No OpenAPI coverage for POST /api/identity/users/notify/feedback (its /notify/comment sibling is covered)

[leecalcote]

Problem

Meshery Cloud serves POST /api/identity/users/notify/feedback, but no construct declares it. Its immediate sibling on the same router line - POST /api/identity/users/notify/comment (notifyMentionUsers) - is covered, in schemas/constructs/v1beta2/user/api.yml. The two were added together and only one was modelled.

// meshery-cloud server/router/router.go
authedAPI.POST("/identity/users/notify/comment",  echo.WrapHandler(http.HandlerFunc(s.h.HandleNotifyMentionUsers)))       // covered
authedAPI.POST("/identity/users/notify/feedback", echo.WrapHandler(http.HandlerFunc(s.h.HandleFeedbackFormSubmission)))   // not covered

The shape is already pinned down

The provider's decode target is small, fully concrete, and has hard validation:

// meshery-cloud server/handlers/users.go
type FeedbackRequestBody struct {
	Message      string                 `json:"message"`
	Scope        string                 `json:"scope"`
	PageLocation string                 `json:"pageLocation"`
	Metadata     map[string]interface{} `json:"metadata"`
}

if message == "" || scope == "" || pageLocation == "" {
	http.Error(res, "Required properties 'message', 'scope' and 'page location' cannot be empty", http.StatusBadRequest)
	return
}

So message, scope and pageLocation are required, and the responses are 200 / 400 / 500.

Impact

Found during a schema-consumer audit of Kanvas (layer5labs/meshery-extensions). Every other Cloud-bound call in the audited surface either repointed to a canonical operation or has a filed defect; this one has nowhere to point, so ui/src/rtk-query/feedback.js keeps a hand-declared endpoint and ui/src/components/common/feedback.tsx a hand-declared body.

That hand-declared body is exactly the failure mode coverage prevents: it previously spelled the field page_location, which encoding/json never bound to PageLocation, so pageLocation stayed empty and every Kanvas feedback submission was rejected with 400. It was fixed by reading the Go struct - which is the job the schema should be doing.

Ask

Add the operation to the user construct alongside notifyMentionUsers:

/api/identity/users/notify/feedback:
  post:
    x-internal: ["cloud"]
    tags: [users]
    operationId: notifyUserFeedback
    summary: Submit user feedback
    requestBody:
      required: true
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/FeedbackRequestBody'
    responses:
      '200': { description: Feedback received }
      '400': { $ref: '#/components/responses/400' }
      '401': { $ref: '#/components/responses/401' }
      '500': { $ref: '#/components/responses/500' }

with FeedbackRequestBody requiring message, scope and pageLocation, and metadata as an open object. Kanvas will delete its local endpoint and body type in the same release.