Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 0 additions & 23 deletions .devcontainer/devcontainer.json

This file was deleted.

8 changes: 4 additions & 4 deletions .github/workflows/ci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -118,17 +118,17 @@ jobs:
echo "version=$VERSION" >> $GITHUB_OUTPUT

- name: "Set npm version from tag"
working-directory: sdk/js
working-directory: sdk/ts
run: |
npm version ${{ steps.version.outputs.version }} --no-git-tag-version

- run: npm ci
working-directory: sdk/js
working-directory: sdk/ts
- run: npm publish --dry-run
working-directory: sdk/js
working-directory: sdk/ts

- name: "🚀 Publish to npm"
working-directory: sdk/js
working-directory: sdk/ts
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
run: |
Expand Down
2 changes: 1 addition & 1 deletion Makefile
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
generate-proto::
rm -rf ./sdk/java/src/generated && rm -rf ./sdk/golang/gen && rm -rf ./sdk/js/gen && rm -rf ./sdk/openapi && rm -rf ./sdk/rust/src/gen && buf generate --template buf.gen.yaml
rm -rf ./sdk/java/studio && rm -rf ./sdk/go && rm -rf ./sdk/ts/src/gen && rm -rf ./sdk/openapi && buf generate --template buf.gen.yaml
59 changes: 37 additions & 22 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,32 +1,47 @@
<img width="1024" height="220" alt="image" src="https://github.com/user-attachments/assets/22d1ec29-1486-4704-8061-3b98c092da21" />

# Octopus API & SDKs

**API & SDKs for o7studios product Octopus**
Source protobufs and generated SDKs for the Octopus product.

## What's here

- `proto/` Protocol Buffer definitions (versioned)
- `sdk/` Generated SDKs: Go, Java, TypeScript, and OpenAPI
- `buf.yaml`, `buf.gen.yaml` Buf config for linting and generation

## Requirements

- [Buf](https://buf.build/) for code generation
- `make` (optional) for the helper target

## Generate SDKs

```sh
make generate-proto
```

This removes existing generated output in `sdk/` and regenerates from `proto/` via `buf`.

- Uses [Protocol Buffers](https://protobuf.dev/) with [Buf](https://buf.build/)
## Install SDKs

## Development
### Go

Full development setup available as [Development Container](https://containers.dev/).
Please use it for being able to tell "It works on my machine".
```sh
go get github.com/o7studios/octopus-sdk/sdk/go@latest
```

**Docker is required to be installed on your machine!**
### TypeScript / JavaScript

### IntelliJ IDEA
```sh
npm install @o7studios/octopus-sdk
```

- Open IntelliJ (Welcome screen)
- Navigate to `Remote Development` - `Dev Containers`
- Press `New Dev Container`
- Select `From VCS Project`
- Select and connect with `Docker`
- Select `IntelliJ IDEA`
- Enter `Git Repository`: `https://github.com/o7studios/octopus-sdk`
- Select `Detection for devcontainer.json file` `Automatic`
- Press `Build Container and Continue`
### Java

### Development Container Issues
Maven Central:

If you encounter an issue with setting up a development container, please
try to rebuild it first before opening a GitHub Issue. It's not uncommon
that some issues may fix themselves after a fresh container rebuild.
```kotlin
// build.gradle.kts
dependencies {
implementation("studio.o7:octopus-sdk:VERSION")
}
```
36 changes: 18 additions & 18 deletions buf.gen.yaml
Original file line number Diff line number Diff line change
@@ -1,31 +1,31 @@
version: v2

plugins:
# Java
- remote: buf.build/protocolbuffers/java:v25.3
out: ./sdk/java/src/generated/java
- remote: buf.build/grpc/java:v1.62.2
out: ./sdk/java/src/generated/java

# Golang
- remote: buf.build/grpc/go:v1.5.1
out: ./sdk/golang/gen
- remote: buf.build/protocolbuffers/java
out: sdk/java/src/java

- remote: buf.build/grpc/java
out: sdk/java/src/java

- remote: buf.build/protocolbuffers/go
out: sdk/go
opt:
- paths=source_relative
- remote: buf.build/protocolbuffers/go:v1.36.5
out: ./sdk/golang/gen

- remote: buf.build/grpc/go
out: sdk/go
opt:
- paths=source_relative

# JavaScript / TypeScript
- remote: buf.build/bufbuild/es:v2.2.3
out: ./sdk/js/gen
- remote: buf.build/grpc/node:v1.13.0
out: ./sdk/js/gen
- remote: buf.build/bufbuild/es
out: sdk/ts/src/gen
opt:
- target=ts
include_imports: true

# OpenAPI (Swagger)
- remote: buf.build/grpc-ecosystem/openapiv2:v2.27.2
out: ./sdk/openapi
- remote: buf.build/grpc-ecosystem/openapiv2
out: sdk/openapi
opt:
- allow_merge=true
- merge_file_name=octopus
2 changes: 1 addition & 1 deletion buf.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -14,4 +14,4 @@ modules:
- path: proto

deps:
- buf.build/googleapis/googleapis
- buf.build/googleapis/googleapis
2 changes: 1 addition & 1 deletion go.mod
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@ module github.com/o7studios/octopus-sdk
go 1.24.4

require (
google.golang.org/grpc v1.78.0
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check GitHub for gRPC v1.78.0 release information

# Try to get release notes from GitHub
echo "=== Checking gRPC Go v1.78.0 release notes ===" 
curl -s -H "Accept: application/vnd.github.v3+json" \
  "https://api.github.com/repos/grpc/grpc-go/releases/tags/v1.78.0" | \
  jq -r '.tag_name, .name, .published_at, .body' 2>/dev/null || echo "Could not fetch release info"

Repository: o7studios/octopus-sdk

Length of output: 2036


🌐 Web query:

gRPC Go v1.78.0 release notes changelog security

💡 Result:

Release v1.78.0 (published 23 Dec 2025) — release notes show behavior changes, new features, bug fixes and performance improvements but do not list any security fixes or CVE patches in that release. [1]

The notable gRPC‑Go HTTP/2 rapid‑reset DoS (CVE‑2023‑44487 / GHSA‑m425‑mq94‑257g) was fixed in earlier patch releases (1.56.3, 1.57.1, 1.58.3 and later) rather than in v1.78.0. [2][3]

Sources:

  • grpc/grpc-go — Release 1.78.0 (GitHub). [1]
  • gRPC‑Go HTTP/2 Rapid Reset vulnerability (GHSA / advisory). [2]
  • Snyk CVE summary for CVE‑2023‑44487. [3]

🌐 Web query:

google.golang.org/grpc v1.78.0 breaking changes compatibility

💡 Result:

Summary of breaking/compatibility changes in google.golang.org/grpc v1.78.0

  • Behavior change (potential breaking): the gRPC client now rejects target URLs whose hostname contains unbracketed colons when running with Go 1.26+. This can break code that previously used such target formats. [1]

  • No other deliberate API removals called out in the v1.78.0 release notes; the release also adds stats/otel metrics features. For prior releases, minimum supported Go version was raised in earlier minor releases (e.g., v1.76.0 / v1.72.0), so verify the minimum Go toolchain required by your dependency graph before upgrading. [1][2]

Recommendation: test your codepaths that construct client target URLs (and any custom resolvers) under v1.78.0; if you rely on hostnames with unbracketed colons, update them to use bracketed IPv6 literals or otherwise canonicalize the target. See the v1.78.0 release notes for details. [1]

Sources:
[1] grpc-go v1.78.0 release notes (summary in dependency bump PRs).
[2] grpc-go v1.78.x branch / repo metadata.


🌐 Web query:

gRPC v1.78.0 CVE security advisories vulnerabilities

💡 Result:

gRPC v1.78.0 — relevant public CVEs and notes

  • CVE-2024-7246 — HPACK table poisoning (affects gRPC C++, Python, Ruby). Fixed in earlier upstream releases (see fixed versions list). Confirmed in NVD/vendor advisories. [1][2]
  • CVE-2024-11407 — data-corruption (gRPC‑C++ transmit zero-copy). Described/fixed upstream (commit e9046b2…). [3][4]

Notes: the v1.78.0 release notes do not list new CVE fixes beyond routine bug fixes; you should verify your build/package vendor for backports or distro fixes and update to a release that includes the upstream fixes (or apply vendor patches). [5]

Sources:

  1. NVD — CVE-2024-7246. [turn1search3]
  2. CVE details / advisories for CVE-2024-7246. [turn0search5]
  3. NVD — CVE-2024-11407. [turn1search0]
  4. Ubuntu / SUSE advisories for CVE-2024-11407. [turn1search1][turn1search6]
  5. gRPC v1.78.0 release announcement. [turn2search2]

Test hostname validation behavior in Go 1.26+ environments.

The gRPC upgrade to v1.78.0 (released 2025-12-23) includes a behavior change: the client now rejects target URLs with unbracketed colons in the hostname when running with Go 1.26+. If your code constructs client targets using IPv6 addresses or custom resolvers, verify they use properly bracketed addresses (e.g., [::1]:8080 not ::1:8080) to avoid connection failures.

🤖 Prompt for AI Agents
In go.mod around line 7, the updated grpc dependency v1.78.0 introduces hostname
validation on Go 1.26+ that rejects unbracketed colons in target hostnames;
audit code that builds gRPC client target strings (including any custom
resolvers) and ensure IPv6 addresses are wrapped in brackets when a port is
present (e.g., [::1]:8080), update any helper that concatenates host:port to
detect IPv6 and add brackets, add unit/integration tests that construct targets
with IPv6 addresses and run under Go 1.26+, and update any docs or comments to
require bracketed IPv6 literals for gRPC targets.

google.golang.org/genproto/googleapis/api v0.0.0-20251222181119-0a764e51fe1b
google.golang.org/grpc v1.77.0
google.golang.org/protobuf v1.36.11
)

Expand Down
2 changes: 2 additions & 0 deletions go.sum
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,8 @@ google.golang.org/grpc v1.75.1 h1:/ODCNEuf9VghjgO3rqLcfg8fiOP0nSluljWFlDxELLI=
google.golang.org/grpc v1.75.1/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
google.golang.org/grpc v1.77.0 h1:wVVY6/8cGA6vvffn+wWK5ToddbgdU3d8MNENr4evgXM=
google.golang.org/grpc v1.77.0/go.mod h1:z0BY1iVj0q8E1uSQCjL9cppRj+gnZjzDnzV0dHhrNig=
google.golang.org/grpc v1.78.0 h1:K1XZG/yGDJnzMdd/uZHAkVqJE+xIDOcmdSFZkBUicNc=
google.golang.org/grpc v1.78.0/go.mod h1:I47qjTo4OKbMkjA/aOOwxDIiPSBofUtQUI5EfpWvW7U=
google.golang.org/protobuf v1.36.9 h1:w2gp2mA27hUeUzj9Ex9FBjsBm40zfaDtEWow293U7Iw=
google.golang.org/protobuf v1.36.9/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=
Expand Down
32 changes: 21 additions & 11 deletions proto/api/v1/api.proto → proto/v1/api.proto
Original file line number Diff line number Diff line change
@@ -1,17 +1,16 @@
syntax = "proto3";

option go_package = "github.com/o7studios/octopus-sdk/sdk/golang/gen/api/v1;apiv1";
option java_package = "studio.o7.octopus.sdk.gen.api.v1";
option go_package = "github.com/o7studios/octopus-sdk/go/v1;octopusv1";
option java_package = "studio.o7.octopus.sdk.v1";
option java_multiple_files = true;

package api.v1;
package octopus_sdk.v1;

import "google/protobuf/struct.proto";
import "google/protobuf/empty.proto";
import "google/protobuf/timestamp.proto";
import "google/api/annotations.proto";


service Octopus {
/**
* Retrieves existing entries from the database matching a
Expand Down Expand Up @@ -83,10 +82,10 @@ message Object {
google.protobuf.Struct data = 2;

// Timestamp when the object should no longer be visible by default.
optional google.protobuf.Timestamp expired_at = 4;
optional google.protobuf.Timestamp expired_at = 3;

// Timestamp when the object should be permanently deleted.
optional google.protobuf.Timestamp deleted_at = 5;
optional google.protobuf.Timestamp deleted_at = 4;
}

/**
Expand Down Expand Up @@ -136,11 +135,22 @@ message GetRequest {
* Paginator for database entry cursor-pagination.
*/
message Paginator {
// 1-based page index (page=1 is first page)
int32 page = 1;

// Number of items to return.
int32 page_size = 1;
int32 page_size = 2;
}
Comment on lines +138 to +143
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Breaking change: Paginator message restructured.

The Paginator message has been restructured:

  • New page field added at tag 1 (1-based page index)
  • page_size moved from tag 1 to tag 2

This is a wire-format breaking change. Existing clients sending pagination with page_size at tag 1 will have that value misinterpreted as page by the new schema.

If this breaking change is intentional, document the migration path clearly.


message PageInfo {
int32 current_page = 1; // current page (1-based)
int32 current_page_size = 2; // current page size

int32 total_pages = 3; // last page number
int64 total_items = 4; // total matching items

// Cursor for efficient pagination. First page is empty.
string cursor = 2;
optional int32 next_page = 5; // next page number. null if not present
optional int32 prev_page = 6; // previous page number. null if not present
}

/**
Expand All @@ -150,8 +160,8 @@ message GetResponse {
// List of found entries including revision, ID and timestamps.
repeated Entry entries = 1;

// Cursor for next page. Empty means "no more results".
string next_cursor = 2;
// Page information about the cursor.
PageInfo page_info = 2;
}

/**
Expand Down
Loading