fakecloud-rds 0.26.0

//! Smithy-aligned input validation for RDS Query-protocol actions.
//!
//! Generated negative conformance probes hit every action with three
//! synthetic shapes: an omitted required member, an out-of-range string
//! length, and an invalid enum value. The historical handler chain in
//! `service.rs` / `extras.rs` accepts these without complaint because the
//! per-handler `required_query_param` / `get_param` calls were uneven and a
//! few actions (e.g. role-management shortcuts that flow through
//! `xml_empty_action`) skipped validation entirely.
//!
//! This module exposes one entry point, [`prevalidate`], which the service
//! handler runs before dispatching. The table inside is hand-derived from
//! the RDS Smithy model (`aws-models/rds.json`). Each entry lists:
//!
//!   * **required**         — Query parameter names with `@required` on the
//!     input shape. Missing or empty values return `MissingParameter`.
//!   * **required_present**  — Like `required` but tolerates empty values;
//!     only the key being absent triggers `MissingParameter`. Used for ops
//!     whose Smithy `errors` set doesn't declare a `*Missing*` shape and
//!     whose `@examples` carry the field with an empty value.
//!   * **strings**           — `(name, min, max)` triples for members
//!     carrying `@length` constraints. Empty values are still length-checked
//!     unless `min == 0`.
//!   * **enums**             — `(name, &[allowed])` tuples for members
//!     whose target is a Smithy `enum` shape. Values outside the set return
//!     `InvalidParameterValue`. Allowed values are the `@enumValue` wire
//!     forms (e.g. `inactive-except-restore`), not the Smithy member names
//!     (e.g. `inactive_except_restore`).
//!   * **ranges**            — `(name, lo, hi)` triples for integer members
//!     carrying `@range` bounds. Out-of-range values return
//!     `InvalidParameterValue`.
//!
//! Only validations the autogenerated probe actually exercises are listed.
//! Everything else is deliberately left out: hand-coded handlers downstream
//! still own business-logic checks, and we do not want to drift from AWS
//! by tightening rules the probe does not assert.

use crate::service::{invalid_param, missing_param};
use fakecloud_core::service::{AwsRequest, AwsServiceError};

/// Constraint table entry for one Query action.
struct OpConstraints {
    /// Parameters that must be present AND non-empty. Missing or empty
    /// values return `MissingParameter`.
    required: &'static [&'static str],
    /// Parameters that must be *present* in the form, but may be empty.
    /// Used for ops whose Smithy `errors` set does not include
    /// `MissingParameter` — the probe's `example_*` variants frequently
    /// carry the field with an empty value, which must reach the handler
    /// rather than tripping a `MissingParameter` here. Only the
    /// `negative_omit_*` probe (which strips the key) needs to fail.
    required_present: &'static [&'static str],
    strings: &'static [(&'static str, u64, u64)],
    enums: &'static [(&'static str, &'static [&'static str])],
    /// Integer parameters with `@range` bounds. Values outside the range
    /// return `InvalidParameterValue`. Missing values are not validated
    /// here (use `required` for that).
    ranges: &'static [(&'static str, i64, i64)],
}

/// Validate the request against the Smithy input shape for `action`.
/// Returns `Ok(())` when the action has no entry or every constraint
/// passes; otherwise returns the appropriate `MissingParameter` /
/// `InvalidParameterValue` AWS error.
pub(crate) fn prevalidate(action: &str, req: &AwsRequest) -> Result<(), AwsServiceError> {
    let Some(spec) = lookup(action) else {
        return Ok(());
    };

    for name in spec.required {
        match req.query_params.get(*name) {
            Some(value) if !value.is_empty() => {}
            _ => {
                // Accept list-shaped parameters where the SDK serialised
                // the members under nested keys like `<List>.member.1.X`
                // or `<List>.Parameter.1.X` (RDS uses both flat and named
                // member styles depending on the Smithy `xmlName` of the
                // list's inner shape). Treating any key beginning with
                // `<name>.` as evidence of presence avoids false rejects
                // on `Parameters`, `Auth`, `VpcSubnetIds`, etc.
                let prefix = format!("{name}.");
                let has_list_member = req.query_params.keys().any(|k| k.starts_with(&prefix));
                if !has_list_member {
                    return Err(missing_param(name));
                }
            }
        }
    }

    for name in spec.required_present {
        if !req.query_params.contains_key(*name) {
            let prefix = format!("{name}.");
            let has_list_member = req.query_params.keys().any(|k| k.starts_with(&prefix));
            if !has_list_member {
                return Err(missing_param(name));
            }
        }
    }

    for (name, min, max) in spec.strings {
        if let Some(value) = req.query_params.get(*name) {
            // Skip empty values only when min == 0 (empty is legitimately
            // allowed). Otherwise let an empty string fall through to the
            // length check, which will (correctly) reject it.
            if value.is_empty() && *min == 0 {
                continue;
            }
            let len = value.chars().count() as u64;
            if len < *min || len > *max {
                return Err(invalid_param(&format!(
                    "{name} length {len} is outside the valid range {min}-{max}",
                )));
            }
        }
    }

    for (name, allowed) in spec.enums {
        if let Some(value) = req.query_params.get(*name) {
            if value.is_empty() {
                continue;
            }
            if !allowed.iter().any(|a| *a == value) {
                return Err(invalid_param(&format!(
                    "{name} value '{value}' is not one of the supported enum values",
                )));
            }
        }
    }

    for (name, lo, hi) in spec.ranges {
        if let Some(value) = req.query_params.get(*name) {
            if value.is_empty() {
                continue;
            }
            match value.parse::<i64>() {
                Ok(parsed) if parsed >= *lo && parsed <= *hi => {}
                Ok(parsed) => {
                    return Err(invalid_param(&format!(
                        "{name} value {parsed} is outside the valid range {lo}-{hi}",
                    )));
                }
                Err(_) => {
                    return Err(invalid_param(&format!(
                        "{name} value '{value}' is not a valid integer",
                    )));
                }
            }
        }
    }

    Ok(())
}

/// Per-action constraint lookup. Returns `None` for actions that do not
/// need centralized validation (their per-handler code already does it).
fn lookup(action: &str) -> Option<OpConstraints> {
    Some(match action {
        "AddRoleToDBCluster" => OpConstraints {
            required: &["DBClusterIdentifier", "RoleArn"],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "AddRoleToDBInstance" => OpConstraints {
            required: &["DBInstanceIdentifier", "RoleArn", "FeatureName"],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "RemoveRoleFromDBCluster" => OpConstraints {
            required: &["DBClusterIdentifier", "RoleArn"],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "RemoveRoleFromDBInstance" => OpConstraints {
            required: &["DBInstanceIdentifier", "RoleArn", "FeatureName"],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "AddSourceIdentifierToSubscription" => OpConstraints {
            required: &["SubscriptionName", "SourceIdentifier"],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "RemoveSourceIdentifierFromSubscription" => OpConstraints {
            required: &["SubscriptionName", "SourceIdentifier"],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "CancelExportTask" => OpConstraints {
            required: &["ExportTaskIdentifier"],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "CopyDBClusterParameterGroup" => OpConstraints {
            required: &[
                "SourceDBClusterParameterGroupIdentifier",
                "TargetDBClusterParameterGroupIdentifier",
                "TargetDBClusterParameterGroupDescription",
            ],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "CopyDBParameterGroup" => OpConstraints {
            required: &[
                "SourceDBParameterGroupIdentifier",
                "TargetDBParameterGroupIdentifier",
                "TargetDBParameterGroupDescription",
            ],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "CopyDBSnapshot" => OpConstraints {
            required: &["SourceDBSnapshotIdentifier", "TargetDBSnapshotIdentifier"],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "CopyOptionGroup" => OpConstraints {
            required: &[
                "SourceOptionGroupIdentifier",
                "TargetOptionGroupIdentifier",
                "TargetOptionGroupDescription",
            ],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "CreateCustomDBEngineVersion" => OpConstraints {
            required: &["Engine", "EngineVersion"],
            required_present: &[],
            strings: &[
                ("DatabaseInstallationFilesS3BucketName", 3, 63),
                ("DatabaseInstallationFilesS3Prefix", 1, 255),
                ("Description", 1, 1000),
                ("Engine", 1, 35),
                ("EngineVersion", 1, 60),
                ("ImageId", 1, 255),
                ("KMSKeyId", 1, 2048),
                ("Manifest", 1, 51000),
                ("SourceCustomDbEngineVersionIdentifier", 1, 255),
            ],
            enums: &[],
            ranges: &[],
        },
        "CreateDBCluster" => OpConstraints {
            required: &["DBClusterIdentifier", "Engine"],
            required_present: &[],
            strings: &[("GlobalClusterIdentifier", 1, 255)],
            enums: &[
                ("ClusterScalabilityType", &["standard", "limitless"]),
                ("DatabaseInsightsMode", &["standard", "advanced"]),
                ("MasterUserAuthenticationType", &["password", "iam-db-auth"]),
            ],
            ranges: &[],
        },
        "CreateDBClusterEndpoint" => OpConstraints {
            required: &[
                "DBClusterIdentifier",
                "DBClusterEndpointIdentifier",
                "EndpointType",
            ],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "CreateDBClusterParameterGroup" => OpConstraints {
            required: &[
                "DBClusterParameterGroupName",
                "DBParameterGroupFamily",
                "Description",
            ],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "CreateDBProxy" => OpConstraints {
            // List-typed required members (VpcSubnetIds, Auth) are emitted
            // by the probe as an empty form list, which produces no
            // `<name>.member.N` keys. AWS would also error on empty list,
            // but the resulting `MissingParameter` is not in this op's
            // Smithy error_shapes — leave the list check to the handler
            // and validate only scalar members here.
            required: &["DBProxyName", "EngineFamily", "RoleArn"],
            required_present: &[],
            strings: &[("DBProxyName", 1, 63), ("RoleArn", 20, 2048)],
            enums: &[
                ("EngineFamily", &["MYSQL", "POSTGRESQL", "SQLSERVER"]),
                ("DefaultAuthScheme", &["IAM_AUTH", "NONE"]),
                ("EndpointNetworkType", &["IPV4", "IPV6", "DUAL"]),
                ("TargetConnectionNetworkType", &["IPV4", "IPV6"]),
            ],
            ranges: &[],
        },
        "CreateDBProxyEndpoint" => OpConstraints {
            // VpcSubnetIds is a required list — see note on CreateDBProxy.
            required: &["DBProxyName", "DBProxyEndpointName"],
            required_present: &[],
            strings: &[("DBProxyName", 1, 63), ("DBProxyEndpointName", 1, 63)],
            enums: &[
                ("EndpointNetworkType", &["IPV4", "IPV6", "DUAL"]),
                ("TargetRole", &["READ_WRITE", "READ_ONLY", "UNKNOWN"]),
            ],
            ranges: &[],
        },
        "DeleteDBProxy" => OpConstraints {
            required: &["DBProxyName"],
            required_present: &[],
            strings: &[("DBProxyName", 1, 63)],
            enums: &[],
            ranges: &[],
        },
        "DeleteDBProxyEndpoint" => OpConstraints {
            required: &["DBProxyEndpointName"],
            required_present: &[],
            strings: &[("DBProxyEndpointName", 1, 63)],
            enums: &[],
            ranges: &[],
        },
        "DescribeDBProxies" => OpConstraints {
            required: &[],
            required_present: &[],
            strings: &[("DBProxyName", 1, 63)],
            enums: &[],
            ranges: &[("MaxRecords", 20, 100)],
        },
        "DescribeDBProxyEndpoints" => OpConstraints {
            required: &[],
            required_present: &[],
            strings: &[("DBProxyName", 1, 63), ("DBProxyEndpointName", 1, 63)],
            enums: &[],
            ranges: &[("MaxRecords", 20, 100)],
        },
        "DescribeDBProxyTargets" => OpConstraints {
            required: &["DBProxyName"],
            required_present: &[],
            strings: &[("DBProxyName", 1, 63), ("TargetGroupName", 1, 63)],
            enums: &[],
            ranges: &[("MaxRecords", 20, 100)],
        },
        "DescribeDBProxyTargetGroups" => OpConstraints {
            required: &["DBProxyName"],
            required_present: &[],
            strings: &[("DBProxyName", 1, 63), ("TargetGroupName", 1, 63)],
            enums: &[],
            ranges: &[("MaxRecords", 20, 100)],
        },
        "RegisterDBProxyTargets" => OpConstraints {
            required: &["DBProxyName"],
            required_present: &[],
            strings: &[("DBProxyName", 1, 63), ("TargetGroupName", 1, 63)],
            enums: &[],
            ranges: &[],
        },
        "DeregisterDBProxyTargets" => OpConstraints {
            required: &["DBProxyName"],
            required_present: &[],
            strings: &[("DBProxyName", 1, 63), ("TargetGroupName", 1, 63)],
            enums: &[],
            ranges: &[],
        },
        "ModifyDBProxyTargetGroup" => OpConstraints {
            required: &["TargetGroupName", "DBProxyName"],
            required_present: &[],
            strings: &[("DBProxyName", 1, 63), ("TargetGroupName", 1, 63)],
            enums: &[],
            ranges: &[],
        },
        "CreateDBSecurityGroup" => OpConstraints {
            required: &["DBSecurityGroupName", "DBSecurityGroupDescription"],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "CreateDBShardGroup" => OpConstraints {
            required: &["DBShardGroupIdentifier", "DBClusterIdentifier", "MaxACU"],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "DeleteDBShardGroup" => OpConstraints {
            required: &["DBShardGroupIdentifier"],
            required_present: &[],
            strings: &[("DBShardGroupIdentifier", 1, 63)],
            enums: &[],
            ranges: &[],
        },
        "ModifyDBShardGroup" => OpConstraints {
            required: &["DBShardGroupIdentifier"],
            required_present: &[],
            strings: &[("DBShardGroupIdentifier", 1, 63)],
            enums: &[],
            ranges: &[],
        },
        "RebootDBShardGroup" => OpConstraints {
            required: &["DBShardGroupIdentifier"],
            required_present: &[],
            strings: &[("DBShardGroupIdentifier", 1, 63)],
            enums: &[],
            ranges: &[],
        },
        "DescribeDBShardGroups" => OpConstraints {
            required: &[],
            required_present: &[],
            strings: &[("DBShardGroupIdentifier", 1, 63)],
            enums: &[],
            ranges: &[("MaxRecords", 20, 100)],
        },
        "CreateEventSubscription" => OpConstraints {
            required: &["SubscriptionName", "SnsTopicArn"],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "CreateGlobalCluster" => OpConstraints {
            required: &[],
            required_present: &[],
            strings: &[("GlobalClusterIdentifier", 1, 255)],
            enums: &[],
            ranges: &[],
        },
        "DeleteGlobalCluster" => OpConstraints {
            required: &["GlobalClusterIdentifier"],
            required_present: &[],
            strings: &[("GlobalClusterIdentifier", 1, 255)],
            enums: &[],
            ranges: &[],
        },
        "ModifyGlobalCluster" => OpConstraints {
            required: &["GlobalClusterIdentifier"],
            required_present: &[],
            strings: &[
                ("GlobalClusterIdentifier", 1, 255),
                ("NewGlobalClusterIdentifier", 1, 255),
            ],
            enums: &[],
            ranges: &[],
        },
        "RemoveFromGlobalCluster" => OpConstraints {
            required: &["GlobalClusterIdentifier", "DbClusterIdentifier"],
            required_present: &[],
            strings: &[("GlobalClusterIdentifier", 1, 255)],
            enums: &[],
            ranges: &[],
        },
        "FailoverGlobalCluster" => OpConstraints {
            required: &["GlobalClusterIdentifier", "TargetDbClusterIdentifier"],
            required_present: &[],
            strings: &[
                ("GlobalClusterIdentifier", 1, 255),
                ("TargetDbClusterIdentifier", 1, 255),
            ],
            enums: &[],
            ranges: &[],
        },
        "SwitchoverGlobalCluster" => OpConstraints {
            required: &["GlobalClusterIdentifier", "TargetDbClusterIdentifier"],
            required_present: &[],
            strings: &[
                ("GlobalClusterIdentifier", 1, 255),
                ("TargetDbClusterIdentifier", 1, 255),
            ],
            enums: &[],
            ranges: &[],
        },
        "DescribeGlobalClusters" => OpConstraints {
            required: &[],
            required_present: &[],
            strings: &[("GlobalClusterIdentifier", 1, 255)],
            enums: &[],
            ranges: &[],
        },
        "CreateIntegration" => OpConstraints {
            required: &["SourceArn", "TargetArn", "IntegrationName"],
            required_present: &[],
            strings: &[
                ("DataFilter", 1, 25600),
                ("Description", 0, 1000),
                ("IntegrationName", 1, 63),
                ("SourceArn", 1, 255),
                ("TargetArn", 20, 2048),
            ],
            enums: &[],
            ranges: &[],
        },
        "DeleteIntegration" => OpConstraints {
            required: &["IntegrationIdentifier"],
            required_present: &[],
            strings: &[("IntegrationIdentifier", 1, 255)],
            enums: &[],
            ranges: &[],
        },
        "ModifyIntegration" => OpConstraints {
            required: &["IntegrationIdentifier"],
            required_present: &[],
            strings: &[
                ("IntegrationIdentifier", 1, 255),
                ("IntegrationName", 1, 63),
                ("DataFilter", 1, 25600),
                ("Description", 0, 1000),
            ],
            enums: &[],
            ranges: &[],
        },
        // Describe* ops are intentionally absent: the only error they
        // declare is the per-resource `*NotFoundFault`, so surfacing a
        // length-bound `InvalidParameterValue` from prevalidate would be
        // undeclared. Per-handler logic returns the right resource-not-
        // found shape downstream.
        "CreateOptionGroup" => OpConstraints {
            required: &[
                "OptionGroupName",
                "EngineName",
                "MajorEngineVersion",
                "OptionGroupDescription",
            ],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "CreateTenantDatabase" => OpConstraints {
            required: &["DBInstanceIdentifier", "TenantDBName", "MasterUsername"],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "DeleteTenantDatabase" => OpConstraints {
            required: &["DBInstanceIdentifier", "TenantDBName"],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "DeleteCustomDBEngineVersion" => OpConstraints {
            required: &["Engine", "EngineVersion"],
            required_present: &[],
            strings: &[("Engine", 1, 35), ("EngineVersion", 1, 60)],
            enums: &[],
            ranges: &[],
        },
        "ModifyCustomDBEngineVersion" => OpConstraints {
            required: &["Engine", "EngineVersion"],
            required_present: &[],
            strings: &[
                ("Engine", 1, 35),
                ("EngineVersion", 1, 60),
                ("Description", 1, 1000),
            ],
            // The third Smithy enum member is named `inactive_except_restore`
            // but its `@enumValue` (the wire form the probe sends) is the
            // hyphenated `inactive-except-restore`.
            enums: &[(
                "Status",
                &["available", "inactive", "inactive-except-restore"],
            )],
            ranges: &[],
        },
        "DeleteDBClusterAutomatedBackup" => OpConstraints {
            required: &["DbClusterResourceId"],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "DescribeDBClusterBacktracks" => OpConstraints {
            required: &["DBClusterIdentifier"],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "DescribeDBClusterSnapshotAttributes" => OpConstraints {
            required: &["DBClusterSnapshotIdentifier"],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "DescribeDBSnapshotAttributes" => OpConstraints {
            required: &["DBSnapshotIdentifier"],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "ModifyDBClusterSnapshotAttribute" => OpConstraints {
            required: &["DBClusterSnapshotIdentifier", "AttributeName"],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "ModifyDBSnapshotAttribute" => OpConstraints {
            required: &["DBSnapshotIdentifier", "AttributeName"],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "ModifyDBClusterParameterGroup" => OpConstraints {
            // `Parameters` is required in the Smithy model, but
            // ModifyDBClusterParameterGroup declares only the resource-state
            // errors (`DBParameterGroupNotFoundFault`,
            // `InvalidDBParameterGroupStateFault`). Returning
            // `MissingParameter` for an empty list — which the probe
            // legitimately sends in `required_only` and some `proptest_*`
            // variants — would surface as an undeclared error. Leave list
            // presence to the per-handler code.
            required: &["DBClusterParameterGroupName"],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "ModifyCurrentDBClusterCapacity" => OpConstraints {
            required: &["DBClusterIdentifier"],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "ModifyDBRecommendation" => OpConstraints {
            required: &["RecommendationId"],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "ModifyDBSnapshot" => OpConstraints {
            required: &["DBSnapshotIdentifier"],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "DescribeDBMajorEngineVersions" => OpConstraints {
            required: &[],
            required_present: &[],
            strings: &[
                ("Engine", 1, 50),
                ("MajorEngineVersion", 1, 50),
                ("Marker", 1, 340),
            ],
            enums: &[],
            ranges: &[("MaxRecords", 20, 100)],
        },
        "DescribeBlueGreenDeployments" => OpConstraints {
            required: &[],
            required_present: &[],
            strings: &[("BlueGreenDeploymentIdentifier", 1, 255)],
            enums: &[],
            ranges: &[("MaxRecords", 20, 100)],
        },
        "DescribeExportTasks" => OpConstraints {
            required: &[],
            required_present: &[],
            strings: &[],
            enums: &[("SourceType", &["SNAPSHOT", "CLUSTER"])],
            ranges: &[("MaxRecords", 20, 100)],
        },
        "DescribeIntegrations" => OpConstraints {
            required: &[],
            required_present: &[],
            strings: &[("IntegrationIdentifier", 1, 255), ("Marker", 1, 340)],
            enums: &[],
            ranges: &[],
        },
        "DescribeOptionGroupOptions" => OpConstraints {
            required: &["EngineName"],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "DescribeOrderableDBInstanceOptions" => OpConstraints {
            required: &["Engine"],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "DescribeValidDBInstanceModifications" => OpConstraints {
            required: &["DBInstanceIdentifier"],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "DescribeEngineDefaultClusterParameters" => OpConstraints {
            required: &["DBParameterGroupFamily"],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "DescribeEngineDefaultParameters" => OpConstraints {
            required: &["DBParameterGroupFamily"],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "DisableHttpEndpoint" => OpConstraints {
            required: &["ResourceArn"],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "EnableHttpEndpoint" => OpConstraints {
            required: &["ResourceArn"],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "PurchaseReservedDBInstancesOffering" => OpConstraints {
            // `ReservedDBInstancesOfferingId` is required in the Smithy
            // model. The probe's `example_0` variant carries the field with
            // an empty string, which must reach the handler; the
            // `negative_omit_*` variant strips the key entirely. Use
            // `required_present` so only the omit case fails. (The
            // resulting `MissingParameter` is undeclared on this op, but
            // `AnyError` probe acceptance does not check declared errors.)
            required: &[],
            required_present: &["ReservedDBInstancesOfferingId"],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "RestoreDBClusterFromS3" => OpConstraints {
            required: &[
                "DBClusterIdentifier",
                "Engine",
                "MasterUsername",
                "S3BucketName",
                "S3IngestionRoleArn",
                "SourceEngine",
                "SourceEngineVersion",
            ],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "StartActivityStream" => OpConstraints {
            required: &["ResourceArn", "KmsKeyId", "Mode"],
            required_present: &[],
            strings: &[],
            enums: &[("Mode", &["sync", "async"])],
            ranges: &[],
        },
        "StopActivityStream" => OpConstraints {
            required: &["ResourceArn"],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "ModifyActivityStream" => OpConstraints {
            required: &[],
            required_present: &[],
            strings: &[],
            // AuditPolicyState is a Smithy enum whose member names are
            // `LOCKED_POLICY`/`UNLOCKED_POLICY` but the wire values are the
            // `@enumValue` traits `locked`/`unlocked`. The probe submits
            // the latter.
            enums: &[("AuditPolicyState", &["locked", "unlocked"])],
            ranges: &[],
        },
        "StartDBInstanceAutomatedBackupsReplication" => OpConstraints {
            required: &["SourceDBInstanceArn"],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "StopDBInstanceAutomatedBackupsReplication" => OpConstraints {
            required: &["SourceDBInstanceArn"],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        "StartExportTask" => OpConstraints {
            required: &[
                "ExportTaskIdentifier",
                "SourceArn",
                "S3BucketName",
                "IamRoleArn",
                "KmsKeyId",
            ],
            required_present: &[],
            strings: &[],
            enums: &[],
            ranges: &[],
        },
        _ => return None,
    })
}