Flatten suppressable request structs into public data bags

[zheylmun]

Summary

Follow-up to the no_std landing. The ported request/response types were split between two visibility styles; this applies our field-visibility convention — encapsulate only invariant-bearing structs, otherwise a public data bag — consistently across the services, and closes a SPRMIB-collision footgun at construction time.

What changed

Flattened to public data bags

Private SuppressablePositiveResponse<T> field + getters → public suppress_positive_response: bool + value field(s), getters removed:
EcuResetRequest, DiagnosticSessionControlRequest, ControlDTCSettingsRequest, RoutineControlRequest, SecurityAccessRequest, TesterPresentRequest, plus the non-invariant responses RoutineControlResponse and RequestTransferExit{Request,Response}.

SPRMIB packing moved to the wire boundary

SuppressablePositiveResponse<T> stays pub(crate) and is now constructed transiently inside encode/decode only. The generic wrapper never appears in the public API.

Reserved sub-function variants locked against SPRMIB collision

The open-ended (u8) variants in reserved ranges (ResetType, DiagnosticSessionType, CommunicationControlType, and the reserved arms of SecurityAccessType) are marked #[non_exhaustive], so callers must build them via the range-checked TryFrom<u8>. A value ≥ 0x80 that would collide with the SPRMIB bit is now unconstructable, rather than something to catch at encode time.

SecurityAccessLevel newtype

SecurityAccessType::RequestSeed/SendKey are user-facing (kept directly constructible), so locking them wasn't an option — instead they now carry a SecurityAccessLevel newtype (private u8 + validated new rejecting ≥ 0x80). This was the last SPRMIB-exposed enum with an unlocked user-facing variant; the colliding value is now unrepresentable. Const construction uses a const-match unwrap since new is fallible.

Deliberate decisions

• CommunicationControlRequest stays encapsulated. node_id must be Some iff control_type is an enhanced-address variant — a genuine cross-field invariant — so it keeps private fields + fallible constructors. Its reserved CommunicationControlType variants are still locked.
• RequestDownloadRequest stays encapsulated. The address/length format identifier must track the memory address/size widths (cross-field invariant) + fallible new.
• ReadDataByIdentifierRequest stays encapsulated. Its field is a private Dids representation (native &[u16] vs borrowed wire bytes); exposing it would leak that abstraction, so the dids() iterator remains the accessor.
• TesterPresentRequest is now { suppress_positive_response }. Its sub-function enum is private, so a non-zero (reserved) sub-function byte still decodes but normalizes to the zero sub-function on re-encode (previously preserved). Per ISO 14229 the sub-function is always 0x00, so this is a deliberate, minor behavior change.

Review feedback addressed

• SecurityAccess SPRMIB collision (RequestSeed/SendKey could hold ≥ 0x80): fixed via the SecurityAccessLevel newtype above. Audited the rest of the baseline — of the six SuppressablePositiveResponse-wrapped enums this was the only remaining unlocked case; other raw-int enum variants (DIDs, NRCs, DTC numbers) span the full valid integer range and steal no bit, so carry no comparable invariant.
• TesterPresent decode comment reworded — after SPRMIB masking the low 7 bits are always a valid zero sub-function, so the parse never rejects.
• Intra-doc-link warnings on Type::try_from links: verified not an issue — cargo doc --all-features with -D rustdoc::broken_intra_doc_links builds clean; the links resolve to the unambiguous TryFrom<u8> impl.

Test plan

• cargo test — 143 + 3 + doctests pass
• cargo build --all-features and cargo build --no-default-features (no_std) both clean
• cargo clippy --all-targets --all-features clean
• cargo doc --all-features clean with -D rustdoc::broken_intra_doc_links

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR standardizes the public API for “suppressable” UDS request types by flattening previously-encapsulated SPRMIB wrappers into public request fields, while keeping SPRMIB bit packing/unpacking at the encode/decode boundary. It also tightens construction of reserved sub-function values to prevent callers from constructing bytes that would collide with the SPRMIB bit.

Changes:

• Flattened several request structs into public “data bag” fields (suppress_positive_response + sub-function/value fields) and removed now-redundant getters.
• Moved SuppressablePositiveResponse<T> construction to encode/decode only (wire-boundary packing).
• Marked reserved-range enum variants as #[non_exhaustive] to force range-checked construction via TryFrom<u8>.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/services/tester_present.rs	Flattens request into a single public suppression flag and normalizes reserved sub-function bytes on re-encode.
src/services/security_access.rs	Flattens request fields and shifts SPRMIB packing to encode/decode; adds #[non_exhaustive] on reserved variants.
src/services/routine_control.rs	Flattens request fields and shifts SPRMIB packing to encode/decode.
src/services/ecu_reset.rs	Flattens request fields, shifts SPRMIB packing to encode/decode, and locks reserved variants.
src/services/diagnostic_session_control.rs	Flattens request fields, shifts SPRMIB packing to encode/decode, and locks reserved variants.
src/services/control_dtc_settings.rs	Flattens request fields and shifts SPRMIB packing to encode/decode.
src/services/communication_control.rs	Locks reserved control-type variants via #[non_exhaustive] (keeps request encapsulated).
src/request.rs	Updates suppression detection to read new public fields for flattened request variants.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 10 changed files in this pull request and generated 11 comments.