@opensoha/contracts 0.1.24 → 0.1.25

package/auth/catalog_generated.go

@@ -6,8 +6,8 @@ import _ "embed"
 
 const (
 	PermissionCatalogVersion = "2.0.0"
-	PermissionCatalogContentSHA256 = "b1a07eef4c26f91735b65ec18799e530271a47d0eed1de60f9a955d11208f9a2"
-	PermissionCatalogSHA256 = "e89a89c109f4dca0ba3a5bea754df659aa8d9bf0298344e5f0b9c5cc7520a2d2"
+	PermissionCatalogContentSHA256 = "2d98b53189afa67c09a2917325e3b1b1b70aafe00d370bdabaef7d6b11ef493c"
+	PermissionCatalogSHA256 = "ae344007ad96fa0b24a0bf74121e1db762a1b904e58b8c8b53a8ac9168abea80"
 )
 
 //go:embed permission-catalog.json

package/auth/gateway_permissions_test.go

@@ -0,0 +1,48 @@
+package auth
+
+import (
+	"encoding/json"
+	"slices"
+	"testing"
+)
+
+func TestGatewayRouteMutationPermissionsAreExplicit(t *testing.T) {
+	var catalog struct {
+		Permissions []struct {
+			Key            string   `json:"key"`
+			Resource       string   `json:"resource"`
+			Action         string   `json:"action"`
+			RiskLevel      string   `json:"riskLevel"`
+			ScopeKinds     []string `json:"scopeKinds"`
+			ApprovalPolicy string   `json:"approvalPolicy"`
+			LegacyAliases  []string `json:"legacyAliases"`
+		}
+	}
+	if err := json.Unmarshal(PermissionCatalogJSON(), &catalog); err != nil {
+		t.Fatal(err)
+	}
+	for _, resource := range []string{"http-routes", "grpc-routes", "backend-tls-policies", "reference-grants"} {
+		for _, action := range []string{"create", "update", "delete"} {
+			key := "platform.network." + resource + "." + action
+			var index = -1
+			for i, permission := range catalog.Permissions {
+				if permission.Key == key {
+					index = i
+					break
+				}
+			}
+			if index < 0 {
+				t.Fatalf("missing %s", key)
+			}
+			p := catalog.Permissions[index]
+
+			risk, approval := "mutate", "never"
+			if action == "delete" {
+				risk, approval = "high", "eligible"
+			}
+			if p.Resource != "network."+resource || p.Action != action || p.RiskLevel != risk || p.ApprovalPolicy != approval || !slices.Contains(p.ScopeKinds, "namespace") || len(p.LegacyAliases) != 0 {
+				t.Fatalf("invalid explicit mutation permission: %+v", p)
+			}
+		}
+	}
+}

package/auth/permission-catalog.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "authorization.opensoha.io/v1",
   "catalogVersion": "2.0.0",
-  "contentHash": "sha256:b1a07eef4c26f91735b65ec18799e530271a47d0eed1de60f9a955d11208f9a2",
+  "contentHash": "sha256:2d98b53189afa67c09a2917325e3b1b1b70aafe00d370bdabaef7d6b11ef493c",
   "permissions": [
     {
       "key": "access.directory.create",
@@ -8504,6 +8504,54 @@
       "status": "active",
       "assignable": true
     },
+    {
+      "key": "platform.network.backend-tls-policies.create",
+      "domain": "platform",
+      "resource": "network.backend-tls-policies",
+      "action": "create",
+      "displayName": "创建 Kubernetes BackendTLSPolicy",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.network.backend-tls-policies.delete",
+      "domain": "platform",
+      "resource": "network.backend-tls-policies",
+      "action": "delete",
+      "displayName": "删除 Kubernetes BackendTLSPolicy",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.network.backend-tls-policies.update",
+      "domain": "platform",
+      "resource": "network.backend-tls-policies",
+      "action": "update",
+      "displayName": "修改 Kubernetes BackendTLSPolicy",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "platform.network.backend-tls-policies.view",
       "domain": "platform",
@@ -8755,6 +8803,54 @@
         "platform.network.view"
       ]
     },
+    {
+      "key": "platform.network.grpc-routes.create",
+      "domain": "platform",
+      "resource": "network.grpc-routes",
+      "action": "create",
+      "displayName": "创建 Kubernetes GRPCRoute",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.network.grpc-routes.delete",
+      "domain": "platform",
+      "resource": "network.grpc-routes",
+      "action": "delete",
+      "displayName": "删除 Kubernetes GRPCRoute",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.network.grpc-routes.update",
+      "domain": "platform",
+      "resource": "network.grpc-routes",
+      "action": "update",
+      "displayName": "修改 Kubernetes GRPCRoute",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "platform.network.grpc-routes.view",
       "domain": "platform",
@@ -8775,6 +8871,54 @@
         "platform.network.view"
       ]
     },
+    {
+      "key": "platform.network.http-routes.create",
+      "domain": "platform",
+      "resource": "network.http-routes",
+      "action": "create",
+      "displayName": "创建 Kubernetes HTTPRoute",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.network.http-routes.delete",
+      "domain": "platform",
+      "resource": "network.http-routes",
+      "action": "delete",
+      "displayName": "删除 Kubernetes HTTPRoute",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.network.http-routes.update",
+      "domain": "platform",
+      "resource": "network.http-routes",
+      "action": "update",
+      "displayName": "修改 Kubernetes HTTPRoute",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "platform.network.http-routes.view",
       "domain": "platform",
@@ -9084,6 +9228,54 @@
         "platform.network.view"
       ]
     },
+    {
+      "key": "platform.network.reference-grants.create",
+      "domain": "platform",
+      "resource": "network.reference-grants",
+      "action": "create",
+      "displayName": "创建 Kubernetes ReferenceGrant",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.network.reference-grants.delete",
+      "domain": "platform",
+      "resource": "network.reference-grants",
+      "action": "delete",
+      "displayName": "删除 Kubernetes ReferenceGrant",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.network.reference-grants.update",
+      "domain": "platform",
+      "resource": "network.reference-grants",
+      "action": "update",
+      "displayName": "修改 Kubernetes ReferenceGrant",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "platform.network.reference-grants.view",
       "domain": "platform",
@@ -9358,6 +9550,22 @@
         "enable"
       ]
     },
+    {
+      "key": "platform.pods.create",
+      "domain": "platform",
+      "resource": "pods",
+      "action": "create",
+      "displayName": "创建 Kubernetes Pod",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "platform.pods.delete",
       "domain": "platform",
@@ -9537,6 +9745,81 @@
       "status": "active",
       "assignable": true
     },
+    {
+      "key": "platform.resource-monitoring.conntrack.view",
+      "domain": "platform",
+      "resource": "resource-monitoring.conntrack",
+      "action": "view",
+      "displayName": "查看资源监控连接跟踪",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "workspace",
+        "cluster"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.resource-monitoring.cpu.view",
+      "domain": "platform",
+      "resource": "resource-monitoring.cpu",
+      "action": "view",
+      "displayName": "查看资源监控CPU",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "workspace",
+        "cluster"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.resource-monitoring.memory.view",
+      "domain": "platform",
+      "resource": "resource-monitoring.memory",
+      "action": "view",
+      "displayName": "查看资源监控内存",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "workspace",
+        "cluster"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.resource-monitoring.overview.view",
+      "domain": "platform",
+      "resource": "resource-monitoring.overview",
+      "action": "view",
+      "displayName": "查看资源监控总览",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "workspace",
+        "cluster"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.resource-monitoring.pods.view",
+      "domain": "platform",
+      "resource": "resource-monitoring.pods",
+      "action": "view",
+      "displayName": "查看资源监控Pod 容量",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "workspace",
+        "cluster"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "platform.storage.persistent-volume-claims.create",
       "domain": "platform",
@@ -10183,6 +10466,22 @@
         "create"
       ]
     },
+    {
+      "key": "platform.workloads.replication-controllers.delete",
+      "domain": "platform",
+      "resource": "workloads.replication-controllers",
+      "action": "delete",
+      "displayName": "删除 Kubernetes ReplicationController",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "platform.workloads.replication-controllers.update",
       "domain": "platform",

package/compat/consumer-revisions.json

@@ -1,5 +1,5 @@
 {
-  "soha": "c29cc6294dd4b7cb69db1187d728c227475fdf7c",
+  "soha": "57bfa94873ff2825bccc6312842859011c1ec23a",
   "soha-web": "447cbe5358802ef40d86ac67b7b59c5afe9c846a",
   "soha-app": "0c3c76c373246f7d2218b48f68b89bf3097f777b",
   "soha-cli": "1c9b760c986a9c1a5148db55b72ab99d23edd7a3",

package/compat/json-schema-ecosystem-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.24",
+  "version": "0.1.25",
   "schemas": {
     "plugins/plugin-manifest.schema.json": {
       "rootRequired": ["id", "name", "publisher", "type", "version"],

package/compat/openapi-loose-boundaries-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.24",
+  "version": "0.1.25",
   "generatedFrom": "openapi/soha-api.yaml",
   "entries": [
     {

package/fixtures/openapi/KubernetesAgentActionCheck/invalid/unproven-state.json

@@ -0,0 +1,6 @@
+{
+  "action": "platform.nodes.drain",
+  "implementation": "supported",
+  "configured": "maybe",
+  "kubernetesRBAC": "allowed"
+}

package/fixtures/openapi/KubernetesAgentActionCheck/valid/configured-denied.json

@@ -0,0 +1,9 @@
+{
+  "action": "platform.nodes.drain",
+  "implementation": "supported",
+  "configured": "denied",
+  "kubernetesRBAC": "unknown",
+  "scope": "cluster",
+  "checkedAt": "2026-10-19T01:30:00Z",
+  "reasonCode": "self_subject_access_review"
+}

package/fixtures/openapi/KubernetesAgentActionProfile/invalid/wildcard.json

@@ -0,0 +1 @@
+"*"

package/fixtures/openapi/KubernetesAgentActionProfile/valid/workbench.json

@@ -0,0 +1 @@
+"workbench"

package/fixtures/openapi/KubernetesClusterRegistrationRequest/invalid/action-profile.json

@@ -0,0 +1,3 @@
+{
+  "agentActionProfile": "all"
+}

package/fixtures/openapi/KubernetesClusterRegistrationRequest/valid/action-profile.json

@@ -0,0 +1,5 @@
+{
+  "name": "agent",
+  "connectionMode": "agent",
+  "agentActionProfile": "read-only"
+}

package/fixtures/openapi/KubernetesNodeListEnvelope/invalid/condition-status-boolean.json

@@ -0,0 +1,17 @@
+{
+  "items": [
+    {
+      "name": "worker-a",
+      "status": "ready",
+      "unschedulable": true,
+      "podCount": 2,
+      "ageSeconds": 3600,
+      "conditions": [
+        {
+          "type": "Ready",
+          "status": true
+        }
+      ]
+    }
+  ]
+}

package/fixtures/openapi/KubernetesNodeListEnvelope/invalid/taint-effect-missing.json

@@ -0,0 +1,16 @@
+{
+  "items": [
+    {
+      "name": "worker-a",
+      "status": "ready",
+      "unschedulable": true,
+      "podCount": 2,
+      "ageSeconds": 3600,
+      "taints": [
+        {
+          "key": "maintenance"
+        }
+      ]
+    }
+  ]
+}

package/fixtures/openapi/KubernetesNodeListEnvelope/valid/legacy-fields-absent.json

@@ -0,0 +1,11 @@
+{
+  "items": [
+    {
+      "name": "worker-a",
+      "status": "ready",
+      "unschedulable": true,
+      "podCount": 2,
+      "ageSeconds": 3600
+    }
+  ]
+}

package/fixtures/openapi/KubernetesNodeListEnvelope/valid/no-taints.json

@@ -0,0 +1,13 @@
+{
+  "items": [
+    {
+      "name": "worker-a",
+      "status": "ready",
+      "unschedulable": false,
+      "podCount": 2,
+      "ageSeconds": 3600,
+      "taints": [],
+      "conditions": []
+    }
+  ]
+}

package/fixtures/openapi/KubernetesNodeListEnvelope/valid/ready-cordoned-tainted.json

@@ -0,0 +1,28 @@
+{
+  "items": [
+    {
+      "name": "worker-a",
+      "status": "ready",
+      "unschedulable": true,
+      "podCount": 2,
+      "ageSeconds": 3600,
+      "taints": [
+        {
+          "key": "maintenance",
+          "value": "task113",
+          "effect": "NoSchedule"
+        }
+      ],
+      "conditions": [
+        {
+          "type": "Ready",
+          "status": "True"
+        },
+        {
+          "type": "DiskPressure",
+          "status": "True"
+        }
+      ]
+    }
+  ]
+}

package/fixtures/openapi/KubernetesNodeListEnvelope/valid/unknown-fields-null.json

@@ -0,0 +1,13 @@
+{
+  "items": [
+    {
+      "name": "worker-a",
+      "status": "ready",
+      "unschedulable": true,
+      "podCount": 2,
+      "ageSeconds": 3600,
+      "taints": null,
+      "conditions": null
+    }
+  ]
+}

package/fixtures/openapi/KubernetesTopologyCoverage/invalid/empty-as-success.json

@@ -0,0 +1,5 @@
+{
+  "provider": "apisix",
+  "sourceId": "apisix.apisixroutes",
+  "state": "empty"
+}

package/fixtures/openapi/KubernetesTopologyCoverage/valid/not-installed.json

@@ -0,0 +1,6 @@
+{
+  "provider": "apisix",
+  "sourceId": "apisix.apisixroutes",
+  "state": "not_installed",
+  "reasonCode": "api_not_served"
+}

package/fixtures/openapi/KubernetesTopologyGraphEdge/invalid/negative-weight.json

@@ -0,0 +1,8 @@
+{
+  "id": "edge-1",
+  "source": "a",
+  "target": "b",
+  "relation": "weights",
+  "resolutionState": "resolved",
+  "weight": -1
+}

package/fixtures/openapi/KubernetesTopologyGraphEdge/valid/zero-weight.json

@@ -0,0 +1,20 @@
+{
+  "id": "edge-1",
+  "source": "rule:route-uid:0",
+  "target": "service-1",
+  "relation": "weights",
+  "resolutionState": "resolved",
+  "port": "http",
+  "weight": 0,
+  "totalWeight": 100,
+  "sourceRef": {
+    "clusterId": "cluster-a",
+    "apiVersion": "traefik.io/v1alpha1",
+    "kind": "IngressRoute",
+    "name": "api",
+    "namespace": "team-a",
+    "scopeMode": "namespace",
+    "uid": "route-uid",
+    "resourceVersion": "7"
+  }
+}

package/fixtures/openapi/KubernetesTopologyGraphNode/invalid/fake-flow-kind.json

@@ -0,0 +1,42 @@
+{
+  "id": "rule:route-uid:0",
+  "type": "live-traffic",
+  "label": "api /",
+  "provider": "traefik",
+  "protocol": "HTTP",
+  "resolutionState": "resolved",
+  "resource": {
+    "clusterId": "cluster-a",
+    "apiVersion": "traefik.io/v1alpha1",
+    "kind": "IngressRoute",
+    "name": "api",
+    "namespace": "team-a",
+    "scopeMode": "namespace",
+    "uid": "route-uid",
+    "resourceVersion": "7"
+  },
+  "rule": {
+    "index": 0,
+    "matchGroups": [
+      [
+        {
+          "type": "host",
+          "operator": "exact",
+          "value": "api.example.test"
+        },
+        {
+          "type": "path",
+          "operator": "prefix",
+          "value": "/"
+        }
+      ]
+    ],
+    "tlsMode": "terminate"
+  },
+  "properties": [
+    {
+      "name": "source",
+      "value": "configuration"
+    }
+  ]
+}