Skip to content

fix(api): ADR 030 contract hardening for #585 - #586

Draft
livio-a wants to merge 3 commits into
mainfrom
cursor/issue-585-contract-hardening-e055
Draft

fix(api): ADR 030 contract hardening for #585#586
livio-a wants to merge 3 commits into
mainfrom
cursor/issue-585-contract-hardening-e055

Conversation

@livio-a

@livio-a livio-a commented Jul 22, 2026

Copy link
Copy Markdown
Member

Summary

Implements issue #585 contract hardening across three areas:

  1. Status map dedup — single codeHTTPStatus manifest in internal/api/error_status.go; all domain errors route through domainErrorResponse.
  2. Selective details — shared marshalErrorDetails; structured RequestInvalidFieldDetails for flow field decode; string blobs moved to Message where appropriate.
  3. Schema sensitivity docs — path/query audit runbook and x-sensitive cross-links.

Follow-up cleanup in this PR:

  • Session TTL details use internal/isoduration.Duration (ISO wire encoding at the type, not per-handler).
  • Removed thin *_errorResponse wrappers that only delegated to domainErrorResponse; errorResponse now calls the manifest directly.

Validation

  • go test ./internal/isoduration/ ./internal/api/ ./internal/domain/ — pass

Release notes / changeset

Changeset included (.changeset/issue-585-contract-hardening.md) — API error envelope behavior change for consumers parsing details.

Notes

  • Authz opaque WithDetails("project does not exist") intentionally deferred.
  • Legacy details.details nesting preserved in marshalErrorDetails.
Open in Web Open in Cursor 

Centralize domain code→HTTP status mapping, unify error details
marshalling, add structured req.invalid field details on flow Fields
decode, clean up string WithDetails blobs, and document producer
contract plus path/query sensitivity audit.

Co-authored-by: Livio Spring <livio-a@users.noreply.github.com>
@vercel

vercel Bot commented Jul 22, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
nextgen Ready Ready Preview, Comment Jul 22, 2026 7:55am
nextgen-docs Ready Ready Preview, Comment Jul 22, 2026 7:55am
nextgen-mock-zitadel Ready Ready Preview, Comment Jul 22, 2026 7:55am

Request Review

@github-actions

github-actions Bot commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

🦋 Changeset detected

Latest commit: b852192

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 19 packages
Name Type
@zitadel/server Patch
@zitadel/cli Patch
@zitadel/server-linux-x64 Patch
@zitadel/server-linux-arm64 Patch
@zitadel/server-darwin-x64 Patch
@zitadel/server-darwin-arm64 Patch
@zitadel/server-win32-x64 Patch
@zitadel/api Patch
@zitadel/config Patch
@zitadel/components Patch
@zitadel/sdk-core Patch
@zitadel/sdk-next Patch
@zitadel/sdk-nuxt Patch
@zitadel/sdk-react Patch
@zitadel/sdk-vue Patch
@zitadel/sdk-angular Patch
@zitadel/sdk-solid Patch
@zitadel/sdk-svelte Patch
@zitadel/sdk-qwik Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

Extract internal/isoduration with ISO JSON marshalling shared by ogen
and SessionInvalidTTLDetails. Remove sessionInvalidTTLResponse special
case; domain tests assert semantic Details without json.Marshal.

Co-authored-by: Livio Spring <livio-a@users.noreply.github.com>
All resource-specific mappers only delegated to domainErrorResponse
after the codeHTTPStatus manifest landed. Route every domain error
through domainErrorResponse directly and remove dead flowdef aliases.

Co-authored-by: Livio Spring <livio-a@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Inbox

Development

Successfully merging this pull request may close these issues.

2 participants