fix(ops): harden runtime placeholder guards

adk-rust/crates/detmir-core/src/lib.rs

@@ -65,6 +65,103 @@ pub fn parse_utc_rfc3339(value: &str) -> Result<DateTime<Utc>> {
         .map(|ts| ts.with_timezone(&Utc))
 }
 
+pub mod runtime_guard {
+    use anyhow::{Result, bail};
+
+    const TEST_NET_MARKERS: [&str; 3] = ["192.0.2.", "198.51.100.", "203.0.113."];
+    const CONTAINS_PLACEHOLDERS: [&str; 2] = ["HOST-EXAMPLE", "WINDOWS_USER_EXAMPLE"];
+    const EXACT_PLACEHOLDERS: [&str; 9] = [
+        "CHANGE_ME",
+        "CHANGEME",
+        "REPLACE_ME",
+        "REPLACE-ME",
+        "YOUR_TOKEN",
+        "YOUR_API_KEY",
+        "TOKEN",
+        "SECRET",
+        "PASSWORD",
+    ];
+
+    pub fn is_runtime_placeholder(value: &str) -> bool {
+        let trimmed = value.trim();
+        if trimmed.is_empty() {
+            return true;
+        }
+        let normalized = trimmed.to_ascii_uppercase();
+        TEST_NET_MARKERS
+            .iter()
+            .any(|marker| normalized.contains(marker))
+            || CONTAINS_PLACEHOLDERS
+                .iter()
+                .any(|placeholder| normalized.contains(placeholder))
+            || EXACT_PLACEHOLDERS
+                .iter()
+                .any(|placeholder| normalized == *placeholder)
+            || normalized == "EXAMPLE"
+            || normalized.contains("-EXAMPLE")
+            || normalized.contains("_EXAMPLE")
+            || normalized.contains("EXAMPLE.")
+            || normalized.contains(".EXAMPLE")
+            || normalized.starts_with("YOUR_")
+            || (normalized.starts_with('<') && normalized.ends_with('>'))
+    }
+
+    pub fn is_secret_placeholder(value: &str) -> bool {
+        is_runtime_placeholder(value)
+            || matches!(
+                value.trim().to_ascii_uppercase().as_str(),
+                "API_KEY" | "INFLUX_TOKEN" | "WRITE_TOKEN" | "BEARER_TOKEN"
+            )
+    }
+
+    pub fn ensure_runtime_value(name: &str, value: &str, context: &str) -> Result<()> {
+        if is_runtime_placeholder(value) {
+            bail!("{name} contains an empty/example/TEST-NET value while {context}");
+        }
+        Ok(())
+    }
+
+    pub fn ensure_secret_value(name: &str, value: &str, context: &str) -> Result<()> {
+        if is_secret_placeholder(value) {
+            bail!("{name} contains an empty/example secret value while {context}");
+        }
+        Ok(())
+    }
+
+    pub fn ensure_runtime_values<'a>(
+        name: &str,
+        values: impl IntoIterator<Item = &'a String>,
+        context: &str,
+    ) -> Result<()> {
+        let mut empty = true;
+        for value in values {
+            empty = false;
+            ensure_runtime_value(name, value, context)?;
+        }
+        if empty {
+            bail!("{name} contains an empty/example value while {context}");
+        }
+        Ok(())
+    }
+
+    pub fn ensure_influx_runtime_config(
+        prefix: &str,
+        url: &str,
+        org: &str,
+        bucket: &str,
+        token: &str,
+        hosts: &[String],
+    ) -> Result<()> {
+        let context = format!("{prefix}_ENABLED=true");
+        ensure_runtime_value(&format!("{prefix}_URL"), url, &context)?;
+        ensure_runtime_value(&format!("{prefix}_ORG"), org, &context)?;
+        ensure_runtime_value(&format!("{prefix}_BUCKET"), bucket, &context)?;
+        ensure_secret_value(&format!("{prefix}_TOKEN"), token, &context)?;
+        ensure_runtime_values(&format!("{prefix}_HOSTS"), hosts, &context)?;
+        Ok(())
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -85,4 +182,45 @@ mod tests {
             "2026-05-31T10:20:30Z"
         );
     }
+
+    #[test]
+    fn runtime_guard_detects_public_placeholders() {
+        assert!(runtime_guard::is_runtime_placeholder("HOST-EXAMPLE"));
+        assert!(runtime_guard::is_runtime_placeholder(
+            "http://192.0.2.10:8086"
+        ));
+        assert!(runtime_guard::is_runtime_placeholder("<TOKEN>"));
+        assert!(runtime_guard::is_secret_placeholder("CHANGE_ME"));
+        assert!(!runtime_guard::is_runtime_placeholder("aw_metrics"));
+        assert!(!runtime_guard::is_runtime_placeholder("proxmox"));
+        assert!(!runtime_guard::is_secret_placeholder(
+            "prod-write-token-value"
+        ));
+    }
+
+    #[test]
+    fn runtime_guard_validates_full_influx_config() {
+        let hosts = vec!["WINDOWS-HOST".to_string()];
+        runtime_guard::ensure_influx_runtime_config(
+            "AW_WORKTIME_INFLUX",
+            "http://influxdb.internal:8086",
+            "proxmox",
+            "aw_metrics",
+            "prod-write-token-value",
+            &hosts,
+        )
+        .unwrap();
+
+        let err = runtime_guard::ensure_influx_runtime_config(
+            "AW_WORKTIME_INFLUX",
+            "http://influxdb.internal:8086",
+            "proxmox",
+            "aw_metrics",
+            "CHANGE_ME",
+            &hosts,
+        )
+        .unwrap_err()
+        .to_string();
+        assert!(err.contains("AW_WORKTIME_INFLUX_TOKEN"));
+    }
 }