TencentCloud/CubeSandbox PR #802 — Align Go SDK domain validation with server contract — PR #802
TencentCloud/CubeSandbox · pull request #802 ·
Transcript
PlainEnglish
Let's walk through pull request 802 for the CubeSandbox Go SDK. This is a focused alignment fix that closes a gap between what the SDK accepts and what the server actually enforces.
PlainEnglish
We're doing two things here. First, we're correcting how the SDK validates domain targets in allowOut policies so it matches the server's actual rules. And second, we're adding tests that document the boundary between AllowPublicTraffic and AllowInternetAccess. The existing test structure stays intact.
PlainEnglish
Here's what was happening. The Go SDK was treating AllowPublicTraffic equals false as a valid deny-all condition and sending those requests to the server. But the server only recognizes AllowInternetAccess equals false as deny-all. So the SDK was accepting requests the server would reject, and that mismatch meant wasted round trips and confusing errors.
Architecture
The fix touches three files in the Go SDK. We're updating the validation check in client dot go, clarifying the comment in policy dot go, and adding new tests plus a data adjustment in aligned test dot go. Let's look at each change.
Architecture
Here's the core change in client dot go. Before, we checked if AllowPublicTraffic was false OR if AllowInternetAccess was false. Now we only check AllowInternetAccess. We extract that boolean up front and use it alone to decide if domain validation should run. This mirrors the server's logic exactly.
Architecture
In policy dot go, we update the function comment to reflect reality. The old comment referenced a Python guard and mentioned public traffic off. The new comment explicitly states the CubeAPI contract: you need AllowInternetAccess equals false or a denyOut containing zero dot zero dot zero dot zero slash zero.
Architecture
The existing test, TestCreateSerializesPolicyAndPublicTraffic, used a domain in allowOut. With the new validation, that would trigger a rejection. We swap the domain for a CIDR block. CIDR targets aren't subject to domain validation, so the test still passes and checks serialization without hitting the new guard.
Architecture
We add two new tests. The first verifies that setting only AllowPublicTraffic to false with a domain allowOut is now rejected client-side. The second confirms that setting AllowInternetAccess to false with a domain allowOut is still accepted and serializes correctly. Together they pin down exactly where the boundary is.
PlainEnglish
After this PR, the Go SDK validates domain allowOut exactly the way CubeAPI does. It rejects sandbox create requests with domain targets unless either AllowInternetAccess is false or denyOut explicitly contains zero dot zero dot zero dot zero slash zero. Callers who set only AllowPublicTraffic to false will now get a clear client-side error instead of a confusing server rejection.
CodeQuality
One thing to keep an eye on. The error message constant at line sixty-three still mentions disable public outbound traffic as an option, but the code no longer treats that as valid. The message is now slightly misleading. It suggests AllowPublicTraffic equals false is acceptable when the validation logic says otherwise.
CodeQuality
The second note is about test semantics. TestCreateSerializesPolicyAndPublicTraffic silently changed from testing domain allowOut to testing CIDR allowOut. The test name and structure suggest it checks policy serialization, but it no longer validates domain-specific handling under the old rule. The change keeps the test passing, but it obscures the behavioral shift.
PlainEnglish
And that's the PR. A focused validation fix that tightens the SDK's handling of domain allowOut targets, aligning it with the server's actual contract. The two gotchas are documentation drift — the error message text and the test name — rather than correctness issues. The core logic now matches CubeAPI.
How this was made
Lenzon read TencentCloud/CubeSandbox at pull request #802 and generated this walkthrough automatically. The narration above is the transcript of what it says.
Explain a pull request from your own repo
Point Lenzon at a repo or a pull request and get a narrated walkthrough like this one.
Try it