{
  "id": "dedicated-password",
  "name": "Generate a Dedicated root password",
  "risk": "mutating",
  "start": { "path": "/tidbs/{{dedicatedClusterId}}/overview" },
  "initialization": [
    "This cluster may already have a root password from an earlier validation run. That is a valid starting state; rotate it once without relying on or exposing the previous value."
  ],
  "goal": [
    "From the verified {{clusterName}} Overview page, open the cluster operation dropdown menu and choose Password Settings. Use Auto-generate Password and save exactly once, whether or not an earlier run already set a password. After the successful save, wait for Done, click Done, and verify the Set Root Password dialog closes."
  ],
  "success": {
    "beforeEvidence": [{ "kind": "roleVisible", "role": "button", "name": "Done" }],
    "evidence": [
      { "kind": "url", "matches": "/(?:tidbs|clusters)/[^/]+/overview(?:[/?]|$)" },
      { "kind": "roleAbsent", "role": "dialog", "name": "Set Root Password" }
    ]
  },
  "limits": { "maxDurationMs": 180000, "maxActions": 16 },
  "safety": {
    "deny": ["Do not type a chosen password, expose the generated value, or change any other cluster setting."],
    "networkGuards": [
      {
        "id": "dedicated-reset-root-password",
        "method": "PUT",
        "pathMatches": "^/api/v1/orgs/[^/]+/projects/[^/]+/clusters/{{dedicatedClusterId}}/password$",
        "resourceIdentity": {
          "requestPathMatches": "^/api/v1/orgs/[^/]+/projects/[^/]+/clusters/([^/]+)/password$",
          "capturedVariable": "dedicatedClusterId"
        },
        "bodyMatches": { "password": ".+" },
        "maxRequests": 1,
        "required": true
      }
    ]
  }
}