"""Shared project-slug validation for workspace transports."""

from __future__ import annotations

import re

_SAFE_PROJECT_RE = re.compile(r"^[A-Za-z0-9_-]+$")


def _validate_project(project: str):
    """Reject project names that can escape projects_root().

    Raises HTTPException 400 if project contains '..', '/', '\\' or any
    character outside [A-Za-z0-9_-]. Use at the top of every endpoint
    that accepts 'project' as a URL parameter.
    """
    if not isinstance(project, str) or not _SAFE_PROJECT_RE.match(project):
        from fastapi import HTTPException

        raise HTTPException(status_code=400, detail="invalid project name")