fix: align TI/QoD/EAM calls with SRM contract and validate app server addresses

George Papathanailrequested to merge
fix/critical-gaps into develop

What

Fixes four places where OEG's calls to SRM didn't match SRM's API, or where OEG accepted input that SRM later rejected.

Changes

GET /traffic-influences always returned 503 SRM's GET /internal/network-capabilities requires app_provider_id, but OEG didn't send it. OEG now passes the caller's app_provider_id.

Network-capability reads by ID expected one object, but SRM returns a list GET /internal/network-capabilities/{id} returns a list of capabilities for the instance. get_traffic_influence and get_network_capability now keep the items of the expected capability_type (traffic_influence / qod_session) and take the newest by created_at. If none match, the result is 404. One type per instance today, but SRM plans to allow several.

Duplicate POST /apps returned 503 instead of 409 submit_app now checks the local registration before calling SRM. An SRM 409 on catalog create (e.g. two concurrent requests) is mapped to AlreadyExistsException; other SRM errors are unchanged.

QoD applicationServer addresses weren't validated

  • ipv4Address / ipv6Address must parse as an address or address/mask; otherwise 400. Before, OEG returned 201 and the session then failed in SRM.
  • Masked values are sent to SRM as their network (10.0.0.5/24 → 10.0.0.0/24), which CAMARA allows but SRM's strict parsing rejected. Plain addresses are sent unchanged, and the API response still echoes the original value.

Tests

  • SRM client: app_provider_id sent; newest capability of the right type chosen; 404 when no item of that type; SRM 409 → AlreadyExistsException.
  • QoD flows: invalid addresses → 400 with no activate published; masked IPv4/IPv6 normalised in the SRM command.
  • EAM: duplicate appId → 409, and SRM is not called.
  • pytest tests/unit: 1190 passed. ruff, ruff format and mypy are clean.

Merge request reports