[CLDAPP-423] Add Encryption Validation

temporalcloudcli/commands.gen.go

@@ -1890,6 +1890,7 @@ func NewCloudNamespaceCommand(cctx *CommandContext, parent *CloudCommand) *Cloud
 	s.Command.AddCommand(&NewCloudNamespaceDeleteCommand(cctx, &s).Command)
 	s.Command.AddCommand(&NewCloudNamespaceDescriptionCommand(cctx, &s).Command)
 	s.Command.AddCommand(&NewCloudNamespaceEditCommand(cctx, &s).Command)
+	s.Command.AddCommand(&NewCloudNamespaceEncryptionValidationCommand(cctx, &s).Command)
 	s.Command.AddCommand(&NewCloudNamespaceExportCommand(cctx, &s).Command)
 	s.Command.AddCommand(&NewCloudNamespaceFairnessCommand(cctx, &s).Command)
 	s.Command.AddCommand(&NewCloudNamespaceGetCommand(cctx, &s).Command)
@@ -2398,17 +2399,22 @@ type CloudNamespaceCreateCommand struct {
 	CodecServerOptions
 	CaCertificateOptions
 	CertificateFilterOptions
-	Name                    string
-	Region                  []string
-	RetentionDays           int
-	ApiKeyAuthEnabled       bool
-	MtlsAuthEnabled         bool
-	EnableDeleteProtection  bool
-	EnableTaskQueueFairness bool
-	SearchAttribute         []string
-	ConnectionRuleId        []string
-	ProjectId               string
-	Description             string
+	Name                               string
+	Region                             []string
+	RetentionDays                      int
+	ApiKeyAuthEnabled                  bool
+	MtlsAuthEnabled                    bool
+	EnableDeleteProtection             bool
+	EnableTaskQueueFairness            bool
+	SearchAttribute                    []string
+	ConnectionRuleId                   []string
+	ProjectId                          string
+	Description                        string
+	EncryptionValidationMode           string
+	EncryptionValidationMetadataKey    string
+	EncryptionValidationMetadataValue  []string
+	EncryptionValidationInspectHeader  bool
+	EncryptionValidationInspectFailure bool
 }
 
 func NewCloudNamespaceCreateCommand(cctx *CommandContext, parent *CloudNamespaceCommand) *CloudNamespaceCreateCommand {
@@ -2436,6 +2442,11 @@ func NewCloudNamespaceCreateCommand(cctx *CommandContext, parent *CloudNamespace
 	s.Command.Flags().StringArrayVar(&s.ConnectionRuleId, "connection-rule-id", nil, "Private connectivity rule ID. Repeat to specify multiple.")
 	s.Command.Flags().StringVar(&s.ProjectId, "project-id", "", "The ID of the project to create the namespace in. If omitted, the namespace is created in the account's default project.")
 	s.Command.Flags().StringVar(&s.Description, "description", "", "The description is a human-readable description of the namespace. Must be at most 255 printable ASCII characters plus whitespace. Optional, default is empty.")
+	s.Command.Flags().StringVar(&s.EncryptionValidationMode, "encryption-validation-mode", "", "[Experimental] Payload encryption validation mode. Valid values: disabled, warn, deny. When any encryption-validation flag is set, this field is required.")
+	s.Command.Flags().StringVar(&s.EncryptionValidationMetadataKey, "encryption-validation-metadata-key", "", "[Experimental] Payload metadata key used to identify encrypted payloads. If omitted, the server default (encoding) applies.")
+	s.Command.Flags().StringArrayVar(&s.EncryptionValidationMetadataValue, "encryption-validation-metadata-value", nil, "[Experimental] Payload metadata value used to identify encrypted payloads. Repeat to add additional values. If omitted, the server default (binary/encrypted) applies.")
+	s.Command.Flags().BoolVar(&s.EncryptionValidationInspectHeader, "encryption-validation-inspect-header", false, "[Experimental] Inspect workflow headers for encryption validation. Default is false.")
+	s.Command.Flags().BoolVar(&s.EncryptionValidationInspectFailure, "encryption-validation-inspect-failure", false, "[Experimental] Inspect Failure payloads for encryption validation. Default is false.")
 	s.ClientOptions.BuildFlags(s.Command.Flags())
 	s.AsyncOperationOptions.BuildFlags(s.Command.Flags())
 	s.CodecServerOptions.BuildFlags(s.Command.Flags())
@@ -2609,6 +2620,165 @@ func NewCloudNamespaceEditCommand(cctx *CommandContext, parent *CloudNamespaceCo
 	return &s
 }
 
+type CloudNamespaceEncryptionValidationCommand struct {
+	Parent  *CloudNamespaceCommand
+	Command cobra.Command
+}
+
+func NewCloudNamespaceEncryptionValidationCommand(cctx *CommandContext, parent *CloudNamespaceCommand) *CloudNamespaceEncryptionValidationCommand {
+	var s CloudNamespaceEncryptionValidationCommand
+	s.Parent = parent
+	s.Command.Use = "encryption-validation"
+	s.Command.Short = "[Experimental] Manage namespace payload encryption validation settings"
+	s.Command.Long = "Commands for managing payload encryption validation configuration of Temporal Cloud namespaces."
+	s.Command.Args = cobra.NoArgs
+	s.Command.AddCommand(&NewCloudNamespaceEncryptionValidationDisableCommand(cctx, &s).Command)
+	s.Command.AddCommand(&NewCloudNamespaceEncryptionValidationEnableCommand(cctx, &s).Command)
+	s.Command.AddCommand(&NewCloudNamespaceEncryptionValidationGetCommand(cctx, &s).Command)
+	s.Command.AddCommand(&NewCloudNamespaceEncryptionValidationSetCommand(cctx, &s).Command)
+	return &s
+}
+
+type CloudNamespaceEncryptionValidationDisableCommand struct {
+	Parent  *CloudNamespaceEncryptionValidationCommand
+	Command cobra.Command
+	ClientOptions
+	NamespaceOptions
+	AsyncOperationOptions
+	ResourceVersionOptions
+}
+
+func NewCloudNamespaceEncryptionValidationDisableCommand(cctx *CommandContext, parent *CloudNamespaceEncryptionValidationCommand) *CloudNamespaceEncryptionValidationDisableCommand {
+	var s CloudNamespaceEncryptionValidationDisableCommand
+	s.Parent = parent
+	s.Command.DisableFlagsInUseLine = true
+	s.Command.Use = "disable [flags]"
+	s.Command.Short = "[Experimental] Disable payload encryption validation for a namespace"
+	if hasHighlighting {
+		s.Command.Long = "Disable payload encryption validation for a Temporal Cloud namespace.\nExisting metadata and inspect settings are kept. If validation is not\nconfigured or is already disabled, nothing is changed.\n\nExample:\n\n\x1b[1mtemporal cloud namespace encryption-validation disable --namespace my-namespace.my-account\x1b[0m"
+	} else {
+		s.Command.Long = "Disable payload encryption validation for a Temporal Cloud namespace.\nExisting metadata and inspect settings are kept. If validation is not\nconfigured or is already disabled, nothing is changed.\n\nExample:\n\n```\ntemporal cloud namespace encryption-validation disable --namespace my-namespace.my-account\n```"
+	}
+	s.Command.Args = cobra.NoArgs
+	s.ClientOptions.BuildFlags(s.Command.Flags())
+	s.NamespaceOptions.BuildFlags(s.Command.Flags())
+	s.AsyncOperationOptions.BuildFlags(s.Command.Flags())
+	s.ResourceVersionOptions.BuildFlags(s.Command.Flags())
+	s.Command.Run = func(c *cobra.Command, args []string) {
+		if err := s.run(cctx, args); err != nil {
+			cctx.Options.Fail(err)
+		}
+	}
+	return &s
+}
+
+type CloudNamespaceEncryptionValidationEnableCommand struct {
+	Parent  *CloudNamespaceEncryptionValidationCommand
+	Command cobra.Command
+	ClientOptions
+	NamespaceOptions
+	AsyncOperationOptions
+	ResourceVersionOptions
+	Deny bool
+}
+
+func NewCloudNamespaceEncryptionValidationEnableCommand(cctx *CommandContext, parent *CloudNamespaceEncryptionValidationCommand) *CloudNamespaceEncryptionValidationEnableCommand {
+	var s CloudNamespaceEncryptionValidationEnableCommand
+	s.Parent = parent
+	s.Command.DisableFlagsInUseLine = true
+	s.Command.Use = "enable [flags]"
+	s.Command.Short = "[Experimental] Enable payload encryption validation for a namespace"
+	if hasHighlighting {
+		s.Command.Long = "Enable payload encryption validation for a Temporal Cloud namespace.\nIf validation has not been configured, it is enabled in warn mode with\nno metadata key or values, so the defaults apply\n(metadata-key=encoding, metadata-values=[binary/encrypted]).\nIf validation is disabled, the existing configuration is re-enabled.\nUse --deny to enable in deny mode; this also switches a namespace that\nis already in warn mode to deny. Without --deny, a namespace that is\nalready in warn or deny mode is left unchanged.\n\nExample:\n\n\x1b[1mtemporal cloud namespace encryption-validation enable --namespace my-namespace.my-account\x1b[0m"
+	} else {
+		s.Command.Long = "Enable payload encryption validation for a Temporal Cloud namespace.\nIf validation has not been configured, it is enabled in warn mode with\nno metadata key or values, so the defaults apply\n(metadata-key=encoding, metadata-values=[binary/encrypted]).\nIf validation is disabled, the existing configuration is re-enabled.\nUse --deny to enable in deny mode; this also switches a namespace that\nis already in warn mode to deny. Without --deny, a namespace that is\nalready in warn or deny mode is left unchanged.\n\nExample:\n\n```\ntemporal cloud namespace encryption-validation enable --namespace my-namespace.my-account\n```"
+	}
+	s.Command.Args = cobra.NoArgs
+	s.Command.Flags().BoolVar(&s.Deny, "deny", false, "Enable validation in deny mode instead of warn. Switches warn mode to deny.")
+	s.ClientOptions.BuildFlags(s.Command.Flags())
+	s.NamespaceOptions.BuildFlags(s.Command.Flags())
+	s.AsyncOperationOptions.BuildFlags(s.Command.Flags())
+	s.ResourceVersionOptions.BuildFlags(s.Command.Flags())
+	s.Command.Run = func(c *cobra.Command, args []string) {
+		if err := s.run(cctx, args); err != nil {
+			cctx.Options.Fail(err)
+		}
+	}
+	return &s
+}
+
+type CloudNamespaceEncryptionValidationGetCommand struct {
+	Parent  *CloudNamespaceEncryptionValidationCommand
+	Command cobra.Command
+	ClientOptions
+	NamespaceOptions
+}
+
+func NewCloudNamespaceEncryptionValidationGetCommand(cctx *CommandContext, parent *CloudNamespaceEncryptionValidationCommand) *CloudNamespaceEncryptionValidationGetCommand {
+	var s CloudNamespaceEncryptionValidationGetCommand
+	s.Parent = parent
+	s.Command.DisableFlagsInUseLine = true
+	s.Command.Use = "get [flags]"
+	s.Command.Short = "[Experimental] Get namespace payload encryption validation configuration"
+	if hasHighlighting {
+		s.Command.Long = "Retrieve the current payload encryption validation configuration for a Temporal Cloud namespace.\n\nExample:\n\n\x1b[1mtemporal cloud namespace encryption-validation get --namespace my-namespace.my-account\x1b[0m"
+	} else {
+		s.Command.Long = "Retrieve the current payload encryption validation configuration for a Temporal Cloud namespace.\n\nExample:\n\n```\ntemporal cloud namespace encryption-validation get --namespace my-namespace.my-account\n```"
+	}
+	s.Command.Args = cobra.NoArgs
+	s.ClientOptions.BuildFlags(s.Command.Flags())
+	s.NamespaceOptions.BuildFlags(s.Command.Flags())
+	s.Command.Run = func(c *cobra.Command, args []string) {
+		if err := s.run(cctx, args); err != nil {
+			cctx.Options.Fail(err)
+		}
+	}
+	return &s
+}
+
+type CloudNamespaceEncryptionValidationSetCommand struct {
+	Parent  *CloudNamespaceEncryptionValidationCommand
+	Command cobra.Command
+	ClientOptions
+	NamespaceOptions
+	AsyncOperationOptions
+	ResourceVersionOptions
+	Mode           string
+	MetadataKey    string
+	MetadataValue  []string
+	InspectHeader  bool
+	InspectFailure bool
+}
+
+func NewCloudNamespaceEncryptionValidationSetCommand(cctx *CommandContext, parent *CloudNamespaceEncryptionValidationCommand) *CloudNamespaceEncryptionValidationSetCommand {
+	var s CloudNamespaceEncryptionValidationSetCommand
+	s.Parent = parent
+	s.Command.DisableFlagsInUseLine = true
+	s.Command.Use = "set [flags]"
+	s.Command.Short = "[Experimental] Set namespace payload encryption validation configuration"
+	if hasHighlighting {
+		s.Command.Long = "Update the payload encryption validation configuration for a Temporal Cloud\nnamespace. At least one flag must be set. Omitted flags keep the\nexisting values. An empty metadata key or values means the server\ndefaults apply (metadata-key=encoding, metadata-values=[binary/encrypted]).\n\nExample:\n\n\x1b[1mtemporal cloud namespace encryption-validation set --namespace my-namespace.my-account --mode warn --metadata-key encoding --metadata-value binary/encrypted\x1b[0m"
+	} else {
+		s.Command.Long = "Update the payload encryption validation configuration for a Temporal Cloud\nnamespace. At least one flag must be set. Omitted flags keep the\nexisting values. An empty metadata key or values means the server\ndefaults apply (metadata-key=encoding, metadata-values=[binary/encrypted]).\n\nExample:\n\n```\ntemporal cloud namespace encryption-validation set --namespace my-namespace.my-account --mode warn --metadata-key encoding --metadata-value binary/encrypted\n```"
+	}
+	s.Command.Args = cobra.NoArgs
+	s.Command.Flags().StringVar(&s.Mode, "mode", "", "Payload encryption validation mode. Valid values: disabled, warn, deny. If omitted, the existing mode is kept. Required when encryption validation is not configured yet.")
+	s.Command.Flags().StringVar(&s.MetadataKey, "metadata-key", "", "Payload metadata key used to identify encrypted payloads. If omitted, the existing key is kept.")
+	s.Command.Flags().StringArrayVar(&s.MetadataValue, "metadata-value", nil, "Payload metadata value used to identify encrypted payloads. Repeat to add additional values. Replaces the existing values. If omitted, the existing values are kept.")
+	s.Command.Flags().BoolVar(&s.InspectHeader, "inspect-header", false, "Inspect workflow headers for encryption validation. If omitted, the existing value is kept.")
+	s.Command.Flags().BoolVar(&s.InspectFailure, "inspect-failure", false, "Inspect Failure payloads for encryption validation. If omitted, the existing value is kept.")
+	s.ClientOptions.BuildFlags(s.Command.Flags())
+	s.NamespaceOptions.BuildFlags(s.Command.Flags())
+	s.AsyncOperationOptions.BuildFlags(s.Command.Flags())
+	s.ResourceVersionOptions.BuildFlags(s.Command.Flags())
+	s.Command.Run = func(c *cobra.Command, args []string) {
+		if err := s.run(cctx, args); err != nil {
+			cctx.Options.Fail(err)
+		}
+	}
+	return &s
+}
+
 type CloudNamespaceExportCommand struct {
 	Parent  *CloudNamespaceCommand
 	Command cobra.Command

temporalcloudcli/commands.namespace.create_test.go

@@ -435,3 +435,61 @@ func TestCreateNamespace_InvalidInput(t *testing.T) {
 		})
 	}
 }
+
+func TestCreateNamespace_EncryptionValidation(t *testing.T) {
+	tests := []struct {
+		name     string
+		spec     *namespacev1.EncryptionValidationSpec
+		expected *namespacev1.EncryptionValidationSpec
+	}{
+		{name: "Unset", spec: nil, expected: nil},
+		{
+			name: "Explicit",
+			spec: &namespacev1.EncryptionValidationSpec{
+				Mode:           namespacev1.EncryptionValidationSpec_ENCRYPTION_VALIDATION_MODE_DENY,
+				MetadataKey:    "encoding",
+				MetadataValues: []string{"binary/encrypted"},
+				InspectHeader:  true,
+			},
+			expected: &namespacev1.EncryptionValidationSpec{
+				Mode:           namespacev1.EncryptionValidationSpec_ENCRYPTION_VALIDATION_MODE_DENY,
+				MetadataKey:    "encoding",
+				MetadataValues: []string{"binary/encrypted"},
+				InspectHeader:  true,
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			expectedSpec := baseNamespaceSpec()
+			expectedSpec.EncryptionValidation = tt.expected
+
+			mockCloud := cloudmock.NewMockCloudServiceClient(t)
+			mockPrompter := cmdmock.NewMockPrompter(t)
+			mockHandler := cmdmock.NewMockAsyncOperationHandler(t)
+
+			mockPrompter.EXPECT().
+				PromptApply(&namespacev1.NamespaceSpec{}, specMatcher(expectedSpec), false).
+				Return(nil)
+			mockCloud.EXPECT().
+				CreateNamespace(context.Background(), createReqMatcher(expectedSpec)).
+				Return(defaultCreateResponse, nil)
+			mockHandler.EXPECT().
+				HandleOperation(defaultCreateResponse.AsyncOperation, "my-namespace.my-account").
+				Return(nil)
+
+			var buf bytes.Buffer
+			err := temporalcloudcli.CreateNamespace(context.Background(), temporalcloudcli.CreateNamespaceParams{
+				Name:                 "my-namespace",
+				Regions:              []string{"aws-us-east-1"},
+				Cloud:                mockCloud,
+				Printer:              &printer.Printer{Output: &buf, JSON: true},
+				Prompter:             mockPrompter,
+				UnmarshalProtoJSON:   noopUnmarshalProtoJSON,
+				OperationHandler:     mockHandler,
+				EncryptionValidation: tt.spec,
+			})
+			require.NoError(t, err)
+		})
+	}
+}