Re: [PATCH proxmox v4 12/39] notify: matcher: add expression support

["Michael Köppl" <m.koeppl@proxmox.com>]

On Mon Oct 12, 2026 at 3:13 PM CEST, Lukas Wagner wrote:

[snip]

> diff --git a/proxmox-notify/src/matcher/field.rs b/proxmox-notify/src/matcher/field.rs
> index ad04b388..fd25939c 100644
> --- a/proxmox-notify/src/matcher/field.rs
> +++ b/proxmox-notify/src/matcher/field.rs
> @@ -6,6 +6,7 @@ use regex::Regex;
>  use proxmox_schema::{
>      ApiStringFormat, Schema, StringSchema, api_types::SAFE_ID_REGEX_STR, const_regex,
>  };
> +use serde::{Deserialize, Serialize};
>
>  use crate::{Error, Notification};
>
> @@ -30,42 +31,38 @@ pub const MATCH_FIELD_ENTRY_SCHEMA: Schema = StringSchema::new("Match metadata f
>      .schema();
>
>  /// Check if the notification metadata fields match
> -#[derive(Clone, Debug)]
> +#[derive(Clone, Debug, Serialize, Deserialize)]
> +#[serde(rename_all = "kebab-case", untagged)]

Via the API or CLI, I can supply an expression with keys that are
AFAIU mutually exclusive:

```
pvesh create /cluster/notifications/matchers \
	--name notsupposedtowork \
	--target mail-to-root \
	--expression \
	'{"match":{"type":"field","field":"type","values":["vzdump"],"regex":"^replication$"}}'
```

This will be accepted, but the config will only contain this:

```
matcher: notsupposedtowork
	expression {"match":{"type":"field","field":"type","values":["vzdump"]}}
	target mail-to-root
```

So it silently drops the second key. I think this should probably be
rejected, no? I think adding `deny_unknown_fields` should resolve this.
Because then, if the field matcher has the form
`{"field": "...", "values": [...]}`, "regex" will be unknown.
Analogously if the field matcher is the regex form, then "values" will
be unknown.

Wouldn't see this as a blocker, though. Could also be resolved as a
follow-up IMO.

>  pub enum FieldMatcher {
>      Exact {
>          field: String,
> -        matched_values: Vec<String>,
> +        values: Vec<String>,
>      },
>      Regex {
>          field: String,
> -        matched_regex: Regex,
> +        #[serde(with = "serde_regex")]
> +        regex: Regex,
>      },
>  }

[snip]