fix: tenant id validation

[parmesant]

Restrict DEFAULT_TENANT, and other values which can be trigger path manipulation as tenant id

Fixes #XXXX.

Description

---

This PR has:

• been tested to ensure log ingestion and log query works.
• added comments explaining the "why" and the intent of the code wherever would not be obvious for an unfamiliar reader.
• added documentation for new or modified features or behaviors.

Summary by CodeRabbit

• Bug Fixes
  • Added validation for tenant identifiers to ensure they follow the required format.
  • Invalid tenant directories are now rejected during tenant loading, including the reserved default tenant identifier.

[coderabbitai]

Walkthrough

The change adds public tenant ID validation with a lazy regex. Tenant creation and tenant directory loading validate IDs before updating state or processing metadata.

Changes

Tenant ID validation

Layer / File(s)	Summary
Validation contract and implementation src/parseable/mod.rs	Adds TENANT_ID_REGEX and validate_tenant_id. The validator checks the allowed format and rejects DEFAULT_TENANT.
Tenant validation integration src/parseable/mod.rs	Validates tenant IDs before tenant creation updates state or directory loading processes metadata.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

A rabbit checks each tenant name,
Regex rules guard the gate.
Invalid IDs stop at entry,
Valid IDs load their metadata.
DEFAULT_TENANT stays outside.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description states the security goal but leaves the required rationale, key changes, issue reference, and checklist items incomplete.	Complete the Description section, replace or remove the issue placeholder, summarize the implementation and rationale, and mark applicable checklist items.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely identifies tenant ID validation as the primary change.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/parseable/mod.rs`:
- Around line 1281-1282: Move the validate_tenant_id call in the
directory-processing flow into the is_multi_tenant conditional, keeping it
before tenant metadata loading. Ensure single-tenant mode accepts root or stream
directory names without tenant-pattern validation, while multi-tenant mode still
validates tenant IDs.
- Around line 107-121: Update TENANT_ID_REGEX and validate_tenant_id so tenant
IDs contain only alphanumeric characters while preserving the 1–36 character
limit. Check DEFAULT_TENANT before applying the regex so its dedicated error
remains reachable, and update the validation error text to match the new
alphanumeric-only pattern.
- Around line 113-121: Update Parseable::add_tenant to call validate_tenant_id
on tenant_id before storing it in either registry, propagating the validation
error and preventing invalid IDs or DEFAULT_TENANT from being registered.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: f353a65a-9a71-4a9b-a099-479e35bb5bb0

📥 Commits

Reviewing files that changed from the base of the PR and between cac761e and bd214d8.

📒 Files selected for processing (1)

• src/parseable/mod.rs