@opensoha/contracts 0.1.15 → 0.1.17

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (211) hide show
  1. package/COMPATIBILITY.md +46 -0
  2. package/README.md +12 -3
  3. package/auth/catalog_generated.go +2 -2
  4. package/auth/catalog_test.go +32 -0
  5. package/auth/permission-catalog.json +537 -8
  6. package/compat/json-schema-ecosystem-0.1.0.json +1 -1
  7. package/compat/openapi-loose-boundaries-0.1.0.json +58 -1
  8. package/fixtures/json-schema/network-ingest-event/invalid/duplicate-event.json +33 -0
  9. package/fixtures/json-schema/network-ingest-event/invalid/message-payload-mismatch.json +23 -0
  10. package/fixtures/json-schema/network-ingest-event/invalid/password.json +22 -0
  11. package/fixtures/json-schema/network-ingest-event/invalid/proxy-flow-destination.json +28 -0
  12. package/fixtures/json-schema/network-ingest-event/valid/endpoint-proxy-flow.json +27 -0
  13. package/fixtures/json-schema/network-ingest-event/valid/freeradius-accounting.json +25 -0
  14. package/fixtures/json-schema/network-ingest-event/valid/gateway.json +53 -0
  15. package/fixtures/json-schema/network-radius-accounting/invalid/password.json +9 -0
  16. package/fixtures/json-schema/network-radius-accounting/valid/accounting.json +16 -0
  17. package/fixtures/json-schema/network-runtime-protocol/invalid/invalid-cidr.json +31 -0
  18. package/fixtures/json-schema/network-runtime-protocol/invalid/message-payload-mismatch.json +19 -0
  19. package/fixtures/json-schema/network-runtime-protocol/invalid/mihomo-raw-subscription.json +33 -0
  20. package/fixtures/json-schema/network-runtime-protocol/invalid/nas-authorization-password.json +18 -0
  21. package/fixtures/json-schema/network-runtime-protocol/invalid/nas-eap-without-certificate.json +17 -0
  22. package/fixtures/json-schema/network-runtime-protocol/invalid/private-key.json +20 -0
  23. package/fixtures/json-schema/network-runtime-protocol/invalid/raw-credential-reference.json +16 -0
  24. package/fixtures/json-schema/network-runtime-protocol/invalid/runtime-interval-too-short.json +23 -0
  25. package/fixtures/json-schema/network-runtime-protocol/invalid/wireguard-capability-without-key.json +19 -0
  26. package/fixtures/json-schema/network-runtime-protocol/invalid/wireguard-default-route.json +31 -0
  27. package/fixtures/json-schema/network-runtime-protocol/invalid/ztna-without-access-grant.json +17 -0
  28. package/fixtures/json-schema/network-runtime-protocol/valid/configuration-desired.json +86 -0
  29. package/fixtures/json-schema/network-runtime-protocol/valid/direct-ztna-connect.json +19 -0
  30. package/fixtures/json-schema/network-runtime-protocol/valid/direct-ztna-result.json +33 -0
  31. package/fixtures/json-schema/network-runtime-protocol/valid/internal-ztna-connect.json +19 -0
  32. package/fixtures/json-schema/network-runtime-protocol/valid/mihomo-app-subscription-configuration.json +32 -0
  33. package/fixtures/json-schema/network-runtime-protocol/valid/mihomo-manual-node-configuration.json +32 -0
  34. package/fixtures/json-schema/network-runtime-protocol/valid/mihomo-wireguard-configuration.json +70 -0
  35. package/fixtures/json-schema/network-runtime-protocol/valid/nas-authorization-request.json +19 -0
  36. package/fixtures/json-schema/network-runtime-protocol/valid/nas-authorization-result.json +24 -0
  37. package/fixtures/json-schema/network-runtime-protocol/valid/nas-session-command-result.json +17 -0
  38. package/fixtures/json-schema/network-runtime-protocol/valid/nas-session-command.json +27 -0
  39. package/fixtures/json-schema/network-runtime-protocol/valid/vpn-connect-request.json +17 -0
  40. package/fixtures/json-schema/network-runtime-protocol/valid/vpn-connect-result.json +34 -0
  41. package/fixtures/json-schema/network-runtime-protocol/valid/wireguard-enrollment.json +20 -0
  42. package/fixtures/json-schema/network-runtime-protocol/valid/wireguard-site-link.json +48 -0
  43. package/fixtures/openapi/AlertRuleEnvelope/invalid/missing-data.json +1 -0
  44. package/fixtures/openapi/AlertRuleEnvelope/valid/metrics.json +11 -0
  45. package/fixtures/openapi/AlertRuleInput/invalid/missing-name.json +3 -0
  46. package/fixtures/openapi/AlertRuleInput/valid/metrics.json +25 -0
  47. package/fixtures/openapi/AlertRuleRunListEnvelope/invalid/missing-rule-id.json +12 -0
  48. package/fixtures/openapi/AlertRuleRunListEnvelope/valid/items.json +13 -0
  49. package/fixtures/openapi/AlertRuleTestResultEnvelope/invalid/missing-executed-at.json +5 -0
  50. package/fixtures/openapi/AlertRuleTestResultEnvelope/valid/clear.json +10 -0
  51. package/fixtures/openapi/AnnouncementReceiptPageEnvelope/invalid/missing-read-count.json +9 -0
  52. package/fixtures/openapi/AnnouncementReceiptPageEnvelope/valid/read-and-unread.json +28 -0
  53. package/fixtures/openapi/ApplicationRuntimeEnvironment/invalid/unknown-status.json +7 -0
  54. package/fixtures/openapi/ApplicationRuntimeEnvironment/valid/unavailable.json +7 -0
  55. package/fixtures/openapi/ApplicationWorkflowInput/invalid/owner-fields.json +7 -0
  56. package/fixtures/openapi/ApplicationWorkflowInput/valid/minimal.json +9 -0
  57. package/fixtures/openapi/BrandingAssetUploadEnvelope/valid/svg-data-url.json +5 -0
  58. package/fixtures/openapi/BrowserHandoffCompletionEnvelope/invalid/token-leak.json +7 -0
  59. package/fixtures/openapi/BrowserHandoffCompletionEnvelope/valid/completed.json +6 -0
  60. package/fixtures/openapi/BrowserHandoffEnvelope/invalid/missing-principal.json +12 -0
  61. package/fixtures/openapi/BrowserHandoffEnvelope/valid/pending.json +11 -0
  62. package/fixtures/openapi/ChangePasswordRequest/invalid/missing-current-password.json +3 -0
  63. package/fixtures/openapi/ChangePasswordRequest/invalid/short-new-password.json +4 -0
  64. package/fixtures/openapi/ChangePasswordRequest/valid/password.json +4 -0
  65. package/fixtures/openapi/DesktopAuthAttemptCreateRequest/invalid/https-redirect.json +6 -0
  66. package/fixtures/openapi/DesktopAuthAttemptCreateRequest/invalid/localhost-redirect.json +6 -0
  67. package/fixtures/openapi/DesktopAuthAttemptCreateRequest/invalid/plain-challenge.json +6 -0
  68. package/fixtures/openapi/DesktopAuthAttemptCreateRequest/invalid/privileged-port.json +6 -0
  69. package/fixtures/openapi/DesktopAuthAttemptCreateRequest/invalid/short-callback.json +6 -0
  70. package/fixtures/openapi/DesktopAuthAttemptCreateRequest/valid/loopback.json +6 -0
  71. package/fixtures/openapi/DesktopAuthAttemptEnvelope/invalid/missing-expiry.json +6 -0
  72. package/fixtures/openapi/DesktopAuthAttemptEnvelope/valid/attempt.json +7 -0
  73. package/fixtures/openapi/DesktopAuthAttemptExchangeRequest/invalid/short-verifier.json +4 -0
  74. package/fixtures/openapi/DesktopAuthAttemptExchangeRequest/valid/exchange.json +4 -0
  75. package/fixtures/openapi/EndpointDevice/invalid/missing-owner.json +8 -0
  76. package/fixtures/openapi/EndpointDevice/valid/active.json +35 -0
  77. package/fixtures/openapi/EndpointDeviceRegistrationInput/invalid/client-owned-status.json +5 -0
  78. package/fixtures/openapi/EndpointDeviceRegistrationInput/invalid/oversized-network-inventory.json +18 -0
  79. package/fixtures/openapi/EndpointDeviceRegistrationInput/valid/macos.json +28 -0
  80. package/fixtures/openapi/IdentityApplication/invalid/missing-id.json +7 -0
  81. package/fixtures/openapi/IdentityApplication/valid/full.json +30 -0
  82. package/fixtures/openapi/IdentityApplicationEnvelope/invalid/missing-data.json +1 -0
  83. package/fixtures/openapi/IdentityApplicationEnvelope/valid/minimal.json +10 -0
  84. package/fixtures/openapi/IdentityApplicationLaunchListEnvelope/invalid/missing-user.json +11 -0
  85. package/fixtures/openapi/IdentityApplicationLaunchListEnvelope/valid/minimal.json +12 -0
  86. package/fixtures/openapi/LLMUpstreamTestResultEnvelope/invalid/models-not-array.json +9 -0
  87. package/fixtures/openapi/LLMUpstreamTestResultEnvelope/valid/discovered-models.json +11 -0
  88. package/fixtures/openapi/LogQuery/invalid/empty-data-source-id.json +7 -0
  89. package/fixtures/openapi/LogQuery/valid/durable-data-source.json +14 -0
  90. package/fixtures/openapi/ManifestPackage/invalid/missing-application.json +12 -0
  91. package/fixtures/openapi/ManifestPackage/valid/service-scoped.json +29 -0
  92. package/fixtures/openapi/NetworkAccessGrant/invalid/token-digest.json +15 -0
  93. package/fixtures/openapi/NetworkAccessGrant/valid/issued.json +14 -0
  94. package/fixtures/openapi/NetworkAccessGrantInput/invalid/no-resources.json +7 -0
  95. package/fixtures/openapi/NetworkAccessGrantInput/valid/direct-ztna.json +8 -0
  96. package/fixtures/openapi/NetworkAccessGrantSecret/invalid/short-token.json +17 -0
  97. package/fixtures/openapi/NetworkAccessGrantSecret/valid/issued.json +17 -0
  98. package/fixtures/openapi/NetworkAccessPolicy/invalid/missing-version.json +20 -0
  99. package/fixtures/openapi/NetworkAccessPolicy/valid/published-draft.json +21 -0
  100. package/fixtures/openapi/NetworkAccessPolicyInput/invalid/duplicate-team.json +17 -0
  101. package/fixtures/openapi/NetworkAccessPolicyInput/valid/team-and-tag-allow.json +17 -0
  102. package/fixtures/openapi/NetworkConflictAnalysisRequest/invalid/ipv6-range.json +9 -0
  103. package/fixtures/openapi/NetworkConflictAnalysisRequest/valid/runtime-ranges.json +15 -0
  104. package/fixtures/openapi/NetworkConnectionOption/invalid/secret.json +10 -0
  105. package/fixtures/openapi/NetworkConnectionOption/valid/wifi.json +9 -0
  106. package/fixtures/openapi/NetworkConnectionOption/valid/wired.json +8 -0
  107. package/fixtures/openapi/NetworkGateway/invalid/missing-site.json +7 -0
  108. package/fixtures/openapi/NetworkGateway/valid/online.json +23 -0
  109. package/fixtures/openapi/NetworkGatewayInput/invalid/default-route-overlay.json +13 -0
  110. package/fixtures/openapi/NetworkGatewayInput/valid/routed.json +14 -0
  111. package/fixtures/openapi/NetworkLease/invalid/empty-cidrs.json +12 -0
  112. package/fixtures/openapi/NetworkLease/valid/active.json +12 -0
  113. package/fixtures/openapi/NetworkMihomoProfile/invalid/subscription-leak.json +20 -0
  114. package/fixtures/openapi/NetworkMihomoProfile/valid/managed.json +21 -0
  115. package/fixtures/openapi/NetworkMihomoProfileInput/invalid/app-subscription-secret.json +14 -0
  116. package/fixtures/openapi/NetworkMihomoProfileInput/invalid/manual-node-with-subscription.json +20 -0
  117. package/fixtures/openapi/NetworkMihomoProfileInput/valid/app-subscription.json +14 -0
  118. package/fixtures/openapi/NetworkMihomoProfileInput/valid/managed.json +16 -0
  119. package/fixtures/openapi/NetworkMihomoProfileInput/valid/manual-node.json +21 -0
  120. package/fixtures/openapi/NetworkNASBinding/invalid/secret.json +13 -0
  121. package/fixtures/openapi/NetworkNASBinding/valid/default.json +16 -0
  122. package/fixtures/openapi/NetworkNASBindingInput/invalid/secret.json +10 -0
  123. package/fixtures/openapi/NetworkNASBindingInput/valid/default.json +13 -0
  124. package/fixtures/openapi/NetworkPolicyPreviewRequest/invalid/unknown-mode.json +6 -0
  125. package/fixtures/openapi/NetworkPolicyPreviewRequest/valid/external-direct-ztna.json +6 -0
  126. package/fixtures/openapi/NetworkPolicyPreviewRequest/valid/external-vpn-ztna.json +6 -0
  127. package/fixtures/openapi/NetworkPolicyPreviewRequest/valid/external-vpn.json +6 -0
  128. package/fixtures/openapi/NetworkPolicyPreviewRequest/valid/internal-direct.json +7 -0
  129. package/fixtures/openapi/NetworkPolicyPreviewRequest/valid/internal-ztna.json +7 -0
  130. package/fixtures/openapi/NetworkPolicyPreviewResult/invalid/bypass-path.json +9 -0
  131. package/fixtures/openapi/NetworkPolicyPreviewResult/valid/onboarding.json +10 -0
  132. package/fixtures/openapi/NetworkPolicyPreviewResult/valid/protected-broad-path-denied.json +9 -0
  133. package/fixtures/openapi/NetworkPolicyPreviewResult/valid/protected-resource.json +9 -0
  134. package/fixtures/openapi/NetworkPolicyPreviewResult/valid/quarantine.json +10 -0
  135. package/fixtures/openapi/NetworkPolicyPreviewResult/valid/restricted.json +10 -0
  136. package/fixtures/openapi/NetworkPolicySnapshot/invalid/zero-version.json +7 -0
  137. package/fixtures/openapi/NetworkPolicySnapshot/valid/published.json +7 -0
  138. package/fixtures/openapi/NetworkResourceInput/invalid/invalid-port.json +10 -0
  139. package/fixtures/openapi/NetworkResourceInput/valid/protected-cidr.json +10 -0
  140. package/fixtures/openapi/NetworkRuntimeEnrollmentInput/invalid/excessive-ttl.json +7 -0
  141. package/fixtures/openapi/NetworkRuntimeEnrollmentInput/valid/endpoint.json +7 -0
  142. package/fixtures/openapi/NetworkRuntimeEnrollmentSecret/invalid/short-token.json +15 -0
  143. package/fixtures/openapi/NetworkRuntimeEnrollmentSecret/valid/pending.json +15 -0
  144. package/fixtures/openapi/NetworkSession/invalid/unknown-status.json +14 -0
  145. package/fixtures/openapi/NetworkSession/valid/restricted-vpn-ztna.json +16 -0
  146. package/fixtures/openapi/NetworkSessionActionExecuteInput/invalid/short-hash.json +6 -0
  147. package/fixtures/openapi/NetworkSessionActionExecuteInput/valid/restrict.json +6 -0
  148. package/fixtures/openapi/NetworkSessionActionInput/invalid/unknown-action.json +5 -0
  149. package/fixtures/openapi/NetworkSessionActionInput/valid/restrict.json +5 -0
  150. package/fixtures/openapi/NetworkSessionActionPlan/invalid/missing-hash.json +12 -0
  151. package/fixtures/openapi/NetworkSessionActionPlan/valid/fallback-disconnect.json +13 -0
  152. package/fixtures/openapi/NetworkSessionCommand/invalid/unknown-status.json +14 -0
  153. package/fixtures/openapi/NetworkSessionCommand/valid/pending.json +14 -0
  154. package/fixtures/openapi/NetworkSiteInput/invalid/unknown-status.json +4 -0
  155. package/fixtures/openapi/NetworkSiteInput/valid/shanghai.json +5 -0
  156. package/fixtures/openapi/NetworkSiteProfileBinding/invalid/vlan.json +9 -0
  157. package/fixtures/openapi/NetworkSiteProfileBinding/valid/default.json +10 -0
  158. package/fixtures/openapi/NetworkSiteProfileBindingInput/invalid/timeout.json +7 -0
  159. package/fixtures/openapi/NetworkSiteProfileBindingInput/valid/default.json +7 -0
  160. package/fixtures/openapi/NetworkSpaceInput/invalid/empty-cidrs.json +6 -0
  161. package/fixtures/openapi/NetworkSpaceInput/invalid/malformed-cidr.json +6 -0
  162. package/fixtures/openapi/NetworkSpaceInput/valid/corp.json +6 -0
  163. package/fixtures/openapi/NetworkTelemetrySummary/invalid/raw-destination.json +29 -0
  164. package/fixtures/openapi/NetworkTelemetrySummary/valid/proxy-flow.json +36 -0
  165. package/fixtures/openapi/OIDCClientInput/valid/generated-client-id.json +8 -0
  166. package/fixtures/openapi/OIDCClientSecretRevealEnvelope/invalid/missing-secret.json +6 -0
  167. package/fixtures/openapi/OIDCClientSecretRevealEnvelope/valid/reveal.json +7 -0
  168. package/fixtures/openapi/PasswordChangeResult/invalid/unexpected-status.json +3 -0
  169. package/fixtures/openapi/PasswordChangeResult/valid/ok.json +3 -0
  170. package/fixtures/openapi/PortalApplicationListEnvelope/invalid/missing-items.json +1 -0
  171. package/fixtures/openapi/PortalApplicationListEnvelope/valid/minimal.json +12 -0
  172. package/fixtures/openapi/PortalBootstrapEnvelope/invalid/missing-security.json +17 -0
  173. package/fixtures/openapi/PortalBootstrapEnvelope/valid/minimal.json +31 -0
  174. package/fixtures/openapi/PortalLaunchDecisionEnvelope/invalid/missing-launch-url.json +14 -0
  175. package/fixtures/openapi/PortalLaunchDecisionEnvelope/valid/desktop-handoff.json +16 -0
  176. package/fixtures/openapi/PortalLaunchRequest/invalid/unknown-surface.json +3 -0
  177. package/fixtures/openapi/PortalLaunchRequest/valid/default-web.json +1 -0
  178. package/fixtures/openapi/PortalLaunchRequest/valid/desktop.json +3 -0
  179. package/fixtures/openapi/PortalSecuritySummaryEnvelope/invalid/missing-session-count.json +15 -0
  180. package/fixtures/openapi/PortalSecuritySummaryEnvelope/valid/minimal.json +16 -0
  181. package/fixtures/openapi/ResourceLease/invalid/missing-session.json +10 -0
  182. package/fixtures/openapi/ResourceLease/valid/active.json +11 -0
  183. package/fixtures/openapi/ScopeGrantInput/invalid/delivery-missing-business-line.json +7 -0
  184. package/fixtures/openapi/ScopeGrantInput/invalid/platform-missing-clusters.json +7 -0
  185. package/fixtures/openapi/ScopeGrantInput/valid/platform.json +8 -0
  186. package/fixtures/openapi/SoftwarePackage/valid/software-package.json +6 -0
  187. package/fixtures/openapi/SoftwarePackageDownloadRecord/invalid/negative-duration.json +6 -0
  188. package/fixtures/openapi/SoftwarePackageDownloadRecord/valid/software-package-download-record.json +8 -0
  189. package/fixtures/openapi/SoftwarePackageURLImportRequest/valid/software-package-url-import-request.json +4 -0
  190. package/fixtures/openapi/SoftwareStorage/invalid/software-storage.json +1 -1
  191. package/fixtures/openapi/SoftwareStorage/valid/software-storage.json +13 -1
  192. package/fixtures/openapi/SystemIntegrationCreateRequest/invalid/s3-storage-missing-name.json +5 -0
  193. package/fixtures/openapi/SystemIntegrationCreateRequest/valid/s3-software-storage.json +18 -0
  194. package/fixtures/openapi/UpdateProfileRequest/invalid/invalid-avatar-fit.json +5 -0
  195. package/fixtures/openapi/UpdateProfileRequest/invalid/missing-email.json +3 -0
  196. package/fixtures/openapi/UpdateProfileRequest/valid/profile.json +7 -0
  197. package/gen/go/sohaapi/client.go +210 -5
  198. package/gen/go/sohaapi/client_test.go +128 -5
  199. package/gen/go/sohaapi/types.go +3326 -369
  200. package/gen/go/sohaapi/types_test.go +22 -0
  201. package/gen/ts/sohaapi/index.ts +11612 -6479
  202. package/network/README.md +116 -0
  203. package/network/network-ingest-event.schema.json +187 -0
  204. package/network/network-radius-accounting.schema.json +41 -0
  205. package/network/network-runtime-protocol.schema.json +752 -0
  206. package/network/schema.go +26 -0
  207. package/network/schema_test.go +22 -0
  208. package/openapi/soha-api.json +29591 -18317
  209. package/openapi/soha-api.yaml +11603 -6720
  210. package/openapi/spec_generated.go +3 -3
  211. package/package.json +5 -1
@@ -0,0 +1,20 @@
1
+ {
2
+ "id": "profile-corporate-egress",
3
+ "deviceId": "device-alice-laptop",
4
+ "name": "Corporate egress",
5
+ "mode": "managed_follow",
6
+ "status": "active",
7
+ "subscriptionConfigured": true,
8
+ "subscriptionUrl": "https://subscriptions.example.com/must-not-leak",
9
+ "revision": 4,
10
+ "mixedPort": 7890,
11
+ "controllerPort": 9090,
12
+ "dnsMode": "disabled",
13
+ "selectorGroup": "SOHA",
14
+ "selectedProxy": "corporate-hk",
15
+ "bypassCidrs": [],
16
+ "bypassHosts": [],
17
+ "failClosed": true,
18
+ "createdAt": "2026-09-03T08:00:00Z",
19
+ "updatedAt": "2026-09-03T08:05:00Z"
20
+ }
@@ -0,0 +1,21 @@
1
+ {
2
+ "id": "profile-corporate-egress",
3
+ "deviceId": "device-alice-laptop",
4
+ "name": "Corporate egress",
5
+ "mode": "managed_follow",
6
+ "sourceType": "managed_subscription",
7
+ "status": "active",
8
+ "subscriptionConfigured": true,
9
+ "manualNodeConfigured": false,
10
+ "revision": 4,
11
+ "mixedPort": 7890,
12
+ "controllerPort": 9090,
13
+ "dnsMode": "disabled",
14
+ "selectorGroup": "SOHA",
15
+ "selectedProxy": "corporate-hk",
16
+ "bypassCidrs": ["10.20.0.0/16"],
17
+ "bypassHosts": ["network-control.example.com"],
18
+ "failClosed": true,
19
+ "createdAt": "2026-09-03T08:00:00Z",
20
+ "updatedAt": "2026-09-03T08:05:00Z"
21
+ }
@@ -0,0 +1,14 @@
1
+ {
2
+ "deviceId": "device-bob-laptop",
3
+ "name": "Personal subscription",
4
+ "mode": "app_subscription",
5
+ "status": "active",
6
+ "subscriptionUrl": "https://subscriptions.example.com/should-stay-local",
7
+ "mixedPort": 7890,
8
+ "controllerPort": 9090,
9
+ "dnsMode": "disabled",
10
+ "selectorGroup": "SOHA",
11
+ "bypassCidrs": [],
12
+ "bypassHosts": [],
13
+ "failClosed": false
14
+ }
@@ -0,0 +1,20 @@
1
+ {
2
+ "deviceId": "device-alice-laptop",
3
+ "name": "Invalid mixed source",
4
+ "mode": "managed_follow",
5
+ "sourceType": "manual_node",
6
+ "status": "active",
7
+ "subscriptionUrl": "https://subscriptions.example.com/mihomo/token-value",
8
+ "manualNode": {
9
+ "protocol": "socks5",
10
+ "server": "proxy.example.com",
11
+ "port": 1080
12
+ },
13
+ "mixedPort": 7890,
14
+ "controllerPort": 9090,
15
+ "dnsMode": "disabled",
16
+ "selectorGroup": "SOHA",
17
+ "bypassCidrs": [],
18
+ "bypassHosts": [],
19
+ "failClosed": true
20
+ }
@@ -0,0 +1,14 @@
1
+ {
2
+ "deviceId": "device-bob-laptop",
3
+ "name": "Personal subscription",
4
+ "mode": "app_subscription",
5
+ "status": "active",
6
+ "mixedPort": 7890,
7
+ "controllerPort": 9090,
8
+ "dnsMode": "fake_ip",
9
+ "fakeIpRange": "198.18.0.0/15",
10
+ "selectorGroup": "SOHA",
11
+ "bypassCidrs": [],
12
+ "bypassHosts": ["network-control.example.com"],
13
+ "failClosed": false
14
+ }
@@ -0,0 +1,16 @@
1
+ {
2
+ "deviceId": "device-alice-laptop",
3
+ "name": "Corporate egress",
4
+ "mode": "managed_follow",
5
+ "sourceType": "managed_subscription",
6
+ "status": "active",
7
+ "subscriptionUrl": "https://subscriptions.example.com/mihomo/token-value",
8
+ "mixedPort": 7890,
9
+ "controllerPort": 9090,
10
+ "dnsMode": "disabled",
11
+ "selectorGroup": "SOHA",
12
+ "selectedProxy": "corporate-hk",
13
+ "bypassCidrs": ["10.20.0.0/16"],
14
+ "bypassHosts": ["network-control.example.com"],
15
+ "failClosed": true
16
+ }
@@ -0,0 +1,21 @@
1
+ {
2
+ "deviceId": "device-alice-laptop",
3
+ "name": "Branch proxy",
4
+ "mode": "managed_follow",
5
+ "sourceType": "manual_node",
6
+ "status": "active",
7
+ "manualNode": {
8
+ "protocol": "https",
9
+ "server": "proxy.example.com",
10
+ "port": 8443,
11
+ "username": "alice",
12
+ "password": "secret"
13
+ },
14
+ "mixedPort": 7890,
15
+ "controllerPort": 9090,
16
+ "dnsMode": "disabled",
17
+ "selectorGroup": "SOHA",
18
+ "bypassCidrs": ["10.20.0.0/16"],
19
+ "bypassHosts": ["network-control.example.com"],
20
+ "failClosed": true
21
+ }
@@ -0,0 +1,13 @@
1
+ {
2
+ "id": "nas-binding-site-a-wifi",
3
+ "nasId": "nas-site-a-wifi",
4
+ "runtimeId": "freeradius-site-a",
5
+ "siteId": "site-a",
6
+ "name": "Site A Wi-Fi",
7
+ "status": "active",
8
+ "coaSupported": true,
9
+ "disconnectSupported": true,
10
+ "sharedSecret": "must-never-enter-public-dtos",
11
+ "createdAt": "2026-09-02T08:00:00Z",
12
+ "updatedAt": "2026-09-02T08:00:00Z"
13
+ }
@@ -0,0 +1,16 @@
1
+ {
2
+ "id": "nas-binding-site-a-wifi",
3
+ "nasId": "nas-site-a-wifi",
4
+ "runtimeId": "freeradius-site-a",
5
+ "siteId": "site-a",
6
+ "name": "Site A Wi-Fi",
7
+ "accessMedium": "wifi",
8
+ "deviceType": "wireless_controller",
9
+ "ssid": "Soha-Staff",
10
+ "managementAddress": "10.0.10.2",
11
+ "status": "active",
12
+ "coaSupported": true,
13
+ "disconnectSupported": true,
14
+ "createdAt": "2026-09-02T08:00:00Z",
15
+ "updatedAt": "2026-09-02T08:00:00Z"
16
+ }
@@ -0,0 +1,10 @@
1
+ {
2
+ "nasId": "nas-site-a-wifi",
3
+ "runtimeId": "freeradius-site-a",
4
+ "siteId": "site-a",
5
+ "name": "Site A Wi-Fi",
6
+ "status": "active",
7
+ "coaSupported": true,
8
+ "disconnectSupported": true,
9
+ "sharedSecret": "must-never-enter-public-dtos"
10
+ }
@@ -0,0 +1,13 @@
1
+ {
2
+ "nasId": "nas-site-a-wifi",
3
+ "runtimeId": "freeradius-site-a",
4
+ "siteId": "site-a",
5
+ "name": "Site A Wi-Fi",
6
+ "accessMedium": "wifi",
7
+ "deviceType": "wireless_controller",
8
+ "ssid": "Soha-Staff",
9
+ "managementAddress": "10.0.10.2",
10
+ "status": "active",
11
+ "coaSupported": true,
12
+ "disconnectSupported": true
13
+ }
@@ -0,0 +1,6 @@
1
+ {
2
+ "subjectUserId": "user-01",
3
+ "deviceId": "device-01",
4
+ "resourceId": "resource-git",
5
+ "mode": "implicit_trust"
6
+ }
@@ -0,0 +1,6 @@
1
+ {
2
+ "subjectUserId": "user-01",
3
+ "deviceId": "device-01",
4
+ "resourceId": "resource-git",
5
+ "mode": "external_direct_ztna"
6
+ }
@@ -0,0 +1,6 @@
1
+ {
2
+ "subjectUserId": "user-01",
3
+ "deviceId": "device-01",
4
+ "resourceId": "resource-git",
5
+ "mode": "external_vpn_ztna"
6
+ }
@@ -0,0 +1,6 @@
1
+ {
2
+ "subjectUserId": "user-01",
3
+ "deviceId": "device-01",
4
+ "resourceId": "resource-intranet",
5
+ "mode": "external_vpn"
6
+ }
@@ -0,0 +1,7 @@
1
+ {
2
+ "subjectUserId": "user-01",
3
+ "deviceId": "device-01",
4
+ "resourceId": "resource-intranet",
5
+ "siteId": "site-shanghai",
6
+ "mode": "internal_direct"
7
+ }
@@ -0,0 +1,7 @@
1
+ {
2
+ "subjectUserId": "user-01",
3
+ "deviceId": "device-01",
4
+ "resourceId": "resource-git",
5
+ "siteId": "site-shanghai",
6
+ "mode": "internal_ztna"
7
+ }
@@ -0,0 +1,9 @@
1
+ {
2
+ "decision": "allow",
3
+ "path": "bypass",
4
+ "policyVersion": 7,
5
+ "protected": true,
6
+ "networkLeaseRequired": false,
7
+ "resourceLeaseRequired": false,
8
+ "reasons": []
9
+ }
@@ -0,0 +1,10 @@
1
+ {
2
+ "decision": "allow",
3
+ "path": "site_direct",
4
+ "policyVersion": 8,
5
+ "protected": false,
6
+ "networkProfile": "onboarding",
7
+ "networkLeaseRequired": false,
8
+ "resourceLeaseRequired": false,
9
+ "reasons": ["policy_allow:onboarding"]
10
+ }
@@ -0,0 +1,9 @@
1
+ {
2
+ "decision": "deny",
3
+ "path": "deny",
4
+ "policyVersion": 8,
5
+ "protected": true,
6
+ "networkLeaseRequired": false,
7
+ "resourceLeaseRequired": false,
8
+ "reasons": ["protected_resource_requires_ztna"]
9
+ }
@@ -0,0 +1,9 @@
1
+ {
2
+ "decision": "allow",
3
+ "path": "wireguard_ztna",
4
+ "policyVersion": 7,
5
+ "protected": true,
6
+ "networkLeaseRequired": true,
7
+ "resourceLeaseRequired": true,
8
+ "reasons": ["team_allowed", "device_compliant", "protected_resource"]
9
+ }
@@ -0,0 +1,10 @@
1
+ {
2
+ "decision": "allow",
3
+ "path": "wireguard_ztna",
4
+ "policyVersion": 8,
5
+ "protected": true,
6
+ "networkProfile": "quarantine",
7
+ "networkLeaseRequired": false,
8
+ "resourceLeaseRequired": true,
9
+ "reasons": ["policy_allow:quarantine"]
10
+ }
@@ -0,0 +1,10 @@
1
+ {
2
+ "decision": "allow",
3
+ "path": "wireguard",
4
+ "policyVersion": 8,
5
+ "protected": false,
6
+ "networkProfile": "restricted",
7
+ "networkLeaseRequired": true,
8
+ "resourceLeaseRequired": false,
9
+ "reasons": ["policy_allow:restricted"]
10
+ }
@@ -0,0 +1,7 @@
1
+ {
2
+ "contentHash": "sha256:4ca9f285bf5f0ac81f7fdb14fdac6f7388a9ee5dba0b39d9bcc8b55ed49e65df",
3
+ "policyCount": 0,
4
+ "policyVersion": 0,
5
+ "protectedResourceCount": 0,
6
+ "publishedAt": "2026-09-02T05:30:00Z"
7
+ }
@@ -0,0 +1,7 @@
1
+ {
2
+ "contentHash": "sha256:4ca9f285bf5f0ac81f7fdb14fdac6f7388a9ee5dba0b39d9bcc8b55ed49e65df",
3
+ "policyCount": 3,
4
+ "policyVersion": 7,
5
+ "protectedResourceCount": 2,
6
+ "publishedAt": "2026-09-02T05:30:00Z"
7
+ }
@@ -0,0 +1,10 @@
1
+ {
2
+ "spaceId": "space-corp",
3
+ "name": "Git service",
4
+ "kind": "cidr",
5
+ "target": "10.42.8.0/24",
6
+ "protected": true,
7
+ "protocol": "tcp",
8
+ "ports": [70000],
9
+ "pathMode": "wireguard_ztna"
10
+ }
@@ -0,0 +1,10 @@
1
+ {
2
+ "spaceId": "space-corp",
3
+ "name": "Git service",
4
+ "kind": "cidr",
5
+ "target": "10.42.8.0/24",
6
+ "protected": true,
7
+ "protocol": "tcp",
8
+ "ports": [443],
9
+ "pathMode": "wireguard_ztna"
10
+ }
@@ -0,0 +1,7 @@
1
+ {
2
+ "runtimeId": "endpoint-shanghai-001",
3
+ "runtimeKind": "endpoint",
4
+ "deviceId": "device-shanghai-001",
5
+ "subjectId": "f7f87a34-077d-4601-af8d-c142a34755f2",
6
+ "ttlSeconds": 601
7
+ }
@@ -0,0 +1,7 @@
1
+ {
2
+ "runtimeId": "endpoint-shanghai-001",
3
+ "runtimeKind": "endpoint",
4
+ "deviceId": "device-shanghai-001",
5
+ "subjectId": "f7f87a34-077d-4601-af8d-c142a34755f2",
6
+ "ttlSeconds": 600
7
+ }
@@ -0,0 +1,15 @@
1
+ {
2
+ "enrollment": {
3
+ "id": "enrollment-01",
4
+ "challengeId": "challenge-01",
5
+ "runtimeId": "endpoint-shanghai-001",
6
+ "runtimeKind": "endpoint",
7
+ "deviceId": "device-shanghai-001",
8
+ "subjectId": "f7f87a34-077d-4601-af8d-c142a34755f2",
9
+ "status": "pending",
10
+ "expiresAt": "2026-09-02T10:10:00Z",
11
+ "createdBy": "1f449d94-682c-4fe7-a73b-df2741380197",
12
+ "createdAt": "2026-09-02T10:00:00Z"
13
+ },
14
+ "token": "too-short"
15
+ }
@@ -0,0 +1,15 @@
1
+ {
2
+ "enrollment": {
3
+ "id": "enrollment-01",
4
+ "challengeId": "challenge-01",
5
+ "runtimeId": "endpoint-shanghai-001",
6
+ "runtimeKind": "endpoint",
7
+ "deviceId": "device-shanghai-001",
8
+ "subjectId": "f7f87a34-077d-4601-af8d-c142a34755f2",
9
+ "status": "pending",
10
+ "expiresAt": "2026-09-02T10:10:00Z",
11
+ "createdBy": "1f449d94-682c-4fe7-a73b-df2741380197",
12
+ "createdAt": "2026-09-02T10:00:00Z"
13
+ },
14
+ "token": "0123456789abcdef0123456789abcdef"
15
+ }
@@ -0,0 +1,14 @@
1
+ {
2
+ "id": "session-01",
3
+ "subjectId": "user-01",
4
+ "deviceId": "device-01",
5
+ "mode": "external_vpn",
6
+ "path": "wireguard",
7
+ "accessProfile": "full",
8
+ "status": "connected",
9
+ "policyVersion": 9,
10
+ "networkLeaseIds": ["network-lease-01"],
11
+ "resourceLeaseIds": [],
12
+ "startedAt": "2026-09-02T08:00:00Z",
13
+ "expiresAt": "2026-09-02T09:00:00Z"
14
+ }
@@ -0,0 +1,16 @@
1
+ {
2
+ "id": "session-01",
3
+ "subjectId": "user-01",
4
+ "deviceId": "device-01",
5
+ "siteId": "site-shanghai",
6
+ "gatewayId": "gateway-shanghai",
7
+ "mode": "external_vpn_ztna",
8
+ "path": "wireguard_ztna",
9
+ "accessProfile": "restricted",
10
+ "status": "restricted",
11
+ "policyVersion": 9,
12
+ "networkLeaseIds": ["network-lease-01"],
13
+ "resourceLeaseIds": ["resource-lease-01"],
14
+ "startedAt": "2026-09-02T08:00:00Z",
15
+ "expiresAt": "2026-09-02T09:00:00Z"
16
+ }
@@ -0,0 +1,6 @@
1
+ {
2
+ "action": "coa",
3
+ "targetAccessProfile": "restricted",
4
+ "reasonCode": "device_posture_changed",
5
+ "planHash": "sha256:short"
6
+ }
@@ -0,0 +1,6 @@
1
+ {
2
+ "action": "coa",
3
+ "targetAccessProfile": "restricted",
4
+ "reasonCode": "device_posture_changed",
5
+ "planHash": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
6
+ }
@@ -0,0 +1,5 @@
1
+ {
2
+ "action": "vendor-coa",
3
+ "targetAccessProfile": "restricted",
4
+ "reasonCode": "device_posture_changed"
5
+ }
@@ -0,0 +1,5 @@
1
+ {
2
+ "action": "coa",
3
+ "targetAccessProfile": "restricted",
4
+ "reasonCode": "device_posture_changed"
5
+ }
@@ -0,0 +1,12 @@
1
+ {
2
+ "sessionId": "session-1",
3
+ "runtimeId": "freeradius-hq",
4
+ "nasId": "nas-hq",
5
+ "requestedAction": "coa",
6
+ "effectiveAction": "coa",
7
+ "currentAccessProfile": "full",
8
+ "targetAccessProfile": "restricted",
9
+ "reasonCode": "device_posture_changed",
10
+ "willDisconnect": false,
11
+ "commandExpiresAt": "2026-09-02T08:05:00Z"
12
+ }
@@ -0,0 +1,13 @@
1
+ {
2
+ "sessionId": "session-1",
3
+ "runtimeId": "freeradius-hq",
4
+ "nasId": "nas-hq",
5
+ "requestedAction": "coa",
6
+ "effectiveAction": "disconnect",
7
+ "currentAccessProfile": "full",
8
+ "targetAccessProfile": "restricted",
9
+ "reasonCode": "device_posture_changed",
10
+ "willDisconnect": true,
11
+ "commandExpiresAt": "2026-09-02T08:05:00Z",
12
+ "planHash": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
13
+ }
@@ -0,0 +1,14 @@
1
+ {
2
+ "id": "command-1",
3
+ "sessionId": "session-1",
4
+ "runtimeId": "freeradius-hq",
5
+ "nasId": "nas-hq",
6
+ "action": "coa",
7
+ "targetAccessProfile": "restricted",
8
+ "policyVersion": 7,
9
+ "status": "running",
10
+ "reasonCode": "device_posture_changed",
11
+ "effectiveAt": "2026-09-02T08:00:00Z",
12
+ "expiresAt": "2026-09-02T08:05:00Z",
13
+ "createdAt": "2026-09-02T08:00:00Z"
14
+ }
@@ -0,0 +1,14 @@
1
+ {
2
+ "id": "command-1",
3
+ "sessionId": "session-1",
4
+ "runtimeId": "freeradius-hq",
5
+ "nasId": "nas-hq",
6
+ "action": "coa",
7
+ "targetAccessProfile": "restricted",
8
+ "policyVersion": 7,
9
+ "status": "pending",
10
+ "reasonCode": "device_posture_changed",
11
+ "effectiveAt": "2026-09-02T08:00:00Z",
12
+ "expiresAt": "2026-09-02T08:05:00Z",
13
+ "createdAt": "2026-09-02T08:00:00Z"
14
+ }
@@ -0,0 +1,4 @@
1
+ {
2
+ "name": "Shanghai Office",
3
+ "status": "unknown"
4
+ }
@@ -0,0 +1,5 @@
1
+ {
2
+ "name": "Shanghai Office",
3
+ "status": "active",
4
+ "location": "Shanghai"
5
+ }
@@ -0,0 +1,9 @@
1
+ {
2
+ "id": "site-a-full",
3
+ "siteId": "site-a",
4
+ "accessProfile": "full",
5
+ "vlanId": 4095,
6
+ "sessionTimeoutSeconds": 3600,
7
+ "createdAt": "2026-09-02T08:00:00Z",
8
+ "updatedAt": "2026-09-02T08:00:00Z"
9
+ }
@@ -0,0 +1,10 @@
1
+ {
2
+ "id": "site-a-full",
3
+ "siteId": "site-a",
4
+ "accessProfile": "full",
5
+ "vlanId": 20,
6
+ "filterId": "soha-full",
7
+ "sessionTimeoutSeconds": 3600,
8
+ "createdAt": "2026-09-02T08:00:00Z",
9
+ "updatedAt": "2026-09-02T08:00:00Z"
10
+ }
@@ -0,0 +1,7 @@
1
+ {
2
+ "siteId": "site-a",
3
+ "accessProfile": "quarantine",
4
+ "vlanId": 90,
5
+ "filterId": "soha-quarantine",
6
+ "sessionTimeoutSeconds": 0
7
+ }
@@ -0,0 +1,7 @@
1
+ {
2
+ "siteId": "site-a",
3
+ "accessProfile": "quarantine",
4
+ "vlanId": 90,
5
+ "filterId": "soha-quarantine",
6
+ "sessionTimeoutSeconds": 300
7
+ }
@@ -0,0 +1,6 @@
1
+ {
2
+ "siteId": "site-shanghai",
3
+ "name": "Corporate LAN",
4
+ "status": "active",
5
+ "cidrs": []
6
+ }
@@ -0,0 +1,6 @@
1
+ {
2
+ "siteId": "site-shanghai",
3
+ "name": "Corporate LAN",
4
+ "status": "active",
5
+ "cidrs": ["10.999.0.0/16"]
6
+ }
@@ -0,0 +1,6 @@
1
+ {
2
+ "siteId": "site-shanghai",
3
+ "name": "Corporate LAN",
4
+ "status": "active",
5
+ "cidrs": ["10.42.0.0/16"]
6
+ }
@@ -0,0 +1,29 @@
1
+ {
2
+ "from": "2026-09-03T00:00:00Z",
3
+ "to": "2026-09-03T01:00:00Z",
4
+ "eventCount": 1,
5
+ "heartbeatCount": 0,
6
+ "radiusAccountingCount": 0,
7
+ "networkFlowCount": 0,
8
+ "connectionSummaryCount": 0,
9
+ "proxyFlowCount": 1,
10
+ "uploadBytes": 1,
11
+ "downloadBytes": 2,
12
+ "activeConnections": 1,
13
+ "producers": [],
14
+ "proxyFlows": [
15
+ {
16
+ "producerId": "endpoint-01",
17
+ "engine": "mihomo",
18
+ "profileId": "profile-01",
19
+ "profileRevision": 1,
20
+ "mode": "managed_follow",
21
+ "selectedProxy": "edge-a",
22
+ "uploadBytes": 1,
23
+ "downloadBytes": 2,
24
+ "activeConnections": 1,
25
+ "lastOccurredAt": "2026-09-03T00:59:00Z",
26
+ "destinationHost": "must-not-leave-ingest"
27
+ }
28
+ ]
29
+ }