From 338d51419775a32805aa3f01fa9f1dc521ebfd19 Mon Sep 17 00:00:00 2001
From: Daniel Barranquero <74871504+danibarranqueroo@users.noreply.github.com>
Date: Wed, 18 Feb 2026 10:11:07 +0100
Subject: [PATCH] fix(api): gcp project id validation for legacy projects
 (#10078)

---
 api/CHANGELOG.md                        |  8 ++++++++
 api/src/backend/api/models.py           |  9 ++++++---
 api/src/backend/api/tests/test_views.py | 10 ++++++++++
 3 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md
index 88f9c2133f..0378a15d53 100644
--- a/api/CHANGELOG.md
+++ b/api/CHANGELOG.md
@@ -29,6 +29,14 @@ All notable changes to the **Prowler API** are documented in this file.
 
 ---
 
+## [1.19.3] (Prowler UNRELEASED)
+
+### 🐞 Fixed
+
+- GCP provider UID validation regex to allow domain prefixes [(#10078)](https://github.com/prowler-cloud/prowler/pull/10078)
+
+---
+
 ## [1.19.2] (Prowler v5.18.2)
 
 ### 🐞 Fixed
diff --git a/api/src/backend/api/models.py b/api/src/backend/api/models.py
index 86246b92a1..5597963216 100644
--- a/api/src/backend/api/models.py
+++ b/api/src/backend/api/models.py
@@ -327,10 +327,13 @@ class Provider(RowLevelSecurityProtectedModel):
 
     @staticmethod
     def validate_gcp_uid(value):
-        if not re.match(r"^[a-z][a-z0-9-]{5,29}$", value):
+        # Standard format: 6-30 chars, starts with letter, lowercase + digits + hyphens
+        # Legacy App Engine format: domain.com:project-id
+        if not re.match(r"^([a-z][a-z0-9.-]*:)?[a-z][a-z0-9-]{5,29}$", value):
             raise ModelValidationError(
-                detail="GCP provider ID must be 6 to 30 characters, start with a letter, and contain only lowercase "
-                "letters, numbers, and hyphens.",
+                detail="GCP provider ID must be a valid project ID: 6 to 30 characters, start with a letter, "
+                "and contain only lowercase letters, numbers, and hyphens. "
+                "Legacy App Engine project IDs with a domain prefix (e.g., example.com:my-project) are also accepted.",
                 code="gcp-uid",
                 pointer="/data/attributes/uid",
             )
diff --git a/api/src/backend/api/tests/test_views.py b/api/src/backend/api/tests/test_views.py
index 2dce642fb7..c7f2e5533d 100644
--- a/api/src/backend/api/tests/test_views.py
+++ b/api/src/backend/api/tests/test_views.py
@@ -1079,6 +1079,11 @@ class TestProviderViewSet:
             [
                 {"provider": "aws", "uid": "111111111111", "alias": "test"},
                 {"provider": "gcp", "uid": "a12322-test54321", "alias": "test"},
+                {
+                    "provider": "gcp",
+                    "uid": "example.com:my-project-123456",
+                    "alias": "legacy-gcp",
+                },
                 {
                     "provider": "kubernetes",
                     "uid": "kubernetes-test-123456789",
@@ -1203,6 +1208,11 @@ class TestProviderViewSet:
             [
                 {"provider": "aws", "uid": "111111111111", "alias": "test"},
                 {"provider": "gcp", "uid": "a12322-test54321", "alias": "test"},
+                {
+                    "provider": "gcp",
+                    "uid": "example.com:my-project-123456",
+                    "alias": "legacy-gcp",
+                },
                 {
                     "provider": "kubernetes",
                     "uid": "kubernetes-test-123456789",