@opensoha/contracts 0.1.15 → 0.1.17

package/fixtures/openapi/DesktopAuthAttemptCreateRequest/invalid/short-callback.json

@@ -0,0 +1,6 @@
+{
+  "providerId": "corp-oidc",
+  "redirectUri": "http://127.0.0.1:49152/callback/short",
+  "codeChallenge": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+  "codeChallengeMethod": "S256"
+}

package/fixtures/openapi/DesktopAuthAttemptCreateRequest/valid/loopback.json

@@ -0,0 +1,6 @@
+{
+  "providerId": "corp-oidc",
+  "redirectUri": "http://127.0.0.1:49152/callback/T4I0wIrt0Pp4qABC",
+  "codeChallenge": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+  "codeChallengeMethod": "S256"
+}

package/fixtures/openapi/DesktopAuthAttemptEnvelope/invalid/missing-expiry.json

@@ -0,0 +1,6 @@
+{
+  "data": {
+    "attemptId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
+    "authorizationUrl": "https://soha.example.com/api/v1/auth/desktop/attempts/3fa85f64-5717-4562-b3fc-2c963f66afa6/start"
+  }
+}

package/fixtures/openapi/DesktopAuthAttemptEnvelope/valid/attempt.json

@@ -0,0 +1,7 @@
+{
+  "data": {
+    "attemptId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
+    "authorizationUrl": "https://soha.example.com/api/v1/auth/desktop/attempts/3fa85f64-5717-4562-b3fc-2c963f66afa6/start",
+    "expiresAt": "2026-08-20T12:00:00Z"
+  }
+}

package/fixtures/openapi/DesktopAuthAttemptExchangeRequest/invalid/short-verifier.json

@@ -0,0 +1,4 @@
+{
+  "code": "ZGVza3RvcC1jYWxsYmFjay1jb2Rl",
+  "codeVerifier": "short"
+}

package/fixtures/openapi/DesktopAuthAttemptExchangeRequest/valid/exchange.json

@@ -0,0 +1,4 @@
+{
+  "code": "ZGVza3RvcC1jYWxsYmFjay1jb2Rl",
+  "codeVerifier": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+}

package/fixtures/openapi/EndpointDevice/invalid/missing-owner.json

@@ -0,0 +1,8 @@
+{
+  "id": "device-01",
+  "name": "Alice Windows",
+  "status": "active",
+  "platform": "windows",
+  "createdAt": "2026-09-02T08:00:00Z",
+  "updatedAt": "2026-09-02T08:00:00Z"
+}

package/fixtures/openapi/EndpointDevice/valid/active.json

@@ -0,0 +1,35 @@
+{
+  "id": "device-01",
+  "name": "Alice Windows",
+  "ownerUserId": "user-01",
+  "status": "active",
+  "platform": "windows",
+  "deviceType": "laptop",
+  "ownershipType": "company",
+  "postureStatus": "compliant",
+  "postureVersion": 3,
+  "credentialGeneration": 1,
+  "reportedFacts": {
+    "osName": "Windows",
+    "osVersion": "11 Pro",
+    "osBuild": "26100",
+    "architecture": "amd64",
+    "manufacturer": "Lenovo",
+    "model": "ThinkPad T14",
+    "serialNumber": "PF000001",
+    "agentVersion": "0.2.0",
+    "collectedAt": "2026-09-02T07:59:00Z",
+    "networkInterfaces": [
+      {
+        "name": "Ethernet",
+        "kind": "physical",
+        "status": "up",
+        "macAddress": "00:11:22:33:44:55",
+        "ipv4Addresses": ["10.0.12.44"],
+        "ipv6Addresses": ["fe80::1"]
+      }
+    ]
+  },
+  "createdAt": "2026-09-02T08:00:00Z",
+  "updatedAt": "2026-09-02T08:00:00Z"
+}

package/fixtures/openapi/EndpointDeviceRegistrationInput/invalid/client-owned-status.json

@@ -0,0 +1,5 @@
+{
+  "name": "Shanchui's Mac",
+  "platform": "darwin",
+  "status": "active"
+}

package/fixtures/openapi/EndpointDeviceRegistrationInput/invalid/oversized-network-inventory.json

@@ -0,0 +1,18 @@
+{
+  "name": "Mac",
+  "platform": "darwin",
+  "reportedFacts": {
+    "architecture": "arm64",
+    "agentVersion": "0.2.0",
+    "collectedAt": "2026-09-03T09:00:00Z",
+    "networkInterfaces": [
+      {
+        "name": "en0",
+        "kind": "physical",
+        "status": "up",
+        "ipv4Addresses": ["not-an-ip"],
+        "ipv6Addresses": []
+      }
+    ]
+  }
+}

package/fixtures/openapi/EndpointDeviceRegistrationInput/valid/macos.json

@@ -0,0 +1,28 @@
+{
+  "name": "Shanchui's Mac",
+  "hostname": "shanchui-mac.local",
+  "platform": "darwin",
+  "deviceType": "laptop",
+  "reportedFacts": {
+    "osName": "macOS",
+    "osVersion": "15.6.1",
+    "osBuild": "24G90",
+    "architecture": "arm64",
+    "manufacturer": "Apple",
+    "model": "MacBookAir15,2",
+    "serialNumber": "C02TEST00001",
+    "agentVersion": "0.2.0",
+    "collectedAt": "2026-09-03T09:00:00Z",
+    "networkInterfaces": [
+      {
+        "name": "en0",
+        "displayName": "Wi-Fi",
+        "kind": "physical",
+        "status": "up",
+        "macAddress": "00:11:22:33:44:55",
+        "ipv4Addresses": ["192.168.1.10"],
+        "ipv6Addresses": ["fe80::1"]
+      }
+    ]
+  }
+}

package/fixtures/openapi/IdentityApplication/invalid/missing-id.json

@@ -0,0 +1,7 @@
+{
+  "name": "Example App",
+  "slug": "example-app",
+  "status": "enabled",
+  "createdAt": "2026-08-24T08:00:00Z",
+  "updatedAt": "2026-08-24T08:00:00Z"
+}

package/fixtures/openapi/IdentityApplication/valid/full.json

@@ -0,0 +1,30 @@
+{
+  "id": "app-example",
+  "name": "Example App",
+  "slug": "example-app",
+  "description": "Example identity application",
+  "iconUrl": "https://app.example.com/icon.png",
+  "tags": ["platform"],
+  "launchUrl": "https://app.example.com",
+  "providerId": "provider-example",
+  "providerType": "oidc",
+  "portalVisible": true,
+  "featured": false,
+  "sortOrder": 100,
+  "status": "enabled",
+  "metadata": {
+    "owner": "platform"
+  },
+  "assignments": [
+    {
+      "id": "assignment-example",
+      "applicationId": "app-example",
+      "subjectType": "role",
+      "subjectId": "platform-admin",
+      "effect": "allow",
+      "createdAt": "2026-08-24T08:00:00Z"
+    }
+  ],
+  "createdAt": "2026-08-24T08:00:00Z",
+  "updatedAt": "2026-08-24T08:00:00Z"
+}

package/fixtures/openapi/IdentityApplicationEnvelope/invalid/missing-data.json

@@ -0,0 +1 @@
+{}

package/fixtures/openapi/IdentityApplicationEnvelope/valid/minimal.json

@@ -0,0 +1,10 @@
+{
+  "data": {
+    "id": "app-1",
+    "name": "Soha Console",
+    "slug": "soha-console",
+    "status": "enabled",
+    "createdAt": "2026-08-31T00:00:00Z",
+    "updatedAt": "2026-08-31T00:00:00Z"
+  }
+}

package/fixtures/openapi/IdentityApplicationLaunchListEnvelope/invalid/missing-user.json

@@ -0,0 +1,11 @@
+{
+  "items": [
+    {
+      "id": "launch-1",
+      "applicationId": "app-1",
+      "providerType": "oidc",
+      "result": "allow",
+      "createdAt": "2026-08-31T00:00:00Z"
+    }
+  ]
+}

package/fixtures/openapi/IdentityApplicationLaunchListEnvelope/valid/minimal.json

@@ -0,0 +1,12 @@
+{
+  "items": [
+    {
+      "id": "launch-1",
+      "applicationId": "app-1",
+      "userId": "user-1",
+      "providerType": "oidc",
+      "result": "allow",
+      "createdAt": "2026-08-31T00:00:00Z"
+    }
+  ]
+}

package/fixtures/openapi/LLMUpstreamTestResultEnvelope/invalid/models-not-array.json

@@ -0,0 +1,9 @@
+{
+  "data": {
+    "status": "success",
+    "providerKind": "openai",
+    "durationMs": 42,
+    "modelCount": 1,
+    "models": "gpt-5.6-luna"
+  }
+}

package/fixtures/openapi/LLMUpstreamTestResultEnvelope/valid/discovered-models.json

@@ -0,0 +1,11 @@
+{
+  "data": {
+    "status": "success",
+    "providerKind": "openai",
+    "httpStatus": 200,
+    "durationMs": 42,
+    "modelCount": 2,
+    "models": ["gpt-5.6-luna", "gpt-5.6-sol"],
+    "checkedAt": "2026-09-02T03:04:05Z"
+  }
+}

package/fixtures/openapi/LogQuery/invalid/empty-data-source-id.json

@@ -0,0 +1,7 @@
+{
+  "sourceMode": "durable",
+  "dataSourceId": "",
+  "selector": {
+    "namespace": "payments"
+  }
+}

package/fixtures/openapi/LogQuery/valid/durable-data-source.json

@@ -0,0 +1,14 @@
+{
+  "sourceMode": "durable",
+  "dataSourceId": "loki-main",
+  "selector": {
+    "namespace": "payments",
+    "workloadKind": "Deployment",
+    "workloadName": "checkout-api"
+  },
+  "from": "2026-08-31T08:00:00Z",
+  "to": "2026-08-31T08:15:00Z",
+  "limit": 200,
+  "direction": "backward",
+  "text": "upstream timeout"
+}

package/fixtures/openapi/ManifestPackage/invalid/missing-application.json

@@ -0,0 +1,12 @@
+{
+  "id": "manifest-package-1",
+  "name": "checkout-api-ingress",
+  "serviceId": "service-checkout-api",
+  "renderer": "raw_yaml",
+  "status": "draft",
+  "currentRevision": 0,
+  "files": [],
+  "bindings": [],
+  "createdAt": "2026-08-27T00:00:00Z",
+  "updatedAt": "2026-08-27T00:00:00Z"
+}

package/fixtures/openapi/ManifestPackage/valid/service-scoped.json

@@ -0,0 +1,29 @@
+{
+  "id": "manifest-package-1",
+  "name": "checkout-api-ingress",
+  "description": "Service-level delivery extensions",
+  "applicationId": "app-1",
+  "serviceId": "service-checkout-api",
+  "renderer": "raw_yaml",
+  "status": "draft",
+  "currentRevision": 0,
+  "files": [
+    {
+      "path": "ingress.yaml",
+      "content": "apiVersion: networking.k8s.io/v1\nkind: Ingress\n"
+    }
+  ],
+  "bindings": [
+    {
+      "id": "binding-1",
+      "applicationEnvironmentId": "app-env-prod",
+      "environmentKey": "prod",
+      "clusterId": "cluster-prod",
+      "namespace": "checkout",
+      "overlay": { "host": "checkout.example.com" },
+      "status": "ready"
+    }
+  ],
+  "createdAt": "2026-08-27T00:00:00Z",
+  "updatedAt": "2026-08-27T00:00:00Z"
+}

package/fixtures/openapi/NetworkAccessGrant/invalid/token-digest.json

@@ -0,0 +1,15 @@
+{
+  "id": "grant-payroll-01",
+  "subjectId": "f7f87a34-077d-4601-af8d-c142a34755f2",
+  "deviceId": "device-shanghai-001",
+  "siteId": "site-shanghai",
+  "networkSpaceId": "space-corp",
+  "mode": "external_direct_ztna",
+  "resourceIds": ["resource-payroll"],
+  "policyVersion": 12,
+  "status": "issued",
+  "createdBy": "f7f87a34-077d-4601-af8d-c142a34755f2",
+  "createdAt": "2026-09-03T08:00:00Z",
+  "expiresAt": "2026-09-03T08:05:00Z",
+  "tokenHash": "sha256:secret"
+}

package/fixtures/openapi/NetworkAccessGrant/valid/issued.json

@@ -0,0 +1,14 @@
+{
+  "id": "grant-payroll-01",
+  "subjectId": "f7f87a34-077d-4601-af8d-c142a34755f2",
+  "deviceId": "device-shanghai-001",
+  "siteId": "site-shanghai",
+  "networkSpaceId": "space-corp",
+  "mode": "external_direct_ztna",
+  "resourceIds": ["resource-payroll"],
+  "policyVersion": 12,
+  "status": "issued",
+  "createdBy": "f7f87a34-077d-4601-af8d-c142a34755f2",
+  "createdAt": "2026-09-03T08:00:00Z",
+  "expiresAt": "2026-09-03T08:05:00Z"
+}

package/fixtures/openapi/NetworkAccessGrantInput/invalid/no-resources.json

@@ -0,0 +1,7 @@
+{
+  "deviceId": "device-shanghai-001",
+  "siteId": "site-shanghai",
+  "networkSpaceId": "space-corp",
+  "mode": "external_direct_ztna",
+  "resourceIds": []
+}

package/fixtures/openapi/NetworkAccessGrantInput/valid/direct-ztna.json

@@ -0,0 +1,8 @@
+{
+  "deviceId": "device-shanghai-001",
+  "siteId": "site-shanghai",
+  "networkSpaceId": "space-corp",
+  "mode": "external_direct_ztna",
+  "resourceIds": ["resource-payroll"],
+  "ttlSeconds": 300
+}

package/fixtures/openapi/NetworkAccessGrantSecret/invalid/short-token.json

@@ -0,0 +1,17 @@
+{
+  "grant": {
+    "id": "grant-payroll-01",
+    "subjectId": "f7f87a34-077d-4601-af8d-c142a34755f2",
+    "deviceId": "device-shanghai-001",
+    "siteId": "site-shanghai",
+    "networkSpaceId": "space-corp",
+    "mode": "external_direct_ztna",
+    "resourceIds": ["resource-payroll"],
+    "policyVersion": 12,
+    "status": "issued",
+    "createdBy": "f7f87a34-077d-4601-af8d-c142a34755f2",
+    "createdAt": "2026-09-03T08:00:00Z",
+    "expiresAt": "2026-09-03T08:05:00Z"
+  },
+  "token": "too-short"
+}

package/fixtures/openapi/NetworkAccessGrantSecret/valid/issued.json

@@ -0,0 +1,17 @@
+{
+  "grant": {
+    "id": "grant-payroll-01",
+    "subjectId": "f7f87a34-077d-4601-af8d-c142a34755f2",
+    "deviceId": "device-shanghai-001",
+    "siteId": "site-shanghai",
+    "networkSpaceId": "space-corp",
+    "mode": "external_direct_ztna",
+    "resourceIds": ["resource-payroll"],
+    "policyVersion": 12,
+    "status": "issued",
+    "createdBy": "f7f87a34-077d-4601-af8d-c142a34755f2",
+    "createdAt": "2026-09-03T08:00:00Z",
+    "expiresAt": "2026-09-03T08:05:00Z"
+  },
+  "token": "0123456789abcdef0123456789abcdef"
+}

package/fixtures/openapi/NetworkAccessPolicy/invalid/missing-version.json

@@ -0,0 +1,20 @@
+{
+  "accessProfile": "full",
+  "createdAt": "2026-09-02T05:00:00Z",
+  "deviceStatuses": ["active"],
+  "effect": "allow",
+  "enabled": true,
+  "id": "policy-engineering",
+  "modes": ["internal_ztna"],
+  "name": "Missing version",
+  "postureStatuses": ["compliant"],
+  "priority": 100,
+  "resourceIds": [],
+  "siteIds": [],
+  "subjects": {
+    "tags": [],
+    "teams": [],
+    "users": []
+  },
+  "updatedAt": "2026-09-02T05:20:00Z"
+}

package/fixtures/openapi/NetworkAccessPolicy/valid/published-draft.json

@@ -0,0 +1,21 @@
+{
+  "accessProfile": "full",
+  "createdAt": "2026-09-02T05:00:00Z",
+  "deviceStatuses": ["active"],
+  "effect": "allow",
+  "enabled": true,
+  "id": "policy-engineering",
+  "modes": ["internal_ztna", "external_vpn_ztna"],
+  "name": "Engineering protected access",
+  "postureStatuses": ["compliant"],
+  "priority": 100,
+  "resourceIds": ["resource-git"],
+  "siteIds": ["site-hq"],
+  "subjects": {
+    "tags": ["employee"],
+    "teams": ["team-engineering"],
+    "users": []
+  },
+  "updatedAt": "2026-09-02T05:20:00Z",
+  "version": 2
+}

package/fixtures/openapi/NetworkAccessPolicyInput/invalid/duplicate-team.json

@@ -0,0 +1,17 @@
+{
+  "accessProfile": "full",
+  "deviceStatuses": ["active"],
+  "effect": "allow",
+  "enabled": true,
+  "modes": ["internal_ztna"],
+  "name": "Duplicate team selector",
+  "postureStatuses": ["compliant"],
+  "priority": 100,
+  "resourceIds": [],
+  "siteIds": [],
+  "subjects": {
+    "tags": [],
+    "teams": ["team-engineering", "team-engineering"],
+    "users": []
+  }
+}

package/fixtures/openapi/NetworkAccessPolicyInput/valid/team-and-tag-allow.json

@@ -0,0 +1,17 @@
+{
+  "accessProfile": "full",
+  "deviceStatuses": ["active"],
+  "effect": "allow",
+  "enabled": true,
+  "modes": ["internal_ztna", "external_vpn_ztna"],
+  "name": "Engineering protected access",
+  "postureStatuses": ["compliant"],
+  "priority": 100,
+  "resourceIds": ["resource-git"],
+  "siteIds": ["site-hq"],
+  "subjects": {
+    "tags": ["employee"],
+    "teams": ["team-engineering"],
+    "users": []
+  }
+}

package/fixtures/openapi/NetworkConflictAnalysisRequest/invalid/ipv6-range.json

@@ -0,0 +1,9 @@
+{
+  "runtimeRanges": [
+    {
+      "cidr": "fd00::/64",
+      "name": "Unsupported IPv6 overlay",
+      "sourceType": "wireguard_overlay"
+    }
+  ]
+}

package/fixtures/openapi/NetworkConflictAnalysisRequest/valid/runtime-ranges.json

@@ -0,0 +1,15 @@
+{
+  "runtimeRanges": [
+    {
+      "cidr": "100.96.0.0/12",
+      "name": "WireGuard overlay",
+      "sourceId": "gateway-hq",
+      "sourceType": "wireguard_overlay"
+    },
+    {
+      "cidr": "198.18.0.0/15",
+      "name": "mihomo fake IP",
+      "sourceType": "mihomo_fake_ip"
+    }
+  ]
+}

package/fixtures/openapi/NetworkConnectionOption/invalid/secret.json

@@ -0,0 +1,10 @@
+{
+  "siteId": "site-a",
+  "siteName": "上海总部",
+  "accessMedium": "wifi",
+  "ssid": "Soha-Staff",
+  "authentication": "radius_802_1x",
+  "accessProfile": "full",
+  "policyVersion": 7,
+  "password": "must-never-enter-public-dtos"
+}

package/fixtures/openapi/NetworkConnectionOption/valid/wifi.json

@@ -0,0 +1,9 @@
+{
+  "siteId": "site-a",
+  "siteName": "上海总部",
+  "accessMedium": "wifi",
+  "ssid": "Soha-Staff",
+  "authentication": "radius_802_1x",
+  "accessProfile": "full",
+  "policyVersion": 7
+}

package/fixtures/openapi/NetworkConnectionOption/valid/wired.json

@@ -0,0 +1,8 @@
+{
+  "siteId": "site-a",
+  "siteName": "上海总部",
+  "accessMedium": "wired",
+  "authentication": "radius_802_1x",
+  "accessProfile": "restricted",
+  "policyVersion": 7
+}

package/fixtures/openapi/NetworkGateway/invalid/missing-site.json

@@ -0,0 +1,7 @@
+{
+  "id": "gateway-01",
+  "name": "Shanghai Gateway",
+  "status": "online",
+  "createdAt": "2026-09-01T08:00:00Z",
+  "updatedAt": "2026-09-02T08:00:00Z"
+}

package/fixtures/openapi/NetworkGateway/valid/online.json

@@ -0,0 +1,23 @@
+{
+  "id": "gateway-01",
+  "runtimeId": "gateway-site-a",
+  "siteId": "site-shanghai",
+  "name": "Shanghai Gateway",
+  "administrativeStatus": "active",
+  "status": "online",
+  "publicEndpointHost": "vpn.example.com",
+  "publicEndpointPort": 51820,
+  "overlayCidr": "100.96.10.0/24",
+  "routingMode": "routed",
+  "advertisedCidrs": ["10.20.0.0/16"],
+  "mtu": 1380,
+  "persistentKeepaliveSeconds": 25,
+  "dnsServers": ["10.20.0.53"],
+  "wireguardPublicKey": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",
+  "version": "0.1.0",
+  "policyVersion": 7,
+  "capabilities": ["wireguard", "access_proxy"],
+  "lastHeartbeatAt": "2026-09-02T08:00:00Z",
+  "createdAt": "2026-09-01T08:00:00Z",
+  "updatedAt": "2026-09-02T08:00:00Z"
+}

package/fixtures/openapi/NetworkGatewayInput/invalid/default-route-overlay.json

@@ -0,0 +1,13 @@
+{
+  "runtimeId": "gateway-site-a",
+  "siteId": "site-shanghai",
+  "name": "Shanghai Gateway",
+  "administrativeStatus": "active",
+  "publicEndpointHost": "vpn.example.com",
+  "publicEndpointPort": 51820,
+  "overlayCidr": "0.0.0.0/0",
+  "routingMode": "routed",
+  "mtu": 1380,
+  "persistentKeepaliveSeconds": 25,
+  "dnsServers": []
+}

package/fixtures/openapi/NetworkGatewayInput/valid/routed.json

@@ -0,0 +1,14 @@
+{
+  "runtimeId": "gateway-site-a",
+  "siteId": "site-shanghai",
+  "name": "Shanghai Gateway",
+  "administrativeStatus": "active",
+  "publicEndpointHost": "vpn.example.com",
+  "publicEndpointPort": 51820,
+  "overlayCidr": "100.96.10.0/24",
+  "routingMode": "routed",
+  "advertisedCidrs": ["10.20.0.0/16"],
+  "mtu": 1380,
+  "persistentKeepaliveSeconds": 25,
+  "dnsServers": ["10.20.0.53"]
+}

package/fixtures/openapi/NetworkLease/invalid/empty-cidrs.json

@@ -0,0 +1,12 @@
+{
+  "id": "network-lease-01",
+  "sessionId": "session-01",
+  "subjectId": "user-01",
+  "deviceId": "device-01",
+  "networkSpaceId": "space-corp",
+  "cidrs": [],
+  "policyVersion": 9,
+  "status": "active",
+  "issuedAt": "2026-09-02T08:00:00Z",
+  "expiresAt": "2026-09-02T09:00:00Z"
+}

package/fixtures/openapi/NetworkLease/valid/active.json

@@ -0,0 +1,12 @@
+{
+  "id": "network-lease-01",
+  "sessionId": "session-01",
+  "subjectId": "user-01",
+  "deviceId": "device-01",
+  "networkSpaceId": "space-corp",
+  "cidrs": ["10.20.0.0/16"],
+  "policyVersion": 9,
+  "status": "active",
+  "issuedAt": "2026-09-02T08:00:00Z",
+  "expiresAt": "2026-09-02T09:00:00Z"
+}