committee 5.6.2 → 5.6.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6f5e2c05d7caa0327f1f9aab8eb4e70fde475df991c89d2969cf1e64fbaf2ab4
-  data.tar.gz: b8e55ce938ae8276b2469cef2a5f451b326fcbd94ab10a0957a0c8908307707d
+  metadata.gz: 59078886ccd7f7a330d9249a0804394504f31e4db513a71f1b0226c4445c5873
+  data.tar.gz: 1029ac7aa696d256bf8c9e588c24aa4c39e2a8ac906481a78d89f6d9490a5222
 SHA512:
-  metadata.gz: 48819e9df56d4ad78afc3e4ccd6992eba3570a3e3ec39570354b8ab3777e73d4ef75f5554cfb2e3bf173b91d645c0015173c465e64712f87d4ef22ad02738b7e
-  data.tar.gz: f3e72af3ca96804db1b07f0b28002367bee84d6557f1725c0244fee839757a940c7aa89e6373952559109c273f5ec721759be89d8f98517234bd3d00bdba17ce
+  metadata.gz: ce35b10aa816fd3514674a710e2ac6b71164bb00a483de716efa66bc5a3fef64e1c566e9535372fd3971c0ec00989cc95b746cdd04892344f375e181b7c35e05
+  data.tar.gz: 7f4adcf8fd1e0c8113b49b9f09f67425219f796f8ea4f34f2e94704b23d7b9e2c932fce33d9d40f261b1b1183b441fce527871940adacb7d26643d78cf615c7d

data/lib/committee/drivers/open_api_3/driver.rb

@@ -8,7 +8,8 @@ module Committee
           true
         end
 
-        # Whether parameters that were form-encoded will be coerced by default.
+        # Historically named for form params, but in OpenAPI 3 this flag controls
+        # request body coercion more generally.
         def default_coerce_form_params
           true
         end

data/lib/committee/middleware/options/response_validation.rb

@@ -10,9 +10,10 @@ module Committee
         attr_reader :parse_response_by_content_type
         attr_reader :coerce_response_values
         attr_reader :streaming_content_parsers
+        attr_reader :strict_response_content_type
 
         # Default values
-        DEFAULTS = { strict: false, validate_success_only: true, parse_response_by_content_type: true, coerce_response_values: false }.freeze
+        DEFAULTS = { strict: false, validate_success_only: true, parse_response_by_content_type: true, coerce_response_values: false, strict_response_content_type: false }.freeze
 
         def initialize(options = {})
           super(options)
@@ -22,6 +23,7 @@ module Committee
           @validate_success_only = options.fetch(:validate_success_only, DEFAULTS[:validate_success_only])
           @parse_response_by_content_type = options.fetch(:parse_response_by_content_type, DEFAULTS[:parse_response_by_content_type])
           @coerce_response_values = options.fetch(:coerce_response_values, DEFAULTS[:coerce_response_values])
+          @strict_response_content_type = options.fetch(:strict_response_content_type, DEFAULTS[:strict_response_content_type])
 
           # Streaming
           @streaming_content_parsers = options[:streaming_content_parsers] || {}
@@ -38,7 +40,7 @@ module Committee
         end
 
         def build_hash
-          super.merge(strict: @strict, validate_success_only: @validate_success_only, parse_response_by_content_type: @parse_response_by_content_type, coerce_response_values: @coerce_response_values, streaming_content_parsers: @streaming_content_parsers)
+          super.merge(strict: @strict, validate_success_only: @validate_success_only, parse_response_by_content_type: @parse_response_by_content_type, coerce_response_values: @coerce_response_values, streaming_content_parsers: @streaming_content_parsers, strict_response_content_type: @strict_response_content_type)
         end
       end
     end

data/lib/committee/middleware/response_validation.rb

@@ -28,8 +28,19 @@ module Committee
             end
           end
         else
+          validator = response_validator(request, status)
+          if validator
+            original_response = response
+            response = []
+            begin
+              original_response.each { |chunk| response << chunk }
+            ensure
+              original_response.close if original_response.respond_to?(:close)
+            end
+          end
+
           begin
-            validate(request, status, headers, response)
+            validator&.response_validate(status, headers, response, @strict)
           rescue Committee::InvalidResponse
             handle_exception($!, request.env)
 
@@ -68,10 +79,12 @@ module Committee
       end
 
       def validate(request, status, headers, response, streaming_content_parser = nil)
-        v = build_schema_validator(request)
-        if v.link_exist? && self.class.validate?(status, validate_success_only)
-          v.response_validate(status, headers, response, @strict, streaming_content_parser)
-        end
+        response_validator(request, status)&.response_validate(status, headers, response, @strict, streaming_content_parser)
+      end
+
+      def response_validator(request, status)
+        validator = build_schema_validator(request)
+        validator if validator.link_exist? && self.class.validate?(status, validate_success_only)
       end
 
       def retrieve_streaming_content_parser(headers)

data/lib/committee/schema_validator/hyper_schema/response_validator.rb

@@ -15,7 +15,7 @@ module Committee
           @validators = {}
           if link.is_a? Drivers::OpenAPI2::Link
             link.target_schemas.each do |status, schema|
-              @validators[status] = JsonSchema::Validator.new(target_schema(link))
+              @validators[status] = JsonSchema::Validator.new(schema)
             end
           else
             @validator = JsonSchema::Validator.new(target_schema(link))

data/lib/committee/schema_validator/hyper_schema.rb

@@ -31,7 +31,7 @@ module Committee
         elsif !full_body.empty?
           parse_to_json = if validator_option.parse_response_by_content_type
                             content_type_key = headers.keys.detect { |k| k.casecmp?('Content-Type') }
-            headers.fetch(content_type_key, nil)&.start_with?('application/json')
+                            Committee::SchemaValidator.json_media_type?(headers.fetch(content_type_key, nil))
           else
             true
           end

data/lib/committee/schema_validator/open_api_3/operation_wrapper.rb

@@ -32,20 +32,34 @@ module Committee
         end
 
         # @param [Boolean] strict when not content_type or status code definition, raise error
-        def validate_response_params(status_code, headers, response_data, strict, check_header, validator_options: {})
+        def validate_response_params(status_code, headers, response_data, strict, check_header, strict_response_content_type: false, validator_options: {})
           response_body = OpenAPIParser::RequestOperation::ValidatableResponseBody.new(status_code, response_data, headers)
 
+          # When strict_response_content_type is enabled, reject responses whose Content-Type is not
+          # declared in the spec's content map for this status code. Responses with no content map
+          # (e.g. bare 204s) are skipped — openapi_parser's validate_response_body handles those.
+          if strict_response_content_type
+            response_object = find_response_object_for_status(request_operation.operation_object&.responses, status_code)
+            if response_object
+              content_type = Rack::MediaType.type(response_body.content_type)
+              matched = response_object.select_media_type(content_type)
+              if matched.nil? && response_object.content && !response_object.content.empty?
+                raise Committee::InvalidResponse, "Response Content-Type '#{content_type}' is not declared in the OpenAPI spec for this operation. Declared types: #{response_object.content.keys.join(', ')}"
+              end
+            end
+          end
+
           return request_operation.validate_response_body(response_body, response_validate_options(strict, check_header, validator_options: validator_options))
         rescue OpenAPIParser::OpenAPIError => e
           raise Committee::InvalidResponse.new(e.message, original_error: e)
         end
 
-        def validate_request_params(path_params, query_params, body_params, headers, validator_option)
+        def validate_request_params(_path_params, query_params, body_params, headers, validator_option)
           ret, err = case request_operation.http_method
                 when 'get', 'delete', 'head'
-                  validate_get_request_params(path_params, query_params, headers, validator_option)
+                  validate_get_request_params(query_params, headers, validator_option)
                 when 'post', 'put', 'patch', 'options'
-                  validate_post_request_params(path_params, query_params, body_params, headers, validator_option)
+                  validate_post_request_params(query_params, body_params, headers, validator_option)
                 else
                   raise "Committee OpenAPI3 not support #{request_operation.http_method} method"
                 end
@@ -112,42 +126,27 @@ module Committee
           OpenAPIParser::SchemaValidator::Options.new(**parser_options)
         end
 
-        def validate_get_request_params(path_params, query_params, headers, validator_option)
-          # bad performance because when we coerce value, same check
-          validate_path_and_query_params(path_params, query_params, headers, validator_option)
+        def validate_get_request_params(query_params, headers, validator_option)
+          validate_query_params(query_params, headers, validator_option)
         rescue OpenAPIParser::OpenAPIError => e
           raise Committee::InvalidRequest.new(e.message, original_error: e)
         end
 
-        def validate_post_request_params(path_params, query_params, body_params, headers, validator_option)
+        def validate_post_request_params(query_params, body_params, headers, validator_option)
           content_type_key = headers.keys.detect { |k| k.casecmp?('Content-Type') }
           content_type = Rack::MediaType.type(headers[content_type_key])
 
-          # bad performance because when we coerce value, same check
-          validate_path_and_query_params(path_params, query_params, headers, validator_option)
+          validate_query_params(query_params, headers, validator_option)
           request_operation.validate_request_body(content_type, body_params, build_openapi_parser_body_option(validator_option))
         rescue => e
           raise Committee::InvalidRequest.new(e.message, original_error: e)
         end
 
-        def validate_path_and_query_params(path_params, query_params, headers, validator_option)
-          path_params ||= {}
+        def validate_query_params(query_params, headers, validator_option)
           query_params ||= {}
 
-          # it's currently impossible to validate path params and query params separately
-          # so we have to resort to this workaround
-
-          path_keys = path_params.keys.to_set
-          query_keys = query_params.keys.to_set
-
-          merged_params = query_params.merge(path_params)
-
-          request_operation.validate_request_parameter(merged_params, headers, build_openapi_parser_request_parameter_option(validator_option))
-
-          merged_params.each do |k, v|
-            path_params[k] = v if path_keys.include?(k)
-            query_params[k] = v if query_keys.include?(k)
-          end
+          # Path parameters have already been validated by coerce_path_parameter.
+          request_operation.validate_request_parameter(query_params, headers, build_openapi_parser_request_parameter_option(validator_option))
 
           validate_no_unknown_query_params(query_params) if validator_option.strict_query_params
         end
@@ -163,6 +162,18 @@ module Committee
           raise Committee::InvalidRequest.new("Unknown query parameter(s): #{unknown_params.join(', ')}")
         end
 
+        def find_response_object_for_status(responses, status_code)
+          return nil unless responses&.response
+
+          response_hash = responses.response
+          return response_hash[status_code.to_s] if response_hash[status_code.to_s]
+
+          wild_card = "#{status_code.to_i / 100}XX"
+          return response_hash[wild_card] if response_hash[wild_card]
+
+          responses.default
+        end
+
         def response_validate_options(strict, check_header, validator_options: {})
           options = { strict: strict, validate_header: check_header }
 

data/lib/committee/schema_validator/open_api_3/parameter_deserializer.rb

@@ -52,6 +52,8 @@ module Committee
           # If no parameters are defined for this location, return raw params as-is
           return raw_params if params_for_location.empty?
 
+          raw_params = normalize_raw_params(raw_params, location, params_for_location)
+
           # Collect parameter names that will be deserialized
           # This includes both the parameter name and any properties (for exploded objects)
           deserialized_keys = Set.new
@@ -105,6 +107,65 @@ module Committee
           Committee::Utils.indifferent_hash.merge(hash)
         end
 
+        # Normalize Rack-style nested query hashes into bracket notation when the
+        # schema expects bracket-named params or deepObject query params.
+        # Example: { "filter" => { "slug" => "/test" } } => { "filter[slug]" => "/test" }
+        # @param [Hash] raw_params
+        # @param [String] location
+        # @param [Array<OpenAPIParser::Schemas::Parameter>] params_for_location
+        # @return [Hash]
+        def normalize_raw_params(raw_params, location, params_for_location)
+          return raw_params unless location == 'query'
+          return raw_params unless raw_params.values.any? { |value| value.is_a?(Hash) }
+          return raw_params unless requires_query_param_flattening?(params_for_location)
+
+          normalized = Committee::Utils.indifferent_hash
+
+          raw_params.each do |key, value|
+            if should_flatten_query_param?(key, value, params_for_location)
+              flatten_nested_query_param(normalized, key.to_s, value)
+            else
+              normalized[key] = value
+            end
+          end
+
+          normalized
+        end
+
+        # @param [Array<OpenAPIParser::Schemas::Parameter>] params_for_location
+        # @return [Boolean]
+        def requires_query_param_flattening?(params_for_location)
+          params_for_location.any? { |param_def| param_def.style == 'deepObject' || param_def.name.include?('[') }
+        end
+
+        # @param [String, Symbol] key
+        # @param [Object] value
+        # @param [Array<OpenAPIParser::Schemas::Parameter>] params_for_location
+        # @return [Boolean]
+        def should_flatten_query_param?(key, value, params_for_location)
+          return false unless value.is_a?(Hash)
+
+          key_name = key.to_s
+          params_for_location.any? do |param_def|
+            param_def.name == key_name || param_def.name.start_with?("#{key_name}[")
+          end
+        end
+
+        # @param [Hash] result
+        # @param [String] prefix
+        # @param [Object] value
+        # @return [void]
+        def flatten_nested_query_param(result, prefix, value)
+          case value
+          when Hash
+            value.each do |child_key, child_value|
+              flatten_nested_query_param(result, "#{prefix}[#{child_key}]", child_value)
+            end
+          else
+            result[prefix] = value
+          end
+        end
+
         # Extract and deserialize a single parameter
         # @param [OpenAPIParser::Schemas::Parameter] param_def Parameter definition
         # @param [Hash] raw_params Raw parameters

data/lib/committee/schema_validator/open_api_3/response_validator.rb

@@ -14,6 +14,7 @@ module Committee
           @check_header = validator_option.check_header
           @allow_empty_date_and_datetime = validator_option.allow_empty_date_and_datetime
           @coerce_response_values = validator_option.coerce_response_values
+          @strict_response_content_type = validator_option.strict_response_content_type
         end
 
         def call(status, headers, response_data, strict)
@@ -21,7 +22,7 @@ module Committee
 
           validator_options = { allow_empty_date_and_datetime: @allow_empty_date_and_datetime, coerce_value: @coerce_response_values }
 
-          operation_wrapper.validate_response_params(status, headers, response_data, strict, check_header, validator_options: validator_options)
+          operation_wrapper.validate_response_params(status, headers, response_data, strict, check_header, strict_response_content_type: @strict_response_content_type, validator_options: validator_options)
         end
 
         def validate?(status)

data/lib/committee/schema_validator/open_api_3.rb

@@ -28,7 +28,7 @@ module Committee
 
         parse_to_json = if validator_option.parse_response_by_content_type
                           content_type_key = headers.keys.detect { |k| k.casecmp?('Content-Type') }
-                          headers.fetch(content_type_key, nil)&.start_with?('application/json')
+                          Committee::SchemaValidator.json_media_type?(headers.fetch(content_type_key, nil))
                         else
                           true
                         end
@@ -50,6 +50,10 @@ module Committee
         !@operation_object.nil?
       end
 
+      # Expose the operation matched for the request, or nil if none matched
+      # @return [Committee::SchemaValidator::OpenAPI3::OperationWrapper, nil]
+      attr_reader :operation_object
+
       private
 
       attr_reader :validator_option

data/lib/committee/schema_validator/option.rb

@@ -4,7 +4,7 @@ module Committee
   module SchemaValidator
     class Option
       # Boolean Options
-      attr_reader :allow_blank_structures, :allow_empty_date_and_datetime, :allow_form_params, :allow_get_body, :allow_query_params, :allow_non_get_query_params, :check_content_type, :check_header, :coerce_date_times, :coerce_form_params, :coerce_path_params, :coerce_query_params, :coerce_recursive, :coerce_response_values, :deserialize_parameters, :optimistic_json, :validate_success_only, :parse_response_by_content_type, :parameter_overwrite_by_rails_rule, :strict_query_params
+      attr_reader :allow_blank_structures, :allow_empty_date_and_datetime, :allow_form_params, :allow_get_body, :allow_query_params, :allow_non_get_query_params, :check_content_type, :check_header, :coerce_date_times, :coerce_form_params, :coerce_path_params, :coerce_query_params, :coerce_recursive, :coerce_response_values, :deserialize_parameters, :optimistic_json, :validate_success_only, :parse_response_by_content_type, :parameter_overwrite_by_rails_rule, :strict_query_params, :strict_response_content_type
 
       # Non-boolean options:
       attr_reader :headers_key, :params_key, :query_hash_key, :request_body_hash_key, :path_hash_key, :prefix
@@ -32,6 +32,7 @@ module Committee
         @optimistic_json                  = options.fetch(:optimistic_json, false)
         @parse_response_by_content_type   = options.fetch(:parse_response_by_content_type, true)
         @strict_query_params              = options.fetch(:strict_query_params, false)
+        @strict_response_content_type     = options.fetch(:strict_response_content_type, false)
 
         @parameter_overwrite_by_rails_rule =
           if options.key?(:parameter_overwite_by_rails_rule)

data/lib/committee/schema_validator.rb

@@ -2,11 +2,18 @@
 
 module Committee
   module SchemaValidator
+    JSON_MEDIA_TYPE_PATTERN = %r{\Aapplication/(?:.+\+)?json\z}.freeze
+
     class << self
       def request_media_type(request)
         Rack::MediaType.type(request.env['CONTENT_TYPE'])
       end
 
+      def json_media_type?(content_type)
+        normalized_content_type = Rack::MediaType.type(content_type)
+        normalized_content_type&.match?(JSON_MEDIA_TYPE_PATTERN) || false
+      end
+
       # @param [String] prefix
       # @return [Regexp]
       def build_prefix_regexp(prefix)

data/lib/committee/test/methods.rb

@@ -23,6 +23,8 @@ module Committee
             schema_validator.request_validate(request_object)
           end
         end
+
+        increment_assertion_count
       end
 
       def assert_response_schema_confirm(expected_status = nil)
@@ -46,6 +48,8 @@ module Committee
         end
 
         schema_validator.response_validate(status, headers, [body], true) if validate_response?(status)
+
+        increment_assertion_count
       end
 
       def committee_options
@@ -73,7 +77,7 @@ module Committee
       end
 
       def schema_validator
-        @schema_validator ||= router.build_schema_validator(request_object)
+        router.build_schema_validator(request_object)
       end
 
       def schema_coverage
@@ -90,6 +94,13 @@ module Committee
 
       private
 
+      # assert_*_schema_confirm signal failure by raising, not via `assert`,
+      # so Minitest would report "Test is missing assertions" on success.
+      # Bump the counter explicitly; no-op outside Minitest (e.g. RSpec).
+      def increment_assertion_count
+        assert true if respond_to?(:assertions)
+      end
+
       # Temporarily adds dummy values for excepted parameters during validation
       # @see ExceptParameter
       def with_except_params(except)

data/lib/committee/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Committee
-  VERSION = '5.6.2'.freeze
+  VERSION = '5.6.4'.freeze
 end

data/test/middleware/options/response_validation_test.rb

@@ -94,6 +94,16 @@ describe Committee::Middleware::Options::ResponseValidation do
       end
       assert_equal "streaming_content_parsers must be a Hash", e.message
     end
+
+    it "sets strict_response_content_type option with default false" do
+      options = Committee::Middleware::Options::ResponseValidation.new(schema: hyper_schema)
+      assert_equal false, options.strict_response_content_type
+    end
+
+    it "sets strict_response_content_type option when provided" do
+      options = Committee::Middleware::Options::ResponseValidation.new(schema: hyper_schema, strict_response_content_type: true)
+      assert_equal true, options.strict_response_content_type
+    end
   end
 
   describe "#to_h" do
@@ -103,6 +113,11 @@ describe Committee::Middleware::Options::ResponseValidation do
       assert_equal true, hash[:strict]
       assert_equal false, hash[:validate_success_only]
     end
+
+    it "includes strict_response_content_type in hash" do
+      options = Committee::Middleware::Options::ResponseValidation.new(schema: hyper_schema, strict_response_content_type: true)
+      assert_equal true, options.to_h[:strict_response_content_type]
+    end
   end
 
   describe ".from" do

data/test/middleware/request_validation_open_api_3_test.rb

@@ -424,7 +424,7 @@ describe Committee::Middleware::RequestValidation do
         assert_equal env['committee.path_hash'][:integer], 84
         assert_equal env['committee.request_body_hash']['integer'], 21
         assert_equal env['committee.request_body_hash'][:integer], 21
-        assert_equal env['committee.query_hash']['integer'], 84 # we can't use query_parameter :(
+        assert_equal env['committee.query_hash']['integer'], 42
         # assert_equal env['rack.request.query_hash'][:integer], 21 # this isn't hash indifferent hash because we use rack.request.query_hash
         [204, {}, []]
       end, schema: open_api_3_schema, parameter_overwrite_by_rails_rule: false)
@@ -478,7 +478,7 @@ describe Committee::Middleware::RequestValidation do
         assert_equal env['committee.params'][:integer], 84
         assert_equal env['committee.request_body_hash']['integer'], 21
         assert_equal env['committee.request_body_hash'][:integer], 21
-        assert_equal env['committee.query_hash']['integer'], 84 # we can't use query_parameter :(
+        assert_equal env['committee.query_hash']['integer'], 42
         assert_equal env['committee.path_hash']['integer'], 84
         assert_equal env['committee.path_hash'][:integer], 84
         [204, {}, []]
@@ -660,6 +660,44 @@ describe Committee::Middleware::RequestValidation do
     end
   end
 
+  describe 'bracket-style query params' do
+    it 'validates query params declared with bracket notation names' do
+      check_parameter = lambda { |env|
+        assert_equal '/test', env['committee.query_hash']['filter[slug]']
+        refute env['committee.query_hash'].key?('filter')
+        [200, {}, []]
+      }
+
+      @app = new_rack_app_with_lambda(check_parameter, schema: query_param_schema(bracket_notation_query_parameter))
+
+      get '/events?filter[slug]=%2Ftest'
+
+      assert_equal 200, last_response.status
+    end
+
+    it 'rejects unknown nested query params with strict_query_params' do
+      @app = new_rack_app(schema: query_param_schema(bracket_notation_query_parameter), strict_query_params: true)
+
+      get '/events?filter[slug]=%2Ftest&filter[status]=active'
+
+      assert_equal 400, last_response.status
+      assert_match(/filter\[status\]/, last_response.body)
+    end
+
+    it 'continues to support deepObject query params from Rack nested hashes' do
+      check_parameter = lambda { |env|
+        assert_equal '/test', env['committee.query_hash']['filter']['slug']
+        [200, {}, []]
+      }
+
+      @app = new_rack_app_with_lambda(check_parameter, schema: query_param_schema(deep_object_query_parameter))
+
+      get '/events?filter[slug]=%2Ftest'
+
+      assert_equal 200, last_response.status
+    end
+  end
+
   private
 
   def new_rack_app(options = {})
@@ -674,4 +712,53 @@ describe Committee::Middleware::RequestValidation do
       run check_lambda
     }
   end
+
+  def query_param_schema(parameter)
+    Committee::Drivers.load_from_data(query_param_document(parameter), nil, parser_options: { strict_reference_validation: true })
+  end
+
+  def bracket_notation_query_parameter
+    {
+      'name' => 'filter[slug]',
+      'in' => 'query',
+      'required' => true,
+      'schema' => { 'type' => 'string' },
+    }
+  end
+
+  def deep_object_query_parameter
+    {
+      'name' => 'filter',
+      'in' => 'query',
+      'required' => true,
+      'style' => 'deepObject',
+      'explode' => true,
+      'schema' => {
+        'type' => 'object',
+        'required' => ['slug'],
+        'properties' => {
+          'slug' => { 'type' => 'string' },
+        },
+      },
+    }
+  end
+
+  def query_param_document(parameter)
+    {
+      'openapi' => '3.0.3',
+      'info' => { 'title' => 'test', 'version' => '1.0.0' },
+      'paths' => {
+        '/events' => {
+          'get' => {
+            'parameters' => [parameter],
+            'responses' => {
+              '200' => {
+                'description' => 'ok',
+              },
+            },
+          },
+        },
+      },
+    }
+  end
 end

data/test/middleware/response_validation_open_api_3_test.rb

@@ -17,6 +17,29 @@ describe Committee::Middleware::ResponseValidation do
     assert_equal 200, last_response.status
   end
 
+  it "preserves a one-shot response body after validation" do
+    content = JSON.generate(CHARACTERS_RESPONSE)
+    chunks = [content]
+    each_calls = 0
+    body = Rack::BodyProxy.new(Enumerator.new do |yielder|
+      each_calls += 1
+      chunks.each { |chunk| yielder << chunk }
+      chunks.clear
+    end) {}
+    @app = Rack::Builder.new {
+      use Committee::Middleware::ResponseValidation, { schema: open_api_3_schema }
+      run ->(_) { [200, { "Content-Type" => "application/json" }, body] }
+    }
+
+    status, _headers, response_body = @app.call(Rack::MockRequest.env_for("/characters"))
+
+    assert_equal 200, status
+    assert_equal content, response_body.each.to_a.join
+    assert_equal 1, each_calls
+    response_body.close if response_body.respond_to?(:close)
+    assert body.closed?
+  end
+
   it "passes through a valid response with content-type (lower-case)" do
     status = 200
     headers = { "content-type" => "application/json" }
@@ -33,6 +56,13 @@ describe Committee::Middleware::ResponseValidation do
     assert_equal 200, last_response.status
   end
 
+  it "passes through a valid response with a +json content-type" do
+    @app = new_response_rack(JSON.generate(CHARACTERS_RESPONSE), { "Content-Type" => "application/problem+json; charset=utf-8" }, schema: open_api_3_schema, parse_response_by_content_type: true,)
+
+    get "/characters"
+    assert_equal 200, last_response.status
+  end
+
   it "passes through a invalid json" do
     @app = new_response_rack("not_json", {}, schema: open_api_3_schema)
 
@@ -296,6 +326,68 @@ describe Committee::Middleware::ResponseValidation do
     end
   end
 
+  describe "strict_response_content_type option" do
+    it "passes through with undeclared content type when strict_response_content_type: false (default)" do
+      @app = new_response_rack(JSON.generate(CHARACTERS_RESPONSE), { "Content-Type" => "application/vnd.api+json" }, schema: open_api_3_schema)
+      get "/characters"
+      assert_equal 200, last_response.status
+    end
+
+    it "raises with undeclared content type when strict_response_content_type: true" do
+      @app = new_response_rack(JSON.generate(CHARACTERS_RESPONSE), { "Content-Type" => "application/vnd.api+json" }, schema: open_api_3_schema, strict_response_content_type: true, raise: true)
+      assert_raises(Committee::InvalidResponse) do
+        get "/characters"
+      end
+    end
+
+    it "returns 500 with undeclared content type when strict_response_content_type: true without raise" do
+      @app = new_response_rack(JSON.generate(CHARACTERS_RESPONSE), { "Content-Type" => "application/vnd.api+json" }, schema: open_api_3_schema, strict_response_content_type: true)
+      get "/characters"
+      assert_equal 500, last_response.status
+    end
+
+    it "passes through when response has no content schema with strict_response_content_type: true" do
+      @app = new_response_rack("", { "Content-Type" => "application/vnd.api+json" }, schema: open_api_3_schema, strict_response_content_type: true)
+      get "/no_content_schema"
+      assert_equal 200, last_response.status
+    end
+
+    it "passes through with declared content type and strict_response_content_type: true" do
+      @app = new_response_rack(JSON.generate(CHARACTERS_RESPONSE), { "Content-Type" => "application/json" }, schema: open_api_3_schema, strict_response_content_type: true)
+      get "/characters"
+      assert_equal 200, last_response.status
+    end
+
+    it "passes through with declared content type and charset param with strict_response_content_type: true" do
+      @app = new_response_rack(JSON.generate(CHARACTERS_RESPONSE), { "Content-Type" => "application/json; charset=utf-8" }, schema: open_api_3_schema, strict_response_content_type: true)
+      get "/characters"
+      assert_equal 200, last_response.status
+    end
+
+    it "raises with undeclared content type matched via wildcard status code with strict_response_content_type: true" do
+      @app = new_response_rack("{}", { "Content-Type" => "application/vnd.api+json" }, { schema: open_api_3_schema, strict_response_content_type: true, raise: true, validate_success_only: false }, { status: 400 })
+      assert_raises(Committee::InvalidResponse) do
+        get "/wildcard_response"
+      end
+    end
+
+    it "raises with undeclared content type matched via default response with strict_response_content_type: true" do
+      @app = new_response_rack("{}", { "Content-Type" => "application/vnd.api+json" }, { schema: open_api_3_schema, strict_response_content_type: true, raise: true, validate_success_only: false }, { status: 500 })
+      assert_raises(Committee::InvalidResponse) do
+        get "/default_response"
+      end
+    end
+
+    it "calls error_handler with strict_response_content_type: true and raise: false" do
+      called_err = nil
+      pr = ->(e, _env) { called_err = e }
+      @app = new_response_rack(JSON.generate(CHARACTERS_RESPONSE), { "Content-Type" => "application/vnd.api+json" }, schema: open_api_3_schema, strict_response_content_type: true, error_handler: pr)
+      get "/characters"
+      assert_equal 500, last_response.status
+      assert_kind_of Committee::InvalidResponse, called_err
+    end
+  end
+
   private
 
   def new_response_rack(response, headers = {}, options = {}, rack_options = {})

data/test/schema_validator/hyper_schema/response_validator_test.rb

@@ -112,6 +112,22 @@ describe Committee::SchemaValidator::HyperSchema::ResponseValidator do
     assert_equal message, e.message
   end
 
+  it "validates OpenAPI 2 responses against the schema for their status" do
+    link = Committee::Drivers::OpenAPI2::Link.new
+    link.href = "/apps"
+    link.media_type = "application/json"
+    link.status_success = 200
+    success_schema = JsonSchema.parse!({ "type" => "object", "required" => ["id"], "properties" => { "id" => { "type" => "integer" } } })
+    error_schema = JsonSchema.parse!({ "type" => "object", "required" => ["error"], "properties" => { "error" => { "type" => "string" } } })
+    link.target_schemas = { 200 => success_schema, 400 => error_schema }
+    validator = Committee::SchemaValidator::HyperSchema::ResponseValidator.new(link, validate_success_only: false)
+
+    validator.call(200, @headers, { "id" => 1 })
+    validator.call(400, @headers, { "error" => "invalid request" })
+    assert_raises(Committee::InvalidResponse) { validator.call(200, @headers, { "error" => "invalid request" }) }
+    assert_raises(Committee::InvalidResponse) { validator.call(400, @headers, { "id" => 1, "error" => 1 }) }
+  end
+
   private
 
   def call

data/test/schema_validator/open_api_3/operation_wrapper_test.rb

@@ -156,6 +156,63 @@ describe Committee::SchemaValidator::OpenAPI3::OperationWrapper do
       assert_kind_of(OpenAPIParser::OpenAPIError, e.original_error)
     end
 
+    describe 'same-named path and query parameters' do
+      %w[get post].each do |method|
+        describe method do
+          before do
+            @path = '/overwrite_same_parameter/123'
+            @method = method
+            data = open_api_3_data
+            path_item = data['paths']['/overwrite_same_parameter/{integer}']
+            path_item[method] = path_item['post']
+            @open_api_3_schema = Committee::Drivers.load_from_data(data, open_api_3_schema_path, parser_options: { strict_reference_validation: true })
+          end
+
+          it 'rejects an invalid query value without overwriting it with the path value' do
+            path_params = { 'integer' => 123 }
+            query_params = { 'integer' => 'not-an-integer' }
+
+            error = assert_raises(Committee::InvalidRequest) do
+              operation_object.validate_request_params(path_params, query_params, {}, HEADER, @validator_option)
+            end
+
+            assert_match(/expected integer, but received String: "not-an-integer"/i, error.message)
+            assert_kind_of(OpenAPIParser::OpenAPIError, error.original_error)
+            assert_equal({ 'integer' => 'not-an-integer' }, query_params)
+            assert_equal({ 'integer' => 123 }, path_params)
+          end
+
+          it 'rejects a missing required query parameter even when the path parameter is present' do
+            error = assert_raises(Committee::InvalidRequest) do
+              operation_object.validate_request_params({ 'integer' => 123 }, {}, {}, HEADER, @validator_option)
+            end
+
+            assert_match(/missing required parameters: integer/i, error.message)
+          end
+
+          it 'coerces the query value independently of the path value' do
+            path_params = { 'integer' => 123 }
+            query_params = { 'integer' => '456' }
+
+            operation_object.validate_request_params(path_params, query_params, {}, HEADER, @validator_option)
+
+            assert_equal({ 'integer' => 123 }, path_params)
+            assert_equal({ 'integer' => 456 }, query_params)
+          end
+
+          it 'honors disabled query coercion even when the path value is already an integer' do
+            options = Committee::SchemaValidator::Option.new({ coerce_query_params: false }, open_api_3_schema, :open_api_3)
+
+            error = assert_raises(Committee::InvalidRequest) do
+              operation_object.validate_request_params({ 'integer' => 123 }, { 'integer' => '456' }, {}, HEADER, options)
+            end
+
+            assert_match(/expected integer, but received String: "456"/i, error.message)
+          end
+        end
+      end
+    end
+
     describe '#content_types' do
       it 'returns supported content types' do
         @path = '/validate_content_types'
@@ -204,6 +261,62 @@ describe Committee::SchemaValidator::OpenAPI3::OperationWrapper do
         @path = '/characters'
         operation_object.validate_request_params({}, { "limit" => "1" }, {}, HEADER, query_coercion_enabled)
       end
+
+      it 'uses coerce_form_params for JSON request bodies too' do
+        @path = '/validate'
+        @method = 'post'
+
+        body_coercion_disabled = Committee::SchemaValidator::Option.new({ coerce_form_params: false }, open_api_3_schema, :open_api_3)
+        body_coercion_enabled = Committee::SchemaValidator::Option.new({ coerce_form_params: true }, open_api_3_schema, :open_api_3)
+
+        error = assert_raises(Committee::InvalidRequest) do
+          operation_object.validate_request_params({}, {}, { "integer" => "1" }, HEADER, body_coercion_disabled)
+        end
+        assert_match(/expected integer, but received String: "1"/i, error.message)
+
+        body_params = { "integer" => "1" }
+        operation_object.validate_request_params({}, {}, body_params, HEADER, body_coercion_enabled)
+
+        assert_kind_of(Integer, body_params["integer"])
+      end
+    end
+
+    describe '#find_response_object_for_status' do
+      def responses_for(path, method = 'get')
+        open_api_3_schema.operation_object(path, method).request_operation.operation_object.responses
+      end
+
+      def find(path, status, method = 'get')
+        wrapper = open_api_3_schema.operation_object(path, method)
+        wrapper.send(:find_response_object_for_status, responses_for(path, method), status)
+      end
+
+      it 'returns nil when responses is nil' do
+        wrapper = open_api_3_schema.operation_object('/characters', 'get')
+        assert_nil wrapper.send(:find_response_object_for_status, nil, 200)
+      end
+
+      it 'returns exact status code match' do
+        result = find('/characters', 200)
+        assert_kind_of OpenAPIParser::Schemas::Response, result
+        assert result.content.key?('application/json')
+      end
+
+      it 'returns wildcard match when exact status not defined' do
+        result = find('/wildcard_response', 400)
+        assert_kind_of OpenAPIParser::Schemas::Response, result
+        assert result.content.key?('application/json')
+      end
+
+      it 'returns default when no exact or wildcard match' do
+        result = find('/default_response', 500)
+        assert_kind_of OpenAPIParser::Schemas::Response, result
+        assert result.content.key?('application/json')
+      end
+
+      it 'returns nil when no exact, wildcard, or default match' do
+        assert_nil find('/characters', 999)
+      end
     end
   end
 end

data/test/schema_validator/open_api_3_test.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+describe Committee::SchemaValidator::OpenAPI3 do
+  before do
+    @router = open_api_3_schema.build_router(schema: open_api_3_schema)
+  end
+
+  def validator_for(path, method)
+    request = Rack::Request.new({ "REQUEST_METHOD" => method, "PATH_INFO" => path, "rack.input" => StringIO.new("") })
+    @router.build_schema_validator(request)
+  end
+
+  describe "#operation_object" do
+    it "returns the matched operation wrapper" do
+      operation_object = validator_for("/validate", "POST").operation_object
+
+      assert_kind_of Committee::SchemaValidator::OpenAPI3::OperationWrapper, operation_object
+      assert_equal "/validate", operation_object.original_path
+    end
+
+    it "returns nil when the request matches no operation" do
+      assert_nil validator_for("/no-such-path", "GET").operation_object
+    end
+  end
+end

data/test/schema_validator_test.rb

@@ -21,6 +21,39 @@ describe Committee::SchemaValidator do
     assert_equal 'multipart/form-data', media_type
   end
 
+  it "detects application/json as a JSON media type" do
+    assert_equal true, Committee::SchemaValidator.json_media_type?("application/json")
+  end
+
+  it "detects application/problem+json with parameters as a JSON media type" do
+    assert_equal true, Committee::SchemaValidator.json_media_type?("application/problem+json; charset=utf-8")
+  end
+
+  it "detects application/vnd.api+json as a JSON media type" do
+    assert_equal true, Committee::SchemaValidator.json_media_type?("application/vnd.api+json")
+  end
+
+  it "does not detect application/x-ndjson as a JSON media type" do
+    assert_equal false, Committee::SchemaValidator.json_media_type?("application/x-ndjson")
+  end
+
+  it "does not detect non-JSON content types as JSON media types" do
+    assert_equal false, Committee::SchemaValidator.json_media_type?("test/csv")
+    assert_equal false, Committee::SchemaValidator.json_media_type?(nil)
+  end
+
+  it "parses +json responses in the HyperSchema validator" do
+    schema = Committee::Drivers::OpenAPI2::Driver.new.parse(open_api_2_data)
+    validator_option = Committee::SchemaValidator::Option.new({ parse_response_by_content_type: true }, schema, :hyper_schema)
+    router = Committee::SchemaValidator::HyperSchema::Router.new(schema, validator_option)
+    request = Rack::Request.new({ "REQUEST_METHOD" => "GET", "PATH_INFO" => "/api/pets", "rack.input" => StringIO.new("") })
+    validator = Committee::SchemaValidator::HyperSchema.new(router, request, validator_option)
+
+    validator.link.media_type = "application/vnd.api+json"
+
+    validator.response_validate(200, { "Content-Type" => "application/vnd.api+json" }, [JSON.generate([ValidPet])])
+  end
+
   it "builds prefix regexp with a path segment boundary" do
     regexp = Committee::SchemaValidator.build_prefix_regexp("/v1")
 

data/test/test/methods_test.rb

@@ -123,6 +123,18 @@ describe Committee::Test::Methods do
         assert_schema_conform(200)
       end
 
+      it "uses each request's operation for consecutive responses" do
+        responses = { "/characters" => JSON.generate(@correct_response), "/validate_response_array" => JSON.generate(["honoka"]), }
+        @app = Rack::Builder.new {
+          run ->(env) { [200, { "Content-Type" => "application/json" }, [responses.fetch(env["PATH_INFO"])]] }
+        }
+
+        get "/characters"
+        assert_schema_conform(200)
+        get "/validate_response_array"
+        assert_schema_conform(200)
+      end
+
       it "detects an invalid response Content-Type" do
         @app = new_rack_app(JSON.generate([@correct_response]), {})
         get "/characters"
@@ -151,6 +163,14 @@ describe Committee::Test::Methods do
         assert_request_schema_confirm
       end
 
+      it "increments the Minitest assertion count on success" do
+        @app = new_rack_app
+        get "/characters"
+        before_count = assertions
+        assert_request_schema_confirm
+        assert_equal before_count + 1, assertions
+      end
+
       it "not exist required" do
         @app = new_rack_app
         get "/validate", { "query_string" => "query", "query_integer_list" => [1, 2] }
@@ -397,6 +417,14 @@ describe Committee::Test::Methods do
         assert_response_schema_confirm(200)
       end
 
+      it "increments the Minitest assertion count on success" do
+        @app = new_rack_app(JSON.generate(@correct_response))
+        get "/characters"
+        before_count = assertions
+        assert_response_schema_confirm(200)
+        assert_equal before_count + 1, assertions
+      end
+
       it "detects an invalid response Content-Type" do
         @app = new_rack_app(JSON.generate([@correct_response]), {})
         get "/characters"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: committee
 version: !ruby/object:Gem::Version
-  version: 5.6.2
+  version: 5.6.4
 platform: ruby
 authors:
 - Brandur
@@ -249,6 +249,7 @@ files:
 - test/schema_validator/open_api_3/parameter_deserializer_test.rb
 - test/schema_validator/open_api_3/request_validator_test.rb
 - test/schema_validator/open_api_3/response_validator_test.rb
+- test/schema_validator/open_api_3_test.rb
 - test/schema_validator_test.rb
 - test/test/methods_new_version_test.rb
 - test/test/methods_test.rb