fix: harden ory validate opl after review

- an empty file is valid; the SDK rejects a zero-length body, so skip the call
- use the nil-safe accessor for the result, which is nil on an empty response
- always emit the `errors` key in machine-readable formats, so that CI scripts
  can rely on `jq '.errors | length'`
- render the column only together with the line, so that a line-less position
  cannot be misread as a line number
- treat an unknown `--format` as human-readable, matching cmdx itself
- do not claim `update opl` validates through the same endpoint

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012UL5u7KWLdu8hzNTNvYq5a

Author: alnr

cmd/cloudx/project/validate_namespace_config.go

@@ -32,9 +32,10 @@ func NewValidateNamespaceConfigCmd() *cobra.Command {
 		Short: "Validate the syntax of an Ory Permission Language file",
 		Long: `Validate the syntax of an Ory Permission Language file without applying it.
 
-Ory Network checks the file the same way ` + "`ory update opl`" + ` does before storing it,
-but nothing is written to the project. The command exits with a non-zero status
-when the file has syntax errors, which makes it usable as a CI/CD check.`,
+The file is checked by the Ory Network project's syntax check endpoint; nothing
+is written to the project. The command exits with a non-zero status when the
+file has syntax errors, which makes it usable as a CI/CD check before running
+` + "`ory update opl`" + `.`,
 		Example: `$ {{ .CommandPath }} --file /path/to/namespace_config.ts
 
 The Ory Permission Language file is valid.
@@ -59,22 +60,33 @@ $ cat namespace_config.ts | {{ .CommandPath }} --file - --format json
 				return err
 			}
 
-			result, _, err := c.RelationshipAPI.CheckOplSyntax(ctx).Body(string(data)).Execute()
-			if err != nil {
-				return cmdx.PrintOpenAPIError(cmd, err)
+			var errs oplSyntaxErrors
+			// An empty file has no syntax errors, and the SDK refuses to send a
+			// zero-length body ("invalid body type text/plain").
+			if len(data) > 0 {
+				result, _, err := c.RelationshipAPI.CheckOplSyntax(ctx).Body(string(data)).Execute()
+				if err != nil {
+					return cmdx.PrintOpenAPIError(cmd, err)
+				}
+				// GetErrors is nil-safe: result is nil if the API replies with an empty body.
+				errs = oplSyntaxErrors(result.GetErrors())
 			}
 
-			errs := oplSyntaxErrors(result.Errors)
 			switch outputFormat(cmd) {
-			case cmdx.FormatDefault, cmdx.FormatTable, cmdx.FormatQuiet:
+			case cmdx.FormatJSON, cmdx.FormatJSONPretty, cmdx.FormatJSONPath, cmdx.FormatJSONPointer, cmdx.FormatYAML:
+				cmdx.PrintTable(cmd, errs)
+			default:
+				// Everything else (including an unknown value, which cmdx itself
+				// treats as the default format) is rendered for humans.
+				source := sourceName(file)
 				for _, parseErr := range errs {
-					_, _ = fmt.Fprintln(cmd.ErrOrStderr(), formatParseError(sourceName(file), parseErr))
+					// Syntax errors are what the command is for, so they are also
+					// printed with --quiet; only the success message is noise.
+					_, _ = fmt.Fprintln(cmd.ErrOrStderr(), formatParseError(source, parseErr))
 				}
 				if len(errs) == 0 {
 					_, _ = cmdx.NewLoudOutPrinter(cmd).Println("The Ory Permission Language file is valid.")
 				}
-			default:
-				cmdx.PrintTable(cmd, errs)
 			}
 
 			if len(errs) > 0 {
@@ -128,10 +140,10 @@ func outputFormat(cmd *cobra.Command) cmdx.Format {
 // and CI log parsers can pick up the location.
 func formatParseError(source string, err cloud.ParseError) string {
 	location := source
-	if start := err.Start; start != nil {
-		if start.Line != nil {
-			location += ":" + strconv.FormatInt(*start.Line, 10)
-		}
+	// The column is only appended together with the line, otherwise it would be
+	// rendered in the position where readers expect the line number.
+	if start := err.Start; start != nil && start.Line != nil {
+		location += ":" + strconv.FormatInt(*start.Line, 10)
 		if start.Column != nil {
 			location += ":" + strconv.FormatInt(*start.Column, 10)
 		}
@@ -165,6 +177,11 @@ func (e oplSyntaxErrors) Table() [][]string {
 }
 
 func (e oplSyntaxErrors) Interface() interface{} {
+	if e == nil {
+		// The field is omitted when nil, but CI/CD consumers should be able to
+		// rely on "errors" always being present, e.g. `jq '.errors | length'`.
+		e = oplSyntaxErrors{}
+	}
 	return cloud.CheckOplSyntaxResult{Errors: e}
 }
 

cmd/cloudx/project/validate_namespace_config_test.go

@@ -34,7 +34,8 @@ func TestValidateNamespaceConfig(t *testing.T) {
 		validate := func(t *testing.T, exec execFunc) {
 			stdout, stderr, err := exec(nil, "validate", "opl", "--file", config)
 			require.NoError(t, err, stderr)
-			assert.Contains(t, stdout, "valid")
+			// not just "valid", which is also a substring of "invalid"
+			assert.Contains(t, stdout, "file is valid")
 			assert.Empty(t, stderr)
 		}
 
@@ -76,30 +77,72 @@ func TestValidateNamespaceConfig(t *testing.T) {
 		runWithProjectAsFlag(ctx, t, extraProject.Id, validate)
 	})
 
+	t.Run("reports an empty error list as JSON", func(t *testing.T) {
+		t.Parallel()
+
+		config := writeFile(t, validOPL)
+		validate := func(t *testing.T, exec execFunc) {
+			stdout, stderr, err := exec(nil, "validate", "opl", "--file", config, "--format", "json")
+			require.NoError(t, err, stderr)
+
+			// the key is always present, so that `jq '.errors | length'` works
+			errs := gjson.Get(stdout, "errors")
+			require.True(t, errs.IsArray(), stdout)
+			assert.Empty(t, errs.Array(), stdout)
+		}
+
+		runWithProjectAsDefault(ctx, t, defaultProject.Id, validate)
+	})
+
+	t.Run("accepts an empty file", func(t *testing.T) {
+		t.Parallel()
+
+		config := writeFile(t, "")
+		validate := func(t *testing.T, exec execFunc) {
+			stdout, stderr, err := exec(nil, "validate", "opl", "--file", config)
+			require.NoError(t, err, stderr)
+			assert.Contains(t, stdout, "file is valid")
+		}
+
+		runWithProjectAsDefault(ctx, t, defaultProject.Id, validate)
+	})
+
 	t.Run("reads the file from stdin", func(t *testing.T) {
 		t.Parallel()
 
 		validate := func(t *testing.T, exec execFunc) {
 			stdout, stderr, err := exec(strings.NewReader(validOPL), "validate", "opl", "--file", "-")
 			require.NoError(t, err, stderr)
-			assert.Contains(t, stdout, "valid")
+			assert.Contains(t, stdout, "file is valid")
+
+			// errors are reported against "stdin", not against the literal "-"
+			_, stderr, err = exec(strings.NewReader(invalidOPL), "validate", "opl", "--file", "-")
+			assert.ErrorIs(t, err, cmdx.ErrNoPrintButFail, stderr)
+			assert.Contains(t, stderr, "stdin:", stderr)
 		}
 
 		runWithProjectAsDefault(ctx, t, defaultProject.Id, validate)
 		runWithProjectAsFlag(ctx, t, extraProject.Id, validate)
 	})
 
-	t.Run("prints nothing on success when quiet", func(t *testing.T) {
+	t.Run("stays quiet on success but still reports syntax errors", func(t *testing.T) {
 		t.Parallel()
 
-		config := writeFile(t, validOPL)
+		valid, invalid := writeFile(t, validOPL), writeFile(t, invalidOPL)
 		validate := func(t *testing.T, exec execFunc) {
-			stdout, stderr, err := exec(nil, "validate", "opl", "--file", config, "--quiet")
+			stdout, stderr, err := exec(nil, "validate", "opl", "--file", valid, "--quiet")
 			require.NoError(t, err, stderr)
 			assert.Empty(t, stdout)
 			assert.Empty(t, stderr)
+
+			// --quiet silences the success message, not the syntax errors
+			stdout, stderr, err = exec(nil, "validate", "opl", "--file", invalid, "--quiet")
+			assert.ErrorIs(t, err, cmdx.ErrNoPrintButFail, stderr)
+			assert.Empty(t, stdout)
+			assert.Contains(t, stderr, invalid+":", stderr)
 		}
 
 		runWithProjectAsDefault(ctx, t, defaultProject.Id, validate)
+		runWithProjectAsFlag(ctx, t, extraProject.Id, validate)
 	})
 }