@opensoha/contracts 0.1.13 → 0.1.15

package/auth/catalog_generated.go

@@ -6,8 +6,8 @@ import _ "embed"
 
 const (
 	PermissionCatalogVersion = "2.0.0"
-	PermissionCatalogContentSHA256 = "82626eb53d9cd6b53ee502ae32285392c672f7f186a7dbefb42bf1f700d67e98"
-	PermissionCatalogSHA256 = "f563a9be8901002e790f271d589c9f4b8b05dcd8e9b4bba767b835b1cc606b76"
+	PermissionCatalogContentSHA256 = "58321138575c22b20933cf2c1db2742b741a123bb8f6a2983bb436e84be4e58a"
+	PermissionCatalogSHA256 = "38ac1a2e7087ff4831e8f6390b804e32f918b49b9af3165fdf2df286d64fe3c8"
 )
 
 //go:embed permission-catalog.json

package/auth/catalog_test.go

@@ -86,3 +86,43 @@ func TestPermissionCatalogIncludesIndependentResourceCreationEntry(t *testing.T)
 		t.Fatal("platform.resource-creation.use is missing")
 	}
 }
+
+func TestPermissionCatalogIncludesIndependentWorkbenchEntries(t *testing.T) {
+	var catalog struct {
+		Permissions []struct {
+			Key        string `json:"key"`
+			Domain     string `json:"domain"`
+			Action     string `json:"action"`
+			Status     string `json:"status"`
+			Assignable bool   `json:"assignable"`
+		} `json:"permissions"`
+	}
+	if err := json.Unmarshal(PermissionCatalogJSON(), &catalog); err != nil {
+		t.Fatalf("decode permission catalog: %v", err)
+	}
+
+	want := map[string]bool{
+		"workbench.ai.view":         false,
+		"workbench.compute.view":    false,
+		"workbench.delivery.view":   false,
+		"workbench.home.view":       false,
+		"workbench.monitoring.view": false,
+		"workbench.platform.view":   false,
+		"workbench.security.view":   false,
+		"workbench.settings.view":   false,
+	}
+	for _, permission := range catalog.Permissions {
+		if _, ok := want[permission.Key]; !ok {
+			continue
+		}
+		if permission.Domain != "workbench" || permission.Action != "view" || permission.Status != "active" || !permission.Assignable {
+			t.Fatalf("workbench entry must be independently assignable: %#v", permission)
+		}
+		want[permission.Key] = true
+	}
+	for key, found := range want {
+		if !found {
+			t.Fatalf("%s is missing", key)
+		}
+	}
+}

package/auth/permission-catalog.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "authorization.opensoha.io/v1",
   "catalogVersion": "2.0.0",
-  "contentHash": "sha256:82626eb53d9cd6b53ee502ae32285392c672f7f186a7dbefb42bf1f700d67e98",
+  "contentHash": "sha256:58321138575c22b20933cf2c1db2742b741a123bb8f6a2983bb436e84be4e58a",
   "permissions": [
     {
       "key": "access.directory.create",
@@ -943,6 +943,70 @@
       "status": "active",
       "assignable": true
     },
+    {
+      "key": "ai.data-sources.create",
+      "domain": "ai",
+      "resource": "data-sources",
+      "action": "create",
+      "displayName": "创建 AI 数据源",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "ai.data-sources.update",
+      "domain": "ai",
+      "resource": "data-sources",
+      "action": "update",
+      "displayName": "修改 AI 数据源",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "ai.data-sources.validate",
+      "domain": "ai",
+      "resource": "data-sources",
+      "action": "validate",
+      "displayName": "校验 AI 数据源",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "ai.data-sources.view",
+      "domain": "ai",
+      "resource": "data-sources",
+      "action": "view",
+      "displayName": "查看 AI 数据源",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "ai.environments.create",
       "domain": "ai",
@@ -5456,6 +5520,26 @@
       "status": "active",
       "assignable": true
     },
+    {
+      "key": "platform.access-control.access-reviews.execute",
+      "domain": "platform",
+      "resource": "access-control.access-reviews",
+      "action": "execute",
+      "displayName": "执行 Kubernetes 有效权限检查",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "workspace",
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true,
+      "legacyAliases": [
+        "platform.access-control.view"
+      ]
+    },
     {
       "key": "platform.access-control.cluster-role-bindings.create",
       "domain": "platform",
@@ -5897,6 +5981,7 @@
       "status": "legacy",
       "assignable": false,
       "replacedBy": [
+        "platform.access-control.access-reviews.execute",
         "platform.access-control.cluster-role-bindings.view",
         "platform.access-control.cluster-roles.view",
         "platform.access-control.role-bindings.view",
@@ -7266,6 +7351,25 @@
         "delete"
       ]
     },
+    {
+      "key": "platform.helm.releases.rollback",
+      "domain": "platform",
+      "resource": "helm.releases",
+      "action": "rollback",
+      "displayName": "回滚 Kubernetes HelmRelease",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true,
+      "legacyCapabilities": [
+        "rollback"
+      ]
+    },
     {
       "key": "platform.helm.releases.update",
       "domain": "platform",
@@ -10929,12 +11033,132 @@
       "status": "active",
       "assignable": true
     },
+    {
+      "key": "workbench.ai.view",
+      "domain": "workbench",
+      "resource": "ai",
+      "action": "view",
+      "displayName": "访问 AI 工作台",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "workbench.compute.view",
+      "domain": "workbench",
+      "resource": "compute",
+      "action": "view",
+      "displayName": "访问计算资源工作台",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "workbench.delivery.view",
+      "domain": "workbench",
+      "resource": "delivery",
+      "action": "view",
+      "displayName": "访问应用交付工作台",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "workbench.home.view",
+      "domain": "workbench",
+      "resource": "home",
+      "action": "view",
+      "displayName": "访问应用门户",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "workbench.monitoring.view",
+      "domain": "workbench",
+      "resource": "monitoring",
+      "action": "view",
+      "displayName": "访问可观测与值班工作台",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "workbench.platform.view",
+      "domain": "workbench",
+      "resource": "platform",
+      "action": "view",
+      "displayName": "访问 k8s工作台",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "workbench.security.view",
+      "domain": "workbench",
+      "resource": "security",
+      "action": "view",
+      "displayName": "访问身份与安全工作台",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "workbench.settings.view",
+      "domain": "workbench",
+      "resource": "settings",
+      "action": "view",
+      "displayName": "访问设置中心",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "workspace.application.view",
       "domain": "workspace",
       "resource": "application",
       "action": "view",
-      "displayName": "查看应用工作台",
+      "displayName": "查看工作空间应用",
       "riskLevel": "read",
       "scopeKinds": [
         "tenant",
@@ -10950,7 +11174,7 @@
       "domain": "workspace",
       "resource": "resource",
       "action": "view",
-      "displayName": "查看 k8s工作台",
+      "displayName": "查看工作空间资源",
       "riskLevel": "read",
       "scopeKinds": [
         "tenant",

package/compat/json-schema-ecosystem-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.13",
+  "version": "0.1.15",
   "schemas": {
     "plugins/plugin-manifest.schema.json": {
       "rootRequired": ["id", "name", "publisher", "type", "version"],

package/compat/openapi-loose-boundaries-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.13",
+  "version": "0.1.15",
   "generatedFrom": "openapi/soha-api.yaml",
   "entries": [
     {

package/fixtures/openapi/AISkillsSettingsEnvelope/invalid/missing-registry.json

@@ -0,0 +1,3 @@
+{
+  "data": {}
+}

package/fixtures/openapi/AISkillsSettingsEnvelope/valid/registry.json

@@ -0,0 +1,13 @@
+{
+  "data": {
+    "skillsRegistry": [
+      {
+        "id": "observability-summary",
+        "name": "Observability Summary",
+        "category": "observability",
+        "enabled": true,
+        "scopes": ["cluster"]
+      }
+    ]
+  }
+}

package/fixtures/openapi/AlertEventStreamSignal/invalid/missing-observed-at.json

@@ -0,0 +1,4 @@
+{
+  "type": "changed",
+  "eventId": "alert-1"
+}

package/fixtures/openapi/AlertEventStreamSignal/valid/changed.json

@@ -0,0 +1,9 @@
+{
+  "type": "changed",
+  "observedAt": "2026-08-23T08:00:00Z",
+  "clusterId": "cluster-a",
+  "namespace": "team-a",
+  "eventId": "alert-1",
+  "eventStatus": "firing",
+  "resyncRequired": false
+}

package/fixtures/openapi/ComputeOverviewEnvelope/valid/partial.json

@@ -27,6 +27,12 @@
         "checkedAt": "2026-07-14T02:00:00Z"
       }
     ],
+    "generatedAt": "2026-07-14T02:00:01Z",
+    "freshness": {
+      "status": "fresh",
+      "observedAt": "2026-07-14T02:00:00Z",
+      "maxAgeSeconds": 120
+    },
     "partial": true,
     "warnings": [{ "code": "runtime_section_unavailable" }]
   }

package/fixtures/openapi/ComputeTaskListEnvelope/invalid/progress-overflow.json

@@ -0,0 +1,21 @@
+{
+  "items": [
+    {
+      "id": "virtualization:task-1",
+      "domain": "virtualization",
+      "sourceType": "virtualization_task",
+      "sourceId": "task-1",
+      "kind": "vm.create",
+      "category": "lifecycle",
+      "normalizedStatus": "running",
+      "rawStatus": "running",
+      "resources": [],
+      "attemptCount": 1,
+      "cancelable": true,
+      "retryable": false,
+      "availableActions": ["cancel"],
+      "progress": 1.5,
+      "createdAt": "2026-07-14T02:00:00Z"
+    }
+  ]
+}

package/fixtures/openapi/ComputeTaskListEnvelope/valid/running.json

@@ -23,6 +23,21 @@
       "cancelable": true,
       "retryable": false,
       "availableActions": ["logs", "cancel"],
+      "progress": 0.65,
+      "heartbeat": {
+        "status": "fresh",
+        "observedAt": "2026-07-14T02:00:08Z",
+        "timeoutSeconds": 30
+      },
+      "result": {
+        "status": "accepted",
+        "summary": "Provider accepted the VM create request."
+      },
+      "verification": {
+        "status": "pending",
+        "summary": "Waiting for the VM to become observable."
+      },
+      "auditRef": "audit-virtualization-task-1",
       "createdAt": "2026-07-14T02:00:00Z",
       "startedAt": "2026-07-14T02:00:01Z"
     }

package/fixtures/openapi/ComputeTaskStreamEvent/invalid/missing-observed-at.json

@@ -0,0 +1,3 @@
+{
+  "type": "heartbeat"
+}

package/fixtures/openapi/ComputeTaskStreamEvent/valid/snapshot.json

@@ -0,0 +1,27 @@
+{
+  "type": "snapshot",
+  "observedAt": "2026-07-14T02:00:08Z",
+  "sequence": 1,
+  "task": {
+    "id": "virtualization:task-1",
+    "domain": "virtualization",
+    "sourceType": "virtualization_task",
+    "sourceId": "task-1",
+    "kind": "vm.create",
+    "category": "lifecycle",
+    "normalizedStatus": "running",
+    "rawStatus": "running",
+    "resources": [],
+    "attemptCount": 1,
+    "cancelable": true,
+    "retryable": false,
+    "availableActions": ["logs", "cancel"],
+    "progress": 0.65,
+    "heartbeat": {
+      "status": "fresh",
+      "observedAt": "2026-07-14T02:00:08Z",
+      "timeoutSeconds": 30
+    },
+    "createdAt": "2026-07-14T02:00:00Z"
+  }
+}

package/fixtures/openapi/KubernetesResourceGraphEnvelope/invalid/edge-without-target.json

@@ -0,0 +1,16 @@
+{
+  "data": {
+    "clusterId": "cluster-a",
+    "generatedAt": "2026-08-23T08:00:00Z",
+    "nodes": [],
+    "edges": [
+      {
+        "id": "broken",
+        "sourceId": "a",
+        "relation": "owns"
+      }
+    ],
+    "evidence": [],
+    "warnings": []
+  }
+}

package/fixtures/openapi/KubernetesResourceGraphEnvelope/valid/deployment.json

@@ -0,0 +1,53 @@
+{
+  "data": {
+    "clusterId": "cluster-a",
+    "namespace": "team-a",
+    "generatedAt": "2026-08-23T08:00:00Z",
+    "rootId": "apps/v1:Deployment:team-a/api",
+    "nodes": [
+      {
+        "id": "apps/v1:Deployment:team-a/api",
+        "resource": {
+          "clusterId": "cluster-a",
+          "apiVersion": "apps/v1",
+          "kind": "Deployment",
+          "name": "api",
+          "namespace": "team-a",
+          "scopeMode": "namespace"
+        },
+        "status": "healthy"
+      },
+      {
+        "id": "v1:Pod:team-a/api-1",
+        "resource": {
+          "clusterId": "cluster-a",
+          "apiVersion": "v1",
+          "kind": "Pod",
+          "name": "api-1",
+          "namespace": "team-a",
+          "scopeMode": "namespace"
+        },
+        "status": "Running"
+      }
+    ],
+    "edges": [
+      {
+        "id": "owns:deployment-api:pod-api-1",
+        "sourceId": "apps/v1:Deployment:team-a/api",
+        "targetId": "v1:Pod:team-a/api-1",
+        "relation": "owns"
+      }
+    ],
+    "evidence": [
+      {
+        "id": "event/team-a/api-1-scheduled",
+        "type": "kubernetes-event",
+        "severity": "info",
+        "summary": "Pod scheduled",
+        "observedAt": "2026-08-23T07:59:58Z",
+        "resourceId": "v1:Pod:team-a/api-1"
+      }
+    ],
+    "warnings": []
+  }
+}

package/fixtures/openapi/KubernetesResourceSearchEnvelope/invalid/missing-resource.json

@@ -0,0 +1,10 @@
+{
+  "data": {
+    "items": [
+      {
+        "status": "Running"
+      }
+    ],
+    "truncated": false
+  }
+}

package/fixtures/openapi/KubernetesResourceSearchEnvelope/valid/mixed.json

@@ -0,0 +1,29 @@
+{
+  "data": {
+    "items": [
+      {
+        "resource": {
+          "clusterId": "cluster-a",
+          "apiVersion": "v1",
+          "kind": "Pod",
+          "name": "api-7c8d9f",
+          "namespace": "production",
+          "scopeMode": "namespace",
+          "uid": "pod-uid"
+        },
+        "status": "Running"
+      },
+      {
+        "resource": {
+          "clusterId": "cluster-a",
+          "apiVersion": "v1",
+          "kind": "Node",
+          "name": "worker-1",
+          "scopeMode": "cluster"
+        },
+        "status": "Ready"
+      }
+    ],
+    "truncated": false
+  }
+}

package/fixtures/openapi/KubernetesResourceStreamEvent/invalid/missing-observed-at.json

@@ -0,0 +1,5 @@
+{
+  "type": "modified",
+  "clusterId": "cluster-a",
+  "source": "informer"
+}

package/fixtures/openapi/KubernetesResourceStreamEvent/valid/modified.json

@@ -0,0 +1,18 @@
+{
+  "type": "modified",
+  "clusterId": "cluster-a",
+  "observedAt": "2026-08-23T08:00:00Z",
+  "source": "informer",
+  "resourceVersion": "42",
+  "cacheStatus": "live",
+  "resyncRequired": false,
+  "resource": {
+    "clusterId": "cluster-a",
+    "apiVersion": "v1",
+    "kind": "Pod",
+    "name": "api-1",
+    "namespace": "team-a",
+    "scopeMode": "namespace",
+    "uid": "pod-uid"
+  }
+}

package/fixtures/openapi/KubernetesSecurityPostureEnvelope/invalid/finding-without-severity.json

@@ -0,0 +1,24 @@
+{
+  "data": {
+    "clusterId": "cluster-a",
+    "provider": "kubescape",
+    "status": "available",
+    "generatedAt": "2026-08-23T08:00:00Z",
+    "counts": {
+      "critical": 0,
+      "high": 1,
+      "medium": 0,
+      "low": 0,
+      "unknown": 0
+    },
+    "findings": [
+      {
+        "id": "broken",
+        "category": "configuration",
+        "title": "Missing severity",
+        "status": "failed"
+      }
+    ],
+    "warnings": []
+  }
+}