Feat/qod v1

QoD: move to CAMARA Quality-On-Demand v1.1.0

Replaces the QoD v0.10.1 API with CAMARA Quality-On-Demand v1.1.0, served at /quality-on-demand/v1. v0 (/qod/v0) is removed, not served side by side.

Breaking changes

• New base path: /quality-on-demand/v1 (was /qod/v0).
• New request fields:
  • webhook.notificationUrl / notificationAuthToken → sink / sinkCredential. sink must be https://.
  • duration is now required.
• New scopes, one per operation as the spec declares:
  • quality-on-demand:sessions:create, :read, :delete, :update, :retrieve-by-device.
  • These replace qod-sessions-read|write|delete.
  • Client-credentials callers no longer skip the scope check. Tokens must carry the new scope names, or callers get 403 when enforcement is on.
• Removed: the v0 qos-profiles routes, which are not part of the v1 API.

API

• Schemas and router vendored from the v1.1.0 spec (api/camara/quality_on_demand/v1_1_0/).
• New stub: POST /retrieve-sessions returns 501, like the existing /extend stub.
• Error codes: added the v1 codes INVALID_SINK, INVALID_CREDENTIAL, INVALID_TOKEN, QUALITY_ON_DEMAND.DURATION_OUT_OF_RANGE, QUALITY_ON_DEMAND.QOS_PROFILE_NOT_APPLICABLE and QUALITY_ON_DEMAND.SESSION_EXTENSION_NOT_ALLOWED. BadRequestException and ConflictException now take an error_code.

Session behaviour

• Session timing: qod_sessions gains started_at, ended_at and status_info. They are set when a session becomes AVAILABLE or UNAVAILABLE, and GET fills in startedAt, expiresAt, duration and statusInfo as the spec describes for each status.
• Ownership: GET and DELETE /sessions/{id} return 404 unless the caller's app_provider_id owns the session (checked through its activate operation).
• GET returns sink when one was registered at create time.
• Device identifiers:
  • A networkAccessIdentifier sent alongside a supported identifier is ignored, not sent to SRM.
  • 422 UNSUPPORTED_IDENTIFIER is returned only when it is the only identifier.
  • A missing device gives 422 MISSING_IDENTIFIER.
• SRM activate commands now carry source_spec.version = 1.1.0.

Callbacks

• The CloudEvent type is now org.camaraproject.quality-on-demand.v1.qos-status-changed.
• Empty fields are left out of the payload.
• Each callback carries an x-correlator header.

Database

create_all does not alter existing tables, so schema_initialization now runs ALTER TABLE qod_sessions ADD COLUMN IF NOT EXISTS … for the three new columns. Existing databases upgrade in place on startup.

Known gaps (not in this MR)

• sinkCredential returns 501, because callback credentials can't be stored yet. The spec doesn't document 501 on POST /sessions, so test_qod_conformance[POST /sessions] fails. /extend and /retrieve-sessions fail that test for the same reason.
• DURATION_EXPIRED is never triggered.
• No 409 check for an existing session on the same device.
• No QoS profile or duration validation at create time.
• A sink answering 410 is ignored.
• No support for three-legged tokens.

Testing

• Unit tests were moved to v1 and extended to cover ownership, sink on GET, identifier handling, session timing and the callback format.
• pytest tests/unit: 899 passed, 1 skipped.