draftgo-cli 4.0.1 → 4.0.23

package/resources/custom-service-sdk/resources.go

@@ -0,0 +1,246 @@
+package sdk
+
+import (
+	"context"
+	"encoding/base64"
+	"fmt"
+)
+
+const (
+	ScopePlatform = "platform"
+	ScopeSpace    = "space"
+)
+
+// FileStore is the generic file-management facade. File bytes are exchanged
+// through the host; custom services never receive object-store paths.
+type FileStore interface {
+	ListFolders(context.Context, map[string]any) (map[string]any, error)
+	GetFolder(context.Context, int64) (map[string]any, error)
+	CreateFolder(context.Context, FileFolderInput) (map[string]any, error)
+	UpdateFolder(context.Context, int64, FileFolderUpdateInput) (map[string]any, error)
+	DeleteFolder(context.Context, int64, bool) error
+	RestoreFolder(context.Context, int64) (map[string]any, error)
+	ListAssets(context.Context, map[string]any) (map[string]any, error)
+	GetAsset(context.Context, int64) (map[string]any, error)
+	Upload(context.Context, FileUploadRequest) (map[string]any, error)
+	UpdateAsset(context.Context, int64, map[string]any) (map[string]any, error)
+	Move(context.Context, int64, int64) (map[string]any, error)
+	Trash(context.Context, int64) error
+	Restore(context.Context, int64) (map[string]any, error)
+	Purge(context.Context, int64) error
+	Download(context.Context, int64) (FileDownload, error)
+	ListBindings(context.Context, int64, bool) (map[string]any, error)
+	Unbind(context.Context, FileBindingRequest) error
+}
+
+type FileFolderInput struct {
+	Name     string `json:"name"`
+	ParentID int64  `json:"parent_id,omitempty"`
+}
+
+// FileFolderUpdateInput uses pointers so moving a folder to the root
+// (parent_id=0) is distinguishable from leaving its parent unchanged.
+type FileFolderUpdateInput struct {
+	Name     *string `json:"name,omitempty"`
+	ParentID *int64  `json:"parent_id,omitempty"`
+}
+
+type FileUploadRequest struct {
+	Filename   string `json:"filename"`
+	MIMEType   string `json:"mime_type,omitempty"`
+	Content    []byte `json:"-"`
+	FolderID   int64  `json:"folder_id,omitempty"`
+	Visibility string `json:"visibility,omitempty"`
+}
+
+type FileDownload struct {
+	Filename string
+	MIMEType string
+	Content  []byte
+	URL      string
+}
+
+type FileBindingRequest struct {
+	AssetID     int64  `json:"asset_id"`
+	BindingType string `json:"binding_type"`
+	BindingID   int64  `json:"binding_id"`
+	Relation    string `json:"relation,omitempty"`
+}
+
+// ScopeAPI exposes invocation identity and permission checks. Current returns
+// the verified ResourceContext so callers do not confuse persisted ownership
+// with a request-global workspace selection.
+type ScopeAPI interface {
+	CurrentPrincipal(context.Context) (ScopePrincipal, error)
+	Current(context.Context) (ResourceContext, error)
+	Check(context.Context, string, ResourceOwnership) error
+}
+
+var (
+	_ FileStore = fileStoreClient{}
+	_ ScopeAPI  = scopeClient{}
+)
+
+type ScopePrincipal struct {
+	SubjectType string `json:"subject_type"`
+	SubjectID   string `json:"subject_id"`
+	Username    string `json:"username,omitempty"`
+	IsAdmin     bool   `json:"is_admin,omitempty"`
+}
+
+// ResourceContext is the persisted ownership context inherited by the custom
+// service invocation. It is not a selected workspace or request-global scope.
+type ResourceContext struct {
+	ScopeType   string `json:"scope_type"`
+	WorkspaceID int64  `json:"workspace_id,omitempty"`
+	SpaceID     int64  `json:"space_id,omitempty"`
+}
+
+// ResourceOwnership identifies the persisted authorization boundary of a
+// resource. OwnerUserID is used only for permissions with own/all data range.
+type ResourceOwnership struct {
+	ScopeType   string `json:"scope_type"`
+	WorkspaceID int64  `json:"workspace_id,omitempty"`
+	SpaceID     int64  `json:"space_id,omitempty"`
+	OwnerUserID int64  `json:"owner_user_id,omitempty"`
+}
+
+func resourceOwnership(value map[string]any) ResourceOwnership {
+	return ResourceOwnership{
+		ScopeType:   fmtString(value["ownership_type"]),
+		WorkspaceID: asInt64(value["workspace_id"]),
+		SpaceID:     asInt64(value["space_id"]),
+		OwnerUserID: asInt64(value["owner_user_id"]),
+	}
+}
+
+func (p platformClient) resourceRequest(ctx context.Context, method, path string, query, body any) (map[string]any, error) {
+	value, err := p.call(ctx, "resource.request", map[string]any{"method": method, "path": path, "query": query, "body": body})
+	return mapResult(value), err
+}
+
+type fileStoreClient struct{ platformClient }
+type scopeClient struct{ platformClient }
+
+func (p fileStoreClient) request(ctx context.Context, operation string, args any) (map[string]any, error) {
+	value, err := p.call(ctx, operation, args)
+	return mapResult(value), err
+}
+func (p fileStoreClient) ListFolders(ctx context.Context, query map[string]any) (map[string]any, error) {
+	return p.request(ctx, "files.folder.list", map[string]any{"query": query})
+}
+func (p fileStoreClient) GetFolder(ctx context.Context, id int64) (map[string]any, error) {
+	return p.request(ctx, "files.folder.get", map[string]any{"id": id})
+}
+func (p fileStoreClient) CreateFolder(ctx context.Context, input FileFolderInput) (map[string]any, error) {
+	return p.request(ctx, "files.folder.create", input)
+}
+func (p fileStoreClient) UpdateFolder(ctx context.Context, id int64, input FileFolderUpdateInput) (map[string]any, error) {
+	return p.request(ctx, "files.folder.update", map[string]any{"id": id, "data": input})
+}
+func (p fileStoreClient) DeleteFolder(ctx context.Context, id int64, force bool) error {
+	_, err := p.request(ctx, "files.folder.delete", map[string]any{"id": id, "force": force})
+	return err
+}
+func (p fileStoreClient) RestoreFolder(ctx context.Context, id int64) (map[string]any, error) {
+	return p.request(ctx, "files.folder.restore", map[string]any{"id": id})
+}
+func (p fileStoreClient) ListAssets(ctx context.Context, query map[string]any) (map[string]any, error) {
+	return p.request(ctx, "files.asset.list", map[string]any{"query": query})
+}
+func (p fileStoreClient) GetAsset(ctx context.Context, id int64) (map[string]any, error) {
+	return p.request(ctx, "files.asset.get", map[string]any{"id": id})
+}
+func (p fileStoreClient) Upload(ctx context.Context, input FileUploadRequest) (map[string]any, error) {
+	return p.request(ctx, "files.asset.upload", map[string]any{"filename": input.Filename, "mime_type": input.MIMEType, "content_base64": base64.StdEncoding.EncodeToString(input.Content), "folder_id": input.FolderID, "visibility": input.Visibility})
+}
+func (p fileStoreClient) UpdateAsset(ctx context.Context, id int64, data map[string]any) (map[string]any, error) {
+	return p.request(ctx, "files.asset.update", map[string]any{"id": id, "data": data})
+}
+func (p fileStoreClient) Move(ctx context.Context, id, folderID int64) (map[string]any, error) {
+	return p.request(ctx, "files.asset.move", map[string]any{"id": id, "folder_id": folderID})
+}
+func (p fileStoreClient) Trash(ctx context.Context, id int64) error {
+	_, err := p.request(ctx, "files.asset.trash", map[string]any{"id": id})
+	return err
+}
+func (p fileStoreClient) Restore(ctx context.Context, id int64) (map[string]any, error) {
+	return p.request(ctx, "files.asset.restore", map[string]any{"id": id})
+}
+func (p fileStoreClient) Purge(ctx context.Context, id int64) error {
+	_, err := p.request(ctx, "files.asset.purge", map[string]any{"id": id})
+	return err
+}
+func (p fileStoreClient) Download(ctx context.Context, id int64) (FileDownload, error) {
+	value, err := p.call(ctx, "files.asset.download", map[string]any{"id": id})
+	if err != nil {
+		return FileDownload{}, err
+	}
+	object := mapResult(value)
+	content, decodeErr := decodeBase64Field(object["content_base64"])
+	if decodeErr != nil {
+		return FileDownload{}, decodeErr
+	}
+	return FileDownload{Filename: fmtString(object["filename"]), MIMEType: fmtString(object["mime_type"]), URL: fmtString(object["url"]), Content: content}, nil
+}
+func (p fileStoreClient) ListBindings(ctx context.Context, assetID int64, includeReleased bool) (map[string]any, error) {
+	return p.request(ctx, "files.binding.list", map[string]any{"asset_id": assetID, "include_released": includeReleased})
+}
+func (p fileStoreClient) Unbind(ctx context.Context, input FileBindingRequest) error {
+	_, err := p.request(ctx, "files.binding.release", input)
+	return err
+}
+
+func (p scopeClient) request(ctx context.Context, operation string, args any) (map[string]any, error) {
+	value, err := p.call(ctx, operation, args)
+	return mapResult(value), err
+}
+func (p scopeClient) Current(ctx context.Context) (ResourceContext, error) {
+	value, err := p.request(ctx, "resource.context.current", nil)
+	if err != nil {
+		return ResourceContext{}, err
+	}
+	return ResourceContext{
+		ScopeType:   fmtString(value["scope_type"]),
+		WorkspaceID: asInt64(value["workspace_id"]),
+		SpaceID:     asInt64(value["space_id"]),
+	}, nil
+}
+func (p scopeClient) CurrentPrincipal(ctx context.Context) (ScopePrincipal, error) {
+	value, err := p.request(ctx, "scope.principal.current", nil)
+	if err != nil {
+		return ScopePrincipal{}, err
+	}
+	return ScopePrincipal{
+		SubjectType: fmtString(value["subject_type"]),
+		SubjectID:   fmtString(value["subject_id"]),
+		Username:    fmtString(value["username"]),
+		IsAdmin:     asBool(value["is_admin"]),
+	}, nil
+}
+func (p scopeClient) Check(ctx context.Context, permission string, resource ResourceOwnership) error {
+	_, err := p.request(ctx, "scope.permission.check", map[string]any{"permission": permission, "resource": resource})
+	return err
+}
+
+func fmtString(value any) string {
+	if value == nil {
+		return ""
+	}
+	return fmt.Sprint(value)
+}
+
+func decodeBase64Field(value any) ([]byte, error) {
+	switch typed := value.(type) {
+	case []byte:
+		return typed, nil
+	case string:
+		decoded, err := base64.StdEncoding.DecodeString(typed)
+		if err != nil {
+			return nil, fmt.Errorf("decode file content: %w", err)
+		}
+		return decoded, nil
+	default:
+		return nil, nil
+	}
+}

package/resources/custom-service-sdk/resources_billing_test.go

@@ -0,0 +1,115 @@
+package sdk
+
+import (
+	"context"
+	"net/http"
+	"reflect"
+	"testing"
+)
+
+type contractClient struct {
+	operations []string
+	args       []any
+}
+
+func (c *contractClient) Call(_ context.Context, operation string, args any) (any, error) {
+	c.operations = append(c.operations, operation)
+	c.args = append(c.args, args)
+	switch operation {
+	case "billing.payment.create":
+		return map[string]any{"order_id": "po_1", "provider": "wechat", "status": "pending", "amount_minor": float64(123), "pay_url": "https://pay"}, nil
+	case "billing.ai.session.start", "billing.ai.session.settle":
+		return map[string]any{"id": "bs_1", "status": "reserved", "reserved_minor": float64(10), "settled_minor": float64(0), "price_version": "v1"}, nil
+	case "files.asset.download":
+		return map[string]any{"filename": "a.txt", "mime_type": "text/plain", "content_base64": "aGVsbG8="}, nil
+	case "resource.context.current":
+		return map[string]any{"scope_type": "space", "workspace_id": float64(2), "space_id": float64(8)}, nil
+	default:
+		return map[string]any{"ok": true}, nil
+	}
+}
+
+func TestGenericResourceAndBillingFacade(t *testing.T) {
+	client := &contractClient{}
+	ctx := NewContext(context.Background(), nil, map[string]any{"id": float64(3)}, http.Header{}, client)
+
+	if _, err := ctx.Files.Upload(ctx.Context(), FileUploadRequest{Filename: "a.txt", Content: []byte("hello")}); err != nil {
+		t.Fatal(err)
+	}
+	download, err := ctx.Files.Download(ctx.Context(), 1)
+	if err != nil || string(download.Content) != "hello" || download.Filename != "a.txt" {
+		t.Fatalf("download = %#v, err = %v", download, err)
+	}
+	if _, err = ctx.Scope.Current(ctx.Context()); err != nil {
+		t.Fatal(err)
+	}
+	if err = ctx.Scope.Check(ctx.Context(), "files:read", ResourceOwnership{ScopeType: ScopeSpace, WorkspaceID: 2, SpaceID: 8}); err != nil {
+		t.Fatal(err)
+	}
+	intent, err := ctx.Billing.CreatePaymentOrder(ctx.Context(), PaymentOrderRequest{BusinessOrderID: "bo_1", AmountMinor: 123, IdempotencyKey: "pay-1"})
+	if err != nil || intent.OrderID != "po_1" || intent.AmountMinor != 123 {
+		t.Fatalf("intent = %#v, err = %v", intent, err)
+	}
+	session, err := ctx.Billing.StartAIBilling(ctx.Context(), AIBillingStartRequest{IdempotencyKey: "ai-1", EstimatedMinor: 10})
+	if err != nil || session.ID != "bs_1" || session.ReservedMinor != 10 {
+		t.Fatalf("session = %#v, err = %v", session, err)
+	}
+	if _, err = ctx.Billing.ConsumeEntitlement(ctx.Context(), EntitlementConsumeRequest{Code: "agent.calls", Quantity: 1, IdempotencyKey: "consume-1"}); err != nil {
+		t.Fatal(err)
+	}
+
+	wantOps := []string{"files.asset.upload", "files.asset.download", "resource.context.current", "scope.permission.check", "billing.payment.create", "billing.ai.session.start", "billing.entitlement.consume"}
+	if !reflect.DeepEqual(client.operations, wantOps) {
+		t.Fatalf("operations = %#v, want %#v", client.operations, wantOps)
+	}
+	uploadArgs := client.args[0].(map[string]any)
+	if uploadArgs["content_base64"] != "aGVsbG8=" {
+		t.Fatalf("file upload is not wire-safe: %#v", uploadArgs)
+	}
+	args, ok := client.args[4].(PaymentOrderRequest)
+	if !ok || args.IdempotencyKey != "pay-1" {
+		t.Fatalf("payment args = %#v", client.args[4])
+	}
+}
+
+func TestAdminResourceFacadeMarksElevatedCalls(t *testing.T) {
+	client := &contractClient{}
+	ctx := NewContext(context.Background(), nil, nil, nil, client)
+	if _, err := ctx.Admin.Billing.ListPaymentOrders(ctx.Context(), nil); err != nil {
+		t.Fatal(err)
+	}
+	args, ok := client.args[0].(map[string]any)
+	if !ok || args["__draftgo_admin"] != true {
+		t.Fatalf("admin marker missing from %#v", client.args[0])
+	}
+}
+
+func TestBillingMoneyOperationsKeepMinorUnitsAndIdempotency(t *testing.T) {
+	client := &contractClient{}
+	ctx := NewContext(context.Background(), nil, nil, nil, client)
+	request := MoneyOperationRequest{AmountMinor: 99, IdempotencyKey: "money-1", RequestID: "request-1"}
+	if _, err := ctx.Billing.GetAccount(ctx.Context()); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := ctx.Billing.DebitAccount(ctx.Context(), request); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := ctx.Billing.HoldFunds(ctx.Context(), request); err != nil {
+		t.Fatal(err)
+	}
+	if err := ctx.Billing.ReleaseHold(ctx.Context(), HoldOperationRequest{HoldID: "hold-1", IdempotencyKey: "release-1"}); err != nil {
+		t.Fatal(err)
+	}
+	want := []string{"billing.account.get", "billing.account.debit", "billing.account.hold", "billing.account.hold.release"}
+	if !reflect.DeepEqual(client.operations, want) {
+		t.Fatalf("operations = %#v, want %#v", client.operations, want)
+	}
+	getArgs := client.args[0].(map[string]any)
+	if len(getArgs) != 0 {
+		t.Fatalf("account get args = %#v, want no client-selected account", getArgs)
+	}
+	got := client.args[1].(MoneyOperationRequest)
+	if got.AmountMinor != 99 || got.IdempotencyKey != "money-1" || got.RequestID != "request-1" {
+		t.Fatalf("money contract = %#v", got)
+	}
+}

package/resources/custom-service-sdk/resources_files_test.go

@@ -0,0 +1,57 @@
+package sdk
+
+import (
+	"context"
+	"testing"
+)
+
+func TestFileStoreClientExposesCompleteFolderAndBindingLifecycle(t *testing.T) {
+	recorder := &scopeRecordingClient{}
+	client := fileStoreClient{platformClient{client: recorder}}
+	ctx := context.Background()
+	root := int64(0)
+	name := "renamed"
+
+	if _, err := client.UpdateFolder(ctx, 4, FileFolderUpdateInput{Name: &name, ParentID: &root}); err != nil || recorder.operation != "files.folder.update" {
+		t.Fatalf("folder update operation=%q args=%#v err=%v", recorder.operation, recorder.args, err)
+	}
+	data := recorder.args.(map[string]any)["data"].(FileFolderUpdateInput)
+	if data.ParentID == nil || *data.ParentID != 0 {
+		t.Fatalf("root move was lost: %#v", data)
+	}
+	if err := client.DeleteFolder(ctx, 4, true); err != nil || recorder.operation != "files.folder.delete" || recorder.args.(map[string]any)["force"] != true {
+		t.Fatalf("folder purge operation=%q args=%#v err=%v", recorder.operation, recorder.args, err)
+	}
+	if _, err := client.RestoreFolder(ctx, 4); err != nil || recorder.operation != "files.folder.restore" {
+		t.Fatalf("folder restore operation=%q err=%v", recorder.operation, err)
+	}
+	if _, err := client.ListBindings(ctx, 8, true); err != nil || recorder.operation != "files.binding.list" || recorder.args.(map[string]any)["include_released"] != true {
+		t.Fatalf("binding list operation=%q args=%#v err=%v", recorder.operation, recorder.args, err)
+	}
+	if err := client.Unbind(ctx, FileBindingRequest{AssetID: 8, BindingType: "knowledge_base", BindingID: 9, Relation: "source"}); err != nil || recorder.operation != "files.binding.release" {
+		t.Fatalf("binding release operation=%q args=%#v err=%v", recorder.operation, recorder.args, err)
+	}
+}
+
+func TestFileStoreClientUsesVerifiedHostScope(t *testing.T) {
+	recorder := &scopeRecordingClient{}
+	client := fileStoreClient{platformClient{client: recorder}}
+	ctx := context.Background()
+
+	folder := FileFolderInput{Name: "Reports"}
+	if _, err := client.CreateFolder(ctx, folder); err != nil || recorder.operation != "files.folder.create" {
+		t.Fatalf("folder create operation=%q err=%v", recorder.operation, err)
+	}
+	gotFolder := recorder.args.(FileFolderInput)
+	if gotFolder.Name != "Reports" {
+		t.Fatalf("folder=%#v", gotFolder)
+	}
+
+	if _, err := client.Upload(ctx, FileUploadRequest{Filename: "a.txt", Content: []byte("a")}); err != nil {
+		t.Fatal(err)
+	}
+	gotUpload := recorder.args.(map[string]any)
+	if _, exists := gotUpload["scope_type"]; exists {
+		t.Fatalf("upload accepted client-selected scope=%#v", gotUpload)
+	}
+}

package/resources/custom-service-sdk/resources_scope_test.go

@@ -0,0 +1,87 @@
+package sdk
+
+import (
+	"context"
+	"testing"
+)
+
+type scopeRecordingClient struct {
+	operation string
+	args      any
+}
+
+func (client *scopeRecordingClient) Call(_ context.Context, operation string, args any) (any, error) {
+	client.operation, client.args = operation, args
+	switch operation {
+	case "resource.context.current":
+		return map[string]any{"scope_type": ScopeSpace, "workspace_id": float64(2), "space_id": float64(8)}, nil
+	case "scope.principal.current":
+		return map[string]any{"subject_type": "service", "subject_id": "service:42", "username": "publisher", "is_admin": true}, nil
+	default:
+		return map[string]any{"ok": true}, nil
+	}
+}
+
+func TestScopeClientUsesResourceAndPermissionOperations(t *testing.T) {
+	recorder := &scopeRecordingClient{}
+	client := scopeClient{platformClient{client: recorder}}
+	ctx := context.Background()
+
+	current, err := client.Current(ctx)
+	if err != nil || recorder.operation != "resource.context.current" {
+		t.Fatalf("current operation=%q err=%v", recorder.operation, err)
+	}
+	if current.ScopeType != ScopeSpace || current.WorkspaceID != 2 || current.SpaceID != 8 {
+		t.Fatalf("current=%#v", current)
+	}
+	principal, err := client.CurrentPrincipal(ctx)
+	if err != nil || recorder.operation != "scope.principal.current" {
+		t.Fatalf("principal operation=%q err=%v", recorder.operation, err)
+	}
+	if principal.SubjectType != "service" || principal.SubjectID != "service:42" || principal.Username != "publisher" || !principal.IsAdmin {
+		t.Fatalf("principal=%#v", principal)
+	}
+
+	resource := ResourceOwnership{ScopeType: ScopeSpace, WorkspaceID: 2, SpaceID: 8, OwnerUserID: 7}
+	if err := client.Check(ctx, "files:read", resource); err != nil || recorder.operation != "scope.permission.check" {
+		t.Fatalf("check operation=%q err=%v", recorder.operation, err)
+	}
+	args := recorder.args.(map[string]any)
+	if args["permission"] != "files:read" || args["resource"].(ResourceOwnership) != resource {
+		t.Fatalf("check args=%#v", args)
+	}
+
+	platform := ResourceOwnership{ScopeType: ScopePlatform}
+	if err := client.Check(ctx, "users:read", platform); err != nil {
+		t.Fatal(err)
+	}
+	if args := recorder.args.(map[string]any); args["resource"].(ResourceOwnership) != platform {
+		t.Fatalf("platform check args=%#v", args)
+	}
+}
+
+func TestContextExposesResourceContextWithoutLegacyOrganization(t *testing.T) {
+	recorder := &scopeRecordingClient{}
+	ctx := NewContext(context.Background(), nil, nil, nil, recorder)
+	if ctx.Scope == nil || ctx.Admin.Scope == nil {
+		t.Fatal("scope SDK facade is unavailable")
+	}
+	if _, err := ctx.Scope.Current(context.Background()); err != nil || recorder.operation != "resource.context.current" {
+		t.Fatalf("scope current operation=%q err=%v", recorder.operation, err)
+	}
+}
+
+func TestContextCarriesPersistedResourceAndPrincipal(t *testing.T) {
+	recorder := &scopeRecordingClient{}
+	ctx := NewContextWithResource(context.Background(), nil, nil, nil, recorder,
+		ResourceContext{ScopeType: ScopeSpace, WorkspaceID: 11, SpaceID: 13},
+		ScopePrincipal{SubjectType: "service", SubjectID: "custom-service:7", Username: "Service-Script"})
+	if ctx.Platform || ctx.WorkspaceID != 11 || ctx.SpaceID != 13 || ctx.Principal.SubjectID != "custom-service:7" {
+		t.Fatalf("runtime context = %+v", ctx)
+	}
+	platform := NewContextWithResource(context.Background(), nil, nil, nil, recorder,
+		ResourceContext{ScopeType: ScopePlatform}, ScopePrincipal{SubjectType: "service", SubjectID: "custom-service:8"})
+	if !platform.Platform || platform.WorkspaceID != 0 || platform.SpaceID != 0 {
+		t.Fatalf("platform runtime context = %+v", platform)
+	}
+}