feat(protocol): define native session credentials

tools/go-conformance/main.go

@@ -38,7 +38,7 @@ func main() {
 			if len(fields) != 5 {
 				panic("invalid fixture row")
 			}
-			actual := evaluate(fields[2], fields[3])
+			actual := evaluate(fields[1], fields[2], fields[3])
 			if actual != fields[4] {
 				panic(fmt.Sprintf("%s: got %s want %s", fields[0], actual, fields[4]))
 			}
@@ -49,7 +49,7 @@ func main() {
 	fmt.Printf("Go conformance passed normalized=%s fixtures=%s\n", normalizedDigest(results), fixtureHash)
 }
 
-func evaluate(kind, input string) string {
+func evaluate(version, kind, input string) string {
 	parts := map[string]string{}
 	for _, item := range strings.Split(input, ";") {
 		pair := strings.SplitN(item, "=", 2)
@@ -59,7 +59,7 @@ func evaluate(kind, input string) string {
 	}
 	switch kind {
 	case "version":
-		if input == "1" || input == "0" || input == "-1" {
+		if input == "2" || input == "1" || input == "0" {
 			return "valid"
 		}
 		return "invalid:unsupported_version"
@@ -81,7 +81,7 @@ func evaluate(kind, input string) string {
 			Version: parts["version"], Purpose: parts["purpose"], SessionID: "session-1",
 			ReconnectSequence: 0,
 			Gateway: protocol.ManifestGateway{
-				ID: parts["gateway_id"], Addresses: []string{"gateway.control.test:443"}, PublicIdentity: parts["gateway_id"],
+				ID: parts["gateway_id"], Addresses: []string{"gateway.control.test:443"}, PublicIdentity: parts["public_identity"],
 			},
 			Tunnel:        protocol.ManifestTunnel{Versions: []string{parts["protocol"] + "/1"}, Features: []string{"control.v1"}},
 			Profile:       protocol.ManifestProfile{ID: "standard", Bounds: protocol.ManifestBounds{MinimumKbps: 1, TargetKbps: 2, MaximumKbps: 3}},
@@ -99,6 +99,60 @@ func evaluate(kind, input string) string {
 			return "valid"
 		}
 		return "invalid:unsupported_clipboard"
+	case "session_request":
+		if version != "2" {
+			return "invalid:unsupported_version"
+		}
+		if _, supplied := parts["policy_snapshot"]; supplied {
+			return "invalid:forbidden_field"
+		}
+		value := protocol.SessionRequest{
+			ClientDeviceID: parts["client_device_id"], DeviceKeyID: parts["device_key_id"],
+			PoolID: parts["pool_id"], IdempotencyKey: parts["idempotency_key"],
+		}
+		if value.Validate() == nil {
+			return "valid"
+		}
+		return "invalid:required"
+	case "browser_authenticated_session":
+		if _, hasDevice := parts["client_device_id"]; hasDevice {
+			return "invalid:forbidden_field"
+		}
+		if _, hasKey := parts["device_key_id"]; hasKey {
+			return "invalid:forbidden_field"
+		}
+		value := protocol.BrowserAuthenticatedSession{
+			Username: parts["username"], Provider: parts["provider"], Roles: []string{parts["roles"]},
+			Role: parts["role"],
+		}
+		if value.Validate() == nil {
+			return "valid"
+		}
+		return "invalid:invalid_session"
+	case "native_authenticated_session":
+		clientDeviceID, hasDevice := parts["client_device_id"]
+		deviceKeyID, hasKey := parts["device_key_id"]
+		if !hasDevice || !hasKey {
+			return "invalid:required"
+		}
+		value := protocol.NativeAuthenticatedSession{
+			Username: parts["username"], Provider: parts["provider"], Roles: []string{parts["roles"]}, Role: parts["role"],
+			NativeIdentity: protocol.NativeSessionIdentity{ClientDeviceID: clientDeviceID, DeviceKeyID: deviceKeyID},
+		}
+		if value.Validate() == nil {
+			return "valid"
+		}
+		return "invalid:invalid_session"
+	case "native_tunnel_credential":
+		value := protocol.NativeTunnelCredential{
+			ClientDeviceID: parts["client_device_id"], DeviceKeyID: parts["device_key_id"],
+			CertificateChainPem: parts["certificate_chain_pem"], TrustBundlePem: parts["trust_bundle_pem"],
+			ExpiresAt: parts["expires_at"],
+		}
+		if value.Validate() == nil {
+			return "valid"
+		}
+		return "invalid:invalid_credential"
 	case "event":
 		sequence, sequenceErr := strconv.ParseInt(parts["sequence"], 10, 64)
 		payloadBytes, payloadErr := strconv.Atoi(parts["payload_bytes"])
@@ -126,8 +180,8 @@ func evaluate(kind, input string) string {
 		return "valid"
 	case "tunnel":
 		feature := parts["feature"]
-		registered := feature == "control.v1" || feature == "display.request.v1" || feature == "input.absolute.v1" || feature == "input.scroll.v1"
-		if (parts["offered"] == "1" || parts["offered"] == "0" || parts["offered"] == "-1") && registered {
+		registered := feature == "control.v1" || feature == "control.v2" || feature == "display.request.v1" || feature == "input.absolute.v1" || feature == "input.scroll.v1"
+		if (parts["offered"] == "2" || parts["offered"] == "1" || parts["offered"] == "0") && registered {
 			return "valid"
 		}
 		if !registered {