fix: validate regex when matches operator is used in custom comparison

Author: dangrondahl

internal/policywizard/forms.go

@@ -382,6 +382,10 @@ func (m *Model) applyFormValues(fv formValues) {
 		case "exists":
 			m.storeSubExpr(policy.ExistsExpr(m.exprContext))
 		case "matches":
+			if err := validateRegex(fv.str); err != nil {
+				m.validationErr = err.Error()
+				return
+			}
 			m.storeSubExpr(policy.MatchesExpr(m.exprContext, fv.str))
 		default:
 			m.storeSubExpr(policy.ComparisonExpr(m.exprContext, fv.operator, fv.str))

internal/policywizard/forms_test.go

@@ -413,6 +413,17 @@ func TestApply_ExprCustomOp_MatchesStoresPending(t *testing.T) {
 	assert.Equal(t, `matches(flow.name, "^prod")`, m.pendingExprs[0])
 }
 
+func TestApply_ExprCustomOp_MatchesInvalidRegex(t *testing.T) {
+	m := newTestModel()
+	m.step = stepExprCustomOp
+	m.exprContext = "flow.name"
+
+	m.applyFormValues(formValues{operator: "matches", str: "[unclosed"})
+
+	assert.Empty(t, m.pendingExprs)
+	assert.Contains(t, m.validationErr, "invalid regex")
+}
+
 func TestApply_ExprCustomOp_ExistsStoresPending(t *testing.T) {
 	m := newTestModel()
 	m.step = stepExprCustomOp