Enhance add-access-rule command UX with intuitive name-based flags

[rkoster]

Summary

This PR enhances the user experience of the access-rules commands by providing intuitive name-based flags and aligning with recent RFC updates that removed rule names.

Related to: cloudfoundry/community#1438

Motivation

The original add-access-rule command required users to manually construct GUID-based selectors (e.g., cf:app:d76446a1-f429-4444-8797-be2f78b75b08), which was cumbersome and error-prone. This PR follows CF CLI conventions from commands like add-network-policy to provide a more user-friendly interface.

Additionally, per RFC commits 882b69a and 11752f2, access rules no longer have user-provided names. They are now identified by their selector only, with labels/annotations used for metadata instead.

Changes

RFC Alignment: Removed Rule Names

Key Changes:

• Removed RULE_NAME positional argument from add-access-rule command
• Removed Name field from AccessRule API resource
• Updated access-rules list command to show 4 columns: route, selector, scope, source
  • The source column shows the resolved name of the app/space/org from the selector
• Updated remove-access-rule to use --selector flag instead of rule name
• Renamed DeleteAccessRule() to DeleteAccessRuleBySelector()

Command Interface Improvements

Before:

cf add-access-rule RULE_NAME DOMAIN SELECTOR --hostname HOST
cf remove-access-rule RULE_NAME DOMAIN --hostname HOST

After:

# add-access-rule examples
cf add-access-rule apps.identity --source-app frontend-app --hostname backend
cf add-access-rule apps.identity --source-space monitoring --hostname api
cf add-access-rule apps.identity --source-org platform --hostname shared-api
cf add-access-rule apps.identity --source-any --hostname public-api

# Cross-space/org access
cf add-access-rule apps.identity --source-app client --source-space prod-space --source-org prod-org --hostname api

# Advanced: raw selector still supported
cf add-access-rule apps.identity --selector cf:app:GUID --hostname backend

# remove-access-rule
cf remove-access-rule apps.identity --selector cf:app:GUID --hostname backend

New Flags

add-access-rule:

• --source-app APP_NAME - Specify source app by name (resolves to GUID)
• --source-space SPACE_NAME - Specify space context for app lookup or create space-level rule
• --source-org ORG_NAME - Specify org context for space/app lookup or create org-level rule
• --source-any - Allow any authenticated app
• --selector SELECTOR - Raw GUID-based selector for advanced users

remove-access-rule:

• --selector SELECTOR - Required. Specify the selector to remove

Terminology Update

• Renamed all "target" terminology to "source" throughout codebase
• Access rules specify the source (who can access), not the target
• Updated AccessRuleWithRoute.TargetName → SourceName
• Updated resolveAccessRuleTarget() → resolveAccessRuleSource()
• Updated access-rules list command table header: "target" → "source"

Enhanced Output

add-access-rule:

Adding access rule for route backend.apps.identity as admin...
  scope: app, source: frontend-app
  selector: cf:app:d76446a1-f429-4444-8797-be2f78b75b08
OK

access-rules:

route                            selector                                       scope   source
backend.apps.identity            cf:app:d76446a1-f429-4444-8797-be2f78b75b08    app     frontend-app
api.apps.identity/metrics        cf:space:2b26e210-1b48-4e60-8432-f24bc5927789  space   monitoring
public-api.apps.identity         cf:any                                         any     

Validation & Error Handling

• Validates exactly one primary source is specified
• Provides helpful error messages when app not found in current space
• Suggests using --source-space and --source-org flags for cross-space/org access
• Follows CF CLI patterns from add-network-policy command

Domain Integration

• Added --enforce-access-rules and --access-rules-scope flags to create-shared-domain and create-private-domain commands
• Updated domain resource with new fields

Testing

• ✅ 17 comprehensive test cases for add-access-rule command
• ✅ Updated actor tests to remove Name field references
• ✅ All tests passing
• ✅ Covers validation, resolution, error handling, and cross-space/org scenarios

Breaking Changes

• Removed RULE_NAME positional argument from add-access-rule command
• Removed Name field from AccessRule API resource
• Updated remove-access-rule to require --selector flag instead of rule name
• These are acceptable breaking changes since the access rules feature has not been released yet

Checklist

• Tests added/updated and passing
• Documentation (help text) updated
• Breaking changes documented
• Follows CF CLI conventions
• Aligned with RFC updates (removed rule names)
• Manual testing against live CF deployment (requires CAPI backend support)

Next Steps

This PR is marked as draft pending:

1. Manual testing against a CF deployment with access rules API support
2. Integration testing with full CF ecosystem
3. Review from CF CLI maintainers

[rkoster]

Don't worry about this PR just yet, just doing some more POC work on the RFC: cloudfoundry/community#1438