feat: add tenant parameter to list_instance_* methods (#73)

cassiofariasmachado · web-flow · commit fc56dc49f3c2 · 2026-04-23T11:52:54.000-03:00
diff --git a/pyproject.toml b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "sap-cloud-sdk"
-version = "0.11.2"
+version = "0.11.3"
 description = "SAP Cloud SDK for Python"
 readme = "README.md"
 license = "Apache-2.0"
diff --git a/src/sap_cloud_sdk/destination/_local_client_base.py b/src/sap_cloud_sdk/destination/_local_client_base.py
@@ -217,6 +217,23 @@ def find_provider() -> Optional[T]:
                 return result
         return None
 
+    def _resolve_instance_list(
+        self,
+        tenant: Optional[str],
+        instance_list: List[Dict[str, Any]],
+    ) -> List[T]:
+        """Resolve entities from the instance list filtered by tenant.
+
+        When tenant is provided, returns entries matching that tenant (subscriber context).
+        When tenant is None, returns entries without a tenant field (provider context).
+        """
+        if tenant is not None:
+            return [
+                self.from_dict(e) for e in instance_list if e.get("tenant") == tenant
+            ]
+
+        return [self.from_dict(e) for e in instance_list if not e.get("tenant")]
+
     def _resolve_subaccount_list(
         self,
         access_strategy: AccessStrategy,
diff --git a/src/sap_cloud_sdk/destination/certificate_client.py b/src/sap_cloud_sdk/destination/certificate_client.py
@@ -79,11 +79,14 @@ def __init__(self, http: DestinationHttp) -> None:
     )
     def list_instance_certificates(
         self,
+        tenant: Optional[str] = None,
         filter: Optional[ListOptions] = None,
     ) -> PagedResult[Certificate]:
         """List all certificates at the service instance level.
 
         Args:
+            tenant: Optional subscriber tenant subdomain. When provided, the request uses
+                subscriber context; otherwise the provider context is used.
             filter: Optional filter configuration for query parameters.
 
         Returns:
@@ -95,7 +98,9 @@ def list_instance_certificates(
             DestinationOperationError: If HTTP error occurs or response parsing fails.
         """
         try:
-            return self._list_certificates(level=Level.SERVICE_INSTANCE, filter=filter)
+            return self._list_certificates(
+                level=Level.SERVICE_INSTANCE, tenant_subdomain=tenant, filter=filter
+            )
         except HttpError as e:
             raise DestinationOperationError(
                 f"failed to list instance certificates: {e}"
diff --git a/src/sap_cloud_sdk/destination/client.py b/src/sap_cloud_sdk/destination/client.py
@@ -127,11 +127,15 @@ def set_proxy(self, transparent_proxy: TransparentProxy) -> None:
         Module.DESTINATION, Operation.DESTINATION_LIST_INSTANCE_DESTINATIONS
     )
     def list_instance_destinations(
-        self, filter: Optional[ListOptions] = None
+        self,
+        tenant: Optional[str] = None,
+        filter: Optional[ListOptions] = None,
     ) -> PagedResult[Destination]:
         """List all destinations from the service instance scope.
 
         Args:
+            tenant: Optional subscriber tenant subdomain. When provided, the request uses
+                subscriber context; otherwise the provider context is used.
             filter: Optional filter configuration for pagination, filtering, or metadata inclusion.
 
         Returns:
@@ -144,7 +148,7 @@ def list_instance_destinations(
         """
         try:
             return self._list_destinations(
-                level=Level.SERVICE_INSTANCE, tenant_subdomain=None, filter=filter
+                level=Level.SERVICE_INSTANCE, tenant_subdomain=tenant, filter=filter
             )
         except HttpError as e:
             raise DestinationOperationError(
diff --git a/src/sap_cloud_sdk/destination/fragment_client.py b/src/sap_cloud_sdk/destination/fragment_client.py
@@ -130,11 +130,14 @@ def get_subaccount_fragment(
     @record_metrics(Module.DESTINATION, Operation.FRAGMENT_LIST_INSTANCE_FRAGMENTS)
     def list_instance_fragments(
         self,
+        tenant: Optional[str] = None,
         filter: Optional[ListOptions] = None,
     ) -> List[Fragment]:
         """List all fragments from the service instance scope.
 
         Args:
+            tenant: Optional subscriber tenant subdomain. When provided, the request uses
+                subscriber context; otherwise the provider context is used.
             filter: Optional filter configuration for label filtering.
 
         Returns:
@@ -144,7 +147,9 @@ def list_instance_fragments(
             DestinationOperationError: If an HTTP error occurs or response parsing fails.
         """
         try:
-            return self._list_fragments(level=Level.SERVICE_INSTANCE, filter=filter)
+            return self._list_fragments(
+                level=Level.SERVICE_INSTANCE, tenant_subdomain=tenant, filter=filter
+            )
         except HttpError as e:
             raise DestinationOperationError(f"failed to list instance fragments: {e}")
 
diff --git a/src/sap_cloud_sdk/destination/local_certificate_client.py b/src/sap_cloud_sdk/destination/local_certificate_client.py
@@ -246,12 +246,17 @@ def patch_certificate_labels(
         )
 
     def list_instance_certificates(
-        self, _filter: Optional[Any] = None
+        self,
+        tenant: Optional[str] = None,
+        _filter: Optional[Any] = None,
     ) -> PagedResult[Certificate]:
         """List all certificates from the service instance scope.
 
         Args:
-            filter: Optional ListCertificatesFilter (ignored in local dev mode).
+            tenant: Optional subscriber tenant subdomain. When provided, returns only entries
+                matching that tenant (subscriber context); otherwise returns provider-level
+                entries (no tenant field).
+            _filter: Optional ListCertificatesFilter (ignored in local dev mode).
 
         Returns:
             PagedResult[Certificate] containing certificates and pagination info.
@@ -263,7 +268,7 @@ def list_instance_certificates(
         """
         try:
             data = self._read()
-            items = [Certificate.from_dict(entry) for entry in data.get("instance", [])]
+            items = self._resolve_instance_list(tenant, data.get("instance", []))
             return PagedResult(items=items)
         except DestinationOperationError:
             raise
diff --git a/src/sap_cloud_sdk/destination/local_client.py b/src/sap_cloud_sdk/destination/local_client.py
@@ -41,6 +41,7 @@ class LocalDevDestinationClient(LocalDevClientBase[Destination]):
       ],
       "instance": [
         {
+          "tenant": "t1",                # optional: subscriber-specific entry
           "name": "destC",
           "type": "HTTP",
           "url": "https://provider.example.com"
@@ -243,12 +244,17 @@ def delete_destination(
                 )
 
     def list_instance_destinations(
-        self, _filter: Optional[Any] = None
+        self,
+        tenant: Optional[str] = None,
+        _filter: Optional[Any] = None,
     ) -> PagedResult[Destination]:
         """List all destinations from the service instance scope.
 
         Args:
-            filter: Optional ListDestinationsFilter (ignored in local dev mode).
+            tenant: Optional subscriber tenant subdomain. When provided, returns only entries
+                matching that tenant (subscriber context); otherwise returns provider-level
+                entries (no tenant field).
+            _filter: Optional ListDestinationsFilter (ignored in local dev mode).
 
         Returns:
             PagedResult[Destination] containing destinations and pagination info.
@@ -260,7 +266,7 @@ def list_instance_destinations(
         """
         try:
             data = self._read()
-            items = [Destination.from_dict(entry) for entry in data.get("instance", [])]
+            items = self._resolve_instance_list(tenant, data.get("instance", []))
             return PagedResult(items=items)
         except DestinationOperationError:
             raise
diff --git a/src/sap_cloud_sdk/destination/local_fragment_client.py b/src/sap_cloud_sdk/destination/local_fragment_client.py
@@ -140,10 +140,16 @@ def get_subaccount_fragment(
 
     def list_instance_fragments(
         self,
+        tenant: Optional[str] = None,
         _filter: Optional[Any] = None,
     ) -> List[Fragment]:
         """List all fragments from the service instance scope.
 
+        Args:
+            tenant: Optional subscriber tenant subdomain. When provided, returns only entries
+                matching that tenant (subscriber context); otherwise returns provider-level
+                entries (no tenant field).
+
         Returns:
             List of fragments. Returns empty list if no fragments exist.
 
@@ -152,7 +158,7 @@ def list_instance_fragments(
         """
         try:
             data = self._read()
-            return [Fragment.from_dict(entry) for entry in data.get("instance", [])]
+            return self._resolve_instance_list(tenant, data.get("instance", []))
         except DestinationOperationError:
             raise
         except Exception as e:
diff --git a/src/sap_cloud_sdk/destination/user-guide.md b/src/sap_cloud_sdk/destination/user-guide.md
@@ -27,6 +27,16 @@ dest = client.get_instance_destination("my-destination")
 fragment = fragment_client.get_instance_fragment("my-fragment")
 cert = certificate_client.get_instance_certificate("my-cert")
 
+# Instance-level list: provider context (no tenant)
+destinations = client.list_instance_destinations()
+fragments = fragment_client.list_instance_fragments()
+certificates = certificate_client.list_instance_certificates()
+
+# Instance-level list: subscriber context (tenant provided)
+destinations = client.list_instance_destinations(tenant="tenant-subdomain")
+fragments = fragment_client.list_instance_fragments(tenant="tenant-subdomain")
+certificates = certificate_client.list_instance_certificates(tenant="tenant-subdomain")
+
 # Subaccount-level read: provider only (no tenant required)
 dest = client.get_subaccount_destination("my-destination", access_strategy=AccessStrategy.PROVIDER_ONLY)
 fragment = fragment_client.get_subaccount_fragment("my-fragment", access_strategy=AccessStrategy.PROVIDER_ONLY)
@@ -111,7 +121,7 @@ class DestinationClient:
     # V1 Admin API - Read operations for destinations
     def get_instance_destination(self, name: str, proxy_enabled: Optional[bool] = None) -> Optional[Destination | TransparentProxyDestination]: ...
     def get_subaccount_destination(self, name: str, access_strategy: AccessStrategy = AccessStrategy.SUBSCRIBER_FIRST, tenant: Optional[str] = None, proxy_enabled: Optional[bool] = None) -> Optional[Destination | TransparentProxyDestination]: ...
-    def list_instance_destinations(self, filter: Optional[ListOptions] = None) -> PagedResult[Destination]: ...
+    def list_instance_destinations(self, tenant: Optional[str] = None, filter: Optional[ListOptions] = None) -> PagedResult[Destination]: ...
     def list_subaccount_destinations(self, access_strategy: AccessStrategy = AccessStrategy.SUBSCRIBER_FIRST, tenant: Optional[str] = None, filter: Optional[ListOptions] = None) -> PagedResult[Destination]: ...
 
     # V1 Admin API - Write operations
@@ -134,7 +144,7 @@ The fragment client produced by `create_fragment_client()` exposes the following
 class FragmentClient:
     def get_instance_fragment(self, name: str) -> Optional[Fragment]: ...
     def get_subaccount_fragment(self, name: str, access_strategy: AccessStrategy = AccessStrategy.SUBSCRIBER_FIRST, tenant: Optional[str] = None) -> Optional[Fragment]: ...
-    def list_instance_fragments(self, filter: Optional[ListOptions] = None) -> List[Fragment]: ...
+    def list_instance_fragments(self, tenant: Optional[str] = None, filter: Optional[ListOptions] = None) -> List[Fragment]: ...
     def list_subaccount_fragments(self, access_strategy: AccessStrategy = AccessStrategy.SUBSCRIBER_FIRST, tenant: Optional[str] = None, filter: Optional[ListOptions] = None) -> List[Fragment]: ...
     def create_fragment(self, fragment: Fragment, level: Optional[Level] = Level.SUB_ACCOUNT, tenant: Optional[str] = None) -> None: ...
     def update_fragment(self, fragment: Fragment, level: Optional[Level] = Level.SUB_ACCOUNT, tenant: Optional[str] = None) -> None: ...
@@ -152,7 +162,7 @@ The certificate client produced by `create_certificate_client()` exposes the fol
 class CertificateClient:
     def get_instance_certificate(self, name: str) -> Optional[Certificate]: ...
     def get_subaccount_certificate(self, name: str, access_strategy: AccessStrategy = AccessStrategy.SUBSCRIBER_FIRST, tenant: Optional[str] = None) -> Optional[Certificate]: ...
-    def list_instance_certificates(self, filter: Optional[ListOptions] = None) -> PagedResult[Certificate]: ...
+    def list_instance_certificates(self, tenant: Optional[str] = None, filter: Optional[ListOptions] = None) -> PagedResult[Certificate]: ...
     def list_subaccount_certificates(self, access_strategy: AccessStrategy = AccessStrategy.SUBSCRIBER_FIRST, tenant: Optional[str] = None, filter: Optional[ListOptions] = None) -> PagedResult[Certificate]: ...
     def create_certificate(self, certificate: Certificate, level: Optional[Level] = Level.SUB_ACCOUNT, tenant: Optional[str] = None) -> None: ...
     def update_certificate(self, certificate: Certificate, level: Optional[Level] = Level.SUB_ACCOUNT, tenant: Optional[str] = None) -> None: ...
diff --git a/tests/destination/integration/destination.feature b/tests/destination/integration/destination.feature
@@ -107,6 +107,20 @@ Feature: Destination Service Integration
     And the destination "test-list-inst-3" should be in the list
     And I clean up all instance destinations
 
+  # Scenario: List instance destinations with tenant (subscriber context)
+  #   Given I have multiple instance destinations:
+  #     | name                  | type | url                      |
+  #     | test-list-inst-ten-1  | HTTP | https://api1.example.com |
+  #     | test-list-inst-ten-2  | HTTP | https://api2.example.com |
+  #   And I use tenant "1776453780"
+  #   When I create all instance destinations
+  #   Then all destination creations should be successful
+  #   When I list instance destinations with tenant
+  #   Then the list should contain at least 2 destinations
+  #   And the destination "test-list-inst-ten-1" should be in the list
+  #   And the destination "test-list-inst-ten-2" should be in the list
+  #   And I clean up all instance destinations
+
   # Scenario: Create and list subaccount destinations (provider access)
   #   Given I have multiple subaccount destinations:
   #     | name            | type | url                      |
diff --git a/tests/destination/integration/test_destination_bdd.py b/tests/destination/integration/test_destination_bdd.py
@@ -414,6 +414,19 @@ def list_instance_destinations(context, destination_client):
         context.operation_error = e
 
 
+@when("I list instance destinations with tenant")
+def list_instance_destinations_with_tenant(context, destination_client):
+    """List all instance-level destinations using subscriber tenant context."""
+    try:
+        context.retrieved_destinations = destination_client.list_instance_destinations(
+            tenant=context.tenant
+        )
+        context.operation_success = True
+    except Exception as e:
+        context.operation_success = False
+        context.operation_error = e
+
+
 @when(parsers.parse('I list subaccount destinations with "{strategy}" access strategy'))
 def list_subaccount_destinations_with_access_strategy(context, destination_client, strategy):
     """List subaccount destinations with access strategy."""
diff --git a/tests/destination/unit/test_certificate_client.py b/tests/destination/unit/test_certificate_client.py
@@ -452,6 +452,23 @@ def test_list_instance_certificates_invalid_json_wrapped(self, certificate_clien
 
         assert "invalid JSON in list certificates response" in str(exc_info.value)
 
+    def test_list_instance_certificates_with_tenant(self, certificate_client, mock_http):
+        """Test listing instance certificates with a tenant subdomain."""
+        mock_response = Mock(spec=Response)
+        mock_response.headers = {}
+        mock_response.json.return_value = [
+            {"Name": "cert1.pem", "Content": "content1", "Type": "PEM"}
+        ]
+        mock_http.get.return_value = mock_response
+
+        certificates = certificate_client.list_instance_certificates(tenant="my-tenant")
+
+        assert len(certificates.items) == 1
+        assert certificates.items[0].name == "cert1.pem"
+        mock_http.get.assert_called_once_with(
+            "v1/instanceCertificates", tenant_subdomain="my-tenant", params={}
+        )
+
     def test_list_subaccount_certificates_requires_tenant_for_subscriber_access(self, certificate_client, mock_http):
         """Test that subscriber access strategies require tenant parameter."""
         # Test SUBSCRIBER_ONLY
diff --git a/tests/destination/unit/test_client.py b/tests/destination/unit/test_client.py
@@ -1309,6 +1309,24 @@ def test_list_instance_destinations_invalid_json_wrapped(self):
         with pytest.raises(DestinationOperationError, match="expected list in response"):
             client.list_instance_destinations()
 
+    def test_list_instance_destinations_with_tenant(self):
+        mock_http = MagicMock()
+        resp = MagicMock(spec=Response)
+        resp.status_code = 200
+        resp.headers = {}
+        resp.json.return_value = [{"name": "dest1", "type": "HTTP"}]
+        mock_http.get.return_value = resp
+
+        client = DestinationClient(mock_http)
+        result = client.list_instance_destinations(tenant="my-tenant")
+
+        assert isinstance(result, PagedResult)
+        assert len(result.items) == 1
+
+        args, kwargs = mock_http.get.call_args
+        assert args[0] == "v1/instanceDestinations"
+        assert kwargs.get("tenant_subdomain") == "my-tenant"
+
     def test_list_subaccount_destinations_requires_tenant_for_subscriber_access(self):
         client = DestinationClient(MagicMock())
 
diff --git a/tests/destination/unit/test_fragment_client.py b/tests/destination/unit/test_fragment_client.py
@@ -416,6 +416,22 @@ def test_list_instance_fragments_invalid_json(self, fragment_client, mock_http):
 
         assert "expected list in response" in str(exc_info.value)
 
+    def test_list_instance_fragments_with_tenant(self, fragment_client, mock_http):
+        """Test listing instance fragments with a tenant subdomain."""
+        mock_response = Mock(spec=Response)
+        mock_response.json.return_value = [
+            {"FragmentName": "frag1", "URL": "https://api1.example.com"}
+        ]
+        mock_http.get.return_value = mock_response
+
+        fragments = fragment_client.list_instance_fragments(tenant="my-tenant")
+
+        assert len(fragments) == 1
+        assert fragments[0].name == "frag1"
+        mock_http.get.assert_called_once_with(
+            "v1/instanceDestinationFragments", tenant_subdomain="my-tenant", params={}
+        )
+
     def test_list_subaccount_fragments_provider_only(self, fragment_client, mock_http):
         """Test listing subaccount fragments with PROVIDER_ONLY strategy."""
         # Setup mock response
diff --git a/tests/destination/unit/test_local_certificate_client.py b/tests/destination/unit/test_local_certificate_client.py
@@ -143,6 +143,32 @@ def test_does_not_include_subaccount_entries(self, client):
         assert len(result.items) == 1
         assert result.items[0].name == "inst.pem"
 
+    def test_without_tenant_excludes_tenant_entries(self, client):
+        _write_store(client, {"instance": [
+            {"Name": "provider.pem", "Content": "c1"},
+            {"Name": "subscriber.pem", "Content": "c2", "tenant": "t1"},
+        ], "subaccount": []})
+        result = client.list_instance_certificates()
+        assert len(result.items) == 1
+        assert result.items[0].name == "provider.pem"
+
+    def test_with_tenant_returns_only_matching_entries(self, client):
+        _write_store(client, {"instance": [
+            {"Name": "provider.pem", "Content": "c1"},
+            {"Name": "t1.pem", "Content": "c2", "tenant": "t1"},
+            {"Name": "t2.pem", "Content": "c3", "tenant": "t2"},
+        ], "subaccount": []})
+        result = client.list_instance_certificates(tenant="t1")
+        assert len(result.items) == 1
+        assert result.items[0].name == "t1.pem"
+
+    def test_with_tenant_returns_empty_when_no_match(self, client):
+        _write_store(client, {"instance": [
+            {"Name": "provider.pem", "Content": "c1"},
+        ], "subaccount": []})
+        result = client.list_instance_certificates(tenant="unknown")
+        assert len(result.items) == 0
+
 
 class TestListSubaccountCertificates:
     def test_returns_paged_result(self, client):
diff --git a/tests/destination/unit/test_local_destination_client.py b/tests/destination/unit/test_local_destination_client.py
diff --git a/tests/destination/unit/test_local_fragment_client.py b/tests/destination/unit/test_local_fragment_client.py
diff --git a/uv.lock b/uv.lock
