Function validateFgaSubject

internal/service/fga.go:115–124

validateFgaSubject ensures an explicitly supplied subject is in OpenFGA "type:id" form (both halves non-empty). It rejects usersets ("type:id#relation") and malformed values.

(user string)

// "type:id" form (both halves non-empty). It rejects usersets
// ("type:id#relation") and malformed values.
func validateFgaSubject(user string) error {
	objType, objID, found := strings.Cut(user, ":")
	if !found || strings.TrimSpace(objType) == "" || strings.TrimSpace(objID) == "" {
		return InvalidArgument(fmt.Sprintf("user must be in type:id form, got %q", user))
	}
	if strings.Contains(objID, "#") {
		return InvalidArgument(fmt.Sprintf("user must be a concrete subject in type:id form, not a userset, got %q", user))
	}
	return nil
}

// toContextualTuples converts client-supplied contextual tuples. These are
// request-scoped only (never persisted) and are safe to accept from any