@opensoha/contracts 0.1.4 → 0.1.6

package/auth/permission-catalog.schema.json

@@ -0,0 +1,74 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://contracts.opensoha.dev/auth/permission-catalog.schema.json",
+  "title": "OpenSoha Permission Catalog",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "catalogVersion", "contentHash", "permissions"],
+  "properties": {
+    "schemaVersion": { "const": "authorization.opensoha.io/v1" },
+    "catalogVersion": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$" },
+    "contentHash": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+    "permissions": {
+      "type": "array",
+      "minItems": 1,
+      "items": { "$ref": "#/$defs/permission" }
+    }
+  },
+  "$defs": {
+    "permission": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "key",
+        "domain",
+        "resource",
+        "action",
+        "displayName",
+        "riskLevel",
+        "scopeKinds",
+        "approvalPolicy",
+        "status",
+        "assignable"
+      ],
+      "properties": {
+        "key": {
+          "type": "string",
+          "pattern": "^[a-z][a-z0-9_-]*(?:\\.[a-z][a-z0-9_-]*)+$"
+        },
+        "domain": { "type": "string", "pattern": "^[a-z][a-z0-9_-]*$" },
+        "resource": { "type": "string", "pattern": "^[a-z][a-z0-9_.-]*$" },
+        "action": { "type": "string", "pattern": "^[a-z][a-z0-9_-]*$" },
+        "displayName": { "type": "string", "minLength": 1 },
+        "riskLevel": { "type": "string", "enum": ["read", "mutate", "execute", "high"] },
+        "scopeKinds": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "enum": ["tenant", "workspace", "cluster", "namespace", "project", "resource", "owner"]
+          }
+        },
+        "approvalPolicy": { "type": "string", "enum": ["never", "eligible", "required"] },
+        "status": { "type": "string", "enum": ["active", "legacy"] },
+        "assignable": { "type": "boolean" },
+        "legacyAliases": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": { "type": "string", "minLength": 1 }
+        },
+        "legacyCapabilities": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": { "type": "string", "pattern": "^[a-z][a-z0-9_-]*$" }
+        },
+        "replacedBy": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": { "type": "string", "minLength": 1 }
+        }
+      }
+    }
+  }
+}

package/compat/json-schema-ecosystem-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.4",
+  "version": "0.1.6",
   "schemas": {
     "plugins/plugin-manifest.schema.json": {
       "rootRequired": ["id", "name", "publisher", "type", "version"],

package/compat/openapi-loose-boundaries-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.4",
+  "version": "0.1.6",
   "generatedFrom": "openapi/soha-api.yaml",
   "entries": [
     {

package/fixtures/json-schema/permission-catalog/invalid/missing-action.json

@@ -0,0 +1,18 @@
+{
+  "schemaVersion": "authorization.opensoha.io/v1",
+  "catalogVersion": "1.0.0",
+  "contentHash": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
+  "permissions": [
+    {
+      "key": "virtualization.vms.view",
+      "domain": "virtualization",
+      "resource": "vms",
+      "displayName": "View virtual machines",
+      "riskLevel": "read",
+      "scopeKinds": ["workspace", "resource"],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    }
+  ]
+}

package/fixtures/json-schema/permission-catalog/valid/minimal.json

@@ -0,0 +1,19 @@
+{
+  "schemaVersion": "authorization.opensoha.io/v1",
+  "catalogVersion": "1.0.0",
+  "contentHash": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
+  "permissions": [
+    {
+      "key": "virtualization.vms.view",
+      "domain": "virtualization",
+      "resource": "vms",
+      "action": "view",
+      "displayName": "View virtual machines",
+      "riskLevel": "read",
+      "scopeKinds": ["workspace", "resource"],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    }
+  ]
+}

package/fixtures/openapi/AccessRoleInput/invalid/missing-permissions.json

@@ -0,0 +1,4 @@
+{
+  "name": "vm-builder",
+  "scope": "custom"
+}

package/fixtures/openapi/AccessRoleInput/valid/granular-vm-operator.json

@@ -0,0 +1,10 @@
+{
+  "name": "vm-builder",
+  "scope": "custom",
+  "capabilities": [],
+  "permissionKeys": [
+    "virtualization.vms.view",
+    "virtualization.vms.create",
+    "virtualization.vms.resize"
+  ]
+}

package/fixtures/openapi/AuthorizationDecision/invalid/missing-reason.json

@@ -0,0 +1,7 @@
+{
+  "status": "deny",
+  "permissionKey": "virtualization.vms.delete",
+  "action": "delete",
+  "resource": { "type": "virtualization.vm", "id": "vm-01" },
+  "policyVersion": "authorization.opensoha.io/v1"
+}

package/fixtures/openapi/AuthorizationDecision/valid/deny-vm-delete.json

@@ -0,0 +1,16 @@
+{
+  "status": "deny",
+  "permissionKey": "virtualization.vms.delete",
+  "action": "delete",
+  "resource": {
+    "type": "virtualization.vm",
+    "id": "vm-01",
+    "workspaceId": "default"
+  },
+  "effectiveScope": {
+    "workspaceIds": ["default"]
+  },
+  "reasonCode": "missing_permission",
+  "policyVersion": "authorization.opensoha.io/v1",
+  "allowedActions": ["view", "create", "resize"]
+}

package/fixtures/openapi/PermissionCatalogEnvelope/invalid/invalid-hash.json

@@ -0,0 +1,8 @@
+{
+  "data": {
+    "schemaVersion": "authorization.opensoha.io/v1",
+    "catalogVersion": "1.0.0",
+    "contentHash": "not-a-hash",
+    "permissions": []
+  }
+}

package/fixtures/openapi/PermissionCatalogEnvelope/valid/minimal.json

@@ -0,0 +1,22 @@
+{
+  "data": {
+    "schemaVersion": "authorization.opensoha.io/v1",
+    "catalogVersion": "1.0.0",
+    "contentHash": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
+    "permissions": [
+      {
+        "key": "virtualization.vms.resize",
+        "domain": "virtualization",
+        "resource": "vms",
+        "action": "resize",
+        "displayName": "Resize virtual machines",
+        "riskLevel": "mutate",
+        "scopeKinds": ["workspace", "resource"],
+        "approvalPolicy": "never",
+        "status": "active",
+        "assignable": true,
+        "legacyAliases": ["virtualization.vms.manage"]
+      }
+    ]
+  }
+}

package/fixtures/openapi/SecretCreateRequest/invalid/both-sources.json

@@ -0,0 +1,12 @@
+{
+  "name": "registry-token",
+  "value": "opaque-token",
+  "vaultKv2": {
+    "mount": "secret",
+    "path": "demo/registry",
+    "key": "token",
+    "version": 3
+  },
+  "scopeType": "project",
+  "scopeId": "demo"
+}

package/fixtures/openapi/SecretCreateRequest/invalid/missing-vault-version.json

@@ -0,0 +1,10 @@
+{
+  "name": "registry-token",
+  "scopeType": "project",
+  "scopeId": "demo",
+  "vaultKv2": {
+    "mount": "team/kv",
+    "path": "demo/app",
+    "key": "token"
+  }
+}

package/fixtures/openapi/SecretCreateRequest/invalid/vault-key-newline.json

@@ -0,0 +1,11 @@
+{
+  "name": "registry-token",
+  "scopeType": "project",
+  "scopeId": "demo",
+  "vaultKv2": {
+    "mount": "team/kv",
+    "path": "demo/app",
+    "key": "token\nvalue",
+    "version": 7
+  }
+}

package/fixtures/openapi/SecretCreateRequest/invalid/vault-key-whitespace.json

@@ -0,0 +1,11 @@
+{
+  "name": "registry-token",
+  "scopeType": "project",
+  "scopeId": "demo",
+  "vaultKv2": {
+    "mount": "team/kv",
+    "path": "demo/app",
+    "key": " \t ",
+    "version": 7
+  }
+}

package/fixtures/openapi/SecretCreateRequest/valid/vault-kv2.json

@@ -0,0 +1,11 @@
+{
+  "name": "registry-token",
+  "scopeType": "project",
+  "scopeId": "demo",
+  "vaultKv2": {
+    "mount": "team/kv",
+    "path": "demo/app",
+    "key": "token",
+    "version": 7
+  }
+}

package/fixtures/openapi/SecretRotateRequest/invalid/both-sources.json

@@ -0,0 +1,9 @@
+{
+  "value": "next-opaque-secret-value",
+  "vaultKv2": {
+    "mount": "team/kv",
+    "path": "demo/app",
+    "key": "token",
+    "version": 8
+  }
+}

package/fixtures/openapi/SecretRotateRequest/invalid/missing-source.json

@@ -0,0 +1 @@
+{}

package/fixtures/openapi/SecretRotateRequest/valid/vault-kv2.json

@@ -0,0 +1,8 @@
+{
+  "vaultKv2": {
+    "mount": "team/kv",
+    "path": "demo/app",
+    "key": "token",
+    "version": 8
+  }
+}

package/gen/go/sohaapi/client.go

@@ -14,7 +14,7 @@ import (
 	"time"
 )
 
-const defaultUserAgent = "opensoha-contracts/0.1.4"
+const defaultUserAgent = "opensoha-contracts/0.1.6"
 
 type Client struct {
 	BaseURL    string

package/gen/go/sohaapi/types.go

@@ -3837,6 +3837,102 @@ func (e OpenAIModelsResponseObject) Valid() bool {
 	}
 }
 
+// Defines values for PermissionApprovalPolicy.
+const (
+	PermissionApprovalPolicyEligible PermissionApprovalPolicy = "eligible"
+	PermissionApprovalPolicyNever    PermissionApprovalPolicy = "never"
+	PermissionApprovalPolicyRequired PermissionApprovalPolicy = "required"
+)
+
+// Valid indicates whether the value is a known member of the PermissionApprovalPolicy enum.
+func (e PermissionApprovalPolicy) Valid() bool {
+	switch e {
+	case PermissionApprovalPolicyEligible:
+		return true
+	case PermissionApprovalPolicyNever:
+		return true
+	case PermissionApprovalPolicyRequired:
+		return true
+	default:
+		return false
+	}
+}
+
+// Defines values for PermissionRiskLevel.
+const (
+	PermissionRiskLevelExecute PermissionRiskLevel = "execute"
+	PermissionRiskLevelHigh    PermissionRiskLevel = "high"
+	PermissionRiskLevelMutate  PermissionRiskLevel = "mutate"
+	PermissionRiskLevelRead    PermissionRiskLevel = "read"
+)
+
+// Valid indicates whether the value is a known member of the PermissionRiskLevel enum.
+func (e PermissionRiskLevel) Valid() bool {
+	switch e {
+	case PermissionRiskLevelExecute:
+		return true
+	case PermissionRiskLevelHigh:
+		return true
+	case PermissionRiskLevelMutate:
+		return true
+	case PermissionRiskLevelRead:
+		return true
+	default:
+		return false
+	}
+}
+
+// Defines values for PermissionScopeKind.
+const (
+	PermissionScopeKindCluster   PermissionScopeKind = "cluster"
+	PermissionScopeKindNamespace PermissionScopeKind = "namespace"
+	PermissionScopeKindOwner     PermissionScopeKind = "owner"
+	PermissionScopeKindProject   PermissionScopeKind = "project"
+	PermissionScopeKindResource  PermissionScopeKind = "resource"
+	PermissionScopeKindTenant    PermissionScopeKind = "tenant"
+	PermissionScopeKindWorkspace PermissionScopeKind = "workspace"
+)
+
+// Valid indicates whether the value is a known member of the PermissionScopeKind enum.
+func (e PermissionScopeKind) Valid() bool {
+	switch e {
+	case PermissionScopeKindCluster:
+		return true
+	case PermissionScopeKindNamespace:
+		return true
+	case PermissionScopeKindOwner:
+		return true
+	case PermissionScopeKindProject:
+		return true
+	case PermissionScopeKindResource:
+		return true
+	case PermissionScopeKindTenant:
+		return true
+	case PermissionScopeKindWorkspace:
+		return true
+	default:
+		return false
+	}
+}
+
+// Defines values for PermissionStatus.
+const (
+	PermissionStatusActive PermissionStatus = "active"
+	PermissionStatusLegacy PermissionStatus = "legacy"
+)
+
+// Valid indicates whether the value is a known member of the PermissionStatus enum.
+func (e PermissionStatus) Valid() bool {
+	switch e {
+	case PermissionStatusActive:
+		return true
+	case PermissionStatusLegacy:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for PluginComputeContainerRuntimeProviderResourceKinds.
 const (
 	PluginComputeContainerRuntimeResourceKindContainer   PluginComputeContainerRuntimeProviderResourceKinds = "container"
@@ -6306,6 +6402,44 @@ type AIWorkbenchModelSettings struct {
 	Enabled        bool   `json:"enabled"`
 }
 
+// AccessRole defines model for AccessRole.
+type AccessRole struct {
+	// Capabilities Legacy role-global action aliases retained only for migration.
+	// Deprecated: this property has been marked as deprecated upstream, but no `x-deprecated-reason` was set
+	Capabilities   []string `json:"capabilities"`
+	ID             string   `json:"id"`
+	Name           string   `json:"name"`
+	PermissionKeys []string `json:"permissionKeys"`
+	Scope          string   `json:"scope"`
+	UserCount      int      `json:"userCount"`
+}
+
+// AccessRoleDeleteResult defines model for AccessRoleDeleteResult.
+type AccessRoleDeleteResult struct {
+	Status string `json:"status"`
+}
+
+// AccessRoleEnvelope defines model for AccessRoleEnvelope.
+type AccessRoleEnvelope struct {
+	Data AccessRole `json:"data"`
+}
+
+// AccessRoleInput defines model for AccessRoleInput.
+type AccessRoleInput struct {
+	// Capabilities Legacy role-global action aliases; new role editors must send an empty array.
+	// Deprecated: this property has been marked as deprecated upstream, but no `x-deprecated-reason` was set
+	Capabilities   []string `json:"capabilities,omitempty"`
+	ID             string   `json:"id,omitempty"`
+	Name           string   `json:"name"`
+	PermissionKeys []string `json:"permissionKeys"`
+	Scope          string   `json:"scope"`
+}
+
+// AccessRoleListEnvelope defines model for AccessRoleListEnvelope.
+type AccessRoleListEnvelope struct {
+	Items []AccessRole `json:"items"`
+}
+
 // AgentProviderCatalog defines model for AgentProviderCatalog.
 type AgentProviderCatalog struct {
 	CreatedAt     time.Time                 `json:"createdAt"`
@@ -12139,6 +12273,50 @@ type PasswordLoginRequest struct {
 	Password string `json:"password"`
 }
 
+// PermissionApprovalPolicy defines model for PermissionApprovalPolicy.
+type PermissionApprovalPolicy string
+
+// PermissionCatalog defines model for PermissionCatalog.
+type PermissionCatalog struct {
+	CatalogVersion string                 `json:"catalogVersion"`
+	ContentHash    string                 `json:"contentHash"`
+	Permissions    []PermissionDefinition `json:"permissions"`
+	SchemaVersion  string                 `json:"schemaVersion"`
+}
+
+// PermissionCatalogEnvelope defines model for PermissionCatalogEnvelope.
+type PermissionCatalogEnvelope struct {
+	Data PermissionCatalog `json:"data"`
+}
+
+// PermissionDefinition defines model for PermissionDefinition.
+type PermissionDefinition struct {
+	Action         string                   `json:"action"`
+	ApprovalPolicy PermissionApprovalPolicy `json:"approvalPolicy"`
+	Assignable     bool                     `json:"assignable"`
+	DisplayName    string                   `json:"displayName"`
+	Domain         string                   `json:"domain"`
+	Key            string                   `json:"key"`
+	LegacyAliases  []string                 `json:"legacyAliases,omitempty"`
+
+	// LegacyCapabilities Migration-only role-global action aliases accepted by this exact permission.
+	LegacyCapabilities []string              `json:"legacyCapabilities,omitempty"`
+	ReplacedBy         []string              `json:"replacedBy,omitempty"`
+	Resource           string                `json:"resource"`
+	RiskLevel          PermissionRiskLevel   `json:"riskLevel"`
+	ScopeKinds         []PermissionScopeKind `json:"scopeKinds"`
+	Status             PermissionStatus      `json:"status"`
+}
+
+// PermissionRiskLevel defines model for PermissionRiskLevel.
+type PermissionRiskLevel string
+
+// PermissionScopeKind defines model for PermissionScopeKind.
+type PermissionScopeKind string
+
+// PermissionStatus defines model for PermissionStatus.
+type PermissionStatus string
+
 // PersonalAccessToken defines model for PersonalAccessToken.
 type PersonalAccessToken struct {
 	CreatedAt      time.Time      `json:"createdAt"`
@@ -13058,14 +13236,15 @@ type SecretBinding struct {
 // SecretBindingTargetType defines model for SecretBinding.TargetType.
 type SecretBindingTargetType string
 
-// SecretCreateRequest defines model for SecretCreateRequest.
+// SecretCreateRequest Exactly one of value or vaultKv2 must be provided.
 type SecretCreateRequest struct {
-	Bindings    []SecretBinding `json:"bindings,omitempty"`
-	Description string          `json:"description,omitempty"`
-	Name        string          `json:"name"`
-	ScopeID     string          `json:"scopeId"`
-	ScopeType   SecretScopeType `json:"scopeType"`
-	Value       string          `json:"value,omitempty"`
+	Bindings    []SecretBinding          `json:"bindings,omitempty"`
+	Description string                   `json:"description,omitempty"`
+	Name        string                   `json:"name"`
+	ScopeID     string                   `json:"scopeId"`
+	ScopeType   SecretScopeType          `json:"scopeType"`
+	Value       string                   `json:"value,omitempty"`
+	VaultKv2    *SecretVaultKV2Reference `json:"vaultKv2,omitempty"`
 }
 
 // SecretLeaseGrant defines model for SecretLeaseGrant.
@@ -13117,9 +13296,10 @@ type SecretMetadataListEnvelope struct {
 // SecretReferenceMap defines model for SecretReferenceMap.
 type SecretReferenceMap map[string]string
 
-// SecretRotateRequest defines model for SecretRotateRequest.
+// SecretRotateRequest Exactly one of value or vaultKv2 must be provided.
 type SecretRotateRequest struct {
-	Value string `json:"value,omitempty"`
+	Value    string                   `json:"value,omitempty"`
+	VaultKv2 *SecretVaultKV2Reference `json:"vaultKv2,omitempty"`
 }
 
 // SecretScopeType defines model for SecretScopeType.
@@ -13136,6 +13316,14 @@ type SecretUpdateRequest struct {
 	Status      SecretStatus    `json:"status,omitempty"`
 }
 
+// SecretVaultKV2Reference defines model for SecretVaultKV2Reference.
+type SecretVaultKV2Reference struct {
+	Key     string `json:"key"`
+	Mount   string `json:"mount"`
+	Path    string `json:"path"`
+	Version int    `json:"version"`
+}
+
 // SecretVersionMetadata defines model for SecretVersionMetadata.
 type SecretVersionMetadata struct {
 	CreatedAt time.Time           `json:"createdAt"`
@@ -14026,6 +14214,9 @@ type AIEnvironmentLeaseID = string
 // AIMemoryID defines model for AIMemoryID.
 type AIMemoryID = string
 
+// AccessRoleID defines model for AccessRoleID.
+type AccessRoleID = string
+
 // AgentProviderRolloutAction defines model for AgentProviderRolloutAction.
 type AgentProviderRolloutAction string
 
@@ -15095,6 +15286,12 @@ type CreateVirtualMachineParams struct {
 	IdempotencyKey IdempotencyKey `json:"Idempotency-Key"`
 }
 
+// CreateAccessRoleJSONRequestBody defines body for CreateAccessRole for application/json ContentType.
+type CreateAccessRoleJSONRequestBody = AccessRoleInput
+
+// UpdateAccessRoleJSONRequestBody defines body for UpdateAccessRole for application/json ContentType.
+type UpdateAccessRoleJSONRequestBody = AccessRoleInput
+
 // DecideAIGatewayApprovalRequestJSONRequestBody defines body for DecideAIGatewayApprovalRequest for application/json ContentType.
 type DecideAIGatewayApprovalRequestJSONRequestBody = ApprovalDecisionInput