@opensoha/contracts 0.1.27 → 0.2.0

package/gen/go/sohaapi/client.go

@@ -16,7 +16,7 @@ import (
 	"time"
 )
 
-const defaultUserAgent = "opensoha-contracts/0.1.27"
+const defaultUserAgent = "opensoha-contracts/0.2.0"
 
 type Client struct {
 	BaseURL    string
@@ -300,6 +300,113 @@ func (c *Client) GetAuthLoginOptions(ctx context.Context) (LoginOptions, error)
 	return out.Data, nil
 }
 
+func (c *Client) GetCLIAuthOptions(ctx context.Context) (CLIAuthOptions, error) {
+	var out CLIAuthOptionsEnvelope
+	if err := c.doJSON(ctx, http.MethodGet, "/auth/cli/options", false, nil, &out); err != nil {
+		return CLIAuthOptions{}, err
+	}
+	return out.Data, nil
+}
+
+func (c *Client) CreateCLIDeviceAuthorization(ctx context.Context, req CLIDeviceAuthorizationCreateRequest) (CLIDeviceAuthorization, error) {
+	var out CLIDeviceAuthorizationEnvelope
+	if err := c.doJSON(ctx, http.MethodPost, "/auth/cli/device-authorizations", false, req, &out); err != nil {
+		return CLIDeviceAuthorization{}, err
+	}
+	return out.Data, nil
+}
+
+func (c *Client) InspectCLIDeviceAuthorization(ctx context.Context, req CLIDeviceInspectRequest) (CLIDeviceConfirmation, error) {
+	var out CLIDeviceConfirmationEnvelope
+	if err := c.doJSON(ctx, http.MethodPost, "/auth/cli/device-authorizations/inspect", true, req, &out); err != nil {
+		return CLIDeviceConfirmation{}, err
+	}
+	return out.Data, nil
+}
+
+func (c *Client) DecideCLIDeviceAuthorization(ctx context.Context, req CLIDeviceDecisionRequest) (CLIDeviceAuthorizationStatus, error) {
+	var out CLIDeviceAuthorizationStatusEnvelope
+	if err := c.doJSON(ctx, http.MethodPost, "/auth/cli/device-authorizations/decision", true, req, &out); err != nil {
+		return CLIDeviceAuthorizationStatus{}, err
+	}
+	return out.Data, nil
+}
+
+func (c *Client) ExchangeCLIDeviceToken(ctx context.Context, req CLIDeviceTokenRequest) (AuthResult, error) {
+	var out AuthResultEnvelope
+	if err := c.doJSON(ctx, http.MethodPost, "/auth/cli/device-token", false, req, &out); err != nil {
+		return AuthResult{}, err
+	}
+	return out.Data, nil
+}
+
+func (c *Client) CancelCLIDeviceAuthorization(ctx context.Context, req CLIDeviceCancelRequest) (CLIDeviceAuthorizationStatus, error) {
+	var out CLIDeviceAuthorizationStatusEnvelope
+	if err := c.doJSON(ctx, http.MethodPost, "/auth/cli/device-authorizations/cancel", false, req, &out); err != nil {
+		return CLIDeviceAuthorizationStatus{}, err
+	}
+	return out.Data, nil
+}
+
+func (c *Client) CLIPasswordLogin(ctx context.Context, req PasswordLoginRequest) (AuthResult, error) {
+	var out AuthResultEnvelope
+	if err := c.doJSON(ctx, http.MethodPost, "/auth/cli/password", false, req, &out); err != nil {
+		return AuthResult{}, err
+	}
+	return out.Data, nil
+}
+
+func (c *Client) RefreshCLISession(ctx context.Context, req CLIRefreshRequest) (AuthResult, error) {
+	var out AuthResultEnvelope
+	if err := c.doJSON(ctx, http.MethodPost, "/auth/cli/refresh", false, req, &out); err != nil {
+		return AuthResult{}, err
+	}
+	return out.Data, nil
+}
+
+func (c *Client) GetAuthContext(ctx context.Context) (CLIAuthContext, error) {
+	var out CLIAuthContextEnvelope
+	if err := c.doJSON(ctx, http.MethodGet, "/auth/context", true, nil, &out); err != nil {
+		return CLIAuthContext{}, err
+	}
+	return out.Data, nil
+}
+
+func (c *Client) LogoutCLISession(ctx context.Context, req CLILogoutRequest) error {
+	return c.doJSON(ctx, http.MethodPost, "/auth/cli/logout", false, req, nil)
+}
+
+func (c *Client) ListCLISessions(ctx context.Context, params ListCLISessionsParams) (CLISessionPage, error) {
+	var out CLISessionPageEnvelope
+	query := url.Values{}
+	if params.Limit > 0 {
+		query.Set("limit", strconv.Itoa(params.Limit))
+	}
+	if params.Cursor != "" {
+		query.Set("cursor", params.Cursor)
+	}
+	path := "/auth/cli/sessions"
+	if len(query) > 0 {
+		path += "?" + query.Encode()
+	}
+	if err := c.doJSON(ctx, http.MethodGet, path, true, nil, &out); err != nil {
+		return CLISessionPage{}, err
+	}
+	return out.Data, nil
+}
+
+func (c *Client) RevokeCLISession(ctx context.Context, sessionID string) error {
+	return c.doJSON(ctx, http.MethodPost, "/auth/cli/sessions/"+url.PathEscape(strings.TrimSpace(sessionID))+"/revoke", true, nil, nil)
+}
+
+func (c *Client) GetTokenRotation(ctx context.Context, requestID string) (TokenRotationRecord, error) {
+	var out TokenRotationRecordEnvelope
+	if err := c.doJSON(ctx, http.MethodGet, "/ai-gateway/token-rotations/"+url.PathEscape(strings.TrimSpace(requestID)), true, nil, &out); err != nil {
+		return TokenRotationRecord{}, err
+	}
+	return out.Data, nil
+}
+
 func (c *Client) PasswordLogin(ctx context.Context, req PasswordLoginRequest) (AuthResult, error) {
 	var out AuthResultEnvelope
 	if err := c.doJSON(ctx, http.MethodPost, "/auth/login", false, req, &out); err != nil {

package/gen/go/sohaapi/client_test.go

@@ -50,6 +50,19 @@ func TestRuntimeAndWorkbenchLegacyEnumConstants(t *testing.T) {
 	}
 }
 
+func TestPersonalAgentAccessDecisionPublishedConstants(t *testing.T) {
+	statuses := map[PersonalAgentAccessDecisionStatus]string{
+		PersonalAgentAccessDecisionStatusApproved: "approved",
+		PersonalAgentAccessDecisionStatusRejected: "rejected",
+		PersonalAgentAccessDecisionStatusRevoked:  "revoked",
+	}
+	for status, want := range statuses {
+		if string(status) != want || !status.Valid() {
+			t.Fatalf("PersonalAgentAccessDecisionStatus %q is not the compatible value %q", status, want)
+		}
+	}
+}
+
 func TestObservabilityCredentialKeyLegacyTypes(t *testing.T) {
 	dataSource := ObservabilityDataSource{
 		CredentialKeys: []ObservabilityDataSourceCredentialKeys{
@@ -2343,3 +2356,75 @@ func pluginManifestJSON(id string) map[string]any {
 		},
 	}
 }
+
+func TestCLIAuthenticationTransportIsolation(t *testing.T) {
+	cases := []struct {
+		name, method, path string
+		protected          bool
+		call               func(*Client) error
+	}{
+		{"options", "GET", "/api/v1/auth/cli/options", false, func(c *Client) error { _, e := c.GetCLIAuthOptions(context.Background()); return e }},
+		{"create", "POST", "/api/v1/auth/cli/device-authorizations", false, func(c *Client) error {
+			_, e := c.CreateCLIDeviceAuthorization(context.Background(), CLIDeviceAuthorizationCreateRequest{})
+			return e
+		}},
+		{"inspect", "POST", "/api/v1/auth/cli/device-authorizations/inspect", true, func(c *Client) error {
+			_, e := c.InspectCLIDeviceAuthorization(context.Background(), CLIDeviceInspectRequest{UserCode: "001234"})
+			return e
+		}},
+		{"decision", "POST", "/api/v1/auth/cli/device-authorizations/decision", true, func(c *Client) error {
+			_, e := c.DecideCLIDeviceAuthorization(context.Background(), CLIDeviceDecisionRequest{})
+			return e
+		}},
+		{"claim", "POST", "/api/v1/auth/cli/device-token", false, func(c *Client) error {
+			_, e := c.ExchangeCLIDeviceToken(context.Background(), CLIDeviceTokenRequest{})
+			return e
+		}},
+		{"cancel", "POST", "/api/v1/auth/cli/device-authorizations/cancel", false, func(c *Client) error {
+			_, e := c.CancelCLIDeviceAuthorization(context.Background(), CLIDeviceCancelRequest{})
+			return e
+		}},
+		{"password", "POST", "/api/v1/auth/cli/password", false, func(c *Client) error {
+			_, e := c.CLIPasswordLogin(context.Background(), PasswordLoginRequest{})
+			return e
+		}},
+		{"refresh", "POST", "/api/v1/auth/cli/refresh", false, func(c *Client) error {
+			_, e := c.RefreshCLISession(context.Background(), CLIRefreshRequest{})
+			return e
+		}},
+		{"logout", "POST", "/api/v1/auth/cli/logout", false, func(c *Client) error { return c.LogoutCLISession(context.Background(), CLILogoutRequest{}) }},
+		{"context", "GET", "/api/v1/auth/context", true, func(c *Client) error { _, e := c.GetAuthContext(context.Background()); return e }},
+		{"sessions", "GET", "/api/v1/auth/cli/sessions", true, func(c *Client) error {
+			_, e := c.ListCLISessions(context.Background(), ListCLISessionsParams{})
+			return e
+		}},
+		{"revoke", "POST", "/api/v1/auth/cli/sessions/session-1/revoke", true, func(c *Client) error { return c.RevokeCLISession(context.Background(), "session-1") }},
+		{"rotation", "GET", "/api/v1/ai-gateway/token-rotations/request-1", true, func(c *Client) error { _, e := c.GetTokenRotation(context.Background(), "request-1"); return e }},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			called := false
+			client := newTestClient(t, func(w http.ResponseWriter, r *http.Request) {
+				called = true
+				if tc.protected {
+					assertCommonRequest(t, r, tc.method, tc.path)
+				} else {
+					assertPublicRequest(t, r, tc.method, tc.path)
+				}
+				if tc.name == "inspect" {
+					var body map[string]any
+					if e := json.NewDecoder(r.Body).Decode(&body); e != nil || body["userCode"] != "001234" {
+						t.Fatal("leading zeros lost")
+					}
+				}
+				writeJSON(t, w, map[string]any{"data": map[string]any{}})
+			})
+			if e := tc.call(client); e != nil {
+				t.Fatal(e)
+			}
+			if !called {
+				t.Fatal("request was not sent")
+			}
+		})
+	}
+}

package/gen/go/sohaapi/docker_configuration_test.go

@@ -0,0 +1,32 @@
+package sohaapi
+
+import (
+	"bytes"
+	"encoding/json"
+	"reflect"
+	"testing"
+)
+
+func TestDockerConfigurationPatchPreservesExplicitTypedValues(t *testing.T) {
+	raw := []byte(`{"idempotencyKey":"original-request-1","preconditions":{"expectedUid":"11111111-1111-4111-8111-111111111111","expectedConfigurationRevision":"22222222-2222-4222-8222-222222222222"},"changes":[{"field":"ttlSeconds","integerValue":0},{"field":"ttlSeconds","integerValue":2147483647},{"field":"description","stringValue":""},{"field":"config","objectValue":{}},{"field":"labels","objectValue":{"counter":9007199254740993}}]}`)
+	var input DockerConfigurationPatchInput
+	if err := json.Unmarshal(raw, &input); err != nil {
+		t.Fatal(err)
+	}
+	encoded, err := json.Marshal(input)
+	if err != nil {
+		t.Fatal(err)
+	}
+	decode := func(data []byte) any {
+		var value any
+		decoder := json.NewDecoder(bytes.NewReader(data))
+		decoder.UseNumber()
+		if err := decoder.Decode(&value); err != nil {
+			t.Fatal(err)
+		}
+		return value
+	}
+	if !reflect.DeepEqual(decode(raw), decode(encoded)) {
+		t.Fatalf("patch lost presence, precision or injected values: %s", encoded)
+	}
+}

package/gen/go/sohaapi/kubernetes_workload_optional_test.go

@@ -0,0 +1,40 @@
+package sohaapi
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+func TestWorkloadAndCertificateSDKKeepExplicitZeroValues(t *testing.T) {
+	for _, tc := range []struct {
+		name, input string
+		destination any
+	}{
+		{"rollout", `{"matchesCurrentTemplate":false}`, new(KubernetesDeploymentRollout)},
+		{"job", `{"completionTarget":0,"suspend":false}`, new(KubernetesJob)},
+		{"job detail", `{"completionTarget":0,"suspend":false,"backoffLimit":0,"activeDeadlineSeconds":0,"ttlSecondsAfterFinished":0}`, new(KubernetesJobDetail)},
+		{"certificate", `{"selfSigned":false}`, new(KubernetesSecretCertificate)},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if err := json.Unmarshal([]byte(tc.input), tc.destination); err != nil {
+				t.Fatal(err)
+			}
+			encoded, err := json.Marshal(tc.destination)
+			if err != nil {
+				t.Fatal(err)
+			}
+			var before, after map[string]json.RawMessage
+			if err := json.Unmarshal([]byte(tc.input), &before); err != nil {
+				t.Fatal(err)
+			}
+			if err := json.Unmarshal(encoded, &after); err != nil {
+				t.Fatal(err)
+			}
+			for key, value := range before {
+				if string(after[key]) != string(value) {
+					t.Errorf("%s = %s, want %s", key, after[key], value)
+				}
+			}
+		})
+	}
+}

package/gen/go/sohaapi/memory_types_test.go

@@ -0,0 +1,59 @@
+package sohaapi
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+func TestMemoryPolicyOptionalConsent(t *testing.T) {
+	disabled := false
+	enabled := true
+	cases := []struct {
+		name    string
+		value   any
+		present bool
+		want    bool
+	}{
+		{"input inherit", AIMemoryPolicyInput{}, false, false},
+		{"input disable", AIMemoryPolicyInput{ReadEnabled: &disabled, WriteEnabled: &disabled}, true, false},
+		{"input enable", AIMemoryPolicyInput{ReadEnabled: &enabled, WriteEnabled: &enabled}, true, true},
+		{"response inherit", AIMemoryPolicy{}, false, false},
+		{"response disable", AIMemoryPolicy{ReadEnabled: &disabled, WriteEnabled: &disabled}, true, false},
+		{"response enable", AIMemoryPolicy{ReadEnabled: &enabled, WriteEnabled: &enabled}, true, true},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			body, err := json.Marshal(tc.value)
+			if err != nil {
+				t.Fatal(err)
+			}
+			var fields map[string]json.RawMessage
+			if err := json.Unmarshal(body, &fields); err != nil {
+				t.Fatal(err)
+			}
+			for _, key := range []string{"readEnabled", "writeEnabled"} {
+				field, present := fields[key]
+				if present != tc.present {
+					t.Fatalf("%s presence = %v, want %v: %s", key, present, tc.present, body)
+				}
+				if !present {
+					continue
+				}
+				var value bool
+				if err := json.Unmarshal(field, &value); err != nil {
+					t.Fatal(err)
+				}
+				if value != tc.want {
+					t.Fatalf("%s = %v, want %v", key, value, tc.want)
+				}
+			}
+		})
+	}
+	var decoded AIMemoryPolicyInput
+	if err := json.Unmarshal([]byte(`{"readEnabled":false,"writeEnabled":false}`), &decoded); err != nil {
+		t.Fatal(err)
+	}
+	if decoded.ReadEnabled == nil || *decoded.ReadEnabled || decoded.WriteEnabled == nil || *decoded.WriteEnabled {
+		t.Fatal("explicit false must survive decoding as a present value")
+	}
+}

package/gen/go/sohaapi/pod_status_compat_test.go

@@ -0,0 +1,36 @@
+package sohaapi
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+)
+
+func TestReasoningEffortNamesRemainCompatibleWithPodStatusEnums(t *testing.T) {
+	values := []WorkbenchModelOptionReasoningEfforts{WorkbenchModelOptionReasoningEffortsHigh, WorkbenchModelOptionReasoningEffortsMedium, WorkbenchModelOptionReasoningEffortsLow}
+	for index, want := range []string{"high", "medium", "low"} {
+		if string(values[index]) != want || !values[index].Valid() {
+			t.Fatalf("reasoning effort %d = %q, want %q", index, values[index], want)
+		}
+	}
+	if High != MarketplaceAdvisorySeverityHigh {
+		t.Fatal("legacy advisory High changed")
+	}
+}
+
+func TestPodStatusSDKKeepsZeroExitCode(t *testing.T) {
+	code := int32(0)
+	encoded, err := json.Marshal(KubernetesPodContainerStatus{ExitCode: &code})
+	if err != nil || !strings.Contains(string(encoded), `"exitCode":0`) {
+		t.Fatalf("successful termination was lost: %s, %v", encoded, err)
+	}
+}
+
+func TestPersonalEnvironmentBackendNamesRemainCompatibleWithPodStatusEnums(t *testing.T) {
+	values := []PersonalEnvironmentTemplateBackend{Container, VM}
+	for index, want := range []string{"container", "vm"} {
+		if string(values[index]) != want || !values[index].Valid() {
+			t.Fatalf("backend %d = %q, want %q", index, values[index], want)
+		}
+	}
+}

package/gen/go/sohaapi/proxy_deployment_presence_test.go

@@ -0,0 +1,47 @@
+package sohaapi
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+func TestProxyDeploymentReplicaPresence(t *testing.T) {
+	zero, two := int64(0), int64(2)
+	for _, tc := range []struct {
+		name         string
+		desired      int64
+		observed     *int64
+		wantObserved string
+	}{
+		{"stopped", 0, &zero, "0"},
+		{"unobserved", 0, nil, ""},
+		{"positive", 2, &two, "2"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			dto := NetworkProxyDeployment{Revision: 1, State: "stopped", Members: []NetworkProxyDeploymentMember{}, DesiredReplicas: tc.desired, ObservedReplicas: tc.observed}
+			raw, err := json.Marshal(dto)
+			if err != nil {
+				t.Fatal(err)
+			}
+			var fields map[string]json.RawMessage
+			if err := json.Unmarshal(raw, &fields); err != nil {
+				t.Fatal(err)
+			}
+			wantDesired, _ := json.Marshal(tc.desired)
+			if string(fields["desiredReplicas"]) != string(wantDesired) {
+				t.Fatalf("desired count lost: %s", raw)
+			}
+			observed, present := fields["observedReplicas"]
+			if present != (tc.observed != nil) || string(observed) != tc.wantObserved {
+				t.Fatalf("observed presence lost: %s", raw)
+			}
+			var decoded NetworkProxyDeployment
+			if err := json.Unmarshal(raw, &decoded); err != nil {
+				t.Fatal(err)
+			}
+			if (decoded.ObservedReplicas == nil) != (tc.observed == nil) || decoded.ObservedReplicas != nil && *decoded.ObservedReplicas != *tc.observed {
+				t.Fatalf("round trip lost observation: %+v", decoded)
+			}
+		})
+	}
+}

package/gen/go/sohaapi/proxy_deployment_stop_test.go

@@ -0,0 +1,40 @@
+package sohaapi
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+func TestProxyDeploymentStopFlagsPreserveKnownZero(t *testing.T) {
+	for _, stopped := range []bool{false, true} {
+		raw, err := json.Marshal(NetworkProxyDeploymentRuntimeAck{ProcessStopped: stopped, ActiveCountKnown: true, ActiveConnections: 0, AcceptingRequests: false})
+		if err != nil {
+			t.Fatal(err)
+		}
+		var value map[string]json.RawMessage
+		if err := json.Unmarshal(raw, &value); err != nil {
+			t.Fatal(err)
+		}
+		if string(value["activeConnections"]) != "0" {
+			t.Fatalf("known zero lost: %s", raw)
+		}
+		flag, present := value["processStopped"]
+		if present != stopped || stopped && string(flag) != "true" {
+			t.Fatalf("stopped flag presence: %s", raw)
+		}
+	}
+	for _, required := range []bool{false, true} {
+		raw, err := json.Marshal(NetworkProxyDeploymentRuntimeControl{StopRequired: required})
+		if err != nil {
+			t.Fatal(err)
+		}
+		var value map[string]json.RawMessage
+		if err := json.Unmarshal(raw, &value); err != nil {
+			t.Fatal(err)
+		}
+		flag, present := value["stopRequired"]
+		if present != required || required && string(flag) != "true" {
+			t.Fatalf("stop flag presence: %s", raw)
+		}
+	}
+}

package/gen/go/sohaapi/proxy_traffic_test.go

@@ -0,0 +1,41 @@
+package sohaapi
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// Existing SDK consumers can still assign both numeric rate fields to float32.
+var (
+	_ float32 = NetworkProxyTrafficSample{}.UploadBytesPerSecond
+	_ float32 = NetworkProxyTrafficSample{}.DownloadBytesPerSecond
+)
+
+func TestProxyTrafficRateWireCompatibility(t *testing.T) {
+	for _, tt := range []struct {
+		name  string
+		state NetworkProxyTrafficSampleRateState
+		up    float32
+	}{
+		{"legacy-numeric.json", "", 1.25},
+		{"unknown-rate.json", NetworkProxyTrafficSampleRateStateUnknown, 0},
+		{"gap-rate.json", NetworkProxyTrafficSampleRateStateGap, 0},
+		{"known-zero.json", NetworkProxyTrafficSampleRateStateKnown, 0},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			raw, err := os.ReadFile(filepath.Join("..", "..", "..", "fixtures", "openapi", "NetworkProxyTrafficSample", "valid", tt.name))
+			if err != nil {
+				t.Fatal(err)
+			}
+			var sample NetworkProxyTrafficSample
+			if err := json.Unmarshal(raw, &sample); err != nil {
+				t.Fatal(err)
+			}
+			if sample.RateState != tt.state || sample.UploadBytesPerSecond != tt.up || sample.DownloadBytesPerSecond != 0 {
+				t.Fatalf("sample = %+v", sample)
+			}
+		})
+	}
+}

package/gen/go/sohaapi/radius_presence_test.go

@@ -0,0 +1,35 @@
+package sohaapi
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+func TestRADIUSKnownZeroAndExplicitScaleZero(t *testing.T) {
+	zero := 0
+	for _, input := range []struct {
+		value any
+		key   string
+	}{{NetworkRADIUSRuntimeACK{StateCountKnown: true, ActiveStates: &zero}, "activeStates"}, {NetworkRADIUSMember{StateCountKnown: true, ActiveStates: &zero}, "activeStates"}, {NetworkRADIUSControlInput{Action: "scale", Replicas: &zero}, "replicas"}, {NetworkRADIUSPool{ObservedReplicas: &zero, ReadyReplicas: &zero}, "observedReplicas"}} {
+		encoded, err := json.Marshal(input.value)
+		if err != nil {
+			t.Fatal(err)
+		}
+		var fields map[string]json.RawMessage
+		if err := json.Unmarshal(encoded, &fields); err != nil {
+			t.Fatal(err)
+		}
+		if string(fields[input.key]) != "0" {
+			t.Fatalf("explicit zero lost: %s", encoded)
+		}
+	}
+	encoded, err := json.Marshal(NetworkRADIUSRuntimeACK{StateCountKnown: false})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var fields map[string]json.RawMessage
+	_ = json.Unmarshal(encoded, &fields)
+	if _, present := fields["activeStates"]; present {
+		t.Fatalf("unknown count serialized as zero: %s", encoded)
+	}
+}