group ValidationPolicy parsing/rendering logic with the type

internal/api/keppel/accounts.go

@@ -94,7 +94,7 @@ func (a *API) renderAccount(dbAccount models.Account) (Account, error) {
 		Metadata:          metadata,
 		RBACPolicies:      rbacPolicies,
 		ReplicationPolicy: renderReplicationPolicy(dbAccount),
-		ValidationPolicy:  renderValidationPolicy(dbAccount),
+		ValidationPolicy:  keppel.RenderValidationPolicy(dbAccount),
 		PlatformFilter:    dbAccount.PlatformFilter,
 	}, nil
 }
@@ -121,16 +121,6 @@ func renderReplicationPolicy(dbAccount models.Account) *keppel.ReplicationPolicy
 	return nil
 }
 
-func renderValidationPolicy(dbAccount models.Account) *keppel.ValidationPolicy {
-	if dbAccount.RequiredLabels == "" {
-		return nil
-	}
-
-	return &keppel.ValidationPolicy{
-		RequiredLabels: dbAccount.SplitRequiredLabels(),
-	}
-}
-
 ////////////////////////////////////////////////////////////////////////////////
 // handlers
 
@@ -294,15 +284,11 @@ func (a *API) handlePutAccount(w http.ResponseWriter, r *http.Request) {
 
 	// validate validation policy
 	if req.Account.ValidationPolicy != nil {
-		vp := *req.Account.ValidationPolicy
-		for _, label := range vp.RequiredLabels {
-			if strings.Contains(label, ",") {
-				http.Error(w, fmt.Sprintf(`invalid label name: %q`, label), http.StatusUnprocessableEntity)
-				return
-			}
+		rerr := req.Account.ValidationPolicy.ApplyToAccount(&accountToCreate)
+		if rerr != nil {
+			rerr.WriteAsTextTo(w)
+			return
 		}
-
-		accountToCreate.RequiredLabels = vp.JoinRequiredLabels()
 	}
 
 	// validate platform filter

internal/keppel/validation.go

@@ -18,13 +18,40 @@
 
 package keppel
 
-import "strings"
+import (
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/sapcc/keppel/internal/models"
+)
 
 // ValidationPolicy represents a validation policy in the API.
 type ValidationPolicy struct {
 	RequiredLabels []string `json:"required_labels,omitempty"`
 }
 
-func (v ValidationPolicy) JoinRequiredLabels() string {
-	return strings.Join(v.RequiredLabels, ",")
+// RenderValidationPolicy builds a ValidationPolicy object out of the
+// information in the given account model.
+func RenderValidationPolicy(account models.Account) *ValidationPolicy {
+	if account.RequiredLabels == "" {
+		return nil
+	}
+
+	return &ValidationPolicy{
+		RequiredLabels: account.SplitRequiredLabels(),
+	}
+}
+
+// ApplyToAccount validates this policy and stores it in the given account model.
+func (v ValidationPolicy) ApplyToAccount(account *models.Account) *RegistryV2Error {
+	for _, label := range v.RequiredLabels {
+		if strings.Contains(label, ",") {
+			err := fmt.Errorf(`invalid label name: %q`, label)
+			return AsRegistryV2Error(err).WithStatus(http.StatusUnprocessableEntity)
+		}
+	}
+
+	account.RequiredLabels = strings.Join(v.RequiredLabels, ",")
+	return nil
 }

internal/models/account.go

@@ -65,6 +65,7 @@ func (a Account) SwiftContainerName() string {
 	return "keppel-" + a.Name
 }
 
+// SplitRequiredLabels parses the RequiredLabels field.
 func (a Account) SplitRequiredLabels() []string {
 	return strings.Split(a.RequiredLabels, ",")
 }