github.com/envoyproxy/go-control-plane/ratelimit v0.1.0: ratelimitv3.RateLimitConfig, ratelimitv3.RateLimitDescriptor, ratelimitv3.RateLimitPolicy

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:golang/github.com/envoyproxy/go-control-plane/ratelimit@v0.1.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/envoyproxy/go-control-plane/ratelimit@v0.1.0

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:6129a07961bd329c494adc1f3ca0bea99728f6292694178b2cb9288be115bab0","contract":["ratelimitv3.RateLimitUnit maps UNKNOWN, SECOND, MINUTE, HOUR, and DAY enum values to numbers 0..4 and string names","ratelimitv3.RateLimitConfig, RateLimitDescriptor, RateLimitPolicy, and RateLimitReplace getters safely return zero values on nil receivers","ratelimitv3.RateLimitConfig preserves nested descriptors, shadow_mode, detailed_metric, unlimited, and policy replaces across protobuf Marshal and Unmarshal","ratelimitv3.RateLimitConfig.Reset clears all fields to zero state","configv3.UnimplementedRateLimitConfigDiscoveryServiceServer returns codes.Unimplemented for FetchRlsConfigs and StreamRlsConfigs","configv3.RegisterRateLimitConfigDiscoveryServiceServer and NewRateLimitConfigDiscoveryServiceClient exchange RateLimitConfig resources packed in discoveryv3.DiscoveryResponse over FetchRlsConfigs and StreamRlsConfigs"],"goal":"verify pkg:golang/github.com/envoyproxy/go-control-plane/ratelimit@v0.1.0","kind":"HOW","packages":["pkg:golang/github.com/envoyproxy/go-control-plane/ratelimit@v0.1.0"],"schemaVersion":1,"symbols":["ratelimitv3.RateLimitConfig","ratelimitv3.RateLimitDescriptor","ratelimitv3.RateLimitPolicy","ratelimitv3.RateLimitReplace","ratelimitv3.RateLimitUnit","configv3.NewRateLimitConfigDiscoveryServiceClient","configv3.RegisterRateLimitConfigDiscoveryServiceServer","configv3.UnimplementedRateLimitConfigDiscoveryServiceServer"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","language":"go","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","packageManagerVersion":"1.26.6","runtime":"go","runtimeVersion":"1.26.6","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/envoyproxy/go-control-plane/ratelimit@v0.1.0"],"schemaVersion":1,"subject":"pkg:golang/github.com/envoyproxy/go-control-plane/ratelimit@v0.1.0","symbols":["ratelimitv3.RateLimitConfig","ratelimitv3.RateLimitDescriptor","ratelimitv3.RateLimitPolicy","ratelimitv3.RateLimitReplace","ratelimitv3.RateLimitUnit","configv3.NewRateLimitConfigDiscoveryServiceClient","configv3.RegisterRateLimitConfigDiscoveryServiceServer","configv3.UnimplementedRateLimitConfigDiscoveryServiceServer"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.26.6

require (
	github.com/envoyproxy/go-control-plane/envoy v1.32.2
	github.com/envoyproxy/go-control-plane/ratelimit v0.1.0
	google.golang.org/grpc v1.67.1
	google.golang.org/protobuf v1.35.2
)

require (
	github.com/cncf/xds/go v0.0.0-20240723142845-024c85f92f20 // indirect
	github.com/envoyproxy/protoc-gen-validate v1.1.0 // indirect
	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
	golang.org/x/net v0.28.0 // indirect
	golang.org/x/sys v0.24.0 // indirect
	golang.org/x/text v0.17.0 // indirect
	google.golang.org/genproto/googleapis/rpc v0.0.0-20240814211410-ddb44dafa142 // indirect
)

github.com/cncf/xds/go v0.0.0-20240723142845-024c85f92f20 h1:N+3sFI5GUjRKBi+i0TxYVST9h4Ie192jJWpHvthBBgg=
github.com/cncf/xds/go v0.0.0-20240723142845-024c85f92f20/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8=
github.com/envoyproxy/go-control-plane/envoy v1.32.2 h1:zidqwmijfcbyKqVxjQDFx042PgX+p9U+/fu/f9VtSk8=
github.com/envoyproxy/go-control-plane/envoy v1.32.2/go.mod h1:eR2SOX2IedqlPvmiKjUH7Wu//S602JKI7HPC/L3SRq8=
github.com/envoyproxy/go-control-plane/ratelimit v0.1.0 h1:/G9QYbddjL25KvtKTv3an9lx6VBE2cnb8wp1vEGNYGI=
github.com/envoyproxy/go-control-plane/ratelimit v0.1.0/go.mod h1:Wk+tMFAFbCXaJPzVVHnPgRKdUdwW/KdbRt94AzgRee4=
github.com/envoyproxy/protoc-gen-validate v1.1.0 h1:tntQDh69XqOCOZsDz0lVJQez/2L6Uu2PdjCQwWCJ3bM=
github.com/envoyproxy/protoc-gen-validate v1.1.0/go.mod h1:sXRDRVmzEbkM7CVcM06s9shE/m23dg3wzjl0UWqJ2q4=
github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo=
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
golang.org/x/net v0.28.0 h1:a9JDOJc5GMUJ0+UDqmLT86WiEy7iWyIhz8gz8E4e5hE=
golang.org/x/net v0.28.0/go.mod h1:yqtgsTWOOnlGLG9GFRrK3++bGOUEkNBoHZc8MEDWPNg=
golang.org/x/sys v0.24.0 h1:Twjiwq9dn6R1fQcyiK+wQyHWfaz/BJB+YIpzU/Cv3Xg=
golang.org/x/sys v0.24.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/text v0.17.0 h1:XtiM5bkSOt+ewxlOE/aE/AKEHibwj/6gvWMl9Rsh0Qc=
golang.org/x/text v0.17.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
google.golang.org/genproto/googleapis/rpc v0.0.0-20240814211410-ddb44dafa142 h1:e7S5W7MGGLaSu8j3YjdezkZ+m1/Nm0uRVRMEMGk26Xs=
google.golang.org/genproto/googleapis/rpc v0.0.0-20240814211410-ddb44dafa142/go.mod h1:UqMtugtsSgubUsoxbuAoiCXvqvErP7Gf0so0mK9tHxU=
google.golang.org/grpc v1.67.1 h1:zWnc1Vrcno+lHZCOofnIMvycFcc0QRGIzm9dhnDX68E=
google.golang.org/grpc v1.67.1/go.mod h1:1gLDyUQU7CTLJI90u3nXZ9ekeghjeM7pTDZlqFNg2AA=
google.golang.org/protobuf v1.35.2 h1:8Ar7bF+apOIoThw1EdZl0p1oWvMqTHmpA2fRTyZO8io=
google.golang.org/protobuf v1.35.2/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=

package main

import (
	"fmt"

	ratelimitv3 "github.com/envoyproxy/go-control-plane/ratelimit/config/ratelimit/v3"
	"google.golang.org/protobuf/proto"
)

func BuildSampleRateLimitConfig() *ratelimitv3.RateLimitConfig {
	return &ratelimitv3.RateLimitConfig{
		Name:   "edge-rate-limit",
		Domain: "edge-proxy",
		Descriptors: []*ratelimitv3.RateLimitDescriptor{
			{
				Key:            "tier",
				Value:          "free",
				ShadowMode:     false,
				DetailedMetric: true,
				RateLimit: &ratelimitv3.RateLimitPolicy{
					Name:            "free-tier-policy",
					Unit:            ratelimitv3.RateLimitUnit_MINUTE,
					RequestsPerUnit: 60,
				},
				Descriptors: []*ratelimitv3.RateLimitDescriptor{
					{
						Key:   "route",
						Value: "burst",
						RateLimit: &ratelimitv3.RateLimitPolicy{
							Name:            "burst-override",
							Unit:            ratelimitv3.RateLimitUnit_SECOND,
							RequestsPerUnit: 10,
							Replaces: []*ratelimitv3.RateLimitReplace{
								{Name: "free-tier-policy"},
							},
						},
					},
				},
			},
			{
				Key:        "tier",
				Value:      "internal",
				ShadowMode: true,
				RateLimit: &ratelimitv3.RateLimitPolicy{
					Unlimited: true,
				},
			},
		},
	}
}

func main() {
	cfg := BuildSampleRateLimitConfig()
	raw, err := proto.Marshal(cfg)
	if err != nil {
		panic(err)
	}

	var decoded ratelimitv3.RateLimitConfig
	if err := proto.Unmarshal(raw, &decoded); err != nil {
		panic(err)
	}

	fmt.Printf("Config %s (domain=%s) descriptors=%d\n",
		decoded.GetName(), decoded.GetDomain(), len(decoded.GetDescriptors()))
}

{
  "schemaVersion": 1,
  "goal": "verify pkg:golang/github.com/envoyproxy/go-control-plane/ratelimit@v0.1.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/envoyproxy/go-control-plane/ratelimit@v0.1.0"
  ]
}

package main

import (
	"context"
	"fmt"
	"net"
	"os"

	discoveryv3 "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3"
	ratelimitv3 "github.com/envoyproxy/go-control-plane/ratelimit/config/ratelimit/v3"
	configv3 "github.com/envoyproxy/go-control-plane/ratelimit/service/ratelimit/v3"
	"google.golang.org/grpc"
	"google.golang.org/grpc/codes"
	"google.golang.org/grpc/credentials/insecure"
	"google.golang.org/grpc/status"
	"google.golang.org/grpc/test/bufconn"
	"google.golang.org/protobuf/proto"
	"google.golang.org/protobuf/types/known/anypb"
)

func failf(format string, args ...interface{}) {
	fmt.Fprintf(os.Stderr, "FAIL: "+format+"\n", args...)
	os.Exit(1)
}

type testRlsServer struct {
	configv3.UnimplementedRateLimitConfigDiscoveryServiceServer
	configs []*ratelimitv3.RateLimitConfig
}

func (s *testRlsServer) FetchRlsConfigs(ctx context.Context, req *discoveryv3.DiscoveryRequest) (*discoveryv3.DiscoveryResponse, error) {
	resources := make([]*anypb.Any, 0, len(s.configs))
	for _, cfg := range s.configs {
		packed, err := anypb.New(cfg)
		if err != nil {
			return nil, err
		}
		resources = append(resources, packed)
	}
	return &discoveryv3.DiscoveryResponse{
		VersionInfo: req.GetVersionInfo(),
		Resources:   resources,
		TypeUrl:     req.GetTypeUrl(),
	}, nil
}

func (s *testRlsServer) StreamRlsConfigs(stream configv3.RateLimitConfigDiscoveryService_StreamRlsConfigsServer) error {
	req, err := stream.Recv()
	if err != nil {
		return err
	}
	resp, err := s.FetchRlsConfigs(stream.Context(), req)
	if err != nil {
		return err
	}
	return stream.Send(resp)
}

func verifyConfigModelAndSerialization() {
	// 1. Verify enum values and string mappings
	units := []struct {
		unit ratelimitv3.RateLimitUnit
		name string
		num  int32
	}{
		{ratelimitv3.RateLimitUnit_UNKNOWN, "UNKNOWN", 0},
		{ratelimitv3.RateLimitUnit_SECOND, "SECOND", 1},
		{ratelimitv3.RateLimitUnit_MINUTE, "MINUTE", 2},
		{ratelimitv3.RateLimitUnit_HOUR, "HOUR", 3},
		{ratelimitv3.RateLimitUnit_DAY, "DAY", 4},
	}
	for _, tc := range units {
		if tc.unit.String() != tc.name {
			failf("expected unit string %q, got %q", tc.name, tc.unit.String())
		}
		if int32(tc.unit.Number()) != tc.num {
			failf("expected unit number %d, got %d", tc.num, tc.unit.Number())
		}
		if *tc.unit.Enum() != tc.unit {
			failf("expected Enum() pointer deref to equal %v", tc.unit)
		}
	}

	// 2. Verify nil receiver safety across generated message types
	var nilCfg *ratelimitv3.RateLimitConfig
	if nilCfg.GetName() != "" || nilCfg.GetDomain() != "" || nilCfg.GetDescriptors() != nil {
		failf("expected zero values from nil RateLimitConfig getters")
	}
	var nilDesc *ratelimitv3.RateLimitDescriptor
	if nilDesc.GetKey() != "" || nilDesc.GetValue() != "" || nilDesc.GetRateLimit() != nil ||
		nilDesc.GetDescriptors() != nil || nilDesc.GetShadowMode() || nilDesc.GetDetailedMetric() {
		failf("expected zero values from nil RateLimitDescriptor getters")
	}
	var nilPol *ratelimitv3.RateLimitPolicy
	if nilPol.GetUnit() != ratelimitv3.RateLimitUnit_UNKNOWN || nilPol.GetRequestsPerUnit() != 0 ||
		nilPol.GetUnlimited() || nilPol.GetName() != "" || nilPol.GetReplaces() != nil {
		failf("expected zero values from nil RateLimitPolicy getters")
	}
	var nilRep *ratelimitv3.RateLimitReplace
	if nilRep.GetName() != "" {
		failf("expected empty string from nil RateLimitReplace.GetName()")
	}

	// 3. Construct full hierarchy and round-trip via protobuf
	orig := &ratelimitv3.RateLimitConfig{
		Name:   "api-gateway-rls",
		Domain: "gateway",
		Descriptors: []*ratelimitv3.RateLimitDescriptor{
			{
				Key:            "plan",
				Value:          "standard",
				ShadowMode:     false,
				DetailedMetric: true,
				RateLimit: &ratelimitv3.RateLimitPolicy{
					Name:            "standard-limit",
					Unit:            ratelimitv3.RateLimitUnit_MINUTE,
					RequestsPerUnit: 120,
				},
				Descriptors: []*ratelimitv3.RateLimitDescriptor{
					{
						Key:   "endpoint",
						Value: "search",
						RateLimit: &ratelimitv3.RateLimitPolicy{
							Name:            "search-limit",
							Unit:            ratelimitv3.RateLimitUnit_SECOND,
							RequestsPerUnit: 5,
							Replaces: []*ratelimitv3.RateLimitReplace{
								{Name: "standard-limit"},
							},
						},
					},
				},
			},
			{
				Key:        "plan",
				Value:      "admin",
				ShadowMode: true,
				RateLimit: &ratelimitv3.RateLimitPolicy{
					Unlimited: true,
				},
			},
		},
	}

	wire, err := proto.Marshal(orig)
	if err != nil {
		failf("proto.Marshal failed: %v", err)
	}

	decoded := &ratelimitv3.RateLimitConfig{}
	if err := proto.Unmarshal(wire, decoded); err != nil {
		failf("proto.Unmarshal failed: %v", err)
	}

	if decoded.GetName() != "api-gateway-rls" || decoded.GetDomain() != "gateway" {
		failf("unexpected config name/domain: %q / %q", decoded.GetName(), decoded.GetDomain())
	}
	if len(decoded.GetDescriptors()) != 2 {
		failf("expected 2 top-level descriptors, got %d", len(decoded.GetDescriptors()))
	}

	d0 := decoded.GetDescriptors()[0]
	if d0.GetKey() != "plan" || d0.GetValue() != "standard" || d0.GetShadowMode() || !d0.GetDetailedMetric() {
		failf("unexpected first descriptor fields: %+v", d0)
	}
	if d0.GetRateLimit().GetUnit() != ratelimitv3.RateLimitUnit_MINUTE || d0.GetRateLimit().GetRequestsPerUnit() != 120 {
		failf("unexpected first descriptor policy: %+v", d0.GetRateLimit())
	}
	if len(d0.GetDescriptors()) != 1 {
		failf("expected 1 nested descriptor, got %d", len(d0.GetDescriptors()))
	}
	sub := d0.GetDescriptors()[0]
	if sub.GetKey() != "endpoint" || sub.GetValue() != "search" {
		failf("unexpected nested descriptor key/value: %s=%s", sub.GetKey(), sub.GetValue())
	}
	if len(sub.GetRateLimit().GetReplaces()) != 1 || sub.GetRateLimit().GetReplaces()[0].GetName() != "standard-limit" {
		failf("expected replaces=[standard-limit], got %+v", sub.GetRateLimit().GetReplaces())
	}

	d1 := decoded.GetDescriptors()[1]
	if !d1.GetShadowMode() || !d1.GetRateLimit().GetUnlimited() {
		failf("expected shadow_mode=true and unlimited=true on second descriptor")
	}

	// Verify Reset clears fields
	decoded.Reset()
	if decoded.GetName() != "" || len(decoded.GetDescriptors()) != 0 {
		failf("expected Reset() to clear RateLimitConfig")
	}
}

func verifyDiscoveryService() {
	ctx := context.Background()

	// 1. Verify UnimplementedRateLimitConfigDiscoveryServiceServer returns codes.Unimplemented
	var unimpl configv3.UnimplementedRateLimitConfigDiscoveryServiceServer
	_, err := unimpl.FetchRlsConfigs(ctx, &discoveryv3.DiscoveryRequest{})
	if status.Code(err) != codes.Unimplemented {
		failf("expected Unimplemented from default FetchRlsConfigs, got %v", err)
	}
	err = unimpl.StreamRlsConfigs(nil)
	if status.Code(err) != codes.Unimplemented {
		failf("expected Unimplemented from default StreamRlsConfigs, got %v", err)
	}

	// 2. Verify implemented gRPC server + client over in-memory bufconn
	lis := bufconn.Listen(1024 * 1024)
	srv := grpc.NewServer()
	sampleCfg := &ratelimitv3.RateLimitConfig{
		Name:   "rls-config-v1",
		Domain: "edge",
		Descriptors: []*ratelimitv3.RateLimitDescriptor{
			{
				Key: "header_match",
				RateLimit: &ratelimitv3.RateLimitPolicy{
					Unit:            ratelimitv3.RateLimitUnit_HOUR,
					RequestsPerUnit: 1000,
				},
			},
		},
	}
	configv3.RegisterRateLimitConfigDiscoveryServiceServer(srv, &testRlsServer{
		configs: []*ratelimitv3.RateLimitConfig{sampleCfg},
	})
	go func() {
		_ = srv.Serve(lis)
	}()
	defer srv.Stop()

	conn, err := grpc.NewClient(
		"passthrough:///bufnet",
		grpc.WithContextDialer(func(ctx context.Context, _ string) (net.Conn, error) {
			return lis.DialContext(ctx)
		}),
		grpc.WithTransportCredentials(insecure.NewCredentials()),
	)
	if err != nil {
		failf("grpc.NewClient failed: %v", err)
	}
	defer conn.Close()

	client := configv3.NewRateLimitConfigDiscoveryServiceClient(conn)

	// Test unary FetchRlsConfigs
	fetchResp, err := client.FetchRlsConfigs(ctx, &discoveryv3.DiscoveryRequest{
		VersionInfo: "v1",
		TypeUrl:     "type.googleapis.com/ratelimit.config.ratelimit.v3.RateLimitConfig",
	})
	if err != nil {
		failf("FetchRlsConfigs failed: %v", err)
	}
	if fetchResp.GetVersionInfo() != "v1" || len(fetchResp.GetResources()) != 1 {
		failf("unexpected FetchRlsConfigs response: %+v", fetchResp)
	}

	unpacked := &ratelimitv3.RateLimitConfig{}
	if err := fetchResp.GetResources()[0].UnmarshalTo(unpacked); err != nil {
		failf("UnmarshalTo failed: %v", err)
	}
	if unpacked.GetName() != "rls-config-v1" || unpacked.GetDomain() != "edge" {
		failf("unexpected unpacked config: %+v", unpacked)
	}

	// Test bidirectional StreamRlsConfigs
	stream, err := client.StreamRlsConfigs(ctx)
	if err != nil {
		failf("StreamRlsConfigs failed: %v", err)
	}
	if err := stream.Send(&discoveryv3.DiscoveryRequest{
		VersionInfo: "v2",
		TypeUrl:     "type.googleapis.com/ratelimit.config.ratelimit.v3.RateLimitConfig",
	}); err != nil {
		failf("stream.Send failed: %v", err)
	}
	streamResp, err := stream.Recv()
	if err != nil {
		failf("stream.Recv failed: %v", err)
	}
	if streamResp.GetVersionInfo() != "v2" || len(streamResp.GetResources()) != 1 {
		failf("unexpected StreamRlsConfigs response: %+v", streamResp)
	}
	_ = stream.CloseSend()
}

func main() {
	verifyConfigModelAndSerialization()
	verifyDiscoveryService()
	fmt.Println("PASS")
}