From b5eb78b72b0db92f89f75aaf702573c85d8aeb91 Mon Sep 17 00:00:00 2001
From: Wez Furlong <wez@wezfurlong.org>
Date: Tue, 3 Sep 2024 14:52:51 -0700
Subject: [PATCH] dkim_sign.lua: make base and domain optional

When splitting the config across multiple files, we should not
raise an error if the base or domain section is missing from
the file that is currently being processed.

Let's also show which file is currently being processed.
---
 assets/policy-extras/dkim_sign.lua | 14 +++++++++-----
 docs/changelog/main.md             |  4 ++++
 2 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/assets/policy-extras/dkim_sign.lua b/assets/policy-extras/dkim_sign.lua
index 00fdfcd1..cf11e6ad 100644
--- a/assets/policy-extras/dkim_sign.lua
+++ b/assets/policy-extras/dkim_sign.lua
@@ -19,7 +19,7 @@ local SignatureSigningPolicy =
 local SigningAlgo = typing.enum('SigningAlgo', 'sha256', 'ed25519')
 
 local DkimSignConfig = Record('DkimSignConfig', {
-  base = Record('DkimSignConfig.Base', {
+  base = Option(Record('DkimSignConfig.Base', {
     vault_mount = Option(String),
     vault_path_prefix = Option(String),
     additional_signatures = Option(List(String)),
@@ -29,9 +29,9 @@ local DkimSignConfig = Record('DkimSignConfig', {
     header_canonicalization = Option(String),
     body_canonicalization = Option(String),
     over_sign = Option(Bool),
-  }),
+  })),
 
-  domain = typing.map(
+  domain = Option(typing.map(
     String,
     Record('DkimSignConfig.Domain', {
       selector = Option(String),
@@ -43,7 +43,7 @@ local DkimSignConfig = Record('DkimSignConfig', {
       body_canonicalization = Option(String),
       over_sign = Option(Bool),
     })
-  ),
+  )),
 
   signature = Option(typing.map(
     String,
@@ -129,7 +129,11 @@ domain = "myesp.com"
 ]]
 
 local function load_dkim_data_from_file(file_name, target)
-  local data = DkimSignConfig(utils.load_json_or_toml_file(file_name))
+  local raw_data = utils.load_json_or_toml_file(file_name)
+  local is_ok, data = pcall(DkimSignConfig, raw_data)
+  if not is_ok then
+    error(string.format("reading data from file '%s': %s'", file_name, data))
+  end
 
   if data.base then
     utils.merge_into(data.base, target.base)
diff --git a/docs/changelog/main.md b/docs/changelog/main.md
index 6997fb12..5a4483f6 100644
--- a/docs/changelog/main.md
+++ b/docs/changelog/main.md
@@ -40,3 +40,7 @@
   `0ns` for sessions for which we had not observed the session opening. Now we
   will assume a start time time of the first record observed for a session, so
   that some sense of relative time can be gleaned from the trace output.
+
+* When using the dkim helper and splitting the configuration
+  across multiple files, a missing `domain` or `base` configuration section in
+  any individual file would raise a validation error.