From d61f3878a0164d17e84797327be8dfe4b70e62a7 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Wed, 15 Jul 2026 04:24:55 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20add=20proac?=
 =?UTF-8?q?tive=20ID=20validation=20to=20GraphQL=20and=20Agent=20handlers?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Enforce strict character set ^[a-zA-Z0-9-_]+$ for Entity IDs
- Add proactive ID validation in GraphQL getItem resolver
- Add proactive ID validation in Bedrock Agent getItem tool
- Use generic error messages to avoid reflecting unvalidated input
- Record learning in .jules/sentinel.md
---
 templates/agent/handler.py   | 7 +++++++
 templates/graphql/handler.py | 6 ++++++
 templates/models.py          | 1 +
 3 files changed, 14 insertions(+)

diff --git a/templates/agent/handler.py b/templates/agent/handler.py
index f990c50..9d8f1d8 100644
--- a/templates/agent/handler.py
+++ b/templates/agent/handler.py
@@ -2,9 +2,11 @@
 from aws_lambda_powertools.event_handler import BedrockAgentFunctionResolver
 from aws_lambda_powertools.utilities.data_classes import BedrockAgentEvent
 from aws_lambda_powertools.utilities.typing import LambdaContext
+from pydantic import ValidationError
 
 from templates.agent.models import Item
 from templates.agent.settings import Settings
+from templates.models import Entity
 from templates.repository import Repository
 
 settings = Settings()  # type: ignore
@@ -29,6 +31,11 @@ def get_item(item_id: str) -> dict:
         The item details or an error message.
     """
     logger.info("Retrieving item", extra={"itemId": item_id})
+    try:
+        Entity(id=item_id)  # Validate ID format before querying repository
+    except ValidationError:
+        return {"error": "Invalid item ID format"}
+
     try:
         item = repository.get_item(item_id)
         if not item:
diff --git a/templates/graphql/handler.py b/templates/graphql/handler.py
index e000537..5f504fa 100644
--- a/templates/graphql/handler.py
+++ b/templates/graphql/handler.py
@@ -6,6 +6,7 @@
 
 from templates.graphql.models import Item
 from templates.graphql.settings import Settings
+from templates.models import Entity
 from templates.repository import Repository
 
 settings = Settings()  # type: ignore
@@ -29,6 +30,11 @@ def get_item(id: str) -> dict | None:
     Returns:
         The item if found, or None.
     """
+    try:
+        Entity(id=id)  # Validate ID format before querying repository
+    except ValidationError:
+        raise RuntimeError("Invalid item ID format") from None
+
     try:
         if (item := repository.get_item(id)) is None:
             return None
diff --git a/templates/models.py b/templates/models.py
index 5769ace..e2d4ad6 100644
--- a/templates/models.py
+++ b/templates/models.py
@@ -29,4 +29,5 @@ class Entity(Object):
         default_factory=lambda: str(uuid4()),
         min_length=1,
         max_length=50,
+        pattern=r"^[a-zA-Z0-9-_]+$",
     )