cache: define response cache boundaries

apps/admin-api/src/service.rs

@@ -1,10 +1,7 @@
 use std::collections::BTreeMap;
 use std::path::PathBuf;
 
-use base64::{
-    Engine as _,
-    engine::general_purpose::URL_SAFE_NO_PAD,
-};
+use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
 use crank_adapter_soap::{SoapServiceSummary, inspect_wsdl};
 use crank_core::{
     Agent, AgentId, AgentOperationBinding, AgentStatus, AgentVersion, AggregationMode,
@@ -15,9 +12,9 @@ use crank_core::{
     IssueOneTimeAgentTokenRequest, IssuedAgentTokenResponse, JobStatus, MachineAccessMode,
     MembershipRole, OperationId, OperationSecurityLevel, OperationStatus, PlatformApiKey,
     PlatformApiKeyId, PlatformApiKeyScope, PlatformApiKeyStatus, ProductEdition, Protocol,
-    SampleId, Samples, Secret, SecretId, SecretKind, SecretStatus, StreamSession, StreamStatus,
-    Target, TransportBehavior, UsagePeriod, UserId, UserSessionId, Workspace, WorkspaceId,
-    WorkspaceStatus,
+    ResponseCachePolicy, SampleId, Samples, Secret, SecretId, SecretKind, SecretStatus,
+    StreamSession, StreamStatus, Target, TransportBehavior, UsagePeriod, UserId, UserSessionId,
+    Workspace, WorkspaceId, WorkspaceStatus,
 };
 use crank_mapping::{JsonPathRoot, MappingSet, infer_mapping_from_samples};
 use crank_proto::{ProtoService, services_from_descriptor_set_bytes};
@@ -3890,6 +3887,7 @@ impl AdminService {
     fn validate_operation_payload(&self, payload: &OperationPayload) -> Result<(), ApiError> {
         self.validate_operation_capabilities(payload.protocol, payload.security_level)?;
         validate_protocol_target(payload.protocol, &payload.target)?;
+        validate_response_cache_policy(&payload.target, &payload.execution_config)?;
         payload.input_mapping.validate_paths()?;
         payload.output_mapping.validate_paths()?;
         Ok(())
@@ -3898,6 +3896,7 @@ impl AdminService {
     fn validate_registry_operation(&self, operation: &RegistryOperation) -> Result<(), ApiError> {
         self.validate_operation_capabilities(operation.protocol, operation.security_level)?;
         validate_protocol_target(operation.protocol, &operation.target)?;
+        validate_response_cache_policy(&operation.target, &operation.execution_config)?;
         operation.input_mapping.validate_paths()?;
         operation.output_mapping.validate_paths()?;
         Ok(())
@@ -4067,8 +4066,12 @@ impl AdminService {
         )
         .await?;
 
-        self.seed_demo_invocation_logs(workspace_id, &AgentId::new(revops_agent.id), &rest_operation.id)
-            .await?;
+        self.seed_demo_invocation_logs(
+            workspace_id,
+            &AgentId::new(revops_agent.id),
+            &rest_operation.id,
+        )
+        .await?;
 
         Ok(())
     }
@@ -4539,6 +4542,7 @@ fn demo_rest_operation_payload() -> OperationPayload {
         execution_config: crank_core::ExecutionConfig {
             timeout_ms: 10_000,
             retry_policy: None,
+            response_cache: None,
             auth_profile_ref: None,
             headers: BTreeMap::new(),
             protocol_options: None,
@@ -4601,6 +4605,7 @@ fn demo_archived_operation_payload() -> OperationPayload {
         execution_config: crank_core::ExecutionConfig {
             timeout_ms: 6_000,
             retry_policy: None,
+            response_cache: None,
             auth_profile_ref: None,
             headers: BTreeMap::new(),
             protocol_options: None,
@@ -5039,6 +5044,47 @@ fn agent_mcp_endpoint(workspace_slug: &str, agent_slug: &str) -> String {
     format!("/mcp/v1/{workspace_slug}/{agent_slug}")
 }
 
+fn validate_response_cache_policy(
+    target: &Target,
+    execution_config: &crank_core::ExecutionConfig,
+) -> Result<(), ApiError> {
+    let Some(ResponseCachePolicy { ttl_ms }) = execution_config.response_cache.as_ref() else {
+        return Ok(());
+    };
+
+    if *ttl_ms == 0 {
+        return Err(ApiError::validation_with_context(
+            "response cache ttl must be greater than zero".to_owned(),
+            json!({
+                "field": "execution_config.response_cache.ttl_ms",
+            }),
+        ));
+    }
+
+    match target {
+        Target::Rest(rest_target) if rest_target.method == crank_core::HttpMethod::Get => {}
+        _ => {
+            return Err(ApiError::validation_with_context(
+                "response cache is supported only for REST GET operations".to_owned(),
+                json!({
+                    "field": "execution_config.response_cache",
+                }),
+            ));
+        }
+    }
+
+    if execution_config.auth_profile_ref.is_some() {
+        return Err(ApiError::validation_with_context(
+            "response cache is not supported for operations with auth_profile_ref".to_owned(),
+            json!({
+                "field": "execution_config.auth_profile_ref",
+            }),
+        ));
+    }
+
+    Ok(())
+}
+
 fn enrich_operation_summary(
     summary: OperationSummary,
     usage_summary: OperationUsageSummaryView,