@opensoha/contracts 0.1.9 → 0.1.11

package/README.md

@@ -105,7 +105,7 @@ calling code in the consumer until those APIs are promoted into the supported
 client surface. Redirect-oriented flows such as OIDC provider redirects should
 not use the JSON-only `doJSON` helper until a non-JSON client mode is added.
 
-The Go generator and generated DTO checks run with Go 1.26.5 in CI.
+The Go generator and generated DTO checks run with Go 1.26.6 in CI.
 
 ## Validation
 

package/auth/catalog_generated.go

@@ -5,9 +5,9 @@ package auth
 import _ "embed"
 
 const (
-	PermissionCatalogVersion = "1.3.0"
-	PermissionCatalogContentSHA256 = "fe738c69a160e58cf919ce6de8380d6427be6f8848cabad7d807ec82fdea8a3b"
-	PermissionCatalogSHA256 = "206f12ff27279b1f345a87cd93be82789d1a79df311de9e7a86ab8cf75dde013"
+	PermissionCatalogVersion = "2.0.0"
+	PermissionCatalogContentSHA256 = "82626eb53d9cd6b53ee502ae32285392c672f7f186a7dbefb42bf1f700d67e98"
+	PermissionCatalogSHA256 = "f563a9be8901002e790f271d589c9f4b8b05dcd8e9b4bba767b835b1cc606b76"
 )
 
 //go:embed permission-catalog.json

package/auth/catalog_test.go

@@ -51,3 +51,38 @@ func TestPermissionCatalogIncludesVirtualizationStorageView(t *testing.T) {
 	}
 	t.Fatal("virtualization.storage.view is missing")
 }
+
+func TestPermissionCatalogIncludesIndependentResourceCreationEntry(t *testing.T) {
+	var catalog struct {
+		Permissions []struct {
+			Key           string   `json:"key"`
+			Status        string   `json:"status"`
+			Assignable    bool     `json:"assignable"`
+			LegacyAliases []string `json:"legacyAliases"`
+		} `json:"permissions"`
+	}
+	if err := json.Unmarshal(PermissionCatalogJSON(), &catalog); err != nil {
+		t.Fatalf("decode permission catalog: %v", err)
+	}
+
+	found := false
+	for _, permission := range catalog.Permissions {
+		if permission.Key == "platform.resource.create" {
+			t.Fatal("retired platform.resource.create definition is still present")
+		}
+		for _, alias := range permission.LegacyAliases {
+			if alias == "platform.resource.create" {
+				t.Fatalf("retired platform.resource.create alias remains on %s", permission.Key)
+			}
+		}
+		if permission.Key == "platform.resource-creation.use" {
+			found = true
+			if permission.Status != "active" || !permission.Assignable {
+				t.Fatalf("resource creation entry must be independently assignable: %#v", permission)
+			}
+		}
+	}
+	if !found {
+		t.Fatal("platform.resource-creation.use is missing")
+	}
+}

package/auth/permission-catalog.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "authorization.opensoha.io/v1",
-  "catalogVersion": "1.3.0",
-  "contentHash": "sha256:fe738c69a160e58cf919ce6de8380d6427be6f8848cabad7d807ec82fdea8a3b",
+  "catalogVersion": "2.0.0",
+  "contentHash": "sha256:82626eb53d9cd6b53ee502ae32285392c672f7f186a7dbefb42bf1f700d67e98",
   "permissions": [
     {
       "key": "access.directory.create",
@@ -5472,8 +5472,7 @@
       "status": "active",
       "assignable": true,
       "legacyAliases": [
-        "platform.rbac.manage",
-        "platform.resource.create"
+        "platform.rbac.manage"
       ],
       "legacyCapabilities": [
         "create"
@@ -5558,8 +5557,7 @@
       "status": "active",
       "assignable": true,
       "legacyAliases": [
-        "platform.rbac.manage",
-        "platform.resource.create"
+        "platform.rbac.manage"
       ],
       "legacyCapabilities": [
         "create"
@@ -5644,8 +5642,7 @@
       "status": "active",
       "assignable": true,
       "legacyAliases": [
-        "platform.rbac.manage",
-        "platform.resource.create"
+        "platform.rbac.manage"
       ],
       "legacyCapabilities": [
         "create"
@@ -5730,8 +5727,7 @@
       "status": "active",
       "assignable": true,
       "legacyAliases": [
-        "platform.rbac.manage",
-        "platform.resource.create"
+        "platform.rbac.manage"
       ],
       "legacyCapabilities": [
         "create"
@@ -5816,8 +5812,7 @@
       "status": "active",
       "assignable": true,
       "legacyAliases": [
-        "platform.rbac.manage",
-        "platform.resource.create"
+        "platform.rbac.manage"
       ],
       "legacyCapabilities": [
         "create"
@@ -5974,9 +5969,6 @@
       "approvalPolicy": "never",
       "status": "active",
       "assignable": true,
-      "legacyAliases": [
-        "platform.resource.create"
-      ],
       "legacyCapabilities": [
         "create"
       ]
@@ -6051,9 +6043,6 @@
       "approvalPolicy": "never",
       "status": "active",
       "assignable": true,
-      "legacyAliases": [
-        "platform.resource.create"
-      ],
       "legacyCapabilities": [
         "create"
       ]
@@ -6131,9 +6120,6 @@
       "approvalPolicy": "never",
       "status": "active",
       "assignable": true,
-      "legacyAliases": [
-        "platform.resource.create"
-      ],
       "legacyCapabilities": [
         "create"
       ]
@@ -6211,9 +6197,6 @@
       "approvalPolicy": "never",
       "status": "active",
       "assignable": true,
-      "legacyAliases": [
-        "platform.resource.create"
-      ],
       "legacyCapabilities": [
         "create"
       ]
@@ -6291,9 +6274,6 @@
       "approvalPolicy": "never",
       "status": "active",
       "assignable": true,
-      "legacyAliases": [
-        "platform.resource.create"
-      ],
       "legacyCapabilities": [
         "create"
       ]
@@ -6372,8 +6352,7 @@
       "status": "active",
       "assignable": true,
       "legacyAliases": [
-        "platform.admission.manage",
-        "platform.resource.create"
+        "platform.admission.manage"
       ],
       "legacyCapabilities": [
         "create"
@@ -6458,9 +6437,6 @@
       "approvalPolicy": "never",
       "status": "active",
       "assignable": true,
-      "legacyAliases": [
-        "platform.resource.create"
-      ],
       "legacyCapabilities": [
         "create"
       ]
@@ -6539,8 +6515,7 @@
       "status": "active",
       "assignable": true,
       "legacyAliases": [
-        "platform.cluster-resources.manage",
-        "platform.resource.create"
+        "platform.cluster-resources.manage"
       ],
       "legacyCapabilities": [
         "create"
@@ -6625,9 +6600,6 @@
       "approvalPolicy": "never",
       "status": "active",
       "assignable": true,
-      "legacyAliases": [
-        "platform.resource.create"
-      ],
       "legacyCapabilities": [
         "create"
       ]
@@ -6705,9 +6677,6 @@
       "approvalPolicy": "never",
       "status": "active",
       "assignable": true,
-      "legacyAliases": [
-        "platform.resource.create"
-      ],
       "legacyCapabilities": [
         "create"
       ]
@@ -6802,9 +6771,6 @@
       "approvalPolicy": "never",
       "status": "active",
       "assignable": true,
-      "legacyAliases": [
-        "platform.resource.create"
-      ],
       "legacyCapabilities": [
         "create"
       ]
@@ -6883,8 +6849,7 @@
       "status": "active",
       "assignable": true,
       "legacyAliases": [
-        "platform.admission.manage",
-        "platform.resource.create"
+        "platform.admission.manage"
       ],
       "legacyCapabilities": [
         "create"
@@ -7139,8 +7104,7 @@
       "status": "active",
       "assignable": true,
       "legacyAliases": [
-        "platform.crds.manage",
-        "platform.resource.create"
+        "platform.crds.manage"
       ],
       "legacyCapabilities": [
         "create"
@@ -7205,9 +7169,6 @@
       "approvalPolicy": "never",
       "status": "active",
       "assignable": true,
-      "legacyAliases": [
-        "platform.resource.create"
-      ],
       "legacyCapabilities": [
         "create"
       ]
@@ -7282,9 +7243,6 @@
       "approvalPolicy": "never",
       "status": "active",
       "assignable": true,
-      "legacyAliases": [
-        "platform.resource.create"
-      ],
       "legacyCapabilities": [
         "create"
       ]
@@ -7377,8 +7335,7 @@
       "status": "active",
       "assignable": true,
       "legacyAliases": [
-        "platform.namespaces.manage",
-        "platform.resource.create"
+        "platform.namespaces.manage"
       ],
       "legacyCapabilities": [
         "create"
@@ -7502,9 +7459,6 @@
       "approvalPolicy": "never",
       "status": "active",
       "assignable": true,
-      "legacyAliases": [
-        "platform.resource.create"
-      ],
       "legacyCapabilities": [
         "create"
       ]
@@ -7582,9 +7536,6 @@
       "approvalPolicy": "never",
       "status": "active",
       "assignable": true,
-      "legacyAliases": [
-        "platform.resource.create"
-      ],
       "legacyCapabilities": [
         "create"
       ]
@@ -7662,9 +7613,6 @@
       "approvalPolicy": "never",
       "status": "active",
       "assignable": true,
-      "legacyAliases": [
-        "platform.resource.create"
-      ],
       "legacyCapabilities": [
         "create"
       ]
@@ -7782,9 +7730,6 @@
       "approvalPolicy": "never",
       "status": "active",
       "assignable": true,
-      "legacyAliases": [
-        "platform.resource.create"
-      ],
       "legacyCapabilities": [
         "create"
       ]
@@ -7862,9 +7807,6 @@
       "approvalPolicy": "never",
       "status": "active",
       "assignable": true,
-      "legacyAliases": [
-        "platform.resource.create"
-      ],
       "legacyCapabilities": [
         "create"
       ]
@@ -7942,9 +7884,6 @@
       "approvalPolicy": "never",
       "status": "active",
       "assignable": true,
-      "legacyAliases": [
-        "platform.resource.create"
-      ],
       "legacyCapabilities": [
         "create"
       ]
@@ -8022,9 +7961,6 @@
       "approvalPolicy": "never",
       "status": "active",
       "assignable": true,
-      "legacyAliases": [
-        "platform.resource.create"
-      ],
       "legacyCapabilities": [
         "create"
       ]
@@ -8103,9 +8039,6 @@
       "approvalPolicy": "never",
       "status": "active",
       "assignable": true,
-      "legacyAliases": [
-        "platform.resource.create"
-      ],
       "legacyCapabilities": [
         "create"
       ]
@@ -8494,11 +8427,11 @@
       ]
     },
     {
-      "key": "platform.resource.create",
+      "key": "platform.resource-creation.use",
       "domain": "platform",
-      "resource": "resource",
-      "action": "create",
-      "displayName": "创建 Kubernetes 资源",
+      "resource": "resource-creation",
+      "action": "use",
+      "displayName": "使用 Kubernetes YAML 创建器",
       "riskLevel": "mutate",
       "scopeKinds": [
         "workspace",
@@ -8507,48 +8440,8 @@
         "resource"
       ],
       "approvalPolicy": "never",
-      "status": "legacy",
-      "assignable": false,
-      "replacedBy": [
-        "platform.access-control.cluster-role-bindings.create",
-        "platform.access-control.cluster-roles.create",
-        "platform.access-control.role-bindings.create",
-        "platform.access-control.roles.create",
-        "platform.access-control.service-accounts.create",
-        "platform.clusters.create",
-        "platform.configuration.config-maps.create",
-        "platform.configuration.horizontal-pod-autoscalers.create",
-        "platform.configuration.leases.create",
-        "platform.configuration.limit-ranges.create",
-        "platform.configuration.mutating-webhook-configurations.create",
-        "platform.configuration.pod-disruption-budgets.create",
-        "platform.configuration.priority-classes.create",
-        "platform.configuration.resource-quotas.create",
-        "platform.configuration.runtime-classes.create",
-        "platform.configuration.secrets.create",
-        "platform.configuration.validating-webhook-configurations.create",
-        "platform.extensions.crds.create",
-        "platform.extensions.custom-resources.create",
-        "platform.helm.releases.create",
-        "platform.namespaces.create",
-        "platform.network.endpoint-slices.create",
-        "platform.network.gateway-classes.create",
-        "platform.network.gateways.create",
-        "platform.network.ingress-classes.create",
-        "platform.network.ingresses.create",
-        "platform.network.network-policies.create",
-        "platform.network.port-forwards.create",
-        "platform.network.services.create",
-        "platform.storage.persistent-volume-claims.create",
-        "platform.storage.persistent-volumes.create",
-        "platform.storage.storage-classes.create",
-        "platform.workloads.cron-jobs.create",
-        "platform.workloads.daemon-sets.create",
-        "platform.workloads.jobs.create",
-        "platform.workloads.replica-sets.create",
-        "platform.workloads.replication-controllers.create",
-        "platform.workloads.stateful-sets.create"
-      ]
+      "status": "active",
+      "assignable": true
     },
     {
       "key": "platform.storage.persistent-volume-claims.create",
@@ -8565,9 +8458,6 @@
       "approvalPolicy": "never",
       "status": "active",
       "assignable": true,
-      "legacyAliases": [
-        "platform.resource.create"
-      ],
       "legacyCapabilities": [
         "create"
       ]
@@ -8645,9 +8535,6 @@
       "approvalPolicy": "never",
       "status": "active",
       "assignable": true,
-      "legacyAliases": [
-        "platform.resource.create"
-      ],
       "legacyCapabilities": [
         "create"
       ]
@@ -8726,8 +8613,7 @@
       "status": "active",
       "assignable": true,
       "legacyAliases": [
-        "platform.cluster-resources.manage",
-        "platform.resource.create"
+        "platform.cluster-resources.manage"
       ],
       "legacyCapabilities": [
         "create"
@@ -8834,9 +8720,6 @@
       "approvalPolicy": "never",
       "status": "active",
       "assignable": true,
-      "legacyAliases": [
-        "platform.resource.create"
-      ],
       "legacyCapabilities": [
         "create"
       ]
@@ -8933,9 +8816,6 @@
       "approvalPolicy": "never",
       "status": "active",
       "assignable": true,
-      "legacyAliases": [
-        "platform.resource.create"
-      ],
       "legacyCapabilities": [
         "create"
       ]
@@ -9032,9 +8912,6 @@
       "approvalPolicy": "never",
       "status": "active",
       "assignable": true,
-      "legacyAliases": [
-        "platform.resource.create"
-      ],
       "legacyCapabilities": [
         "create"
       ]
@@ -9131,9 +9008,6 @@
       "approvalPolicy": "never",
       "status": "active",
       "assignable": true,
-      "legacyAliases": [
-        "platform.resource.create"
-      ],
       "legacyCapabilities": [
         "create"
       ]
@@ -9211,9 +9085,6 @@
       "approvalPolicy": "never",
       "status": "active",
       "assignable": true,
-      "legacyAliases": [
-        "platform.resource.create"
-      ],
       "legacyCapabilities": [
         "create"
       ]
@@ -9272,9 +9143,6 @@
       "approvalPolicy": "never",
       "status": "active",
       "assignable": true,
-      "legacyAliases": [
-        "platform.resource.create"
-      ],
       "legacyCapabilities": [
         "create"
       ]

package/compat/json-schema-ecosystem-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.9",
+  "version": "0.1.11",
   "schemas": {
     "plugins/plugin-manifest.schema.json": {
       "rootRequired": ["id", "name", "publisher", "type", "version"],

package/compat/openapi-loose-boundaries-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.9",
+  "version": "0.1.11",
   "generatedFrom": "openapi/soha-api.yaml",
   "entries": [
     {
@@ -354,10 +354,6 @@
       "kind": "additionalPropertiesTrue",
       "path": "components/schemas/IdentityProviderInput/properties/config/additionalProperties"
     },
-    {
-      "kind": "additionalPropertiesTrue",
-      "path": "components/schemas/IdentityProviderInput/properties/secretRefs/additionalProperties"
-    },
     {
       "kind": "additionalPropertiesTrue",
       "path": "components/schemas/InstalledPlugin/properties/metadata/additionalProperties"

package/fixtures/openapi/DockerHostAgentInstallation/invalid/missing-command.json

@@ -0,0 +1,6 @@
+{
+  "hostId": "runtime-host-01",
+  "operationId": "host-sync-01",
+  "scriptUrl": "https://soha.example.com/api/v1/docker/agent-installations/ticket/install.sh",
+  "expiresAt": "2026-08-11T10:15:00Z"
+}

package/fixtures/openapi/DockerHostAgentInstallation/valid/installation.json

@@ -0,0 +1,7 @@
+{
+  "hostId": "runtime-host-01",
+  "operationId": "host-sync-01",
+  "scriptUrl": "https://soha.example.com/api/v1/docker/agent-installations/ticket/install.sh",
+  "command": "curl -fsSL 'https://soha.example.com/api/v1/docker/agent-installations/ticket/install.sh' | sudo sh",
+  "expiresAt": "2026-08-11T10:15:00Z"
+}

package/fixtures/openapi/IdentityProvider/invalid/missing-id.json

@@ -0,0 +1,9 @@
+{
+  "applicationId": "application-1",
+  "name": "Broken provider",
+  "type": "oidc",
+  "enabled": true,
+  "status": "active",
+  "createdAt": "2026-08-01T00:00:00Z",
+  "updatedAt": "2026-08-01T00:00:00Z"
+}

package/fixtures/openapi/IdentityProvider/valid/current.json

@@ -0,0 +1,12 @@
+{
+  "id": "provider-2",
+  "applicationId": "application-2",
+  "name": "Example SAML",
+  "type": "saml",
+  "enabled": true,
+  "config": {},
+  "configuredSecretAliases": ["SIGNING_KEY"],
+  "status": "active",
+  "createdAt": "2026-08-01T00:00:00Z",
+  "updatedAt": "2026-08-01T00:00:00Z"
+}

package/fixtures/openapi/IdentityProvider/valid/v0.1.9.json

@@ -0,0 +1,14 @@
+{
+  "id": "provider-1",
+  "applicationId": "application-1",
+  "name": "Example OIDC",
+  "type": "oidc",
+  "enabled": true,
+  "config": {},
+  "secretRefs": {
+    "CLIENT_SECRET": "soha://secrets/oidc-client"
+  },
+  "status": "active",
+  "createdAt": "2026-08-01T00:00:00Z",
+  "updatedAt": "2026-08-01T00:00:00Z"
+}

package/fixtures/openapi/MenuEnvelope/invalid/missing-data.json

@@ -0,0 +1 @@
+{}

package/fixtures/openapi/MenuEnvelope/valid/menu.json

@@ -0,0 +1,13 @@
+{
+  "data": {
+    "id": "settings-overview",
+    "path": "/settings/overview",
+    "labelZh": "设置总览",
+    "labelEn": "Settings Overview",
+    "iconKey": "dashboard",
+    "section": "",
+    "sortOrder": 10,
+    "enabled": true,
+    "roleIds": []
+  }
+}

package/fixtures/openapi/MenuInput/invalid/missing-icon.json

@@ -0,0 +1,5 @@
+{
+  "path": "/settings/overview",
+  "labelZh": "设置总览",
+  "labelEn": "Settings Overview"
+}

package/fixtures/openapi/MenuInput/valid/top-level.json

@@ -0,0 +1,12 @@
+{
+  "id": "settings-overview",
+  "parentId": null,
+  "path": "/settings/overview",
+  "labelZh": "设置总览",
+  "labelEn": "Settings Overview",
+  "iconKey": "dashboard",
+  "section": "",
+  "sortOrder": 10,
+  "enabled": true,
+  "roleIds": []
+}

package/fixtures/openapi/MenuListEnvelope/invalid/items-object.json

@@ -0,0 +1,3 @@
+{
+  "items": {}
+}

package/fixtures/openapi/MenuListEnvelope/valid/tree.json

@@ -0,0 +1,27 @@
+{
+  "items": [
+    {
+      "id": "settings",
+      "path": "/settings",
+      "labelZh": "设置中心",
+      "labelEn": "Settings",
+      "iconKey": "setting",
+      "section": "",
+      "sortOrder": 10,
+      "enabled": true,
+      "children": [
+        {
+          "id": "settings-overview",
+          "parentId": "settings",
+          "path": "/settings/overview",
+          "labelZh": "设置总览",
+          "labelEn": "Settings Overview",
+          "iconKey": "dashboard",
+          "section": "",
+          "sortOrder": 10,
+          "enabled": true
+        }
+      ]
+    }
+  ]
+}

package/fixtures/openapi/OIDCClient/invalid/missing-grant-types.json

@@ -0,0 +1,9 @@
+{
+  "id": "client-1",
+  "providerId": "provider-1",
+  "clientId": "grafana",
+  "redirectUris": ["https://grafana.example.com/login/oauth"],
+  "status": "active",
+  "createdAt": "2026-08-01T00:00:00Z",
+  "updatedAt": "2026-08-01T00:00:00Z"
+}