feat: MVM protos

README.md

@@ -97,7 +97,7 @@ These options specify the RBAC of the api-endpoint.
 > [!CAUTION]
 >
 > If we use a Tenant or Project role, the request will be respectively scoped as Tenant or Project request.
-> Tenant-Requests must have the field **login**, which is the tenant id and specifies the tenant on which the service-method is scoped.
+> Tenant-Requests must have the field **tenant**, which is the tenant id and specifies the tenant on which the service-method is scoped.
 > Project-Requests must have the field **project**, which is the project id and specifies the project on which the service-method is scoped.
 
 ### Auditing

generate/generate.go

@@ -38,8 +38,9 @@ var (
 )
 
 type api struct {
-	Name     string
-	Services []struct {
+	Name        string
+	ConnectName string
+	Services    []struct {
 		Name     string
 		FileName string
 	}
@@ -254,11 +255,15 @@ func svcs(root string) (map[string]api, error) {
 		_, name, _ := strings.Cut(*fd.Package, "fits.")
 		name = strings.ReplaceAll(name, ".", "")
 
+		segs := strings.Split(*fd.Package, ".")
+		connectName := strings.Join(segs[len(segs)-2:], "")
+
 		a, ok := result[name]
 		if !ok {
 			a = api{
-				Name: name,
-				Path: path.Dir(strings.TrimPrefix(filename, root)),
+				Name:        name,
+				ConnectName: connectName,
+				Path:        path.Dir(strings.TrimPrefix(filename, root)),
 			}
 		}
 		for _, serviceDesc := range fd.GetService() {

generate/go_client.tpl

@@ -6,7 +6,7 @@ import (
 	compress "github.com/klauspost/connect-compress/v2"
 
 {{ range $name, $api := . -}}
-	"github.com/fi-ts/api/go{{ $api.Path }}/{{ $api.Name }}connect"
+	"github.com/fi-ts/api/go{{ $api.Path }}/{{ $api.ConnectName }}connect"
 {{ end }}
 )
 
@@ -24,13 +24,13 @@ type (
 {{ range $name, $api := . -}}
 	{{ $name | title }} interface {
 {{ range $svc := $api.Services -}}
-	{{ $svc.Name | trimSuffix "Service" }}() {{ $name }}connect.{{ $svc.Name }}Client
+	{{ $svc.Name | trimSuffix "Service" }}() {{ $api.ConnectName }}connect.{{ $svc.Name }}Client
 {{ end }}
 	}
 
     {{ $name }} struct {
 {{ range $svc := $api.Services -}}
-	{{ $svc.Name | lower }} {{ $name }}connect.{{ $svc.Name }}Client
+	{{ $svc.Name | lower }} {{ $api.ConnectName }}connect.{{ $svc.Name }}Client
 {{ end }}
     }
 
@@ -41,7 +41,7 @@ type (
 func (c *client) {{ $name | title }}() {{ $name | title }} {
 	a := &{{ $name }}{
 {{ range $svc := $api.Services -}}
-	{{ $svc.Name | lower }}:  {{ $name }}connect.New{{ $svc.Name }}Client(
+	{{ $svc.Name | lower }}:  {{ $api.ConnectName }}connect.New{{ $svc.Name }}Client(
 		c.config.HttpClient(),
 		c.config.BaseURL,
 		connect.WithInterceptors(c.interceptors...),
@@ -53,7 +53,7 @@ func (c *client) {{ $name | title }}() {{ $name | title }} {
 }
 
 {{ range $svc := $api.Services -}}
-func (c  *{{ $name }} ) {{ $svc.Name | trimSuffix "Service" }}() {{ $name }}connect.{{ $svc.Name }}Client {
+func (c  *{{ $name }} ) {{ $svc.Name | trimSuffix "Service" }}() {{ $api.ConnectName }}connect.{{ $svc.Name }}Client {
 	return c.{{ $svc.Name | lower }}
 }
 {{ end }}

generate/go_servicepermissions.tpl

@@ -120,8 +120,8 @@ func GetTenantFromRequest(req connect.AnyRequest) (string, bool) {
 		return "", false
 	}
 	switch rq := req.Any().(type) {
-	case interface{ GetLogin() string }:
-		return rq.GetLogin(), true
+	case interface{ GetTenant() string }:
+		return rq.GetTenant(), true
 	}
 	return "", false
 }
@@ -131,6 +131,12 @@ func GetProjectFromRequest(req connect.AnyRequest) (string, bool) {
 		return "", false
 	}
 	switch rq := req.Any().(type) {
+	case interface{ GetProjectSlug() string }:
+		return rq.GetProjectSlug(), true
+	// TODO: drop the GetProjectUuid/GetProject fallbacks once all services
+	// are streamlined to project_slug.
+	case interface{ GetProjectUuid() string }:
+		return rq.GetProjectUuid(), true
 	case interface{ GetProject() string }:
 		return rq.GetProject(), true
 	}

generate/python_client.tpl

@@ -4,7 +4,7 @@ import pyqwest
 
 {{ range $name, $api := . -}}
 {{ range $svc := $api.Services -}}
-import fits.{{ $name | trimSuffix "v1" }}.v1.{{ $svc.FileName | trimSuffix ".proto" | lower }}_connect as {{ $name | trimSuffix "v1" }}_{{ $svc.FileName | trimSuffix ".proto" | lower }}_connect
+import {{ $api.Path | trimPrefix "/" | replace "/" "." }}.{{ $svc.FileName | trimSuffix ".proto" | lower }}_connect as {{ $api.Path | trimPrefix "/" | replace "/" "_" }}_{{ $svc.FileName | trimSuffix ".proto" | lower }}_connect
 {{ end }}
 {{ end }}
 
@@ -35,6 +35,6 @@ class Client:
 
 {{ range $svc := $api.Services }}
         def {{ $svc.FileName | trimSuffix ".proto" | lower }}(self):
-            return {{ $name | trimSuffix "v1" }}_{{ $svc.FileName | trimSuffix ".proto" | lower }}_connect.{{ $svc.Name }}ClientSync(address=self._baseurl, http_client=self._client, interceptors=self._interceptors)
+            return {{ $api.Path | trimPrefix "/" | replace "/" "_" }}_{{ $svc.FileName | trimSuffix ".proto" | lower }}_connect.{{ $svc.Name }}ClientSync(address=self._baseurl, http_client=self._client, interceptors=self._interceptors)
 {{ end }}
 {{ end }}

go.mod

@@ -12,6 +12,7 @@ require (
 	github.com/google/go-cmp v0.7.0
 	github.com/klauspost/connect-compress/v2 v2.1.1
 	github.com/stretchr/testify v1.12.1
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260831171406-18b4a7587f8a
 	google.golang.org/grpc v1.83.2
 	google.golang.org/protobuf v1.36.12
 )
@@ -22,11 +23,9 @@ require (
 	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
 	github.com/klauspost/compress v1.19.2 // indirect
 	github.com/minio/minlz v1.2.0 // indirect
-	github.com/stretchr/objx v0.5.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
 	golang.org/x/exp v0.0.0-20260824195058-e88cd73687aa // indirect
 	golang.org/x/sys v0.47.0 // indirect
 	golang.org/x/text v0.41.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260831171406-18b4a7587f8a // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260831171406-18b4a7587f8a // indirect
 )

go.sum

@@ -30,8 +30,6 @@ github.com/minio/minlz v1.2.0 h1:6IOBuiHg04QxvbFfgFLT/9sMaO/UhL7S+ApW1mK8q5A=
 github.com/minio/minlz v1.2.0/go.mod h1:Ls9H7nlkASeCcdl5thjVD5Eraj6z+zGa7xtq57jIKD4=
 github.com/rodaine/protogofakeit v0.1.1 h1:ZKouljuRM3A+TArppfBqnH8tGZHOwM/pjvtXe9DaXH8=
 github.com/rodaine/protogofakeit v0.1.1/go.mod h1:pXn/AstBYMaSfc1/RqH3N82pBuxtWgejz1AlYpY1mI0=
-github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
-github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
 github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
 github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=

go/errorutil/errors.go

@@ -6,6 +6,7 @@ import (
 	"strings"
 
 	"connectrpc.com/connect"
+	"google.golang.org/genproto/googleapis/rpc/errdetails"
 	"google.golang.org/grpc/status"
 
 	"github.com/google/go-cmp/cmp"
@@ -222,6 +223,56 @@ func WrapConnectErr(c connect.Code, underlying error) *connect.Error {
 	return connect.NewError(c, underlying)
 }
 
+// ValidationError describes a single validation problem reported by an
+// upstream API (e.g. an HTTP 422 body from nulink).
+type ValidationError struct {
+	// Loc is the path of the offending field within the upstream request,
+	// e.g. ["body", "serviceclass"].
+	Loc []string
+	// Msg is a human readable description of the problem.
+	Msg string
+	// Type is the upstream error type, e.g. "value_error".
+	Type string
+}
+
+// UpstreamValidation builds an InvalidArgument connect.Error for upstream
+// validation rejections (HTTP 422). It attaches the standard google.rpc error
+// details so clients can render per-field problems uniformly:
+//
+//   - BadRequest with one FieldViolation per error (field = dotted loc path,
+//     description = upstream message)
+//   - ErrorInfo identifying the upstream domain and the error type
+//
+// The top-level message stays generic; the structured content lives in the
+// details. This mirrors how buf.validate failures surface locally, so clients
+// see one uniform shape for "your input was wrong" regardless of which layer
+// rejected it.
+func UpstreamValidation(domain, op string, errs []ValidationError) *connect.Error {
+	err := connect.NewError(connect.CodeInvalidArgument,
+		fmt.Errorf("%s rejected %s with %d validation error(s)", domain, op, len(errs)))
+	if len(errs) == 0 {
+		return err
+	}
+
+	violations := make([]*errdetails.BadRequest_FieldViolation, 0, len(errs))
+	for _, e := range errs {
+		violations = append(violations, &errdetails.BadRequest_FieldViolation{
+			Field:       strings.Join(e.Loc, "."),
+			Description: e.Msg,
+		})
+	}
+	if d, derr := connect.NewErrorDetail(&errdetails.BadRequest{FieldViolations: violations}); derr == nil {
+		err.AddDetail(d)
+	}
+	if d, derr := connect.NewErrorDetail(&errdetails.ErrorInfo{
+		Reason: strings.ToUpper(errs[0].Type),
+		Domain: domain,
+	}); derr == nil {
+		err.AddDetail(d)
+	}
+	return err
+}
+
 // ConnectErrorComparer returns a go-cmp Option for comparing *connect.Error values.
 // Two errors are considered equal if they have the same error string and the same Connect code.
 func ConnectErrorComparer() cmp.Option {