@opensoha/contracts 0.1.14 → 0.1.16

package/auth/catalog_generated.go

@@ -6,8 +6,8 @@ import _ "embed"
 
 const (
 	PermissionCatalogVersion = "2.0.0"
-	PermissionCatalogContentSHA256 = "0efe8f496fa0fb29703584586f9306d04fdb5b9a38eaea78532107698230f609"
-	PermissionCatalogSHA256 = "5f1d8b49fb4155473f61ff255002ec7a13e3f63d718d5f9fc592daa93da610df"
+	PermissionCatalogContentSHA256 = "5aa6fa361c2ab8d987415fb1eb93218510deb9359a68212dfe86655dbfaeea5e"
+	PermissionCatalogSHA256 = "01c80a71427e3d7f4898212fb1667405c27f1b798318d9eac86ece8262cd188c"
 )
 
 //go:embed permission-catalog.json

package/auth/permission-catalog.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "authorization.opensoha.io/v1",
   "catalogVersion": "2.0.0",
-  "contentHash": "sha256:0efe8f496fa0fb29703584586f9306d04fdb5b9a38eaea78532107698230f609",
+  "contentHash": "sha256:5aa6fa361c2ab8d987415fb1eb93218510deb9359a68212dfe86655dbfaeea5e",
   "permissions": [
     {
       "key": "access.directory.create",
@@ -943,6 +943,70 @@
       "status": "active",
       "assignable": true
     },
+    {
+      "key": "ai.data-sources.create",
+      "domain": "ai",
+      "resource": "data-sources",
+      "action": "create",
+      "displayName": "创建 AI 数据源",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "ai.data-sources.update",
+      "domain": "ai",
+      "resource": "data-sources",
+      "action": "update",
+      "displayName": "修改 AI 数据源",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "ai.data-sources.validate",
+      "domain": "ai",
+      "resource": "data-sources",
+      "action": "validate",
+      "displayName": "校验 AI 数据源",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "ai.data-sources.view",
+      "domain": "ai",
+      "resource": "data-sources",
+      "action": "view",
+      "displayName": "查看 AI 数据源",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "ai.environments.create",
       "domain": "ai",
@@ -5456,6 +5520,26 @@
       "status": "active",
       "assignable": true
     },
+    {
+      "key": "platform.access-control.access-reviews.execute",
+      "domain": "platform",
+      "resource": "access-control.access-reviews",
+      "action": "execute",
+      "displayName": "执行 Kubernetes 有效权限检查",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "workspace",
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true,
+      "legacyAliases": [
+        "platform.access-control.view"
+      ]
+    },
     {
       "key": "platform.access-control.cluster-role-bindings.create",
       "domain": "platform",
@@ -5897,6 +5981,7 @@
       "status": "legacy",
       "assignable": false,
       "replacedBy": [
+        "platform.access-control.access-reviews.execute",
         "platform.access-control.cluster-role-bindings.view",
         "platform.access-control.cluster-roles.view",
         "platform.access-control.role-bindings.view",
@@ -7266,6 +7351,25 @@
         "delete"
       ]
     },
+    {
+      "key": "platform.helm.releases.rollback",
+      "domain": "platform",
+      "resource": "helm.releases",
+      "action": "rollback",
+      "displayName": "回滚 Kubernetes HelmRelease",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true,
+      "legacyCapabilities": [
+        "rollback"
+      ]
+    },
     {
       "key": "platform.helm.releases.update",
       "domain": "platform",
@@ -10388,9 +10492,9 @@
       "replacedBy": [
         "virtualization.clusters.create",
         "virtualization.clusters.delete",
-        "virtualization.clusters.sync",
         "virtualization.clusters.test",
-        "virtualization.clusters.update"
+        "virtualization.clusters.update",
+        "virtualization.sync.sync"
       ]
     },
     {
@@ -10405,10 +10509,10 @@
         "resource"
       ],
       "approvalPolicy": "never",
-      "status": "active",
-      "assignable": true,
-      "legacyAliases": [
-        "virtualization.clusters.manage"
+      "status": "legacy",
+      "assignable": false,
+      "replacedBy": [
+        "virtualization.sync.sync"
       ]
     },
     {
@@ -10773,6 +10877,7 @@
       "status": "active",
       "assignable": true,
       "legacyAliases": [
+        "virtualization.clusters.sync",
         "virtualization.sync.manage"
       ]
     },
@@ -10964,7 +11069,7 @@
       "domain": "workbench",
       "resource": "delivery",
       "action": "view",
-      "displayName": "访问应用交付工作台",
+      "displayName": "访问持续交付工作台",
       "riskLevel": "read",
       "scopeKinds": [
         "tenant",

package/compat/json-schema-ecosystem-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.14",
+  "version": "0.1.16",
   "schemas": {
     "plugins/plugin-manifest.schema.json": {
       "rootRequired": ["id", "name", "publisher", "type", "version"],

package/compat/openapi-loose-boundaries-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.14",
+  "version": "0.1.16",
   "generatedFrom": "openapi/soha-api.yaml",
   "entries": [
     {
@@ -170,6 +170,10 @@
       "kind": "additionalPropertiesTrue",
       "path": "components/schemas/ApplicationServiceInput/properties/metadata/additionalProperties"
     },
+    {
+      "kind": "additionalPropertiesTrue",
+      "path": "components/schemas/ApplicationWorkflowInput/properties/definition/additionalProperties"
+    },
     {
       "kind": "additionalPropertiesTrue",
       "path": "components/schemas/ApprovalRequest/properties/relatedIds/additionalProperties"
@@ -206,6 +210,14 @@
       "kind": "additionalPropertiesTrue",
       "path": "components/schemas/AuthBootstrapEnvelope/properties/data/properties/permissionSnapshot/additionalProperties"
     },
+    {
+      "kind": "additionalPropertiesTrue",
+      "path": "components/schemas/IdentityApplication/properties/metadata/additionalProperties"
+    },
+    {
+      "kind": "additionalPropertiesTrue",
+      "path": "components/schemas/IdentityApplicationInput/properties/metadata/additionalProperties"
+    },
     {
       "kind": "additionalPropertiesTrue",
       "path": "components/schemas/BuildPolicy/properties/buildArgs/additionalProperties"
@@ -666,6 +678,51 @@
       "path": "components/schemas/ApprovalRequest/properties/output",
       "target": "#/components/schemas/AnyValue"
     },
+    {
+      "kind": "schemaRef",
+      "path": "components/schemas/AlertRule/properties/datasourceSelector",
+      "target": "#/components/schemas/GenericObject"
+    },
+    {
+      "kind": "schemaRef",
+      "path": "components/schemas/AlertRule/properties/querySpec",
+      "target": "#/components/schemas/GenericObject"
+    },
+    {
+      "kind": "schemaRef",
+      "path": "components/schemas/AlertRule/properties/thresholdSpec",
+      "target": "#/components/schemas/GenericObject"
+    },
+    {
+      "kind": "schemaRef",
+      "path": "components/schemas/AlertRuleInput/properties/datasourceSelector",
+      "target": "#/components/schemas/GenericObject"
+    },
+    {
+      "kind": "schemaRef",
+      "path": "components/schemas/AlertRuleInput/properties/querySpec",
+      "target": "#/components/schemas/GenericObject"
+    },
+    {
+      "kind": "schemaRef",
+      "path": "components/schemas/AlertRuleInput/properties/thresholdSpec",
+      "target": "#/components/schemas/GenericObject"
+    },
+    {
+      "kind": "schemaRef",
+      "path": "components/schemas/AlertRuleRun/properties/result",
+      "target": "#/components/schemas/GenericObject"
+    },
+    {
+      "kind": "schemaRef",
+      "path": "components/schemas/AlertRuleTestResult/properties/notificationPreview/items",
+      "target": "#/components/schemas/GenericObject"
+    },
+    {
+      "kind": "schemaRef",
+      "path": "components/schemas/AlertRuleTestResult/properties/samples/items",
+      "target": "#/components/schemas/GenericObject"
+    },
     {
       "kind": "schemaRef",
       "path": "components/schemas/DeliveryDraft/properties/executionHints",

package/fixtures/openapi/AISkillsSettingsEnvelope/invalid/missing-registry.json

@@ -0,0 +1,3 @@
+{
+  "data": {}
+}

package/fixtures/openapi/AISkillsSettingsEnvelope/valid/registry.json

@@ -0,0 +1,13 @@
+{
+  "data": {
+    "skillsRegistry": [
+      {
+        "id": "observability-summary",
+        "name": "Observability Summary",
+        "category": "observability",
+        "enabled": true,
+        "scopes": ["cluster"]
+      }
+    ]
+  }
+}

package/fixtures/openapi/AlertEventStreamSignal/invalid/missing-observed-at.json

@@ -0,0 +1,4 @@
+{
+  "type": "changed",
+  "eventId": "alert-1"
+}

package/fixtures/openapi/AlertEventStreamSignal/valid/changed.json

@@ -0,0 +1,9 @@
+{
+  "type": "changed",
+  "observedAt": "2026-08-23T08:00:00Z",
+  "clusterId": "cluster-a",
+  "namespace": "team-a",
+  "eventId": "alert-1",
+  "eventStatus": "firing",
+  "resyncRequired": false
+}

package/fixtures/openapi/AlertRuleEnvelope/invalid/missing-data.json

@@ -0,0 +1 @@
+{}

package/fixtures/openapi/AlertRuleEnvelope/valid/metrics.json

@@ -0,0 +1,11 @@
+{
+  "data": {
+    "id": "rule-checkout-errors",
+    "name": "Checkout error rate",
+    "ruleType": "metrics",
+    "forSeconds": 120,
+    "enabled": true,
+    "createdAt": "2026-08-31T00:00:00Z",
+    "updatedAt": "2026-08-31T00:05:00Z"
+  }
+}

package/fixtures/openapi/AlertRuleInput/invalid/missing-name.json

@@ -0,0 +1,3 @@
+{
+  "ruleType": "metrics"
+}

package/fixtures/openapi/AlertRuleInput/valid/metrics.json

@@ -0,0 +1,25 @@
+{
+  "name": "Checkout error rate",
+  "ruleType": "metrics",
+  "datasourceSelector": {
+    "id": "prometheus-main"
+  },
+  "querySpec": {
+    "metricKey": "http.server.errors"
+  },
+  "thresholdSpec": {
+    "operator": "gte",
+    "value": 5
+  },
+  "forSeconds": 120,
+  "groupBy": ["service"],
+  "labels": {
+    "severity": "critical"
+  },
+  "annotations": {
+    "summary": "Checkout error rate is elevated"
+  },
+  "notificationPolicyId": "policy-primary",
+  "healingPolicyIds": ["healing-checkout"],
+  "enabled": true
+}

package/fixtures/openapi/AlertRuleRunListEnvelope/invalid/missing-rule-id.json

@@ -0,0 +1,12 @@
+{
+  "items": [
+    {
+      "id": "run-1",
+      "status": "completed",
+      "matched": false,
+      "durationMs": 42,
+      "createdAt": "2026-08-31T00:06:00Z",
+      "updatedAt": "2026-08-31T00:06:00Z"
+    }
+  ]
+}

package/fixtures/openapi/AlertRuleRunListEnvelope/valid/items.json

@@ -0,0 +1,13 @@
+{
+  "items": [
+    {
+      "id": "run-1",
+      "ruleId": "rule-checkout-errors",
+      "status": "completed",
+      "matched": false,
+      "durationMs": 42,
+      "createdAt": "2026-08-31T00:06:00Z",
+      "updatedAt": "2026-08-31T00:06:00Z"
+    }
+  ]
+}

package/fixtures/openapi/AlertRuleTestResultEnvelope/invalid/missing-executed-at.json

@@ -0,0 +1,5 @@
+{
+  "data": {
+    "matched": false
+  }
+}

package/fixtures/openapi/AlertRuleTestResultEnvelope/valid/clear.json

@@ -0,0 +1,10 @@
+{
+  "data": {
+    "ruleId": "rule-checkout-errors",
+    "ruleType": "metrics",
+    "state": "clear",
+    "summary": "metrics threshold is clear",
+    "matched": false,
+    "executedAt": "2026-08-31T00:06:00Z"
+  }
+}

package/fixtures/openapi/ApplicationRuntimeEnvironment/invalid/unknown-status.json

@@ -0,0 +1,7 @@
+{
+  "applicationEnvironmentId": "binding-1",
+  "environmentId": "production",
+  "requiresApproval": true,
+  "status": "offline",
+  "workloads": []
+}

package/fixtures/openapi/ApplicationRuntimeEnvironment/valid/unavailable.json

@@ -0,0 +1,7 @@
+{
+  "applicationEnvironmentId": "binding-1",
+  "environmentId": "production",
+  "requiresApproval": true,
+  "status": "unavailable",
+  "workloads": []
+}

package/fixtures/openapi/ApplicationWorkflowInput/invalid/owner-fields.json

@@ -0,0 +1,7 @@
+{
+  "key": "application-app-2",
+  "name": "Production release",
+  "category": "application:app-2",
+  "definition": {},
+  "enabled": true
+}

package/fixtures/openapi/ApplicationWorkflowInput/valid/minimal.json

@@ -0,0 +1,9 @@
+{
+  "name": "Production release",
+  "definition": {
+    "mode": "release_dag",
+    "nodes": [],
+    "edges": []
+  },
+  "enabled": true
+}

package/fixtures/openapi/BrandingAssetUploadEnvelope/valid/svg-data-url.json

@@ -0,0 +1,5 @@
+{
+  "data": {
+    "url": "data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg=="
+  }
+}

package/fixtures/openapi/BrowserHandoffCompletionEnvelope/invalid/token-leak.json

@@ -0,0 +1,7 @@
+{
+  "data": {
+    "status": "completed",
+    "destinationUrl": "/oauth2/authorize?client_id=console",
+    "accessToken": "must-not-be-returned"
+  }
+}

package/fixtures/openapi/BrowserHandoffCompletionEnvelope/valid/completed.json

@@ -0,0 +1,6 @@
+{
+  "data": {
+    "status": "completed",
+    "destinationUrl": "/oauth2/authorize?client_id=console"
+  }
+}

package/fixtures/openapi/BrowserHandoffEnvelope/invalid/missing-principal.json

@@ -0,0 +1,12 @@
+{
+  "data": {
+    "application": {
+      "id": "app-1",
+      "name": "Soha Console"
+    },
+    "accountName": "OpenSoha",
+    "email": "must-not-be-exposed@example.com",
+    "status": "pending",
+    "expiresAt": "2026-08-31T00:01:00Z"
+  }
+}

package/fixtures/openapi/BrowserHandoffEnvelope/valid/pending.json

@@ -0,0 +1,11 @@
+{
+  "data": {
+    "application": {
+      "id": "app-1",
+      "name": "Soha Console"
+    },
+    "accountName": "OpenSoha",
+    "status": "pending",
+    "expiresAt": "2026-08-31T00:01:00Z"
+  }
+}

package/fixtures/openapi/ChangePasswordRequest/invalid/missing-current-password.json

@@ -0,0 +1,3 @@
+{
+  "newPassword": "new-password"
+}

package/fixtures/openapi/ChangePasswordRequest/invalid/short-new-password.json

@@ -0,0 +1,4 @@
+{
+  "currentPassword": "current-password",
+  "newPassword": "short"
+}

package/fixtures/openapi/ChangePasswordRequest/valid/password.json

@@ -0,0 +1,4 @@
+{
+  "currentPassword": "current-password",
+  "newPassword": "new-password"
+}

package/fixtures/openapi/ComputeOverviewEnvelope/valid/partial.json

@@ -27,6 +27,12 @@
         "checkedAt": "2026-07-14T02:00:00Z"
       }
     ],
+    "generatedAt": "2026-07-14T02:00:01Z",
+    "freshness": {
+      "status": "fresh",
+      "observedAt": "2026-07-14T02:00:00Z",
+      "maxAgeSeconds": 120
+    },
     "partial": true,
     "warnings": [{ "code": "runtime_section_unavailable" }]
   }

package/fixtures/openapi/ComputeTaskListEnvelope/invalid/progress-overflow.json

@@ -0,0 +1,21 @@
+{
+  "items": [
+    {
+      "id": "virtualization:task-1",
+      "domain": "virtualization",
+      "sourceType": "virtualization_task",
+      "sourceId": "task-1",
+      "kind": "vm.create",
+      "category": "lifecycle",
+      "normalizedStatus": "running",
+      "rawStatus": "running",
+      "resources": [],
+      "attemptCount": 1,
+      "cancelable": true,
+      "retryable": false,
+      "availableActions": ["cancel"],
+      "progress": 1.5,
+      "createdAt": "2026-07-14T02:00:00Z"
+    }
+  ]
+}

package/fixtures/openapi/ComputeTaskListEnvelope/valid/running.json

@@ -23,6 +23,21 @@
       "cancelable": true,
       "retryable": false,
       "availableActions": ["logs", "cancel"],
+      "progress": 0.65,
+      "heartbeat": {
+        "status": "fresh",
+        "observedAt": "2026-07-14T02:00:08Z",
+        "timeoutSeconds": 30
+      },
+      "result": {
+        "status": "accepted",
+        "summary": "Provider accepted the VM create request."
+      },
+      "verification": {
+        "status": "pending",
+        "summary": "Waiting for the VM to become observable."
+      },
+      "auditRef": "audit-virtualization-task-1",
       "createdAt": "2026-07-14T02:00:00Z",
       "startedAt": "2026-07-14T02:00:01Z"
     }

package/fixtures/openapi/ComputeTaskStreamEvent/invalid/missing-observed-at.json

@@ -0,0 +1,3 @@
+{
+  "type": "heartbeat"
+}

package/fixtures/openapi/ComputeTaskStreamEvent/valid/snapshot.json

@@ -0,0 +1,27 @@
+{
+  "type": "snapshot",
+  "observedAt": "2026-07-14T02:00:08Z",
+  "sequence": 1,
+  "task": {
+    "id": "virtualization:task-1",
+    "domain": "virtualization",
+    "sourceType": "virtualization_task",
+    "sourceId": "task-1",
+    "kind": "vm.create",
+    "category": "lifecycle",
+    "normalizedStatus": "running",
+    "rawStatus": "running",
+    "resources": [],
+    "attemptCount": 1,
+    "cancelable": true,
+    "retryable": false,
+    "availableActions": ["logs", "cancel"],
+    "progress": 0.65,
+    "heartbeat": {
+      "status": "fresh",
+      "observedAt": "2026-07-14T02:00:08Z",
+      "timeoutSeconds": 30
+    },
+    "createdAt": "2026-07-14T02:00:00Z"
+  }
+}

package/fixtures/openapi/DesktopAuthAttemptCreateRequest/invalid/https-redirect.json

@@ -0,0 +1,6 @@
+{
+  "providerId": "corp-oidc",
+  "redirectUri": "https://127.0.0.1:49152/callback/T4I0wIrt0Pp4qABC",
+  "codeChallenge": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+  "codeChallengeMethod": "S256"
+}

package/fixtures/openapi/DesktopAuthAttemptCreateRequest/invalid/localhost-redirect.json

@@ -0,0 +1,6 @@
+{
+  "providerId": "corp-oidc",
+  "redirectUri": "http://localhost:49152/callback/T4I0wIrt0Pp4qABC",
+  "codeChallenge": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+  "codeChallengeMethod": "S256"
+}

package/fixtures/openapi/DesktopAuthAttemptCreateRequest/invalid/plain-challenge.json

@@ -0,0 +1,6 @@
+{
+  "providerId": "corp-oidc",
+  "redirectUri": "http://127.0.0.1:49152/callback/T4I0wIrt0Pp4qABC",
+  "codeChallenge": "short",
+  "codeChallengeMethod": "plain"
+}

package/fixtures/openapi/DesktopAuthAttemptCreateRequest/invalid/privileged-port.json

@@ -0,0 +1,6 @@
+{
+  "providerId": "corp-oidc",
+  "redirectUri": "http://127.0.0.1:1023/callback/T4I0wIrt0Pp4qABC",
+  "codeChallenge": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+  "codeChallengeMethod": "S256"
+}

package/fixtures/openapi/DesktopAuthAttemptCreateRequest/invalid/short-callback.json

@@ -0,0 +1,6 @@
+{
+  "providerId": "corp-oidc",
+  "redirectUri": "http://127.0.0.1:49152/callback/short",
+  "codeChallenge": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+  "codeChallengeMethod": "S256"
+}