@opensoha/contracts 0.1.15 → 0.1.16

package/auth/catalog_generated.go

@@ -6,8 +6,8 @@ import _ "embed"
 
 const (
 	PermissionCatalogVersion = "2.0.0"
-	PermissionCatalogContentSHA256 = "58321138575c22b20933cf2c1db2742b741a123bb8f6a2983bb436e84be4e58a"
-	PermissionCatalogSHA256 = "38ac1a2e7087ff4831e8f6390b804e32f918b49b9af3165fdf2df286d64fe3c8"
+	PermissionCatalogContentSHA256 = "5aa6fa361c2ab8d987415fb1eb93218510deb9359a68212dfe86655dbfaeea5e"
+	PermissionCatalogSHA256 = "01c80a71427e3d7f4898212fb1667405c27f1b798318d9eac86ece8262cd188c"
 )
 
 //go:embed permission-catalog.json

package/auth/permission-catalog.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "authorization.opensoha.io/v1",
   "catalogVersion": "2.0.0",
-  "contentHash": "sha256:58321138575c22b20933cf2c1db2742b741a123bb8f6a2983bb436e84be4e58a",
+  "contentHash": "sha256:5aa6fa361c2ab8d987415fb1eb93218510deb9359a68212dfe86655dbfaeea5e",
   "permissions": [
     {
       "key": "access.directory.create",
@@ -10492,9 +10492,9 @@
       "replacedBy": [
         "virtualization.clusters.create",
         "virtualization.clusters.delete",
-        "virtualization.clusters.sync",
         "virtualization.clusters.test",
-        "virtualization.clusters.update"
+        "virtualization.clusters.update",
+        "virtualization.sync.sync"
       ]
     },
     {
@@ -10509,10 +10509,10 @@
         "resource"
       ],
       "approvalPolicy": "never",
-      "status": "active",
-      "assignable": true,
-      "legacyAliases": [
-        "virtualization.clusters.manage"
+      "status": "legacy",
+      "assignable": false,
+      "replacedBy": [
+        "virtualization.sync.sync"
       ]
     },
     {
@@ -10877,6 +10877,7 @@
       "status": "active",
       "assignable": true,
       "legacyAliases": [
+        "virtualization.clusters.sync",
         "virtualization.sync.manage"
       ]
     },
@@ -11068,7 +11069,7 @@
       "domain": "workbench",
       "resource": "delivery",
       "action": "view",
-      "displayName": "访问应用交付工作台",
+      "displayName": "访问持续交付工作台",
       "riskLevel": "read",
       "scopeKinds": [
         "tenant",

package/compat/json-schema-ecosystem-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.15",
+  "version": "0.1.16",
   "schemas": {
     "plugins/plugin-manifest.schema.json": {
       "rootRequired": ["id", "name", "publisher", "type", "version"],

package/compat/openapi-loose-boundaries-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.15",
+  "version": "0.1.16",
   "generatedFrom": "openapi/soha-api.yaml",
   "entries": [
     {
@@ -170,6 +170,10 @@
       "kind": "additionalPropertiesTrue",
       "path": "components/schemas/ApplicationServiceInput/properties/metadata/additionalProperties"
     },
+    {
+      "kind": "additionalPropertiesTrue",
+      "path": "components/schemas/ApplicationWorkflowInput/properties/definition/additionalProperties"
+    },
     {
       "kind": "additionalPropertiesTrue",
       "path": "components/schemas/ApprovalRequest/properties/relatedIds/additionalProperties"
@@ -206,6 +210,14 @@
       "kind": "additionalPropertiesTrue",
       "path": "components/schemas/AuthBootstrapEnvelope/properties/data/properties/permissionSnapshot/additionalProperties"
     },
+    {
+      "kind": "additionalPropertiesTrue",
+      "path": "components/schemas/IdentityApplication/properties/metadata/additionalProperties"
+    },
+    {
+      "kind": "additionalPropertiesTrue",
+      "path": "components/schemas/IdentityApplicationInput/properties/metadata/additionalProperties"
+    },
     {
       "kind": "additionalPropertiesTrue",
       "path": "components/schemas/BuildPolicy/properties/buildArgs/additionalProperties"
@@ -666,6 +678,51 @@
       "path": "components/schemas/ApprovalRequest/properties/output",
       "target": "#/components/schemas/AnyValue"
     },
+    {
+      "kind": "schemaRef",
+      "path": "components/schemas/AlertRule/properties/datasourceSelector",
+      "target": "#/components/schemas/GenericObject"
+    },
+    {
+      "kind": "schemaRef",
+      "path": "components/schemas/AlertRule/properties/querySpec",
+      "target": "#/components/schemas/GenericObject"
+    },
+    {
+      "kind": "schemaRef",
+      "path": "components/schemas/AlertRule/properties/thresholdSpec",
+      "target": "#/components/schemas/GenericObject"
+    },
+    {
+      "kind": "schemaRef",
+      "path": "components/schemas/AlertRuleInput/properties/datasourceSelector",
+      "target": "#/components/schemas/GenericObject"
+    },
+    {
+      "kind": "schemaRef",
+      "path": "components/schemas/AlertRuleInput/properties/querySpec",
+      "target": "#/components/schemas/GenericObject"
+    },
+    {
+      "kind": "schemaRef",
+      "path": "components/schemas/AlertRuleInput/properties/thresholdSpec",
+      "target": "#/components/schemas/GenericObject"
+    },
+    {
+      "kind": "schemaRef",
+      "path": "components/schemas/AlertRuleRun/properties/result",
+      "target": "#/components/schemas/GenericObject"
+    },
+    {
+      "kind": "schemaRef",
+      "path": "components/schemas/AlertRuleTestResult/properties/notificationPreview/items",
+      "target": "#/components/schemas/GenericObject"
+    },
+    {
+      "kind": "schemaRef",
+      "path": "components/schemas/AlertRuleTestResult/properties/samples/items",
+      "target": "#/components/schemas/GenericObject"
+    },
     {
       "kind": "schemaRef",
       "path": "components/schemas/DeliveryDraft/properties/executionHints",

package/fixtures/openapi/AlertRuleEnvelope/invalid/missing-data.json

@@ -0,0 +1 @@
+{}

package/fixtures/openapi/AlertRuleEnvelope/valid/metrics.json

@@ -0,0 +1,11 @@
+{
+  "data": {
+    "id": "rule-checkout-errors",
+    "name": "Checkout error rate",
+    "ruleType": "metrics",
+    "forSeconds": 120,
+    "enabled": true,
+    "createdAt": "2026-08-31T00:00:00Z",
+    "updatedAt": "2026-08-31T00:05:00Z"
+  }
+}

package/fixtures/openapi/AlertRuleInput/invalid/missing-name.json

@@ -0,0 +1,3 @@
+{
+  "ruleType": "metrics"
+}

package/fixtures/openapi/AlertRuleInput/valid/metrics.json

@@ -0,0 +1,25 @@
+{
+  "name": "Checkout error rate",
+  "ruleType": "metrics",
+  "datasourceSelector": {
+    "id": "prometheus-main"
+  },
+  "querySpec": {
+    "metricKey": "http.server.errors"
+  },
+  "thresholdSpec": {
+    "operator": "gte",
+    "value": 5
+  },
+  "forSeconds": 120,
+  "groupBy": ["service"],
+  "labels": {
+    "severity": "critical"
+  },
+  "annotations": {
+    "summary": "Checkout error rate is elevated"
+  },
+  "notificationPolicyId": "policy-primary",
+  "healingPolicyIds": ["healing-checkout"],
+  "enabled": true
+}

package/fixtures/openapi/AlertRuleRunListEnvelope/invalid/missing-rule-id.json

@@ -0,0 +1,12 @@
+{
+  "items": [
+    {
+      "id": "run-1",
+      "status": "completed",
+      "matched": false,
+      "durationMs": 42,
+      "createdAt": "2026-08-31T00:06:00Z",
+      "updatedAt": "2026-08-31T00:06:00Z"
+    }
+  ]
+}

package/fixtures/openapi/AlertRuleRunListEnvelope/valid/items.json

@@ -0,0 +1,13 @@
+{
+  "items": [
+    {
+      "id": "run-1",
+      "ruleId": "rule-checkout-errors",
+      "status": "completed",
+      "matched": false,
+      "durationMs": 42,
+      "createdAt": "2026-08-31T00:06:00Z",
+      "updatedAt": "2026-08-31T00:06:00Z"
+    }
+  ]
+}

package/fixtures/openapi/AlertRuleTestResultEnvelope/invalid/missing-executed-at.json

@@ -0,0 +1,5 @@
+{
+  "data": {
+    "matched": false
+  }
+}

package/fixtures/openapi/AlertRuleTestResultEnvelope/valid/clear.json

@@ -0,0 +1,10 @@
+{
+  "data": {
+    "ruleId": "rule-checkout-errors",
+    "ruleType": "metrics",
+    "state": "clear",
+    "summary": "metrics threshold is clear",
+    "matched": false,
+    "executedAt": "2026-08-31T00:06:00Z"
+  }
+}

package/fixtures/openapi/ApplicationRuntimeEnvironment/invalid/unknown-status.json

@@ -0,0 +1,7 @@
+{
+  "applicationEnvironmentId": "binding-1",
+  "environmentId": "production",
+  "requiresApproval": true,
+  "status": "offline",
+  "workloads": []
+}

package/fixtures/openapi/ApplicationRuntimeEnvironment/valid/unavailable.json

@@ -0,0 +1,7 @@
+{
+  "applicationEnvironmentId": "binding-1",
+  "environmentId": "production",
+  "requiresApproval": true,
+  "status": "unavailable",
+  "workloads": []
+}

package/fixtures/openapi/ApplicationWorkflowInput/invalid/owner-fields.json

@@ -0,0 +1,7 @@
+{
+  "key": "application-app-2",
+  "name": "Production release",
+  "category": "application:app-2",
+  "definition": {},
+  "enabled": true
+}

package/fixtures/openapi/ApplicationWorkflowInput/valid/minimal.json

@@ -0,0 +1,9 @@
+{
+  "name": "Production release",
+  "definition": {
+    "mode": "release_dag",
+    "nodes": [],
+    "edges": []
+  },
+  "enabled": true
+}

package/fixtures/openapi/BrandingAssetUploadEnvelope/valid/svg-data-url.json

@@ -0,0 +1,5 @@
+{
+  "data": {
+    "url": "data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg=="
+  }
+}

package/fixtures/openapi/BrowserHandoffCompletionEnvelope/invalid/token-leak.json

@@ -0,0 +1,7 @@
+{
+  "data": {
+    "status": "completed",
+    "destinationUrl": "/oauth2/authorize?client_id=console",
+    "accessToken": "must-not-be-returned"
+  }
+}

package/fixtures/openapi/BrowserHandoffCompletionEnvelope/valid/completed.json

@@ -0,0 +1,6 @@
+{
+  "data": {
+    "status": "completed",
+    "destinationUrl": "/oauth2/authorize?client_id=console"
+  }
+}

package/fixtures/openapi/BrowserHandoffEnvelope/invalid/missing-principal.json

@@ -0,0 +1,12 @@
+{
+  "data": {
+    "application": {
+      "id": "app-1",
+      "name": "Soha Console"
+    },
+    "accountName": "OpenSoha",
+    "email": "must-not-be-exposed@example.com",
+    "status": "pending",
+    "expiresAt": "2026-08-31T00:01:00Z"
+  }
+}

package/fixtures/openapi/BrowserHandoffEnvelope/valid/pending.json

@@ -0,0 +1,11 @@
+{
+  "data": {
+    "application": {
+      "id": "app-1",
+      "name": "Soha Console"
+    },
+    "accountName": "OpenSoha",
+    "status": "pending",
+    "expiresAt": "2026-08-31T00:01:00Z"
+  }
+}

package/fixtures/openapi/ChangePasswordRequest/invalid/missing-current-password.json

@@ -0,0 +1,3 @@
+{
+  "newPassword": "new-password"
+}

package/fixtures/openapi/ChangePasswordRequest/invalid/short-new-password.json

@@ -0,0 +1,4 @@
+{
+  "currentPassword": "current-password",
+  "newPassword": "short"
+}

package/fixtures/openapi/ChangePasswordRequest/valid/password.json

@@ -0,0 +1,4 @@
+{
+  "currentPassword": "current-password",
+  "newPassword": "new-password"
+}

package/fixtures/openapi/DesktopAuthAttemptCreateRequest/invalid/https-redirect.json

@@ -0,0 +1,6 @@
+{
+  "providerId": "corp-oidc",
+  "redirectUri": "https://127.0.0.1:49152/callback/T4I0wIrt0Pp4qABC",
+  "codeChallenge": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+  "codeChallengeMethod": "S256"
+}

package/fixtures/openapi/DesktopAuthAttemptCreateRequest/invalid/localhost-redirect.json

@@ -0,0 +1,6 @@
+{
+  "providerId": "corp-oidc",
+  "redirectUri": "http://localhost:49152/callback/T4I0wIrt0Pp4qABC",
+  "codeChallenge": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+  "codeChallengeMethod": "S256"
+}

package/fixtures/openapi/DesktopAuthAttemptCreateRequest/invalid/plain-challenge.json

@@ -0,0 +1,6 @@
+{
+  "providerId": "corp-oidc",
+  "redirectUri": "http://127.0.0.1:49152/callback/T4I0wIrt0Pp4qABC",
+  "codeChallenge": "short",
+  "codeChallengeMethod": "plain"
+}

package/fixtures/openapi/DesktopAuthAttemptCreateRequest/invalid/privileged-port.json

@@ -0,0 +1,6 @@
+{
+  "providerId": "corp-oidc",
+  "redirectUri": "http://127.0.0.1:1023/callback/T4I0wIrt0Pp4qABC",
+  "codeChallenge": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+  "codeChallengeMethod": "S256"
+}

package/fixtures/openapi/DesktopAuthAttemptCreateRequest/invalid/short-callback.json

@@ -0,0 +1,6 @@
+{
+  "providerId": "corp-oidc",
+  "redirectUri": "http://127.0.0.1:49152/callback/short",
+  "codeChallenge": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+  "codeChallengeMethod": "S256"
+}

package/fixtures/openapi/DesktopAuthAttemptCreateRequest/valid/loopback.json

@@ -0,0 +1,6 @@
+{
+  "providerId": "corp-oidc",
+  "redirectUri": "http://127.0.0.1:49152/callback/T4I0wIrt0Pp4qABC",
+  "codeChallenge": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+  "codeChallengeMethod": "S256"
+}

package/fixtures/openapi/DesktopAuthAttemptEnvelope/invalid/missing-expiry.json

@@ -0,0 +1,6 @@
+{
+  "data": {
+    "attemptId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
+    "authorizationUrl": "https://soha.example.com/api/v1/auth/desktop/attempts/3fa85f64-5717-4562-b3fc-2c963f66afa6/start"
+  }
+}

package/fixtures/openapi/DesktopAuthAttemptEnvelope/valid/attempt.json

@@ -0,0 +1,7 @@
+{
+  "data": {
+    "attemptId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
+    "authorizationUrl": "https://soha.example.com/api/v1/auth/desktop/attempts/3fa85f64-5717-4562-b3fc-2c963f66afa6/start",
+    "expiresAt": "2026-08-20T12:00:00Z"
+  }
+}

package/fixtures/openapi/DesktopAuthAttemptExchangeRequest/invalid/short-verifier.json

@@ -0,0 +1,4 @@
+{
+  "code": "ZGVza3RvcC1jYWxsYmFjay1jb2Rl",
+  "codeVerifier": "short"
+}

package/fixtures/openapi/DesktopAuthAttemptExchangeRequest/valid/exchange.json

@@ -0,0 +1,4 @@
+{
+  "code": "ZGVza3RvcC1jYWxsYmFjay1jb2Rl",
+  "codeVerifier": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+}

package/fixtures/openapi/IdentityApplication/invalid/missing-id.json

@@ -0,0 +1,7 @@
+{
+  "name": "Example App",
+  "slug": "example-app",
+  "status": "enabled",
+  "createdAt": "2026-08-24T08:00:00Z",
+  "updatedAt": "2026-08-24T08:00:00Z"
+}

package/fixtures/openapi/IdentityApplication/valid/full.json

@@ -0,0 +1,30 @@
+{
+  "id": "app-example",
+  "name": "Example App",
+  "slug": "example-app",
+  "description": "Example identity application",
+  "iconUrl": "https://app.example.com/icon.png",
+  "tags": ["platform"],
+  "launchUrl": "https://app.example.com",
+  "providerId": "provider-example",
+  "providerType": "oidc",
+  "portalVisible": true,
+  "featured": false,
+  "sortOrder": 100,
+  "status": "enabled",
+  "metadata": {
+    "owner": "platform"
+  },
+  "assignments": [
+    {
+      "id": "assignment-example",
+      "applicationId": "app-example",
+      "subjectType": "role",
+      "subjectId": "platform-admin",
+      "effect": "allow",
+      "createdAt": "2026-08-24T08:00:00Z"
+    }
+  ],
+  "createdAt": "2026-08-24T08:00:00Z",
+  "updatedAt": "2026-08-24T08:00:00Z"
+}

package/fixtures/openapi/IdentityApplicationEnvelope/invalid/missing-data.json

@@ -0,0 +1 @@
+{}

package/fixtures/openapi/IdentityApplicationEnvelope/valid/minimal.json

@@ -0,0 +1,10 @@
+{
+  "data": {
+    "id": "app-1",
+    "name": "Soha Console",
+    "slug": "soha-console",
+    "status": "enabled",
+    "createdAt": "2026-08-31T00:00:00Z",
+    "updatedAt": "2026-08-31T00:00:00Z"
+  }
+}

package/fixtures/openapi/IdentityApplicationLaunchListEnvelope/invalid/missing-user.json

@@ -0,0 +1,11 @@
+{
+  "items": [
+    {
+      "id": "launch-1",
+      "applicationId": "app-1",
+      "providerType": "oidc",
+      "result": "allow",
+      "createdAt": "2026-08-31T00:00:00Z"
+    }
+  ]
+}

package/fixtures/openapi/IdentityApplicationLaunchListEnvelope/valid/minimal.json

@@ -0,0 +1,12 @@
+{
+  "items": [
+    {
+      "id": "launch-1",
+      "applicationId": "app-1",
+      "userId": "user-1",
+      "providerType": "oidc",
+      "result": "allow",
+      "createdAt": "2026-08-31T00:00:00Z"
+    }
+  ]
+}

package/fixtures/openapi/LogQuery/invalid/empty-data-source-id.json

@@ -0,0 +1,7 @@
+{
+  "sourceMode": "durable",
+  "dataSourceId": "",
+  "selector": {
+    "namespace": "payments"
+  }
+}

package/fixtures/openapi/LogQuery/valid/durable-data-source.json

@@ -0,0 +1,14 @@
+{
+  "sourceMode": "durable",
+  "dataSourceId": "loki-main",
+  "selector": {
+    "namespace": "payments",
+    "workloadKind": "Deployment",
+    "workloadName": "checkout-api"
+  },
+  "from": "2026-08-31T08:00:00Z",
+  "to": "2026-08-31T08:15:00Z",
+  "limit": 200,
+  "direction": "backward",
+  "text": "upstream timeout"
+}

package/fixtures/openapi/ManifestPackage/invalid/missing-application.json

@@ -0,0 +1,12 @@
+{
+  "id": "manifest-package-1",
+  "name": "checkout-api-ingress",
+  "serviceId": "service-checkout-api",
+  "renderer": "raw_yaml",
+  "status": "draft",
+  "currentRevision": 0,
+  "files": [],
+  "bindings": [],
+  "createdAt": "2026-08-27T00:00:00Z",
+  "updatedAt": "2026-08-27T00:00:00Z"
+}

package/fixtures/openapi/ManifestPackage/valid/service-scoped.json

@@ -0,0 +1,29 @@
+{
+  "id": "manifest-package-1",
+  "name": "checkout-api-ingress",
+  "description": "Service-level delivery extensions",
+  "applicationId": "app-1",
+  "serviceId": "service-checkout-api",
+  "renderer": "raw_yaml",
+  "status": "draft",
+  "currentRevision": 0,
+  "files": [
+    {
+      "path": "ingress.yaml",
+      "content": "apiVersion: networking.k8s.io/v1\nkind: Ingress\n"
+    }
+  ],
+  "bindings": [
+    {
+      "id": "binding-1",
+      "applicationEnvironmentId": "app-env-prod",
+      "environmentKey": "prod",
+      "clusterId": "cluster-prod",
+      "namespace": "checkout",
+      "overlay": { "host": "checkout.example.com" },
+      "status": "ready"
+    }
+  ],
+  "createdAt": "2026-08-27T00:00:00Z",
+  "updatedAt": "2026-08-27T00:00:00Z"
+}

package/fixtures/openapi/OIDCClientInput/valid/generated-client-id.json

@@ -0,0 +1,8 @@
+{
+  "clientType": "confidential",
+  "redirectUris": ["https://app.example.com/oauth/callback"],
+  "allowedScopes": ["openid", "profile", "email"],
+  "allowedGrantTypes": ["authorization_code"],
+  "requirePkce": true,
+  "status": "enabled"
+}

package/fixtures/openapi/OIDCClientSecretRevealEnvelope/invalid/missing-secret.json

@@ -0,0 +1,6 @@
+{
+  "data": {
+    "clientId": "generated-client-id",
+    "revealedAt": "2026-08-24T08:00:00Z"
+  }
+}

package/fixtures/openapi/OIDCClientSecretRevealEnvelope/valid/reveal.json

@@ -0,0 +1,7 @@
+{
+  "data": {
+    "clientId": "generated-client-id",
+    "clientSecret": "revealable-client-secret",
+    "revealedAt": "2026-08-24T08:00:00Z"
+  }
+}

package/fixtures/openapi/PasswordChangeResult/invalid/unexpected-status.json

@@ -0,0 +1,3 @@
+{
+  "status": "changed"
+}

package/fixtures/openapi/PasswordChangeResult/valid/ok.json

@@ -0,0 +1,3 @@
+{
+  "status": "ok"
+}

package/fixtures/openapi/PortalApplicationListEnvelope/invalid/missing-items.json

@@ -0,0 +1 @@
+{}

package/fixtures/openapi/PortalApplicationListEnvelope/valid/minimal.json

@@ -0,0 +1,12 @@
+{
+  "items": [
+    {
+      "id": "app-1",
+      "name": "Soha Console",
+      "slug": "soha-console",
+      "status": "enabled",
+      "createdAt": "2026-08-31T00:00:00Z",
+      "updatedAt": "2026-08-31T00:00:00Z"
+    }
+  ]
+}