@opensoha/contracts 0.1.24 → 0.1.26

package/resource/resource_monitoring.go

@@ -0,0 +1,99 @@
+package resource
+
+const ResourceMonitoringSnapshotFeature = "resource.monitoring.snapshot.v1"
+const ResourceMonitoringMaxNodes = 500
+const ResourceMonitoringMaxPoints = 1440
+const ResourceMonitoringMaxTotalPoints = 60000
+
+type ResourceMonitoringQuery struct {
+	View         string `json:"view"`
+	Node         string `json:"node,omitempty"`
+	From         string `json:"from,omitempty"`
+	To           string `json:"to,omitempty"`
+	RangeMinutes int    `json:"rangeMinutes,omitempty"`
+	StepSeconds  int    `json:"stepSeconds,omitempty"`
+}
+
+type ResourceMonitoringQuantity struct {
+	CPUCores    *float64 `json:"cpuCores"`
+	MemoryBytes *float64 `json:"memoryBytes"`
+	PodSlots    *float64 `json:"podSlots"`
+}
+
+type ResourceMonitoringNode struct {
+	NodeRef              ResourceRef                `json:"nodeRef"`
+	InternalIP           string                     `json:"internalIP,omitempty"`
+	OS                   string                     `json:"os,omitempty"`
+	CreatedAt            string                     `json:"createdAt,omitempty"`
+	Ready                string                     `json:"ready"`
+	Cordoned             bool                       `json:"cordoned"`
+	MemoryPressure       string                     `json:"memoryPressure"`
+	DiskPressure         string                     `json:"diskPressure"`
+	PIDPressure          string                     `json:"pidPressure"`
+	Capacity             ResourceMonitoringQuantity `json:"capacity"`
+	Allocatable          ResourceMonitoringQuantity `json:"allocatable"`
+	Requests             ResourceMonitoringQuantity `json:"requests"`
+	Limits               ResourceMonitoringQuantity `json:"limits"`
+	CPULimitsComplete    bool                       `json:"cpuLimitsComplete"`
+	MemoryLimitsComplete bool                       `json:"memoryLimitsComplete"`
+	BoundPods            *float64                   `json:"boundPods"`
+	PendingPods          *float64                   `json:"pendingPods"`
+	RemainingPodSlots    *float64                   `json:"remainingPodSlots"`
+	OverflowPodSlots     *float64                   `json:"overflowPodSlots"`
+	Quality              string                     `json:"quality"`
+	ObservedAt           string                     `json:"observedAt,omitempty"`
+}
+
+type ResourceMonitoringInventory struct {
+	Nodes                  []ResourceMonitoringNode `json:"nodes"`
+	UnscheduledPendingPods *float64                 `json:"unscheduledPendingPods"`
+	Quality                string                   `json:"quality"`
+	ReasonCode             string                   `json:"reasonCode,omitempty"`
+	ObservedAt             string                   `json:"observedAt"`
+	Truncated              bool                     `json:"truncated,omitempty"`
+}
+
+type ResourceMonitoringPoint struct {
+	Timestamp string   `json:"timestamp"`
+	Value     *float64 `json:"value"`
+}
+
+type ResourceMonitoringSeries struct {
+	NodeRef    ResourceRef               `json:"nodeRef"`
+	MetricKey  string                    `json:"metricKey"`
+	Unit       string                    `json:"unit"`
+	Quality    string                    `json:"quality"`
+	ReasonCode string                    `json:"reasonCode,omitempty"`
+	Source     string                    `json:"source"`
+	SampledAt  string                    `json:"sampledAt,omitempty"`
+	Latest     *float64                  `json:"latest"`
+	Points     []ResourceMonitoringPoint `json:"points"`
+}
+
+type ResourceMonitoringPanel struct {
+	Key           string                     `json:"key"`
+	Label         string                     `json:"label"`
+	Unit          string                     `json:"unit"`
+	Quality       string                     `json:"quality"`
+	ReasonCode    string                     `json:"reasonCode,omitempty"`
+	Estimated     bool                       `json:"estimated,omitempty"`
+	WindowSeconds int                        `json:"windowSeconds,omitempty"`
+	Series        []ResourceMonitoringSeries `json:"series"`
+}
+
+type ResourceMonitoringView struct {
+	NodeOptions            []ResourceRef             `json:"nodeOptions,omitempty"`
+	ClusterID              string                    `json:"clusterId"`
+	View                   string                    `json:"view"`
+	Node                   string                    `json:"node,omitempty"`
+	From                   string                    `json:"from"`
+	To                     string                    `json:"to"`
+	StepSeconds            int                       `json:"stepSeconds"`
+	GeneratedAt            string                    `json:"generatedAt"`
+	SnapshotObservedAt     string                    `json:"snapshotObservedAt,omitempty"`
+	SnapshotQuality        string                    `json:"snapshotQuality"`
+	UnscheduledPendingPods *float64                  `json:"unscheduledPendingPods"`
+	Nodes                  []ResourceMonitoringNode  `json:"nodes"`
+	Panels                 []ResourceMonitoringPanel `json:"panels"`
+	Truncated              bool                      `json:"truncated,omitempty"`
+}

package/resource/root_cr.go

@@ -0,0 +1,38 @@
+package resource
+
+import (
+	"fmt"
+	"github.com/opensoha/soha-contracts/gen/go/sohaapi"
+	"strings"
+)
+
+// ValidateRootCRDocument prevents a root publication from changing runtime metadata
+// or writing generated children. Operator reconciliation remains independent.
+func ValidateRootCRDocument(object map[string]any, root sohaapi.ManifestRootResource) error {
+	metadata, ok := object["metadata"].(map[string]any)
+	if !ok {
+		return fmt.Errorf("root CR metadata is required")
+	}
+	if root.UID == "" || root.Generation < 1 || root.CrdName == "" || !strings.Contains(root.APIVersion, "/") || root.Namespace == "" {
+		return fmt.Errorf("root CR requires a frozen namespaced identity")
+	}
+	if object["apiVersion"] != root.APIVersion || object["kind"] != root.Kind || metadata["namespace"] != root.Namespace || metadata["name"] != root.Name {
+		return fmt.Errorf("root CR identity differs from the approved resource")
+	}
+	for key := range object {
+		switch key {
+		case "apiVersion", "kind", "metadata", "spec":
+		default:
+			return fmt.Errorf("root CR updates only support spec")
+		}
+	}
+	for key := range metadata {
+		if key != "name" && key != "namespace" {
+			return fmt.Errorf("root CR runtime metadata cannot be published")
+		}
+	}
+	if _, ok := object["spec"].(map[string]any); !ok {
+		return fmt.Errorf("root CR spec must be an object")
+	}
+	return nil
+}

package/resource/runtime/argocd_integration_test.go

@@ -37,7 +37,7 @@ func TestArgoCDWithKubernetes(t *testing.T) {
 	operatorRequire(t, err)
 	kube, err := kubernetes.NewForConfig(config)
 	operatorRequire(t, err)
-	data, err := os.ReadFile(os.Getenv("SOHA_ARGOCD_TEST_STATE"))
+	data, err := os.ReadFile(os.Getenv("SOHA_ARGOCD_TEST_STATE")) // #nosec G703 -- Opt-in integration test reads the operator-selected local fixture path; no server request controls it.
 	operatorRequire(t, err)
 	var state map[string]json.RawMessage
 	operatorRequire(t, json.Unmarshal(data, &state))

package/resource/runtime/initialization.go

@@ -0,0 +1,66 @@
+package runtime
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/opensoha/soha-contracts/gen/go/sohaapi"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/client-go/dynamic"
+)
+
+const ManifestInitializationCapability = "manifest.initialize.v1"
+const ManifestInitializationProviderPrefix = "manifest_initialize_v1."
+
+// ValidateManifestInitialization fences the new mode from legacy/controller writes.
+// Callers still own current authorization, immutable Plan validation and admission.
+func ValidateManifestInitialization(p sohaapi.ManifestExecutionTaskPayload) error {
+	if p.InitializationPlanID == "" {
+		return nil
+	}
+	if strings.TrimSpace(p.InitializationPlanID) != p.InitializationPlanID || len(p.InitializationPlanID) > 128 || p.ForceConflicts || p.RootResource != nil || p.RolloutControl != nil || len(p.GitOpsDocuments) != 0 {
+		return fmt.Errorf("%w: invalid initialization boundary", ErrResourceOwnership)
+	}
+	if p.Action != sohaapi.ManifestTaskActionPreflight && p.Action != sohaapi.ManifestTaskActionApply && p.Action != sohaapi.ManifestTaskActionObserve {
+		return fmt.Errorf("%w: initialization requires preflight, apply or observation", ErrResourceOwnership)
+	}
+	if IsRolloutTask(p) {
+		return fmt.Errorf("%w: controller delivery cannot guarantee create-only initialization", ErrResourceOwnership)
+	}
+	for _, document := range p.Documents {
+		if initializationController(document.APIVersion, document.Kind) {
+			return fmt.Errorf("%w: controller delivery cannot guarantee create-only initialization", ErrResourceOwnership)
+		}
+	}
+	return nil
+}
+
+func initializationController(apiVersion, kind string) bool {
+	return strings.HasPrefix(apiVersion, "kustomize.toolkit.fluxcd.io/") || strings.HasPrefix(apiVersion, "helm.toolkit.fluxcd.io/") || strings.HasPrefix(apiVersion, "argoproj.io/") && (kind == "Application" || kind == "Rollout")
+}
+
+// CreateManifest never falls back to SSA or adopts a concurrent object. Kubernetes
+// validates non-existence atomically for both dry-run and the actual POST.
+func CreateManifest(ctx context.Context, client dynamic.ResourceInterface, desired *unstructured.Unstructured, options metav1.CreateOptions) (*unstructured.Unstructured, error) {
+	if desired.GetUID() != "" || desired.GetResourceVersion() != "" || desired.GetGenerateName() != "" {
+		return nil, fmt.Errorf("%w: initialization requires a new named resource", ErrResourceOwnership)
+	}
+	if initializationController(desired.GetAPIVersion(), desired.GetKind()) {
+		return nil, fmt.Errorf("%w: controller delivery requires its existing publication path", ErrResourceOwnership)
+	}
+	if err := ValidateDirectManifestOwner(desired); err != nil {
+		return nil, err
+	}
+	return client.Create(ctx, desired, options)
+}
+
+// ValidateInitializedUID prevents a healthy same-name replacement from confirming
+// the baseline of a different object created by the approved initialization.
+func ValidateInitializedUID(live metav1.Object, expectedUID string) error {
+	if live == nil || expectedUID == "" || live.GetUID() == "" || string(live.GetUID()) != expectedUID {
+		return fmt.Errorf("%w: initialized resource identity is missing or changed", ErrResourceOwnership)
+	}
+	return nil
+}

package/resource/runtime/initialization_test.go

@@ -0,0 +1,80 @@
+package runtime
+
+import (
+	"context"
+	"testing"
+
+	"github.com/opensoha/soha-contracts/gen/go/sohaapi"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/client-go/dynamic/fake"
+	ktesting "k8s.io/client-go/testing"
+)
+
+func TestManifestInitializationCreatesWithoutAdoption(t *testing.T) {
+	object := &unstructured.Unstructured{Object: map[string]any{"apiVersion": "v1", "kind": "ConfigMap", "metadata": map[string]any{"name": "settings", "namespace": "test"}}}
+	gvr := schema.GroupVersionResource{Version: "v1", Resource: "configmaps"}
+	for _, existing := range []bool{false, true} {
+		t.Run(map[bool]string{false: "new", true: "concurrently-created"}[existing], func(t *testing.T) {
+			client := fake.NewSimpleDynamicClient(runtime.NewScheme())
+			if existing {
+				if err := client.Tracker().Create(gvr, object.DeepCopy(), "test"); err != nil {
+					t.Fatal(err)
+				}
+			}
+			_, err := CreateManifest(t.Context(), client.Resource(gvr).Namespace("test"), object.DeepCopy(), metav1.CreateOptions{})
+			if existing && !apierrors.IsAlreadyExists(err) || !existing && err != nil {
+				t.Fatalf("create existing=%v: %v", existing, err)
+			}
+			for _, action := range client.Actions() {
+				if action.GetVerb() != "create" {
+					t.Fatalf("initialization used %s instead of atomic create", action.GetVerb())
+				}
+			}
+		})
+	}
+	client := fake.NewSimpleDynamicClient(runtime.NewScheme())
+	client.PrependReactor("create", "configmaps", func(action ktesting.Action) (bool, runtime.Object, error) {
+		typed, ok := action.(interface{ GetCreateOptions() metav1.CreateOptions })
+		if !ok {
+			t.Fatalf("missing create options: %T", action)
+		}
+		if options := typed.GetCreateOptions(); len(options.DryRun) != 1 || options.DryRun[0] != metav1.DryRunAll {
+			t.Fatal("preflight lost server dry-run")
+		}
+		return true, object.DeepCopy(), nil
+	})
+	if _, err := CreateManifest(context.Background(), client.Resource(gvr).Namespace("test"), object, metav1.CreateOptions{DryRun: []string{metav1.DryRunAll}}); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestManifestInitializationRejectsUnsafeModesAndReplacedUID(t *testing.T) {
+	p := sohaapi.ManifestExecutionTaskPayload{InitializationPlanID: "plan", Action: sohaapi.ManifestTaskActionApply}
+	if err := ValidateManifestInitialization(p); err != nil {
+		t.Fatal(err)
+	}
+	for _, action := range []sohaapi.ManifestTaskAction{sohaapi.ManifestTaskActionRepair, sohaapi.ManifestTaskActionRollback, sohaapi.ManifestTaskActionAdopt} {
+		p.Action = action
+		if err := ValidateManifestInitialization(p); err == nil {
+			t.Fatalf("accepted initialization %s", action)
+		}
+	}
+	p.Action, p.ForceConflicts = sohaapi.ManifestTaskActionApply, true
+	if ValidateManifestInitialization(p) == nil {
+		t.Fatal("initialization accepted forced conflicts")
+	}
+	live := &unstructured.Unstructured{}
+	live.SetUID("created-uid")
+	if err := ValidateInitializedUID(live, "created-uid"); err != nil {
+		t.Fatal(err)
+	}
+	for _, expected := range []string{"", "replaced-uid"} {
+		if ValidateInitializedUID(live, expected) == nil {
+			t.Fatal("unproven initialization UID was accepted")
+		}
+	}
+}

package/resource/runtime/network_topology.go

@@ -0,0 +1,232 @@
+package runtime
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+	"sync"
+	"time"
+
+	resource "github.com/opensoha/soha-contracts/resource"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/client-go/rest"
+)
+
+// ReadNetworkTopologySnapshot performs only fixed, discovery-verified, bounded reads.
+// The caller authenticates and authorizes each query before invoking this reader.
+func ReadNetworkTopologySnapshot(ctx context.Context, client rest.Interface, clusterID string, input resource.NetworkTopologySnapshotRequest) (resource.NetworkTopologySnapshot, error) {
+	if err := resource.ValidateNetworkTopologySnapshotRequest(input); err != nil {
+		return resource.NetworkTopologySnapshot{}, err
+	}
+	if client == nil {
+		return resource.NetworkTopologySnapshot{}, fmt.Errorf("kubernetes REST client unavailable")
+	}
+	ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
+	defer cancel()
+	output := resource.NetworkTopologySnapshot{Version: resource.NetworkTopologySnapshotFeature, Sources: make([]resource.NetworkTopologySourceResult, len(input.Queries))}
+	budget := &topologyReadBudget{remaining: resource.NetworkTopologyMaxTotalBytes}
+	sem := make(chan struct{}, 4)
+	var wg sync.WaitGroup
+	for index, query := range input.Queries {
+		wg.Add(1)
+		go func(index int, query resource.NetworkTopologySourceQuery) {
+			defer wg.Done()
+			select {
+			case sem <- struct{}{}:
+				defer func() { <-sem }()
+			case <-ctx.Done():
+				output.Sources[index] = topologySourceFailure(query, "error", "timeout")
+				return
+			}
+			output.Sources[index] = readTopologySource(ctx, client, clusterID, query, budget)
+		}(index, query)
+	}
+	wg.Wait()
+	total := 0
+	for i := range output.Sources {
+		source := &output.Sources[i]
+		kept := source.Objects[:0]
+		for _, object := range source.Objects {
+			size := len(object.Content)
+			if total+size > resource.NetworkTopologyMaxTotalBytes {
+				source.Coverage.State = "partial"
+				source.Coverage.Truncated = true
+				source.Coverage.ReasonCode = "total_budget"
+				continue
+			}
+			total += size
+			kept = append(kept, object)
+		}
+		source.Objects = kept
+	}
+	return output, nil
+}
+
+func topologySourceFailure(query resource.NetworkTopologySourceQuery, state, reason string) resource.NetworkTopologySourceResult {
+	definition, _ := resource.LookupNetworkTopologySource(query.SourceID)
+	return resource.NetworkTopologySourceResult{Coverage: resource.NetworkTopologyCoverage{Provider: definition.Provider, SourceID: query.SourceID, Namespace: query.Namespace, State: state, ReasonCode: reason, CheckedAt: time.Now().UTC().Format(time.RFC3339), SupportedKinds: []string{definition.Kind}}, Objects: []resource.NetworkTopologySourceObject{}}
+}
+
+func readTopologySource(ctx context.Context, client rest.Interface, clusterID string, query resource.NetworkTopologySourceQuery, budget *topologyReadBudget) resource.NetworkTopologySourceResult {
+	definition, _ := resource.LookupNetworkTopologySource(query.SourceID)
+	result := topologySourceFailure(query, "available", "")
+	version, err := discoverTopologySource(ctx, client, definition, budget)
+	if err != nil {
+		result.Coverage.State, result.Coverage.ReasonCode = topologyReadError(err)
+		return result
+	}
+	base := topologyAPIBase(definition.Group, version)
+	if query.Namespace != "" {
+		base += "/namespaces/" + query.Namespace
+	}
+	raw, err := boundedTopologyGET(ctx, client, base+"/"+definition.Resource, true, budget)
+	if err != nil {
+		result.Coverage.State, result.Coverage.ReasonCode = topologyReadError(err)
+		return result
+	}
+	var list struct {
+		Metadata struct {
+			Continue string `json:"continue"`
+		} `json:"metadata"`
+		Items []map[string]any `json:"items"`
+	}
+	if json.Unmarshal(raw, &list) != nil {
+		result.Coverage.State = "error"
+		result.Coverage.ReasonCode = "invalid_response"
+		return result
+	}
+	result.Coverage.ObservedAt = time.Now().UTC().Format(time.RFC3339)
+	if len(list.Items) > resource.NetworkTopologyMaxSourceItems || list.Metadata.Continue != "" {
+		result.Coverage.Truncated = true
+		result.Coverage.State = "partial"
+		result.Coverage.ReasonCode = "item_budget"
+	}
+	for index, object := range list.Items {
+		if index >= resource.NetworkTopologyMaxSourceItems {
+			break
+		}
+		projected, err := resource.ProjectNetworkTopologyObject(query.SourceID, object)
+		if err != nil {
+			result.Coverage.Truncated = true
+			result.Coverage.State = "partial"
+			result.Coverage.ReasonCode = "object_budget"
+			continue
+		}
+		metadata, _ := projected["metadata"].(map[string]any)
+		name, _ := metadata["name"].(string)
+		namespace, _ := metadata["namespace"].(string)
+		if name == "" || (query.Namespace != "" && namespace != query.Namespace) {
+			result.Coverage.State = "partial"
+			result.Coverage.ReasonCode = "invalid_identity"
+			continue
+		}
+		uid, _ := metadata["uid"].(string)
+		rv, _ := metadata["resourceVersion"].(string)
+		generation, _ := metadata["generation"].(float64)
+		content, _ := json.Marshal(projected)
+		result.Objects = append(result.Objects, resource.NetworkTopologySourceObject{Resource: resource.ResourceRef{ClusterID: clusterID, APIVersion: strings.TrimPrefix(definition.Group+"/"+version, "/"), ScopeMode: topologyScope(definition.Namespaced), Kind: definition.Kind, Namespace: namespace, Name: name, UID: uid, ResourceVersion: rv}, Generation: int64(generation), Content: string(content)})
+	}
+	return result
+}
+
+func topologyAPIBase(group, version string) string {
+	if group == "" {
+		return "/api/" + version
+	}
+	return "/apis/" + group + "/" + version
+}
+
+func discoverTopologySource(ctx context.Context, client rest.Interface, definition resource.NetworkTopologySourceDefinition, budget *topologyReadBudget) (string, error) {
+	versions := []string{definition.Version}
+	if definition.FallbackVersion != "" {
+		versions = append(versions, definition.FallbackVersion)
+	}
+	for _, version := range versions {
+		raw, err := boundedTopologyGET(ctx, client, topologyAPIBase(definition.Group, version), false, budget)
+		if apierrors.IsNotFound(err) {
+			continue
+		}
+		if err != nil {
+			return "", err
+		}
+		var list metav1.APIResourceList
+		if err := json.Unmarshal(raw, &list); err != nil {
+			return "", fmt.Errorf("invalid discovery")
+		}
+		for _, item := range list.APIResources {
+			if item.Name == definition.Resource && item.Kind == definition.Kind && item.Namespaced == definition.Namespaced {
+				return version, nil
+			}
+		}
+	}
+	return "", apierrors.NewNotFound(schema.GroupResource{Group: definition.Group, Resource: definition.Resource}, "")
+}
+
+func boundedTopologyGET(ctx context.Context, client rest.Interface, path string, list bool, budget *topologyReadBudget) ([]byte, error) {
+	request := client.Get().AbsPath(path).SetHeader("Accept", "application/json")
+	if list {
+		request = request.Param("limit", fmt.Sprint(resource.NetworkTopologyMaxSourceItems))
+	}
+	stream, err := request.Stream(ctx)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = stream.Close() }()
+	body, err := io.ReadAll(io.LimitReader(&topologyBudgetReader{reader: stream, budget: budget}, resource.NetworkTopologyMaxSourceBytes+1))
+	if err != nil {
+		return nil, err
+	}
+	if len(body) > resource.NetworkTopologyMaxSourceBytes {
+		return nil, fmt.Errorf("topology byte budget")
+	}
+	return body, nil
+}
+
+func topologyReadError(err error) (string, string) {
+	switch {
+	case apierrors.IsForbidden(err) || apierrors.IsUnauthorized(err):
+		return "denied", "kubernetes_rbac"
+	case apierrors.IsNotFound(err):
+		return "not_installed", "source_not_served"
+	case strings.Contains(err.Error(), "budget"):
+		return "partial", "byte_budget"
+	default:
+		return "error", "source_unavailable"
+	}
+}
+
+func topologyScope(namespaced bool) resource.ResourceScopeMode {
+	if namespaced {
+		return resource.ResourceScopeModeNamespace
+	}
+	return resource.ResourceScopeModeCluster
+}
+
+type topologyReadBudget struct {
+	mu        sync.Mutex
+	remaining int
+}
+type topologyBudgetReader struct {
+	reader io.Reader
+	budget *topologyReadBudget
+}
+
+func (r *topologyBudgetReader) Read(data []byte) (int, error) {
+	r.budget.mu.Lock()
+	available := min(len(data), r.budget.remaining)
+	r.budget.remaining -= available
+	r.budget.mu.Unlock()
+	if available <= 0 {
+		return 0, errors.New("topology total byte budget")
+	}
+	count, err := r.reader.Read(data[:available])
+	r.budget.mu.Lock()
+	r.budget.remaining += available - count
+	r.budget.mu.Unlock()
+	return count, err
+}

package/resource/runtime/network_topology_test.go

@@ -0,0 +1,62 @@
+package runtime
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	cr "github.com/opensoha/soha-contracts/resource"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+)
+
+func TestTopologySnapshotBoundsDiscoveryAndProjection(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/api/v1":
+			_, _ = fmt.Fprint(w, `{"resources":[{"name":"pods","kind":"Pod","namespaced":true},{"name":"services","kind":"Service","namespaced":true}]}`)
+		case "/api/v1/namespaces/team/pods":
+			if r.URL.Query().Get("limit") != "200" {
+				t.Error("missing item bound")
+			}
+			_, _ = fmt.Fprint(w, `{"metadata":{"continue":"next"},"items":[{"metadata":{"name":"p","namespace":"team","uid":"uid","resourceVersion":"9"},"spec":{"secret":"credential"},"status":{"phase":"Running"}}]}`)
+		case "/api/v1/namespaces/team/services":
+			http.Error(w, `{"kind":"Status","apiVersion":"v1","reason":"Forbidden","code":403}`, http.StatusForbidden)
+		case "/apis/traefik.io/v1alpha1":
+			http.NotFound(w, r)
+		default:
+			t.Errorf("unexpected path: %s", r.URL.Path)
+			http.NotFound(w, r)
+		}
+	}))
+	defer server.Close()
+	client, err := kubernetes.NewForConfig(&rest.Config{Host: server.URL})
+	if err != nil {
+		t.Fatal(err)
+	}
+	output, err := ReadNetworkTopologySnapshot(context.Background(), client.CoreV1().RESTClient(), "cluster", cr.NetworkTopologySnapshotRequest{Queries: []cr.NetworkTopologySourceQuery{{SourceID: "kubernetes.pods", Namespace: "team"}, {SourceID: "kubernetes.services", Namespace: "team"}, {SourceID: "traefik.ingressroutes", Namespace: "team"}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if output.Sources[0].Coverage.State != "partial" || !output.Sources[0].Coverage.Truncated || output.Sources[1].Coverage.State != "denied" || output.Sources[2].Coverage.State != "not_installed" {
+		t.Fatalf("coverage: %+v", output.Sources)
+	}
+	raw, _ := json.Marshal(output)
+	if strings.Contains(string(raw), "credential") {
+		t.Fatal("full manifest escaped")
+	}
+	if output.Sources[0].Objects[0].Resource.ResourceVersion != "9" {
+		t.Fatal("identity lost")
+	}
+}
+
+func TestTopologySnapshotDoesNotReadArbitrarySources(t *testing.T) {
+	_, err := ReadNetworkTopologySnapshot(context.Background(), nil, "c", cr.NetworkTopologySnapshotRequest{Queries: []cr.NetworkTopologySourceQuery{{SourceID: "secrets"}}})
+	if err == nil {
+		t.Fatal("unknown source accepted")
+	}
+}