test.http

###############################################
# Go SNMP OLT ZTE C320/C300 — live API test collection
# Works with VS Code "REST Client" and JetBrains HTTP Client.
# OpenAPI: api/openapi.yaml
#
# Response contract (v3.x):
#   success: {"code":200,"status":"success","data":...,"meta":{...}}
#   error  : {"code":400,"status":"...","error_code":"...","data":...,"request_id":"..."}
#
# Defaults match the multi-OLT + per-tenant dev setup used in testing:
#   OLTS        : id "1" = C320 (boards 1,2, user_id 1); id "2" = C300 (slot 3, user_id 2)
#   DEFAULT_OLT : 1  (also answers the bare /api/v1/board/... paths)
#   API_USERS   : keyA -> user 1, keyB -> user 2, admintoken -> admin (sees all)
# Override the variables below for your own instance.
###############################################

@host = http://localhost:8081
@olt1 = 1
@olt2 = 2
@keyA = keyA
@keyB = keyB
@admin = admintoken
# Single-key / legacy deployments (OLTS + API_USERS unset): set this instead.
@API_KEY = admintoken

###############################################
# Health, Readiness, Version, Metrics (no auth, never rate limited)
###############################################

### Liveness probe (legacy alias) -> 200
GET {{host}}/health
Accept: application/json

### Liveness probe (k8s style) -> 200
GET {{host}}/healthz
Accept: application/json

### Readiness probe -> 200 {"status":"ready","dependencies":{"redis":{...},"snmp_1":{...},"snmp_2":{...}}}
# In multi-OLT mode each OLT has its own probe keyed snmp_<id>. Secondary OLTs
# are non-critical: one unreachable -> degraded report but still 200.
GET {{host}}/readyz
Accept: application/json

### Build metadata (version, commit, build_time, uptime) -> 200
GET {{host}}/version
Accept: application/json

### Prometheus metrics -> 200
GET {{host}}/metrics
Accept: text/plain

### Root endpoint -> 200
GET {{host}}/
Accept: application/json

###############################################
# Authentication (per-tenant API_USERS)
# 401 envelope: {"code":401,"status":"Unauthorized","error_code":"UNAUTHORIZED","data":"...","request_id":"..."}
###############################################

### No API key -> 401
GET {{host}}/api/v1/olt/{{olt1}}/board/1/pon/1/
Accept: application/json

### Invalid API key -> 401
GET {{host}}/api/v1/olt/{{olt1}}/board/1/pon/1/
Accept: application/json
X-API-Key: not-a-real-key

###############################################
# Tenant isolation (the core of per-user access control)
# Cross-tenant requests return 404 (NOT 403) to prevent enumeration.
###############################################

### user1 -> own OLT (C320) -> 200
GET {{host}}/api/v1/olt/{{olt1}}/board/1/pon/1/
Accept: application/json
X-API-Key: {{keyA}}

### user1 -> other tenant's OLT (C300) -> 404
GET {{host}}/api/v1/olt/{{olt2}}/board/3/pon/1/
Accept: application/json
X-API-Key: {{keyA}}

### user2 -> own OLT (C300) -> 200
GET {{host}}/api/v1/olt/{{olt2}}/board/3/pon/1/
Accept: application/json
X-API-Key: {{keyB}}

### user2 -> other tenant's OLT (C320) -> 404
GET {{host}}/api/v1/olt/{{olt1}}/board/1/pon/1/
Accept: application/json
X-API-Key: {{keyB}}

### admin -> C320 -> 200
GET {{host}}/api/v1/olt/{{olt1}}/board/1/pon/1/
Accept: application/json
X-API-Key: {{admin}}

### admin -> C300 -> 200
GET {{host}}/api/v1/olt/{{olt2}}/board/3/pon/1/
Accept: application/json
X-API-Key: {{admin}}

###############################################
# Bare /board paths -> DEFAULT_OLT (olt 1 / C320), scoped to its owner
###############################################

### user1 owns the default OLT -> 200
GET {{host}}/api/v1/board/1/pon/1/
Accept: application/json
X-API-Key: {{keyA}}

### user2 does NOT own the default OLT -> 404
GET {{host}}/api/v1/board/1/pon/1/
Accept: application/json
X-API-Key: {{keyB}}

###############################################
# ONU read endpoints (multi-OLT path, full surface)
###############################################

### List all ONUs on a board/PON -> 200
GET {{host}}/api/v1/olt/{{olt1}}/board/1/pon/1/
Accept: application/json
X-API-Key: {{admin}}

### Specific ONU detail -> 200 (404 if onu_id absent)
GET {{host}}/api/v1/olt/{{olt1}}/board/1/pon/1/onu/1
Accept: application/json
X-API-Key: {{admin}}

### Empty / available ONU IDs -> 200
GET {{host}}/api/v1/olt/{{olt1}}/board/1/pon/1/onu_id/empty
Accept: application/json
X-API-Key: {{admin}}

### ONU IDs with serial numbers -> 200
GET {{host}}/api/v1/olt/{{olt1}}/board/1/pon/1/onu_id_sn
Accept: application/json
X-API-Key: {{admin}}

### Paginated ONU list -> 200
GET {{host}}/api/v1/olt/{{olt1}}/paginate/board/1/pon/1?page=1&limit=10
Accept: application/json
X-API-Key: {{admin}}

### C300 (olt 2) list via admin -> 200
GET {{host}}/api/v1/olt/{{olt2}}/board/3/pon/1/
Accept: application/json
X-API-Key: {{admin}}

###############################################
# Write / cache endpoints (emit an audit log entry)
###############################################

### Force refresh empty ONU ID cache (POST) -> 200
POST {{host}}/api/v1/olt/{{olt1}}/board/1/pon/1/onu_id/update
Accept: application/json
X-API-Key: {{admin}}

### Clear cache for a board/PON (DELETE) -> 200
DELETE {{host}}/api/v1/olt/{{olt1}}/board/1/pon/1/cache/clear
Accept: application/json
X-API-Key: {{admin}}

###############################################
# Validation & error contract
###############################################

### Unknown OLT id -> 404
GET {{host}}/api/v1/olt/does-not-exist/board/1/pon/1/
Accept: application/json
X-API-Key: {{admin}}

### board_id out of range -> 400 VALIDATION_ERROR
GET {{host}}/api/v1/olt/{{olt1}}/board/99/pon/1/
Accept: application/json
X-API-Key: {{admin}}

### pon_id out of range for the card -> 400 VALIDATION_ERROR
GET {{host}}/api/v1/olt/{{olt1}}/board/1/pon/99/
Accept: application/json
X-API-Key: {{admin}}

### Slot not present on this OLT (C320 has no slot 3) -> 400
GET {{host}}/api/v1/olt/{{olt1}}/board/3/pon/1/
Accept: application/json
X-API-Key: {{admin}}

### Request ID echo: response echoes X-Request-ID (header + error body request_id)
GET {{host}}/api/v1/olt/{{olt1}}/board/99/pon/1/
Accept: application/json
X-API-Key: {{admin}}
X-Request-ID: my-custom-trace-id-123

###############################################
# Single-OLT / legacy mode (OLTS + API_USERS unset; single API_KEY)
# Uses the bare /api/v1/board/... paths with {{API_KEY}}.
###############################################

### Legacy: list ONUs -> 200
GET {{host}}/api/v1/board/1/pon/8
Accept: application/json
X-API-Key: {{API_KEY}}

### Legacy: paginate -> 200  (pagination lives under /paginate/, not query params on the list path)
GET {{host}}/api/v1/paginate/board/1/pon/8?page=2&limit=5
Accept: application/json
X-API-Key: {{API_KEY}}

###############################################
# Uplink / card auto-detect (ENTITY-MIB + IF-MIB; detection-only, no writes)
###############################################

### Default OLT uplink topology -> 200 {cards[], ports[]}
GET {{host}}/api/v1/uplinks
Accept: application/json
X-API-Key: {{API_KEY}}

### Per-OLT uplink topology -> 200
GET {{host}}/api/v1/olt/{{olt1}}/uplinks
Accept: application/json
X-API-Key: {{admin}}

###############################################
# Forced-fresh serial-list read (?nocache=true bypasses + refreshes the
# serial-list Redis cache — used by write-olt-zte pre-write checks)
###############################################

### Cached serial list (default) -> 200
GET {{host}}/api/v1/olt/{{olt1}}/board/1/pon/1/onu_id_sn
Accept: application/json
X-API-Key: {{admin}}

### Forced-fresh serial list -> 200 (live SNMP read, cache repopulated)
GET {{host}}/api/v1/olt/{{olt1}}/board/1/pon/1/onu_id_sn?nocache=true
Accept: application/json
X-API-Key: {{admin}}

###############################################
# Notes
# - Response headers on every request: X-Request-ID, X-API-Version, X-App-Version, X-Build-Commit
# - Health/readiness/metrics are unauthenticated AND exempt from the rate limiter
#   (so k8s probes and Prometheus scrapes are never 429'd under API load).
# - API rate limit: 100 req/s, burst 200 (global; infra endpoints exempt).
# - board_id = physical GPON slot (C320: 1-2; C300: e.g. 3,5). pon_id validated
#   per card (GTGO=8, GTGH=16). Valid slots/pons differ per OLT.
# - Per-tenant: each OLT carries a user_id; a caller sees only its own OLTs
#   (cross-tenant -> 404). role "admin" sees all. Unowned (user_id 0) = admin-only.
###############################################