a value built from it may contain only the fields that the definition declares.

Warm-up

Build values from a shape

Replace the contents of estate.cue. The shape declares three fields.

package estate

#Bucket: {
	name!:      string
	class:      *"standard" | "ia" | "glacier"
	versioning: *false | bool
}

logs:  #Bucket & {name: "logs"}
media: #Bucket & {name: "media", versioning: true}

logs: {
	name:       "logs"
	class:      "standard"
	versioning: false
}
media: {
	name:       "media"
	class:      "standard"
	versioning: true
}

The definition #Bucket is not printed. It describes a shape and holds no data. The two buckets take the defaults of the shape.

Break it

Misspell the field again. This time the bucket is built from #Bucket.

package estate

#Bucket: {
	name!:      string
	class:      *"standard" | "ia" | "glacier"
	versioning: *false | bool
}

logs:  #Bucket & {name: "logs", vrsioning: true}
media: #Bucket & {name: "media", versioning: true}

Error: evaluating .:
logs.vrsioning: field not allowed:
    ./estate.cue:9:33

Read the error from the top.

• The path is logs.vrsioning.
• The rule is field not allowed. #Bucket is closed and does not declare vrsioning.
• One location is given, line 9. Only that line wrote the field.

pravo prints no buckets at all. A specification with an error has no result, so the typo cannot reach a plan.

When a definition refuses a field you meant to add, read C3. It shows how to open a definition with ... and how to extend one by embedding.

Exercise

package estate

#Bucket: {
	name!:      string
	class:      *"standard" | "ia" | "glacier"
	versioning: *false | bool
}

logs:    #Bucket & {name: "logs", vrsioning: true}
media:   #Bucket & {name: "media"}
backups: #Bucket & {name: "backups", class: "glacier"}

Error: evaluating .:
logs.vrsioning: field not allowed:
    ./estate.cue:9:35

pravo eval -c > /dev/null 2>&1 || { echo "pravo eval -c should pass"; exit 1; }
tmp=$(mktemp -d)
fixture() {
  mkdir "$tmp/$1"; cp estate.cue "$tmp/$1/"
  printf 'package estate\n\nextra: #Bucket & {name: "extra"%s}\n' "$2" > "$tmp/$1/fixture.cue"
  pravo -C "$tmp/$1" eval -c 2>&1
}
fixture ok ', tags: {owner: "o", cost_center: "c"}' > /dev/null || { echo "a complete bucket should pass"; exit 1; }
fixture one ', tags: {owner: "o"}' | grep -q 'field is required but not present' || { echo "a missing tag should fail"; exit 1; }
fixture typo ', tags: {owner: "o", cost_center: "c", ownr: "x"}' | grep -q 'field not allowed' || { echo "a misspelt tag should be refused"; exit 1; }
fixture none '' | grep -q 'field is required but not present' || { echo "a bucket without tags should fail"; exit 1; }
rm -rf "$tmp"
echo ok

pravo eval -c should pass

package estate

#Tagged: {
	owner!:       string
	cost_center!: string
}

#Bucket: {
	name!:      string
	class:      *"standard" | "ia" | "glacier"
	versioning: *false | bool
	tags:       #Tagged
}

logs: #Bucket & {
	name:       "logs"
	versioning: true
	tags: {owner: "platform", cost_center: "c100"}
}

media: #Bucket & {
	name: "media"
	tags: {owner: "web", cost_center: "c200"}
}

backups: #Bucket & {
	name:  "backups"
	class: "glacier"
	tags: {owner: "platform", cost_center: "c100"}
}

name:       "backups"
class:      "glacier"
versioning: false
tags: {
	owner:       "platform"
	cost_center: "c100"
}

Recap

• A name that starts with # is a definition: a shape, not data.
• A value built with #Bucket & {...} may contain only declared fields.
• A misspelt field is refused during evaluation and names its path.

You have already used a definition. In Start, $local.#Resource.local_file is one that pravo generates from the provider's schema, and rules.cue narrowed it. Every resource is built from such a definition, so a misspelt attribute fails in pravo validate before any provider starts. C3 shows that error on a real resource.