feat: deliver authenticated task APIs, SDK and P1 regression

sdk/go/client.go

@@ -12,12 +12,15 @@ import (
 	"time"
 )
 
-// Options currently configures bootstrap health calls. Task, Worker and workflow
-// clients will be added alongside their corresponding server endpoints.
-type Options struct{ HTTPClient *http.Client }
+// Options 配置传输与命名空间凭据；健康查询不使用凭据。
+type Options struct {
+	HTTPClient *http.Client
+	Token      string
+}
 type Client struct {
 	baseURL string
 	http    *http.Client
+	token   string
 }
 type Health struct {
 	Status string `json:"status"`
@@ -34,6 +37,9 @@ func NewClient(baseURL string, opts Options) (*Client, error) {
 	if err != nil || u == nil || u.Host == "" || (u.Scheme != "http" && u.Scheme != "https") || u.User != nil || u.RawQuery != "" || u.Fragment != "" {
 		return nil, errors.New("Orbit base URL must be absolute HTTP(S), without credentials, query or fragment")
 	}
+	if len(opts.Token) > 1024 || strings.ContainsAny(opts.Token, " \t\r\n") {
+		return nil, errors.New("invalid Orbit token")
+	}
 	client := opts.HTTPClient
 	if client == nil {
 		client = &http.Client{Timeout: 10 * time.Second}
@@ -41,7 +47,7 @@ func NewClient(baseURL string, opts Options) (*Client, error) {
 	clone := *client
 	// Do not silently forward requests to another origin through redirects.
 	clone.CheckRedirect = func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }
-	return &Client{baseURL: strings.TrimRight(u.String(), "/"), http: &clone}, nil
+	return &Client{baseURL: strings.TrimRight(u.String(), "/"), http: &clone, token: opts.Token}, nil
 }
 func (c *Client) Liveness(ctx context.Context) (Health, error) { return c.health(ctx, "/health/live") }
 func (c *Client) Readiness(ctx context.Context) (Health, error) {