[sdairs]

CLI exposure for the ClickStack part of the #1112 drift remediation. Refs #1112. Stacked on CLI 2 (#1120, cursor/openapi-drift-1112-cli-clickpipes-c05d), which it merges; the ClickStack library changes it uses are in API 3 (#1121).

Follow-up issues

I can't open issues from this environment. This PR's tracking issue would read:

CLI: ClickStack webhook validation and new alert and dashboard shapes (#1112). Expose cloud clickstack webhook validate; inline alerts and optional channel/channels in alert create/update; stacked-line tiles, series heatmaps and all four filter types in dashboard create/update/validate; strict role permissions. Not exposed: typed write-back flows for roles or dashboards. The CLI keeps taking complete JSON bodies, as it does today.

Changes

• clickstack webhook validate <service-id> --file sends a webhook create body to the new validate endpoint and prints the result. The CLI's create-body checks run first. Like dashboard validate, it's classified as a write (API key auth) because the API exposes it as POST. A permission declaration is included.
• Alerts.
  • channel, channels (1 to 10, no duplicates) or both are accepted. At least one is still required, because an alert with no destination isn't useful and the spec doesn't define one.
  • source: inline needs chartConfig and rejects dashboard, tile and saved-search IDs. chartConfig with tile or saved_search is rejected.
  • chartConfig is a union, so the CLI checks it strictly against its alert variant (unknown fields, type errors, overlay whereLanguage, where on raw SQL), then runs the tile validator for the chart it extends.
  • source is still required; see the decision in the API 1 description (fix(api): refresh OpenAPI snapshot; Postgres IP access lists, pgConfig settings and GCP size renames (#1112) #1117).
• Dashboards.
  • stacked_line tiles (builder and raw SQL) and heatmapMode: series heatmaps are validated like the other tiles. lineInterpolation is checked on line and stacked-line tiles.
  • All four filter types are checked strictly per variant: input shapes on create, shapes with id on update. Unknown minSelections/maxSelections values are rejected.
• Roles. Unknown action, subject and ClickHouse condition whereLanguage values are rejected, on top of API 3's strict per-variant check.
• Help and docs. The alert help no longer claims both channel fields are required. docs/guides/clickstack.md covers webhook validation, inline alerts, the new tile and filter shapes, and role integrations.

Tests

• Parsing and read/write classification for webhook validate, plus the shared --file/--config-file contract.
• Alert builders for channels-only, channel-only and inline alerts with each chart kind, plus rejection cases (missing chartConfig, wrong source combinations, unsupported display type, unknown fields, raw-SQL where, unknown whereLanguage, unknown select aggFn, no channels).
• Dashboard builders: create and update round trips with stacked-line tiles, both heatmap modes and all four filter types; rejection of unknown fields in series heatmaps and static-list filters, unknown lineInterpolation, minSelections: 2, unknown filter types, and create-shaped filters on update.
• Role enum rejections.
• Subprocess with wiremock: webhook validate sends the exact body with basic auth, prints JSON and human output, and fails locally on an invalid Slack body.

Verification

cargo fmt --all --check, both clickhousectl clippy configurations, cargo check -p clickhousectl --no-default-features and cargo test -p clickhousectl all pass, including the help-structure tests. No files added or renamed.

  

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}