Add extra validation for CDEvents

go.mod

@@ -11,6 +11,17 @@ require (
 )
 
 require (
+	github.com/go-playground/locales v0.14.0 // indirect
+	github.com/go-playground/universal-translator v0.18.0 // indirect
+	github.com/leodido/go-urn v1.2.1 // indirect
+	github.com/package-url/packageurl-go v0.1.0 // indirect
+	golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3 // indirect
+	golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069 // indirect
+	golang.org/x/text v0.3.7 // indirect
+)
+
+require (
+	github.com/go-playground/validator/v10 v10.11.1
 	github.com/iancoleman/orderedmap v0.0.0-20190318233801-ac98e3ecb4b0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect

go.sum

@@ -4,6 +4,13 @@ github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ3
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/go-playground/assert/v2 v2.0.1/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
+github.com/go-playground/locales v0.14.0 h1:u50s323jtVGugKlcYeyzC0etD1HifMjqmJqb8WugfUU=
+github.com/go-playground/locales v0.14.0/go.mod h1:sawfccIbzZTqEDETgFXqTho0QybSa7l++s0DH+LDiLs=
+github.com/go-playground/universal-translator v0.18.0 h1:82dyy6p4OuJq4/CByFNOn/jYrnRPArHwAcmLoJZxyho=
+github.com/go-playground/universal-translator v0.18.0/go.mod h1:UvRDBj+xPUEGrFYl+lu/H90nyDXpg0fqeB/AQUGNTVA=
+github.com/go-playground/validator/v10 v10.11.1 h1:prmOlTVv+YjZjmRmNSF3VmspqJIxJWXmqUsHwfTRRkQ=
+github.com/go-playground/validator/v10 v10.11.1/go.mod h1:i+3WkQ1FvaUjjxh1kSvIA4dMGDBiPU55YFDl0WbKdWU=
 github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg=
 github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
@@ -18,27 +25,38 @@ github.com/invopop/jsonschema v0.6.0/go.mod h1:O9uiLokuu0+MGFlyiaqtWxwqJm41/+8Nj
 github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/leodido/go-urn v1.2.1 h1:BqpAaACuzVSgi/VLzGZIobT2z4v53pjosyNd9Yv6n/w=
+github.com/leodido/go-urn v1.2.1/go.mod h1:zt4jvISO2HfUBqxjfIshjdMTYS56ZS/qv49ictyFfxY=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
+github.com/package-url/packageurl-go v0.1.0 h1:efWBc98O/dBZRg1pw2xiDzovnlMjCa9NPnfaiBduh8I=
+github.com/package-url/packageurl-go v0.1.0/go.mod h1:C/ApiuWpmbpni4DIOECf6WCjFUZV7O1Fx7VAzrZHgBw=
+github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
+github.com/rogpeppe/go-internal v1.8.0/go.mod h1:WmiCO8CzOY8rg0OYDC4/i/2WRWAB6poM+XZ2dLUbcbE=
 github.com/santhosh-tekuri/jsonschema/v5 v5.0.0 h1:TToq11gyfNlrMFZiYujSekIsPd9AmsA2Bj/iv+s4JHE=
 github.com/santhosh-tekuri/jsonschema/v5 v5.0.0/go.mod h1:FKdcjfQW6rpZSnxxUvEA5H/cDPdvJ/SZJQLWWXWGrZ0=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.3.1-0.20190311161405-34c6fa2dc709/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
+github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1 h1:5TQK59W5E3v0r2duFAb7P95B6hEeOyEnHRa8MjYSMTY=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
@@ -53,12 +71,28 @@ go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9i
 go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
 go.uber.org/zap v1.17.0 h1:MTjgFu6ZLKvY6Pvaqk97GlxNBuMpV4Hy/3P6tRGlI2U=
 go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo=
+golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3 h1:0es+/5331RGQPcXlMfP+WrnIIS6dNnNRe0WB02W0F4M=
+golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069 h1:siQdpVirKtzPhKl3lZWozZraCFObP8S1v6PRp0bLrtU=
+golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7 h1:olpwvP2KacW1ZWvsR7uQhoyTYvKAupfQrRGBFM352Gk=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac h1:7zkz7BUtwNFFqcowJ+RIgu2MaV/MapERkDIy+mwPyjs=
 golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=

pkg/api/bindings.go

@@ -21,9 +21,12 @@ package api
 import (
 	"encoding/json"
 	"fmt"
+	"net/url"
 
 	cloudevents "github.com/cloudevents/sdk-go/v2"
+	"github.com/go-playground/validator/v10"
 	schemaproducer "github.com/invopop/jsonschema"
+	purl "github.com/package-url/packageurl-go"
 	jsonschema "github.com/santhosh-tekuri/jsonschema/v5"
 )
 
@@ -71,6 +74,9 @@ var (
 
 	// Map CDEventType to empty event objects
 	cdeventsByTypes map[CDEventType]CDEvent
+
+	// Validation helper as singleton
+	validate *validator.Validate
 )
 
 func init() {
@@ -97,6 +103,15 @@ func init() {
 		// Set type to receiver map
 		cdeventsByTypes[eventType.GetType()] = eventType
 	}
+
+	// Register custom validators
+	validate = validator.New()
+	err := validate.RegisterValidation("event-type", ValidateEventType)
+	panicOnError(err)
+	err = validate.RegisterValidation("uri-reference", ValidateUriReference)
+	panicOnError(err)
+	err = validate.RegisterValidation("purl", ValidatePurl)
+	panicOnError(err)
 }
 
 func panicOnError(err error) {
@@ -119,11 +134,27 @@ func ParseType(eventType string) (CDEventType, error) {
 	return t, nil
 }
 
+func ValidateEventType(fl validator.FieldLevel) bool {
+	_, err := ParseType(fl.Field().String())
+	return err == nil
+}
+
+func ValidateUriReference(fl validator.FieldLevel) bool {
+	_, err := url.Parse(fl.Field().String())
+	return err == nil
+}
+
+func ValidatePurl(fl validator.FieldLevel) bool {
+	_, err := purl.FromString(fl.Field().String())
+	return err == nil
+}
+
 // AsCloudEvent renders a CDEvent as a CloudEvent
 func AsCloudEvent(event CDEventReader) (*cloudevents.Event, error) {
 	if event == nil {
 		return nil, fmt.Errorf("nil CDEvent cannot be rendered as CloudEvent")
 	}
+	// Validate the event
 	err := Validate(event)
 	if err != nil {
 		return nil, fmt.Errorf("cannot validate CDEvent %v", err)
@@ -148,7 +179,7 @@ func AsJsonString(event CDEventReader) (string, error) {
 	return string(jsonBytes), nil
 }
 
-// Validate checks the CDEvent against the JSON schema
+// Validate checks the CDEvent against the JSON schema and validate constraints
 func Validate(event CDEventReader) error {
 	schemaName := event.GetSchema()
 	sch, err := jsonschema.CompileString(fmt.Sprintf("%s.json", schemaName), allEventSchemas[schemaName])
@@ -163,7 +194,17 @@ func Validate(event CDEventReader) error {
 	if err := json.Unmarshal([]byte(jsonString), &v); err != nil {
 		return fmt.Errorf("cannot unmarshal event json: %v", err)
 	}
-	return sch.Validate(v)
+	// Validate the "jsonschema" tags
+	err = sch.Validate(v)
+	if err != nil {
+		return err
+	}
+	// Validate the "validate" tags
+	err = validate.Struct(event)
+	if err != nil {
+		return err
+	}
+	return nil
 }
 
 // Build a new CDEventReader from a JSON string

pkg/api/bindings_test.go

@@ -48,7 +48,7 @@ var (
 	testOwner                = "TestOrg"
 	testUrl                  = "https://example.org/TestOrg/TestRepo"
 	testViewUrl              = "https://example.org/view/TestOrg/TestRepo"
-	testArtifactId           = "0b31b1c02ff458ad9b7b81cbdf8f028bd54699fa151f221d1e8de6817db93427"
+	testArtifactId           = "pkg:oci/myapp@sha256%3A0b31b1c02ff458ad9b7b81cbdf8f028bd54699fa151f221d1e8de6817db93427"
 	testEnvironmentId        = "test123"
 	testEnvironmentName      = "testEnv"
 	testEnvironmentUrl       = "https://example.org/testEnv"
@@ -542,7 +542,7 @@ var (
 		"source": "TestAsCloudEvent",
 		"type": "build",
 		"content": {
-			"artifactId": "0b31b1c02ff458ad9b7b81cbdf8f028bd54699fa151f221d1e8de6817db93427"
+			"artifactId": "pkg:oci/myapp@sha256%%3A0b31b1c02ff458ad9b7b81cbdf8f028bd54699fa151f221d1e8de6817db93427"
 		}
 	}
 }`
@@ -655,7 +655,7 @@ var (
 			"environment": {
 				"id": "test123"
 			},
-			"artifactId": "0b31b1c02ff458ad9b7b81cbdf8f028bd54699fa151f221d1e8de6817db93427"
+			"artifactId": "pkg:oci/myapp@sha256%%3A0b31b1c02ff458ad9b7b81cbdf8f028bd54699fa151f221d1e8de6817db93427"
 		}
 	}
 }`
@@ -676,7 +676,7 @@ var (
 			"environment": {
 				"id": "test123"
 			},
-			"artifactId": "0b31b1c02ff458ad9b7b81cbdf8f028bd54699fa151f221d1e8de6817db93427"
+			"artifactId": "pkg:oci/myapp@sha256%%3A0b31b1c02ff458ad9b7b81cbdf8f028bd54699fa151f221d1e8de6817db93427"
 		}
 	}
 }`
@@ -697,7 +697,7 @@ var (
 			"environment": {
 				"id": "test123"
 			},
-			"artifactId": "0b31b1c02ff458ad9b7b81cbdf8f028bd54699fa151f221d1e8de6817db93427"
+			"artifactId": "pkg:oci/myapp@sha256%%3A0b31b1c02ff458ad9b7b81cbdf8f028bd54699fa151f221d1e8de6817db93427"
 		}
 	}
 }`
@@ -1460,6 +1460,32 @@ func TestInvalidEvent(t *testing.T) {
 	eventIncompleteSubject.SetSubjectId(testSubjectId)
 	eventIncompleteSubject.SetSubjectName(testRepo)
 
+	// invalid source format in context
+	eventInvalidSource, _ := NewChangeAbandonedEvent()
+	eventInvalidSource.SetSource("\\--##@@")
+
+	// invalid source format in reference
+	eventInvalidSourceReference, _ := NewServiceDeployedEvent()
+	eventInvalidSourceReference.SetSubjectEnvironment(
+		Reference{Id: "1234", Source: "\\--##@@"})
+
+	// invalid format of purl
+	eventInvalidPurl, _ := NewBuildFinishedEvent()
+	eventInvalidPurl.SetSubjectArtifactId("not-a-valid-purl")
+
+	// invalid event type
+	eventInvalidType := &ServicePublishedEvent{
+		Context: Context{
+			Type:    CDEventType("not-a-valid-type"),
+			Version: CDEventsSpecVersion,
+		},
+		Subject: ServicePublishedSubject{
+			SubjectBase: SubjectBase{
+				Type: ServiceSubjectType,
+			},
+		},
+	}
+
 	tests := []struct {
 		name  string
 		event CDEvent
@@ -1475,6 +1501,18 @@ func TestInvalidEvent(t *testing.T) {
 	}, {
 		name:  "missing subject url",
 		event: eventIncompleteSubject,
+	}, {
+		name:  "invalid source in context",
+		event: eventInvalidSource,
+	}, {
+		name:  "invalid source in reference",
+		event: eventInvalidSourceReference,
+	}, {
+		name:  "invalid purl in build finished",
+		event: eventInvalidPurl,
+	}, {
+		name:  "invalid event type",
+		event: eventInvalidType,
 	}}
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {

pkg/api/buildfinished.go

@@ -31,7 +31,7 @@ const (
 type BuildFinishedSubjectContent struct {
 
 	// The Id of the artifact produced by the build
-	ArtifactId string `json:"artifactId,omitempty"`
+	ArtifactId string `json:"artifactId,omitempty" validate:"purl"`
 }
 
 type BuildFinishedSubject struct {

pkg/api/servicedeployed.go

@@ -34,7 +34,7 @@ type ServiceDeployedSubjectContent struct {
 	Environment Reference `json:"environment,omitempty"`
 
 	// The Id of the artifact deployed
-	ArtifactId string `json:"artifactId,omitempty"`
+	ArtifactId string `json:"artifactId,omitempty" validate:"purl"`
 }
 
 type ServiceDeployedSubject struct {

pkg/api/servicerolledback.go

@@ -34,7 +34,7 @@ type ServiceRolledbackSubjectContent struct {
 	Environment Reference `json:"environment,omitempty"`
 
 	// The Id of the target artifact
-	ArtifactId string `json:"artifactId,omitempty"`
+	ArtifactId string `json:"artifactId,omitempty" validate:"purl"`
 }
 
 type ServiceRolledbackSubject struct {

pkg/api/serviceupgraded.go

@@ -34,7 +34,7 @@ type ServiceUpgradedSubjectContent struct {
 	Environment Reference `json:"environment,omitempty"`
 
 	// The Id of the target artifact
-	ArtifactId string `json:"artifactId,omitempty"`
+	ArtifactId string `json:"artifactId,omitempty" validate:"purl"`
 }
 
 type ServiceUpgradedSubject struct {

pkg/api/types.go

@@ -47,15 +47,15 @@ type Context struct {
 	// purpose of the source is to provide global uniqueness for source + id.
 	// The source MAY identify a single producer or a group of producer that
 	// belong to the same application.
-	Source string `json:"source" jsonschema:"required,minLength=1"`
+	Source string `json:"source" jsonschema:"required,minLength=1" validate:"uri-reference"`
 
 	// Spec: https://cdevents.dev/docs/spec/#type
 	// Description: defines the type of event, as combination of a subject and
 	// predicate. Valid event types are defined in the vocabulary. All event
 	// types should be prefixed with dev.cdevents.
 	// One occurrence may have multiple events associated, as long as they have
 	// different event types
-	Type CDEventType `json:"type" jsonschema:"required,minLength=1"`
+	Type CDEventType `json:"type" jsonschema:"required,minLength=1" validate:"event-type"`
 
 	// Spec: https://cdevents.dev/docs/spec/#timestamp
 	// Description: Description: defines the time of the occurrence. When the
@@ -77,7 +77,7 @@ type Reference struct {
 	// purpose of the source is to provide global uniqueness for source + id.
 	// The source MAY identify a single producer or a group of producer that
 	// belong to the same application.
-	Source string `json:"source,omitempty"`
+	Source string `json:"source,omitempty" validate:"uri-reference"`
 }
 
 type SubjectBase struct {