feat(marketplace-discovery): emulate AWS Marketplace Discovery API

[KenkoGeek]

Summary

Adds AWS Marketplace Discovery API emulation as an independent Marketplace API-family contribution. Includes the 2026-02-05 REST surface, listing/product/offer/search operations, regional validation, integration coverage, docs, and an AWS SDK compatibility smoke test. Discovery reads the shared Marketplace entity backend without depending on the Catalog controller/service implementation.

This is one of the API-family splits of the previous combined Marketplace contribution (#3303).

Type of change

• Bug fix (fix:)
• New feature (feat:)
• Breaking change (feat!: or fix!:)
• Docs / chore

AWS Compatibility

Reviewed against the current AWS Marketplace Discovery API reference, including the 2026-02-05 API version, supported regions, search constraints, and pagination. Senior review removed direct Catalog-service coupling while preserving shared state interoperability. make docs-check and git diff --check pass. Heavy local Maven execution was intentionally not run on this machine; CI is expected to execute the full test suite.

Checklist

• ./mvnw test passes locally
• New or updated integration test added
• Commit messages follow Conventional Commits

[greptile-apps]

Greptile Summary

Adds AWS Marketplace Discovery REST API emulation backed by shared Marketplace entity storage.

• Registers nine Discovery operations under the 2026-02-05 API surface.
• Implements listing, product, offer, purchase-option, facet, sorting, filtering, and pagination behavior.
• Adds service, integration, and AWS SDK compatibility coverage.
• Updates Marketplace documentation and generated-service registration.

Confidence Score: 4/5

The PR is not yet safe to merge because free-text searches can return listings based solely on internal facet metadata that is absent from the response.

SearchListings and SearchFacets match searchText after adding hidden deployment and product-count metadata to the serialized listing summary, producing false-positive results for terms found only in those internal fields. All previous findings were resolved and are not outstanding.

Files Needing Attention: src/main/java/io/github/hectorvent/floci/services/marketplace/MarketplaceDiscoveryService.java

Important Files Changed

Filename	Overview
src/main/java/io/github/hectorvent/floci/services/marketplace/MarketplaceDiscoveryService.java	Implements Discovery behavior and fixes earlier offer-term, sorting, facet, reset, and testing issues, but includes hidden facet metadata in free-text matching.
src/main/java/io/github/hectorvent/floci/services/marketplace/MarketplaceDiscoveryController.java	Exposes the Discovery REST routes with strict JSON parsing and region propagation.
src/main/java/io/github/hectorvent/floci/core/common/ResolvedServiceCatalog.java	Registers the Discovery controller with the shared AWS Marketplace service descriptor.
src/test/java/io/github/hectorvent/floci/services/marketplace/MarketplaceDiscoveryServiceTest.java	Adds focused coverage for prior findings, limits, response-field hygiene, and reset behavior, but does not cover free-text matching against hidden metadata.
src/test/java/io/github/hectorvent/floci/services/marketplace/MarketplaceDiscoveryIntegrationTest.java	Verifies shared Marketplace storage discovery and unsupported-region rejection through REST.
compatibility-tests/sdk-test-java/src/test/java/com/floci/test/MarketplaceDiscoveryTest.java	Adds an AWS SDK wire-contract smoke test for SearchListings.

Sequence Diagram

sequenceDiagram
    participant SDK as AWS SDK Client
    participant Controller as MarketplaceDiscoveryController
    participant Service as MarketplaceDiscoveryService
    participant Storage as Shared Marketplace Storage

    SDK->>Controller: "POST /2026-02-05/{operation}"
    Controller->>Controller: Parse JSON and resolve region
    Controller->>Service: Execute Discovery operation
    Service->>Service: Validate request and region
    Service->>Storage: Scan Marketplace entities
    Storage-->>Service: Products, offers, and offer sets
    Service->>Service: Filter, sort, facet, and paginate
    Service-->>Controller: AWS-shaped JSON response
    Controller-->>SDK: HTTP 200 or AWS error

Loading

_{Reviews (11): Last reviewed commit: "feat(marketplace-discovery): emulate AWS..." | Re-trigger Greptile}

[github-actions]

🎉 Thanks for your first pull request to Floci!

Your CI checks need a maintainer to approve them before they run. That is GitHub's standard gate on first-time contributors, not a problem with your PR — so if the checks look like they are doing nothing, that is why. Once a maintainer approves, CI and the compatibility suite start automatically. Nothing is needed from you in the meantime.

While you wait, a couple of things that make review faster:

• Link the issue this fixes with Closes #N in the description
• Commits follow Conventional Commits (feat(s3): ..., fix(dynamodb): ...)
• Behaviour changes come with a test — see CONTRIBUTING.md

Come join us in Slack — it is the fastest way to reach maintainers if you get stuck, or want feedback on an approach before investing more time in it.

[github-actions]

👋 Thanks for the pull request!

It looks like you now have 10 open pull requests in this repository, which is above our advisory limit of 5. To keep the review backlog focused and make sure every contribution gets proper attention, we ask contributors to shepherd their existing PRs to the finish line before opening new ones — responding to review feedback, rebasing, or closing any that are no longer needed.

Here is your list of open PRs. Nothing is blocked and this PR stays open — this is just a friendly nudge. The over-pr-limit label helps maintainers see at a glance which PRs to prioritize.

If some of these PRs are stacked or intentionally related, just say so here and a maintainer will take that into account.

[pgermosen]

This needs a rebase, same shared-file collision as the rest of the Marketplace family: ResolvedServiceCatalog.java's descriptor here still assumes just MarketplaceCatalogController, which predates the Agreement/Entitlement splits already on main.

Beyond that, I checked this against the real Discovery API (2026-02-05, a live current AWS service) in some depth. The API paths, the region restriction (us-east-1/us-west-2/eu-west-1), GetProduct's full response shape, and the SearchListings/SearchFacets validation all match the docs exactly, and I confirmed the claim that Discovery reads the shared Marketplace entity backend rather than a private copy, that's genuinely true, not just asserted in the description.

Two things worth fixing before merge, both are real AWS-documented limits that aren't enforced here: SearchFilter.filterValues has a documented max of 30 items, but only non-emptiness is checked, so 31+ values would go through where AWS would reject them. Same shape on ListPurchaseOptions, the outer filters array has a documented 1-10 item bound that's never checked at all, only that a PRODUCT_ID or VISIBILITY_SCOPE filter exists somewhere in it.

Smaller things I noticed but wouldn't block on: SearchFacets doesn't implement pagination even though AWS documents it as paginated, listingSummary() leaks two fields (deployedOnAws, numberOfProducts) that aren't part of the documented ListingSummary shape (harmless since SDKs ignore unknown fields, but worth cleaning up), individual filter values aren't validated for length/pattern, and the new doc table rows all show a - placeholder description instead of real text. Also, several methods here are written as long single-line bodies (getOfferSet, matchesPurchase, etc.) that are noticeably denser and harder to review than the rest of this codebase, might be worth reformatting.

[KenkoGeek]

Addressed the review on the current head and rebased onto current main. Discovery now enforces SearchFilter.filterValues at 1-30, ListPurchaseOptions.filters at 1-10, validates individual filter value length/patterns, paginates SearchFacets via nextToken, removes the undocumented deployedOnAws/numberOfProducts fields from public ListingSummary responses while retaining them internally for facets/filtering, adds real action descriptions to the generated docs table, and reformats the dense methods called out in review. Added regression coverage for the documented limits and response shape. Focused tests, docs-check, diff-check, and AWS SDK Java compile all pass.

[KenkoGeek]

Addressed the new Greptile P1 on the current head: searchText now evaluates only the buyer-visible ListingSummary before facet-only metadata is added. DEPLOYED_ON_AWS and NUMBER_OF_PRODUCTS metadata remain available for documented filtering/faceting but no longer create hidden-field text matches. Added regression coverage; focused tests, docs-check, diff-check, and AWS SDK Java compile pass.