@opensoha/contracts 0.1.14 → 0.1.16

package/fixtures/openapi/DesktopAuthAttemptCreateRequest/valid/loopback.json

@@ -0,0 +1,6 @@
+{
+  "providerId": "corp-oidc",
+  "redirectUri": "http://127.0.0.1:49152/callback/T4I0wIrt0Pp4qABC",
+  "codeChallenge": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+  "codeChallengeMethod": "S256"
+}

package/fixtures/openapi/DesktopAuthAttemptEnvelope/invalid/missing-expiry.json

@@ -0,0 +1,6 @@
+{
+  "data": {
+    "attemptId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
+    "authorizationUrl": "https://soha.example.com/api/v1/auth/desktop/attempts/3fa85f64-5717-4562-b3fc-2c963f66afa6/start"
+  }
+}

package/fixtures/openapi/DesktopAuthAttemptEnvelope/valid/attempt.json

@@ -0,0 +1,7 @@
+{
+  "data": {
+    "attemptId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
+    "authorizationUrl": "https://soha.example.com/api/v1/auth/desktop/attempts/3fa85f64-5717-4562-b3fc-2c963f66afa6/start",
+    "expiresAt": "2026-08-20T12:00:00Z"
+  }
+}

package/fixtures/openapi/DesktopAuthAttemptExchangeRequest/invalid/short-verifier.json

@@ -0,0 +1,4 @@
+{
+  "code": "ZGVza3RvcC1jYWxsYmFjay1jb2Rl",
+  "codeVerifier": "short"
+}

package/fixtures/openapi/DesktopAuthAttemptExchangeRequest/valid/exchange.json

@@ -0,0 +1,4 @@
+{
+  "code": "ZGVza3RvcC1jYWxsYmFjay1jb2Rl",
+  "codeVerifier": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+}

package/fixtures/openapi/IdentityApplication/invalid/missing-id.json

@@ -0,0 +1,7 @@
+{
+  "name": "Example App",
+  "slug": "example-app",
+  "status": "enabled",
+  "createdAt": "2026-08-24T08:00:00Z",
+  "updatedAt": "2026-08-24T08:00:00Z"
+}

package/fixtures/openapi/IdentityApplication/valid/full.json

@@ -0,0 +1,30 @@
+{
+  "id": "app-example",
+  "name": "Example App",
+  "slug": "example-app",
+  "description": "Example identity application",
+  "iconUrl": "https://app.example.com/icon.png",
+  "tags": ["platform"],
+  "launchUrl": "https://app.example.com",
+  "providerId": "provider-example",
+  "providerType": "oidc",
+  "portalVisible": true,
+  "featured": false,
+  "sortOrder": 100,
+  "status": "enabled",
+  "metadata": {
+    "owner": "platform"
+  },
+  "assignments": [
+    {
+      "id": "assignment-example",
+      "applicationId": "app-example",
+      "subjectType": "role",
+      "subjectId": "platform-admin",
+      "effect": "allow",
+      "createdAt": "2026-08-24T08:00:00Z"
+    }
+  ],
+  "createdAt": "2026-08-24T08:00:00Z",
+  "updatedAt": "2026-08-24T08:00:00Z"
+}

package/fixtures/openapi/IdentityApplicationEnvelope/invalid/missing-data.json

@@ -0,0 +1 @@
+{}

package/fixtures/openapi/IdentityApplicationEnvelope/valid/minimal.json

@@ -0,0 +1,10 @@
+{
+  "data": {
+    "id": "app-1",
+    "name": "Soha Console",
+    "slug": "soha-console",
+    "status": "enabled",
+    "createdAt": "2026-08-31T00:00:00Z",
+    "updatedAt": "2026-08-31T00:00:00Z"
+  }
+}

package/fixtures/openapi/IdentityApplicationLaunchListEnvelope/invalid/missing-user.json

@@ -0,0 +1,11 @@
+{
+  "items": [
+    {
+      "id": "launch-1",
+      "applicationId": "app-1",
+      "providerType": "oidc",
+      "result": "allow",
+      "createdAt": "2026-08-31T00:00:00Z"
+    }
+  ]
+}

package/fixtures/openapi/IdentityApplicationLaunchListEnvelope/valid/minimal.json

@@ -0,0 +1,12 @@
+{
+  "items": [
+    {
+      "id": "launch-1",
+      "applicationId": "app-1",
+      "userId": "user-1",
+      "providerType": "oidc",
+      "result": "allow",
+      "createdAt": "2026-08-31T00:00:00Z"
+    }
+  ]
+}

package/fixtures/openapi/KubernetesResourceGraphEnvelope/invalid/edge-without-target.json

@@ -0,0 +1,16 @@
+{
+  "data": {
+    "clusterId": "cluster-a",
+    "generatedAt": "2026-08-23T08:00:00Z",
+    "nodes": [],
+    "edges": [
+      {
+        "id": "broken",
+        "sourceId": "a",
+        "relation": "owns"
+      }
+    ],
+    "evidence": [],
+    "warnings": []
+  }
+}

package/fixtures/openapi/KubernetesResourceGraphEnvelope/valid/deployment.json

@@ -0,0 +1,53 @@
+{
+  "data": {
+    "clusterId": "cluster-a",
+    "namespace": "team-a",
+    "generatedAt": "2026-08-23T08:00:00Z",
+    "rootId": "apps/v1:Deployment:team-a/api",
+    "nodes": [
+      {
+        "id": "apps/v1:Deployment:team-a/api",
+        "resource": {
+          "clusterId": "cluster-a",
+          "apiVersion": "apps/v1",
+          "kind": "Deployment",
+          "name": "api",
+          "namespace": "team-a",
+          "scopeMode": "namespace"
+        },
+        "status": "healthy"
+      },
+      {
+        "id": "v1:Pod:team-a/api-1",
+        "resource": {
+          "clusterId": "cluster-a",
+          "apiVersion": "v1",
+          "kind": "Pod",
+          "name": "api-1",
+          "namespace": "team-a",
+          "scopeMode": "namespace"
+        },
+        "status": "Running"
+      }
+    ],
+    "edges": [
+      {
+        "id": "owns:deployment-api:pod-api-1",
+        "sourceId": "apps/v1:Deployment:team-a/api",
+        "targetId": "v1:Pod:team-a/api-1",
+        "relation": "owns"
+      }
+    ],
+    "evidence": [
+      {
+        "id": "event/team-a/api-1-scheduled",
+        "type": "kubernetes-event",
+        "severity": "info",
+        "summary": "Pod scheduled",
+        "observedAt": "2026-08-23T07:59:58Z",
+        "resourceId": "v1:Pod:team-a/api-1"
+      }
+    ],
+    "warnings": []
+  }
+}

package/fixtures/openapi/KubernetesResourceSearchEnvelope/invalid/missing-resource.json

@@ -0,0 +1,10 @@
+{
+  "data": {
+    "items": [
+      {
+        "status": "Running"
+      }
+    ],
+    "truncated": false
+  }
+}

package/fixtures/openapi/KubernetesResourceSearchEnvelope/valid/mixed.json

@@ -0,0 +1,29 @@
+{
+  "data": {
+    "items": [
+      {
+        "resource": {
+          "clusterId": "cluster-a",
+          "apiVersion": "v1",
+          "kind": "Pod",
+          "name": "api-7c8d9f",
+          "namespace": "production",
+          "scopeMode": "namespace",
+          "uid": "pod-uid"
+        },
+        "status": "Running"
+      },
+      {
+        "resource": {
+          "clusterId": "cluster-a",
+          "apiVersion": "v1",
+          "kind": "Node",
+          "name": "worker-1",
+          "scopeMode": "cluster"
+        },
+        "status": "Ready"
+      }
+    ],
+    "truncated": false
+  }
+}

package/fixtures/openapi/KubernetesResourceStreamEvent/invalid/missing-observed-at.json

@@ -0,0 +1,5 @@
+{
+  "type": "modified",
+  "clusterId": "cluster-a",
+  "source": "informer"
+}

package/fixtures/openapi/KubernetesResourceStreamEvent/valid/modified.json

@@ -0,0 +1,18 @@
+{
+  "type": "modified",
+  "clusterId": "cluster-a",
+  "observedAt": "2026-08-23T08:00:00Z",
+  "source": "informer",
+  "resourceVersion": "42",
+  "cacheStatus": "live",
+  "resyncRequired": false,
+  "resource": {
+    "clusterId": "cluster-a",
+    "apiVersion": "v1",
+    "kind": "Pod",
+    "name": "api-1",
+    "namespace": "team-a",
+    "scopeMode": "namespace",
+    "uid": "pod-uid"
+  }
+}

package/fixtures/openapi/KubernetesSecurityPostureEnvelope/invalid/finding-without-severity.json

@@ -0,0 +1,24 @@
+{
+  "data": {
+    "clusterId": "cluster-a",
+    "provider": "kubescape",
+    "status": "available",
+    "generatedAt": "2026-08-23T08:00:00Z",
+    "counts": {
+      "critical": 0,
+      "high": 1,
+      "medium": 0,
+      "low": 0,
+      "unknown": 0
+    },
+    "findings": [
+      {
+        "id": "broken",
+        "category": "configuration",
+        "title": "Missing severity",
+        "status": "failed"
+      }
+    ],
+    "warnings": []
+  }
+}

package/fixtures/openapi/KubernetesSecurityPostureEnvelope/valid/kubescape.json

@@ -0,0 +1,34 @@
+{
+  "data": {
+    "clusterId": "cluster-a",
+    "provider": "kubescape",
+    "status": "available",
+    "generatedAt": "2026-08-23T08:00:00Z",
+    "counts": {
+      "critical": 1,
+      "high": 2,
+      "medium": 3,
+      "low": 4,
+      "unknown": 0
+    },
+    "findings": [
+      {
+        "id": "configuration:C-001:team-a:Deployment:api",
+        "category": "configuration",
+        "severity": "high",
+        "title": "Privileged container",
+        "status": "failed",
+        "controlId": "C-001",
+        "resource": {
+          "clusterId": "cluster-a",
+          "apiVersion": "apps/v1",
+          "kind": "Deployment",
+          "name": "api",
+          "namespace": "team-a",
+          "scopeMode": "namespace"
+        }
+      }
+    ],
+    "warnings": []
+  }
+}

package/fixtures/openapi/KubernetesService/invalid/node-port-out-of-range.json

@@ -0,0 +1,14 @@
+{
+  "name": "web",
+  "namespace": "default",
+  "type": "NodePort",
+  "ageSeconds": 0,
+  "portMappings": [
+    {
+      "protocol": "TCP",
+      "targetPort": "8080",
+      "port": 80,
+      "nodePort": 70000
+    }
+  ]
+}

package/fixtures/openapi/KubernetesService/valid/port-mappings.json

@@ -0,0 +1,22 @@
+{
+  "name": "web",
+  "namespace": "default",
+  "type": "NodePort",
+  "ageSeconds": 0,
+  "ports": ["http:80/tcp (nodePort:30001)"],
+  "portMappings": [
+    {
+      "name": "http",
+      "protocol": "TCP",
+      "targetPort": "8080",
+      "port": 80,
+      "nodePort": 30001
+    },
+    {
+      "name": "metrics",
+      "protocol": "TCP",
+      "targetPort": "metrics",
+      "port": 9090
+    }
+  ]
+}

package/fixtures/openapi/KubernetesServiceDetail/invalid/empty-target-port.json

@@ -0,0 +1,13 @@
+{
+  "name": "web",
+  "namespace": "default",
+  "type": "ClusterIP",
+  "ageSeconds": 60,
+  "portMappings": [
+    {
+      "protocol": "TCP",
+      "targetPort": "",
+      "port": 80
+    }
+  ]
+}

package/fixtures/openapi/KubernetesServiceDetail/valid/port-mappings.json

@@ -0,0 +1,22 @@
+{
+  "name": "web",
+  "namespace": "default",
+  "type": "ClusterIP",
+  "clusterIp": "10.43.0.10",
+  "ageSeconds": 60,
+  "ports": ["http:80/tcp"],
+  "portMappings": [
+    {
+      "name": "http",
+      "protocol": "TCP",
+      "targetPort": "http",
+      "port": 80
+    }
+  ],
+  "endpoints": [
+    {
+      "address": "10.42.0.10",
+      "ready": true
+    }
+  ]
+}

package/fixtures/openapi/LogQuery/invalid/empty-data-source-id.json

@@ -0,0 +1,7 @@
+{
+  "sourceMode": "durable",
+  "dataSourceId": "",
+  "selector": {
+    "namespace": "payments"
+  }
+}

package/fixtures/openapi/LogQuery/valid/durable-data-source.json

@@ -0,0 +1,14 @@
+{
+  "sourceMode": "durable",
+  "dataSourceId": "loki-main",
+  "selector": {
+    "namespace": "payments",
+    "workloadKind": "Deployment",
+    "workloadName": "checkout-api"
+  },
+  "from": "2026-08-31T08:00:00Z",
+  "to": "2026-08-31T08:15:00Z",
+  "limit": 200,
+  "direction": "backward",
+  "text": "upstream timeout"
+}

package/fixtures/openapi/ManifestPackage/invalid/missing-application.json

@@ -0,0 +1,12 @@
+{
+  "id": "manifest-package-1",
+  "name": "checkout-api-ingress",
+  "serviceId": "service-checkout-api",
+  "renderer": "raw_yaml",
+  "status": "draft",
+  "currentRevision": 0,
+  "files": [],
+  "bindings": [],
+  "createdAt": "2026-08-27T00:00:00Z",
+  "updatedAt": "2026-08-27T00:00:00Z"
+}

package/fixtures/openapi/ManifestPackage/valid/service-scoped.json

@@ -0,0 +1,29 @@
+{
+  "id": "manifest-package-1",
+  "name": "checkout-api-ingress",
+  "description": "Service-level delivery extensions",
+  "applicationId": "app-1",
+  "serviceId": "service-checkout-api",
+  "renderer": "raw_yaml",
+  "status": "draft",
+  "currentRevision": 0,
+  "files": [
+    {
+      "path": "ingress.yaml",
+      "content": "apiVersion: networking.k8s.io/v1\nkind: Ingress\n"
+    }
+  ],
+  "bindings": [
+    {
+      "id": "binding-1",
+      "applicationEnvironmentId": "app-env-prod",
+      "environmentKey": "prod",
+      "clusterId": "cluster-prod",
+      "namespace": "checkout",
+      "overlay": { "host": "checkout.example.com" },
+      "status": "ready"
+    }
+  ],
+  "createdAt": "2026-08-27T00:00:00Z",
+  "updatedAt": "2026-08-27T00:00:00Z"
+}

package/fixtures/openapi/OIDCClientInput/valid/generated-client-id.json

@@ -0,0 +1,8 @@
+{
+  "clientType": "confidential",
+  "redirectUris": ["https://app.example.com/oauth/callback"],
+  "allowedScopes": ["openid", "profile", "email"],
+  "allowedGrantTypes": ["authorization_code"],
+  "requirePkce": true,
+  "status": "enabled"
+}

package/fixtures/openapi/OIDCClientSecretRevealEnvelope/invalid/missing-secret.json

@@ -0,0 +1,6 @@
+{
+  "data": {
+    "clientId": "generated-client-id",
+    "revealedAt": "2026-08-24T08:00:00Z"
+  }
+}

package/fixtures/openapi/OIDCClientSecretRevealEnvelope/valid/reveal.json

@@ -0,0 +1,7 @@
+{
+  "data": {
+    "clientId": "generated-client-id",
+    "clientSecret": "revealable-client-secret",
+    "revealedAt": "2026-08-24T08:00:00Z"
+  }
+}

package/fixtures/openapi/OperationalPlanEnvelope/invalid/kubernetes-owner-without-manager.json

@@ -0,0 +1,29 @@
+{
+  "data": {
+    "capability": "k8s.resources.update",
+    "target": "cluster-a/team-a/Deployment/api",
+    "ready": false,
+    "riskLevel": "mutate",
+    "requiresApproval": false,
+    "changes": [
+      {
+        "action": "apply",
+        "resource": "Deployment/api",
+        "summary": "apply the reviewed manifest"
+      }
+    ],
+    "warnings": [],
+    "kubernetesResourceUpdate": {
+      "fieldManager": "opensoha-resource-edit/v1",
+      "changedFields": ["/spec/replicas"],
+      "owners": [
+        {
+          "operation": "Apply",
+          "apiVersion": "apps/v1",
+          "fields": ["/spec/template"]
+        }
+      ],
+      "conflicts": []
+    }
+  }
+}

package/fixtures/openapi/OperationalPlanEnvelope/valid/kubernetes-resource-update.json

@@ -0,0 +1,30 @@
+{
+  "data": {
+    "capability": "k8s.resources.update",
+    "target": "cluster-a/team-a/Deployment/api",
+    "ready": true,
+    "riskLevel": "mutate",
+    "requiresApproval": false,
+    "changes": [
+      {
+        "action": "apply",
+        "resource": "Deployment/api",
+        "summary": "apply the reviewed manifest"
+      }
+    ],
+    "warnings": [],
+    "kubernetesResourceUpdate": {
+      "fieldManager": "opensoha-resource-edit/v1",
+      "changedFields": ["/spec/replicas"],
+      "owners": [
+        {
+          "manager": "helm",
+          "operation": "Apply",
+          "apiVersion": "apps/v1",
+          "fields": ["/spec/template"]
+        }
+      ],
+      "conflicts": []
+    }
+  }
+}

package/fixtures/openapi/PasswordChangeResult/invalid/unexpected-status.json

@@ -0,0 +1,3 @@
+{
+  "status": "changed"
+}

package/fixtures/openapi/PasswordChangeResult/valid/ok.json

@@ -0,0 +1,3 @@
+{
+  "status": "ok"
+}

package/fixtures/openapi/PortalApplicationListEnvelope/invalid/missing-items.json

@@ -0,0 +1 @@
+{}

package/fixtures/openapi/PortalApplicationListEnvelope/valid/minimal.json

@@ -0,0 +1,12 @@
+{
+  "items": [
+    {
+      "id": "app-1",
+      "name": "Soha Console",
+      "slug": "soha-console",
+      "status": "enabled",
+      "createdAt": "2026-08-31T00:00:00Z",
+      "updatedAt": "2026-08-31T00:00:00Z"
+    }
+  ]
+}

package/fixtures/openapi/PortalBootstrapEnvelope/invalid/missing-security.json

@@ -0,0 +1,17 @@
+{
+  "data": {
+    "principal": {
+      "userId": "user-1",
+      "userName": "OpenSoha",
+      "email": "opensoha@example.com",
+      "roles": [],
+      "teams": [],
+      "projects": [],
+      "tags": []
+    },
+    "applications": [],
+    "favorites": [],
+    "recent": [],
+    "categories": []
+  }
+}

package/fixtures/openapi/PortalBootstrapEnvelope/valid/minimal.json

@@ -0,0 +1,31 @@
+{
+  "data": {
+    "principal": {
+      "userId": "user-1",
+      "userName": "OpenSoha",
+      "email": "opensoha@example.com",
+      "roles": [],
+      "teams": [],
+      "projects": [],
+      "tags": []
+    },
+    "applications": [],
+    "favorites": [],
+    "recent": [],
+    "categories": [],
+    "security": {
+      "principal": {
+        "userId": "user-1",
+        "userName": "OpenSoha",
+        "email": "opensoha@example.com",
+        "roles": [],
+        "teams": [],
+        "projects": [],
+        "tags": []
+      },
+      "mfaEnabled": false,
+      "linkedSources": [],
+      "activeSession": 1
+    }
+  }
+}

package/fixtures/openapi/PortalLaunchDecisionEnvelope/invalid/missing-launch-url.json

@@ -0,0 +1,14 @@
+{
+  "data": {
+    "application": {
+      "id": "app-1",
+      "name": "Soha Console",
+      "slug": "soha-console",
+      "status": "enabled",
+      "createdAt": "2026-08-31T00:00:00Z",
+      "updatedAt": "2026-08-31T00:00:00Z"
+    },
+    "providerType": "oidc",
+    "decision": "allow"
+  }
+}

package/fixtures/openapi/PortalLaunchDecisionEnvelope/valid/desktop-handoff.json

@@ -0,0 +1,16 @@
+{
+  "data": {
+    "application": {
+      "id": "app-1",
+      "name": "Soha Console",
+      "slug": "soha-console",
+      "status": "enabled",
+      "createdAt": "2026-08-31T00:00:00Z",
+      "updatedAt": "2026-08-31T00:00:00Z"
+    },
+    "launchUrl": "/auth/browser-handoff/handoff-1",
+    "providerType": "oidc",
+    "decision": "allow",
+    "handoffExpiresAt": "2026-08-31T00:01:00Z"
+  }
+}