Skip binary files in DB cache sync (kptdev#437)

* Skip binary files and NUL bytes in DB cache sync

Binary files with invalid UTF-8 and files containing NUL bytes
(0x00) both cause PostgreSQL TEXT columns to reject the INSERT.
While utf8.ValidString() catches invalid UTF-8, NUL is technically
valid UTF-8 per RFC 3629 but PostgreSQL still rejects it.

Add strings.Contains(val, "\x00") check alongside utf8.ValidString()
to also filter files containing NUL bytes. Add 5 test cases covering:
mixed text/binary files, all text files, all binary files, empty
resources, and NUL byte content that passes utf8.ValidString().

Fixes: nephio-project/nephio#1040

Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>

* Also validate resource_key (file path) for PostgreSQL TEXT safety

resource_key is also a TEXT column, so file paths with invalid UTF-8
(e.g. Latin-1 encoded paths from older systems) would crash the INSERT.
Added validation for both key and value, plus a test case.

Fixes: nephio-project/nephio#1040

Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>

* Add defer Close and mock CacheInstance to test functions

The 6 test functions added for binary file filtering were missing
defer testRepo.Close(ctx) after OpenRepository, which could leak
resources if assertions fail. Also added mock CacheInstance setup
since Close() internally calls pkgScanRowsFromDB which requires
CacheInstance to resolve repository references.

Follows the same pattern used in TestRepositorySync_SyncOnce and
TestNewRepositorySync.

Fixes: nephio-project/nephio#1040

Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>

* Add nil guard for GetResources and improve test coverage

- Guard against nil return from GetResources() to prevent panic,
  since the PackageRevision interface contract allows (nil, nil)
- Add TestCacheExternalPRs_NilResources to cover the nil guard path
- Use testify idiomatic assertions (t.Empty, t.Len) for consistency
  with the rest of the dbcache test suite

Fixes: nephio-project/nephio#1040

Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>

---------

Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>
Co-authored-by: Liam Fallon <35595825+liamfallon@users.noreply.github.com>

Author: thc1006

pkg/cache/dbcache/dbreposync.go

@@ -17,8 +17,10 @@ package dbcache
 import (
 	"context"
 	"fmt"
+	"strings"
 	stdSync "sync"
 	"time"
+	"unicode/utf8"
 
 	porchapi "github.com/nephio-project/porch/api/porch/v1alpha1"
 	configapi "github.com/nephio-project/porch/api/porchconfig/v1alpha1"
@@ -224,6 +226,24 @@ func (s *repositorySync) cacheExternalPRs(ctx context.Context, externalPrMap map
 			return err
 		}
 
+		// Guard against nil return from GetResources (interface contract allows it).
+		var resources map[string]string
+		if extPRResources == nil || extPRResources.Spec.Resources == nil {
+			resources = make(map[string]string)
+		} else {
+			// Filter out files with invalid UTF-8 or NUL bytes to avoid PostgreSQL TEXT errors.
+			// Both resource_key and resource_value are TEXT columns, so both must be validated.
+			resources = make(map[string]string, len(extPRResources.Spec.Resources))
+			for key, val := range extPRResources.Spec.Resources {
+				if !utf8.ValidString(key) || strings.Contains(key, "\x00") ||
+					!utf8.ValidString(val) || strings.Contains(val, "\x00") {
+					klog.Warningf("repositorySync %+v: skipping file %q in PR %+v (not compatible with PostgreSQL TEXT)", s.repo.Key(), key, extPRKey)
+					continue
+				}
+				resources[key] = val
+			}
+		}
+
 		if extAPIPR.CreationTimestamp.Time.IsZero() {
 			extAPIPR.CreationTimestamp.Time = time.Now()
 		}
@@ -239,7 +259,7 @@ func (s *repositorySync) cacheExternalPRs(ctx context.Context, externalPrMap map
 			lifecycle: extAPIPR.Spec.Lifecycle,
 			extPRID:   extPRUpstreamLock,
 			tasks:     extAPIPR.Spec.Tasks,
-			resources: extPRResources.Spec.Resources,
+			resources: resources,
 		}
 		_, err = s.repo.savePackageRevision(ctx, &dbPR, true)
 		if err != nil {