feat(protocol): define native session credentials

tools/native_conformance.swift

@@ -9,17 +9,49 @@ func values(_ input: String) -> [String: String] {
     return result
 }
 
-func evaluate(_ kind: String, _ input: String) -> String {
+func evaluate(_ version: String, _ kind: String, _ input: String) -> String {
     let values = values(input)
     switch kind {
-    case "version": return ["1", "0", "-1"].contains(input) ? "valid" : "invalid:unsupported_version"
+    case "version": return ["2", "1", "0"].contains(input) ? "valid" : "invalid:unsupported_version"
     case "page":
         guard let raw = values["limit"], let limit = Int(raw), (1...100).contains(limit) else { return "invalid:invalid_limit" }
         return "valid"
     case "manifest":
         for key in ["provider_url", "vm_address", "password", "private_key"] where values[key] != nil { return "invalid:forbidden_field" }
-        return values["version"] == "1" && values["gateway_id"] != nil && (values["grant"]?.utf8.count ?? 0) >= 43 && values["purpose"] == "launch" ? "valid" : "invalid:invalid_manifest"
+        return values["version"] == "1" && values["gateway_id"] != nil && values["public_identity"] != nil && (values["grant"]?.utf8.count ?? 0) >= 43 && values["purpose"] == "launch" ? "valid" : "invalid:invalid_manifest"
     case "clipboard": return values["encoding"] == "utf-8" && values["file"] == nil ? "valid" : "invalid:unsupported_clipboard"
+    case "session_request":
+        guard version == "2" else { return "invalid:unsupported_version" }
+        if values["policy_snapshot"] != nil { return "invalid:forbidden_field" }
+        guard (try? SessionRequest(
+            clientDeviceId: values["client_device_id"] ?? "", deviceKeyId: values["device_key_id"] ?? "",
+            poolId: values["pool_id"] ?? "", idempotencyKey: values["idempotency_key"] ?? "",
+            requestedDisplayMode: nil
+        )) != nil else { return "invalid:required" }
+        return "valid"
+    case "browser_authenticated_session":
+        guard values["client_device_id"] == nil, values["device_key_id"] == nil else { return "invalid:forbidden_field" }
+        guard (try? BrowserAuthenticatedSession(
+            username: values["username"] ?? "", provider: values["provider"] ?? "",
+            roles: [values["roles"] ?? ""], role: values["role"] ?? ""
+        )) != nil else { return "invalid:invalid_session" }
+        return "valid"
+    case "native_authenticated_session":
+        guard let identity = try? NativeSessionIdentity(
+            clientDeviceId: values["client_device_id"] ?? "", deviceKeyId: values["device_key_id"] ?? ""
+        ), values["client_device_id"] != nil, values["device_key_id"] != nil else { return "invalid:required" }
+        guard (try? NativeAuthenticatedSession(
+            username: values["username"] ?? "", provider: values["provider"] ?? "",
+            roles: [values["roles"] ?? ""], role: values["role"] ?? "", nativeIdentity: identity
+        )) != nil else { return "invalid:invalid_session" }
+        return "valid"
+    case "native_tunnel_credential":
+        guard (try? NativeTunnelCredential(
+            clientDeviceId: values["client_device_id"] ?? "", deviceKeyId: values["device_key_id"] ?? "",
+            certificateChainPem: values["certificate_chain_pem"] ?? "", trustBundlePem: values["trust_bundle_pem"] ?? "",
+            expiresAt: values["expires_at"] ?? ""
+        )) != nil else { return "invalid:invalid_credential" }
+        return "valid"
     case "event":
         guard values["version"] == "1" else { return "invalid:unsupported_version" }
         if let after = Int(values["after"] ?? ""), let earliest = Int(values["earliest"] ?? ""), after > 0, earliest > 0, after < earliest - 1 { return "invalid:gap" }
@@ -27,8 +59,8 @@ func evaluate(_ kind: String, _ input: String) -> String {
         guard let sequence = Int(values["sequence"] ?? ""), sequence > 0, values["correlation_id"] != nil else { return "invalid:required" }
         return "valid"
     case "tunnel":
-        let registered = ["control.v1", "display.request.v1", "input.absolute.v1", "input.scroll.v1"].contains(values["feature"] ?? "")
-        if ["1", "0", "-1"].contains(values["offered"] ?? "") && registered { return "valid" }
+        let registered = ["control.v1", "control.v2", "display.request.v1", "input.absolute.v1", "input.scroll.v1"].contains(values["feature"] ?? "")
+        if ["2", "1", "0"].contains(values["offered"] ?? "") && registered { return "valid" }
         return registered ? "invalid:unsupported_version" : "invalid:unsupported_feature"
     case "datagram": return classifyDatagram(values["hex"] ?? "")
     case "gateway_input": return classifyGatewayInput(values["hex"] ?? "")
@@ -197,7 +229,7 @@ struct ConformanceMain {
             for line in lines {
                 let fields = line.split(separator: "\t", omittingEmptySubsequences: false).map(String.init)
                 precondition(fields.count == 5)
-                let actual = evaluate(fields[2], fields[3])
+                let actual = evaluate(fields[1], fields[2], fields[3])
                 precondition(actual == fields[4], fields[0])
                 results.append("\(fields[0])\t\(actual)")
             }