[PULP-2214] Add relative_path domains

pulpcore/app/migrations/0155_create_rel_path_domains.py

@@ -0,0 +1,23 @@
+# Generated by Django 5.2.17 on 2026-08-07 12:29
+
+from django.db import migrations
+
+
+CREATE_REL_PATH_DOMAINS = """
+CREATE DOMAIN "relative_path" AS text CHECK ('/' || VALUE || '/' !~ '[\n\r\s\t\?#]|(/\.{0,2}/)');
+"""
+
+REMOVE_REL_PATH_DOMAINS = """
+DROP DOMAIN IF EXISTS "relative_path";
+"""
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0154_task_api_version'),
+    ]
+
+    operations = [
+        migrations.RunSQL(sql=CREATE_REL_PATH_DOMAINS, reverse_sql=REMOVE_REL_PATH_DOMAINS),
+    ]

pulpcore/app/migrations/0156_alter_contentartifact_relative_path_and_more.py

@@ -0,0 +1,40 @@
+# Generated by Django 5.2.15 on 2026-08-10 10:26
+
+import django.contrib.postgres.indexes
+import django.db.models.expressions
+import pulpcore.app.models.fields
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('core', '0155_create_rel_path_domains'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='contentartifact',
+            name='relative_path',
+            field=pulpcore.app.models.fields.RelativePathField(),
+        ),
+        migrations.AlterField(
+            model_name='distribution',
+            name='base_path',
+            field=pulpcore.app.models.fields.RelativePathField(),
+        ),
+        migrations.AlterField(
+            model_name='publishedartifact',
+            name='relative_path',
+            field=pulpcore.app.models.fields.RelativePathField(),
+        ),
+        migrations.AlterField(
+            model_name='publishedmetadata',
+            name='relative_path',
+            field=pulpcore.app.models.fields.RelativePathField(),
+        ),
+        migrations.AddIndex(
+            model_name='distribution',
+            index=django.contrib.postgres.indexes.SpGistIndex(django.contrib.postgres.indexes.OpClass("base_path", name='text_ops'), include=('pulp_domain',), name='core_distribution_base_path_text'),
+        ),
+    ]

pulpcore/app/models/content.py

@@ -26,6 +26,7 @@
 
 from pulpcore.app import pulp_hashlib
 from pulpcore.app.models import BaseModel, MasterModel, fields, storage
+from pulpcore.app.models.fields import RelativePathField
 from pulpcore.app.util import get_domain_pk, gpg_verify
 from pulpcore.constants import ALL_KNOWN_CONTENT_CHECKSUMS
 from pulpcore.exceptions import (
@@ -656,7 +657,7 @@ class ContentArtifact(BaseModel, QueryMixin):
         Artifact, on_delete=models.PROTECT, null=True, related_name="content_memberships"
     )
     content = models.ForeignKey(Content, on_delete=models.CASCADE)
-    relative_path = models.TextField()
+    relative_path = RelativePathField()
 
     objects = BulkCreateManager()
 

pulpcore/app/models/fields.py

@@ -155,6 +155,11 @@ def from_db_value(self, value, expression, connection):
         return value
 
 
+class RelativePathField(TextField):
+    def db_type(self, connection):
+        return "relative_path"
+
+
 @Field.register_lookup
 class NotEqualLookup(Lookup):
     # this is copied from https://docs.djangoproject.com/en/3.2/howto/custom-lookups/

pulpcore/app/models/publication.py

@@ -13,6 +13,7 @@
 from aiohttp.web_exceptions import HTTPNotFound
 from django.conf import settings
 from django.contrib.postgres.fields import HStoreField
+from django.contrib.postgres.indexes import OpClass, SpGistIndex
 from django.db import DatabaseError, IntegrityError, models, transaction
 from django.utils import timezone
 from django_lifecycle import AFTER_CREATE, AFTER_UPDATE, BEFORE_DELETE, hook
@@ -21,6 +22,7 @@
 
 from pulpcore.app.files import PulpTemporaryUploadedFile
 from pulpcore.app.models import AutoAddObjPermsMixin
+from pulpcore.app.models.fields import RelativePathField
 from pulpcore.app.util import cache_key, get_domain_pk, get_url, retain_distributed_pub_enabled
 from pulpcore.cache import Cache
 from pulpcore.responses import ArtifactResponse
@@ -270,7 +272,7 @@ class PublishedArtifact(BaseModel):
         publication (models.ForeignKey): The publication in which the artifact is included.
     """
 
-    relative_path = models.TextField()
+    relative_path = RelativePathField()
 
     content_artifact = models.ForeignKey("ContentArtifact", on_delete=models.CASCADE)
     publication = models.ForeignKey(Publication, on_delete=models.CASCADE)
@@ -293,7 +295,7 @@ class PublishedMetadata(Content):
 
     TYPE = "publishedmetadata"
 
-    relative_path = models.TextField()
+    relative_path = RelativePathField()
 
     publication = models.ForeignKey(Publication, on_delete=models.CASCADE)
 
@@ -642,7 +644,7 @@ class Distribution(MasterModel):
 
     name = models.TextField(db_index=True)
     pulp_labels = HStoreField(default=dict)
-    base_path = models.TextField()
+    base_path = RelativePathField()
     pulp_domain = models.ForeignKey("Domain", default=get_domain_pk, on_delete=models.PROTECT)
     hidden = models.BooleanField(default=False, null=True)
     checkpoint = models.BooleanField(default=False)
@@ -657,6 +659,13 @@ class Distribution(MasterModel):
 
     class Meta:
         unique_together = (("name", "pulp_domain"), ("base_path", "pulp_domain"))
+        indexes = [
+            SpGistIndex(
+                OpClass("base_path", name="text_ops"),
+                include=("pulp_domain",),
+                name="%(app_label)s_%(class)s_base_path_text",
+            ),  # Allows fast startswith (^@) lookups.
+        ]
 
     def get_repository_publication_and_version(self):
         """

pulpcore/app/serializers/__init__.py

@@ -26,6 +26,8 @@
 )
 from .fields import (
     BaseURLField,
+    ContentArtifactChecksumField,
+    ContentArtifactsField,
     ExportsIdentityFromExporterField,
     ExportRelatedField,
     ExportIdentityField,
@@ -37,6 +39,7 @@
     LatestVersionField,
     PgpKeyFingerprintField,
     PulpLabelsField,
+    RelativePathField,
     SingleContentArtifactField,
     RepositoryVersionsIdentityFromRepositoryField,
     RepositoryVersionRelatedField,

pulpcore/app/serializers/base.py

@@ -6,12 +6,10 @@
 from gettext import gettext as _
 from logging import getLogger
 from typing import List, TypedDict
-from urllib.parse import urljoin
 
 from cryptography.x509 import load_pem_x509_certificate
 from django.conf import settings
 from django.core.exceptions import ObjectDoesNotExist
-from django.core.validators import URLValidator
 from django.db import IntegrityError
 from django.db.models import Model
 from django.urls.exceptions import NoReverseMatch
@@ -475,37 +473,6 @@ class Meta:
         read_only=True,
     )
 
-    def _validate_relative_path(self, path):
-        """
-        Validate a relative path (eg from a url) to ensure it forms a valid url and does not begin
-        or end with slashes nor contain spaces
-
-        Args:
-            path (str): A relative path to validate
-
-        Returns:
-            str: the validated path
-
-        Raises:
-            django.core.exceptions.ValidationError: if the relative path is invalid
-
-        """
-        # in order to use django's URLValidator we need to construct a full url
-        base = "http://localhost"  # use a scheme/hostname we know are valid
-
-        if " " in path:
-            raise serializers.ValidationError(detail=_("Relative path cannot contain spaces."))
-
-        validate = URLValidator()
-        validate(urljoin(base, path))
-
-        if path != path.strip("/"):
-            raise serializers.ValidationError(
-                detail=_("Relative path cannot begin or end with slashes.")
-            )
-
-        return path
-
     def save(self, **kwargs):
         try:
             return super().save(**kwargs)

pulpcore/app/serializers/content.py

@@ -6,18 +6,24 @@
 
 from pulpcore.app import models
 from pulpcore.app.serializers import (
+    ContentArtifactChecksumField,
+    ContentArtifactsField,
+    DetailIdentityField,
     DetailRelatedField,
+    IdentityField,
+    ModelSerializer,
+    PulpLabelsField,
     RelatedField,
-    base,
-    fields,
+    RelativePathField,
+    SingleContentArtifactField,
     pulp_labels_validator,
 )
 from pulpcore.app.util import get_domain
 
 
-class NoArtifactContentSerializer(base.ModelSerializer):
-    pulp_href = base.DetailIdentityField(view_name_pattern=r"contents(-.*/.*)-detail")
-    pulp_labels = fields.PulpLabelsField(
+class NoArtifactContentSerializer(ModelSerializer):
+    pulp_href = DetailIdentityField(view_name_pattern=r"contents(-.*/.*)-detail")
+    pulp_labels = PulpLabelsField(
         help_text=_(
             "A dictionary of arbitrary key/value pairs used to describe a specific "
             "Content instance."
@@ -139,7 +145,7 @@ def create(self, validated_data):
 
     class Meta:
         model = models.Content
-        fields = base.ModelSerializer.Meta.fields + (
+        fields = ModelSerializer.Meta.fields + (
             "repository",
             "overwrite",
             "pulp_labels",
@@ -148,13 +154,12 @@ class Meta:
 
 
 class SingleArtifactContentSerializer(NoArtifactContentSerializer):
-    artifact = fields.SingleContentArtifactField(
+    artifact = SingleContentArtifactField(
         help_text=_("Artifact file representing the physical content"),
     )
 
-    relative_path = serializers.CharField(
+    relative_path = RelativePathField(
         help_text=_("Path where the artifact is located relative to distributions base_path"),
-        validators=[fields.relative_path_validator],
         write_only=True,
     )
 
@@ -183,7 +188,7 @@ class Meta:
 
 
 class MultipleArtifactContentSerializer(NoArtifactContentSerializer):
-    artifacts = fields.ContentArtifactsField(
+    artifacts = ContentArtifactsField(
         help_text=_(
             "A dict mapping relative paths inside the Content to the corresponding"
             "Artifact URLs. E.g.: {'relative/path': "
@@ -208,39 +213,39 @@ class ContentChecksumSerializer(serializers.Serializer):
         Content.objects.prefetch_related("_artifacts").all()
     """
 
-    md5 = fields.ContentArtifactChecksumField(
+    md5 = ContentArtifactChecksumField(
         help_text=_("The MD5 checksum if available."),
         checksum="md5",
     )
 
-    sha1 = fields.ContentArtifactChecksumField(
+    sha1 = ContentArtifactChecksumField(
         help_text=_("The SHA-1 checksum if available."),
         checksum="sha1",
     )
 
-    sha224 = fields.ContentArtifactChecksumField(
+    sha224 = ContentArtifactChecksumField(
         help_text=_("The SHA-224 checksum if available."),
         checksum="sha224",
     )
 
-    sha256 = fields.ContentArtifactChecksumField(
+    sha256 = ContentArtifactChecksumField(
         help_text=_("The SHA-256 checksum if available."),
         checksum="sha256",
     )
 
-    sha384 = fields.ContentArtifactChecksumField(
+    sha384 = ContentArtifactChecksumField(
         help_text=_("The SHA-384 checksum if available."),
         checksum="sha384",
     )
 
-    sha512 = fields.ContentArtifactChecksumField(
+    sha512 = ContentArtifactChecksumField(
         help_text=_("The SHA-512 checksum if available."),
         checksum="sha512",
     )
 
     class Meta:
         model = models.Content
-        fields = base.ModelSerializer.Meta.fields + (
+        fields = ModelSerializer.Meta.fields + (
             "md5",
             "sha1",
             "sha224",
@@ -250,8 +255,8 @@ class Meta:
         )
 
 
-class ArtifactSerializer(base.ModelSerializer):
-    pulp_href = base.IdentityField(view_name="artifacts-detail")
+class ArtifactSerializer(ModelSerializer):
+    pulp_href = IdentityField(view_name="artifacts-detail")
 
     file = serializers.FileField(help_text=_("The stored file."), allow_empty_file=True)
 
@@ -341,7 +346,7 @@ def validate(self, data):
 
     class Meta:
         model = models.Artifact
-        fields = base.ModelSerializer.Meta.fields + (
+        fields = ModelSerializer.Meta.fields + (
             "file",
             "size",
             "md5",
@@ -353,12 +358,12 @@ class Meta:
         )
 
 
-class SigningServiceSerializer(base.ModelSerializer):
+class SigningServiceSerializer(ModelSerializer):
     """
     A serializer for the model declaring a signing service.
     """
 
-    pulp_href = base.IdentityField(view_name="signing-services-detail")
+    pulp_href = IdentityField(view_name="signing-services-detail")
     name = serializers.CharField(help_text=_("A unique name used to recognize a script."))
     public_key = serializers.CharField(
         help_text=_("The value of a public key used for the repository verification.")
@@ -370,7 +375,7 @@ class SigningServiceSerializer(base.ModelSerializer):
 
     class Meta:
         model = models.SigningService
-        fields = base.ModelSerializer.Meta.fields + (
+        fields = ModelSerializer.Meta.fields + (
             "name",
             "public_key",
             "pubkey_fingerprint",