@opensoha/contracts 0.1.26 → 0.1.27

package/COMPATIBILITY.md

@@ -22,6 +22,16 @@ Current stream: `0.1.x`.
 - `1.0.0` starts the stable contract line. After `1.0.0`, breaking changes
   require a major version bump, a migration note, and consumer coordination.
 
+## Proxy Configuration Inputs
+
+The proxy configuration endpoint accepts partial updates through
+`NetworkProxyConfigurationPatchInput`. Its optional `content` distinguishes omission
+from an explicit empty value. Existing Go consumers retain
+`NetworkProxyConfigurationInput.Content` as a string and the full-input
+`UpdateNetworkProxyConfigurationJSONRequestBody` alias. New Go consumers that omit
+encrypted content must explicitly use the Patch input. TypeScript operation types
+follow the partial HTTP schema. Both full and partial requests use the same endpoint.
+
 ## Version Synchronization
 
 Each release must keep these values aligned:

package/auth/catalog_generated.go

@@ -6,8 +6,8 @@ import _ "embed"
 
 const (
 	PermissionCatalogVersion = "2.0.0"
-	PermissionCatalogContentSHA256 = "2d98b53189afa67c09a2917325e3b1b1b70aafe00d370bdabaef7d6b11ef493c"
-	PermissionCatalogSHA256 = "ae344007ad96fa0b24a0bf74121e1db762a1b904e58b8c8b53a8ac9168abea80"
+	PermissionCatalogContentSHA256 = "bd4a7240d34750d3fcf38b4649f6dbe67b17fb0f6ebeb96a32f8d874685e5150"
+	PermissionCatalogSHA256 = "835ccdfccfa955ae3ee9377fffb4c523b53d2eb647d01840f79cce5524d72c36"
 )
 
 //go:embed permission-catalog.json

package/auth/permission-catalog.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "authorization.opensoha.io/v1",
   "catalogVersion": "2.0.0",
-  "contentHash": "sha256:2d98b53189afa67c09a2917325e3b1b1b70aafe00d370bdabaef7d6b11ef493c",
+  "contentHash": "sha256:bd4a7240d34750d3fcf38b4649f6dbe67b17fb0f6ebeb96a32f8d874685e5150",
   "permissions": [
     {
       "key": "access.directory.create",
@@ -3624,6 +3624,86 @@
       "status": "active",
       "assignable": true
     },
+    {
+      "key": "docker.dlp-appeals.review",
+      "domain": "docker",
+      "resource": "dlp-appeals",
+      "action": "approve",
+      "displayName": "审查卷文件 DLP 申诉",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "docker.dlp-events.view",
+      "domain": "docker",
+      "resource": "dlp-events",
+      "action": "view",
+      "displayName": "查看卷文件 DLP 事件",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "docker.dlp-policy.publish",
+      "domain": "docker",
+      "resource": "dlp-policy",
+      "action": "trigger",
+      "displayName": "发布卷文件 DLP 策略",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "docker.dlp-policy.update",
+      "domain": "docker",
+      "resource": "dlp-policy",
+      "action": "update",
+      "displayName": "编辑卷文件 DLP 草稿",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "docker.dlp-policy.view",
+      "domain": "docker",
+      "resource": "dlp-policy",
+      "action": "view",
+      "displayName": "查看卷文件 DLP 策略",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "docker.hosts.create",
       "domain": "docker",
@@ -4742,6 +4822,214 @@
       "status": "active",
       "assignable": true
     },
+    {
+      "key": "network_access.content_destinations.publish",
+      "domain": "network_access",
+      "resource": "content_destinations",
+      "action": "publish",
+      "displayName": "发布受管内容目的连接",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.content_destinations.update",
+      "domain": "network_access",
+      "resource": "content_destinations",
+      "action": "update",
+      "displayName": "编辑受管内容目的连接",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.content_destinations.view",
+      "domain": "network_access",
+      "resource": "content_destinations",
+      "action": "view",
+      "displayName": "查看受管内容目的连接",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.content_transfer_appeals.review",
+      "domain": "network_access",
+      "resource": "content_transfer_appeals",
+      "action": "review",
+      "displayName": "审查受管内容申诉",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.content_transfer_events.view",
+      "domain": "network_access",
+      "resource": "content_transfer_events",
+      "action": "view",
+      "displayName": "查看受管内容安全事件",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.content_transfers.create",
+      "domain": "network_access",
+      "resource": "content_transfers",
+      "action": "create",
+      "displayName": "提交受管内容传输",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.content_transfers.delete",
+      "domain": "network_access",
+      "resource": "content_transfers",
+      "action": "delete",
+      "displayName": "删除自己的受管文件",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.content_transfers.download",
+      "domain": "network_access",
+      "resource": "content_transfers",
+      "action": "download",
+      "displayName": "下载自己的受管文件",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.content_transfers.view",
+      "domain": "network_access",
+      "resource": "content_transfers",
+      "action": "view",
+      "displayName": "查看自己的受管内容记录",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.dlp_linkage.manage",
+      "domain": "network_access",
+      "resource": "dlp_linkage",
+      "action": "update",
+      "displayName": "管理全主体 DLP 网络联动",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.endpoint_controls.publish",
+      "domain": "network_access",
+      "resource": "endpoint_controls",
+      "action": "publish",
+      "displayName": "发布端点通道控制",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.endpoint_controls.update",
+      "domain": "network_access",
+      "resource": "endpoint_controls",
+      "action": "update",
+      "displayName": "编辑端点通道策略",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.endpoint_controls.view",
+      "domain": "network_access",
+      "resource": "endpoint_controls",
+      "action": "view",
+      "displayName": "查看端点通道策略与回执",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "network_access.endpoint_devices.update",
       "domain": "network_access",
@@ -4774,6 +5062,150 @@
       "status": "active",
       "assignable": true
     },
+    {
+      "key": "network_access.endpoint_response_events.maintenance",
+      "domain": "network_access",
+      "resource": "endpoint_response_events",
+      "action": "maintenance",
+      "displayName": "管理终端维护例外",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.endpoint_response_events.restore",
+      "domain": "network_access",
+      "resource": "endpoint_response_events",
+      "action": "restore",
+      "displayName": "解除终端联动限制",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.endpoint_response_events.view",
+      "domain": "network_access",
+      "resource": "endpoint_response_events",
+      "action": "view",
+      "displayName": "查看终端联动事件",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.endpoint_response_policies.create",
+      "domain": "network_access",
+      "resource": "endpoint_response_policies",
+      "action": "create",
+      "displayName": "创建终端联动策略",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.endpoint_response_policies.delete",
+      "domain": "network_access",
+      "resource": "endpoint_response_policies",
+      "action": "delete",
+      "displayName": "停用终端联动策略",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.endpoint_response_policies.preview",
+      "domain": "network_access",
+      "resource": "endpoint_response_policies",
+      "action": "preview",
+      "displayName": "预览终端联动策略",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.endpoint_response_policies.publish",
+      "domain": "network_access",
+      "resource": "endpoint_response_policies",
+      "action": "publish",
+      "displayName": "发布终端联动策略",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.endpoint_response_policies.update",
+      "domain": "network_access",
+      "resource": "endpoint_response_policies",
+      "action": "update",
+      "displayName": "修改终端联动策略",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.endpoint_response_policies.view",
+      "domain": "network_access",
+      "resource": "endpoint_response_policies",
+      "action": "view",
+      "displayName": "查看终端联动策略",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "network_access.enrollments.create",
       "domain": "network_access",
@@ -5478,6 +5910,54 @@
       "status": "active",
       "assignable": true
     },
+    {
+      "key": "network_access.vpn_sessions.release",
+      "domain": "network_access",
+      "resource": "vpn_sessions",
+      "action": "release",
+      "displayName": "解除 VPN 重连限制",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.vpn_sessions.revoke",
+      "domain": "network_access",
+      "resource": "vpn_sessions",
+      "action": "revoke",
+      "displayName": "撤销 VPN 会话与重连",
+      "riskLevel": "execute",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.vpn_sessions.view",
+      "domain": "network_access",
+      "resource": "vpn_sessions",
+      "action": "view",
+      "displayName": "查看 VPN 会话限制",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "observe.ai.chat",
       "domain": "observe",

package/compat/json-schema-ecosystem-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.26",
+  "version": "0.1.27",
   "schemas": {
     "plugins/plugin-manifest.schema.json": {
       "rootRequired": ["id", "name", "publisher", "type", "version"],

package/compat/openapi-loose-boundaries-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.26",
+  "version": "0.1.27",
   "generatedFrom": "openapi/soha-api.yaml",
   "entries": [
     {

package/endpointcontrol/decode.go

@@ -0,0 +1,64 @@
+package endpointcontrol
+
+import (
+	"errors"
+	"time"
+)
+
+// Required booleans must be present, including explicit false. Missing input
+// must never become a newer all-off policy through Go zero values.
+func (c *Controls) UnmarshalJSON(raw []byte) error {
+	var w struct {
+		USB       *bool `json:"usb"`
+		Print     *bool `json:"print"`
+		Clipboard *bool `json:"clipboard"`
+	}
+	if err := Decode(raw, &w); err != nil {
+		return err
+	}
+	if w.USB == nil || w.Print == nil || w.Clipboard == nil {
+		return errors.New("all native channel decisions are required")
+	}
+	*c = Controls{USB: *w.USB, Print: *w.Print, Clipboard: *w.Clipboard}
+	return nil
+}
+func (d *Desired) UnmarshalJSON(raw []byte) error {
+	var w struct {
+		Configured    *bool      `json:"configured"`
+		SchemaVersion string     `json:"schemaVersion"`
+		DeviceID      string     `json:"deviceId"`
+		RuntimeID     string     `json:"runtimeId"`
+		CredentialID  string     `json:"credentialId"`
+		PolicyVersion *int64     `json:"policyVersion"`
+		Controls      *Controls  `json:"controls"`
+		Challenge     string     `json:"challenge"`
+		IssuedAt      *time.Time `json:"issuedAt"`
+		ValidUntil    *time.Time `json:"validUntil"`
+	}
+	if err := Decode(raw, &w); err != nil {
+		return err
+	}
+	if w.Configured == nil || w.PolicyVersion == nil || w.Controls == nil || w.IssuedAt == nil || w.ValidUntil == nil {
+		return errors.New("native channel envelope has missing required fields")
+	}
+	*d = Desired{Configured: *w.Configured, SchemaVersion: w.SchemaVersion, DeviceID: w.DeviceID, RuntimeID: w.RuntimeID, CredentialID: w.CredentialID, PolicyVersion: *w.PolicyVersion, Controls: *w.Controls, Challenge: w.Challenge, IssuedAt: *w.IssuedAt, ValidUntil: *w.ValidUntil}
+	return nil
+}
+func (c *Channel) UnmarshalJSON(raw []byte) error {
+	var w struct {
+		Name       string `json:"name"`
+		Scope      string `json:"scope"`
+		State      string `json:"state"`
+		Targets    *int   `json:"targets"`
+		Controlled *int   `json:"controlled"`
+		ReasonCode string `json:"reasonCode"`
+	}
+	if err := Decode(raw, &w); err != nil {
+		return err
+	}
+	if w.Targets == nil || w.Controlled == nil {
+		return errors.New("native channel counts are required")
+	}
+	*c = Channel{Name: w.Name, Scope: w.Scope, State: w.State, Targets: *w.Targets, Controlled: *w.Controlled, ReasonCode: w.ReasonCode}
+	return nil
+}