openapi_first 1.0.0.beta4 → 1.0.0.beta6

data/lib/openapi_first/definition.rb

@@ -1,19 +1,39 @@
 # frozen_string_literal: true
 
-require_relative 'operation'
+require 'mustermann/template'
+require_relative 'definition/path_item'
 
 module OpenapiFirst
   # Represents an OpenAPI API Description document
   class Definition
-    attr_reader :filepath, :operations
+    attr_reader :filepath, :paths, :openapi_version
 
     def initialize(resolved, filepath)
       @filepath = filepath
+      @paths = resolved['paths']
+      @openapi_version = detect_version(resolved)
+    end
+
+    # @param request_path String
+    def find_path_item_and_params(request_path)
+      matches = paths.each_with_object([]) do |kv, result|
+        path, path_item_object = kv
+        template = Mustermann::Template.new(path)
+        path_params = template.params(request_path)
+        next unless path_params
+
+        path_item = PathItem.new(path, path_item_object, openapi_version:)
+        result << [path_item, path_params]
+      end
+      # Thanks to open ota42y/openapi_parser for this part
+      matches.min_by { |match| match[1].size }
+    end
+
+    def operations
       methods = %w[get head post put patch delete trace options]
-      @operations = resolved['paths'].flat_map do |path, path_item|
-        path_item.slice(*methods).map do |request_method, _operation_object|
-          Operation.new(path, request_method, path_item, openapi_version: detect_version(resolved))
-        end
+      @operations ||= paths.flat_map do |path, path_item_object|
+        path_item = PathItem.new(path, path_item_object, openapi_version:)
+        path_item_object.slice(*methods).keys.map { |method| path_item.find_operation(method) }
       end
     end
 

data/lib/openapi_first/error_response.rb

@@ -1,22 +1,38 @@
 # frozen_string_literal: true
 
+require 'forwardable'
+
 module OpenapiFirst
   # This is the base class for error responses
   class ErrorResponse
-    ## @param status [Integer] The HTTP status code.
-    ## @param title [String] The title of the error. Usually the name of the HTTP status code.
-    ## @param location [Symbol] The location of the error (:request_body, :query, :header, :cookie, :path).
-    ## @param validation_result [ValidationResult]
-    def initialize(status:, location:, title:, validation_result:)
-      @status = status
-      @title = title
-      @location = location
-      @validation_output = validation_result&.output
-      @schema = validation_result&.schema
-      @data = validation_result&.data
+    ## @param request [Hash] The Rack request env
+    ## @param request_validation_error [OpenapiFirst::RequestValidationError]
+    def initialize(env, request_validation_error)
+      @env = env
+      @request_validation_error = request_validation_error
+    end
+
+    extend Forwardable
+
+    attr_reader :env, :request_validation_error
+
+    def_delegators :@request_validation_error, :status, :location, :schema_validation
+
+    def validation_output
+      schema_validation&.output
     end
 
-    attr_reader :status, :location, :title, :schema, :data, :validation_output
+    def schema
+      schema_validation&.schema
+    end
+
+    def data
+      schema_validation&.data
+    end
+
+    def message
+      request_validation_error.message
+    end
 
     def render
       Rack::Response.new(body, status, Rack::CONTENT_TYPE => content_type).finish

data/lib/openapi_first/error_responses/default.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+module OpenapiFirst
+  module ErrorResponses
+    class Default < ErrorResponse
+      OpenapiFirst::Plugins.register_error_response(:default, self)
+
+      def body
+        MultiJson.dump({ errors: serialized_errors })
+      end
+
+      def content_type
+        'application/json'
+      end
+
+      def serialized_errors
+        return default_errors unless validation_output
+
+        key = pointer_key
+        validation_errors&.map do |error|
+          {
+            status: status.to_s,
+            source: { key => pointer(error['instanceLocation']) },
+            title: error['error']
+          }
+        end
+      end
+
+      def validation_errors
+        validation_output['errors'] || [validation_output]
+      end
+
+      def default_errors
+        [{
+          status: status.to_s,
+          title: message
+        }]
+      end
+
+      def pointer_key
+        case location
+        when :body
+          :pointer
+        when :query, :path
+          :parameter
+        else
+          location
+        end
+      end
+
+      def pointer(data_pointer)
+        return data_pointer if location == :body
+
+        data_pointer.delete_prefix('/')
+      end
+    end
+  end
+end

data/lib/openapi_first/error_responses/json_api.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+module OpenapiFirst
+  module ErrorResponses
+    class JsonApi < ErrorResponse
+      OpenapiFirst::Plugins.register_error_response(:json_api, self)
+
+      def body
+        MultiJson.dump({ errors: serialized_errors })
+      end
+
+      def content_type
+        'application/vnd.api+json'
+      end
+
+      def serialized_errors
+        return default_errors unless validation_output
+
+        key = pointer_key
+        validation_errors&.map do |error|
+          {
+            status: status.to_s,
+            source: { key => pointer(error['instanceLocation']) },
+            title: error['error']
+          }
+        end
+      end
+
+      def validation_errors
+        validation_output['errors'] || [validation_output]
+      end
+
+      def default_errors
+        [{
+          status: status.to_s,
+          title: message
+        }]
+      end
+
+      def pointer_key
+        case location
+        when :body
+          :pointer
+        when :query, :path
+          :parameter
+        else
+          location
+        end
+      end
+
+      def pointer(data_pointer)
+        return data_pointer if location == :body
+
+        data_pointer.delete_prefix('/')
+      end
+    end
+  end
+end

data/lib/openapi_first/request_body_validator.rb

@@ -5,37 +5,33 @@ module OpenapiFirst
     def initialize(operation, env)
       @operation = operation
       @env = env
-      @parsed_request_body = env[REQUEST_BODY]
     end
 
     def validate!
-      content_type = Rack::Request.new(@env).content_type
-      validate_request_content_type!(@operation, content_type)
-      validate_request_body!(@operation, @parsed_request_body, content_type)
-    end
-
-    private
+      request_body = @operation.request_body
+      return unless request_body
 
-    def validate_request_content_type!(operation, content_type)
-      operation.valid_request_content_type?(content_type) || OpenapiFirst.error!(415)
-    end
+      request_content_type = Rack::Request.new(@env).content_type
+      schema = request_body.schema_for(request_content_type)
+      RequestValidation.fail!(415, :header) unless schema
 
-    def validate_request_body!(operation, body, content_type)
-      validate_request_body_presence!(body, operation)
-      return if content_type.nil?
+      parsed_request_body = BodyParser.new.parse_body(@env)
+      RequestValidation.fail!(400, :body) if request_body.required? && parsed_request_body.nil?
 
-      schema = operation&.request_body_schema(content_type)
-      return unless schema
-
-      validation_result = schema.validate(body)
-      OpenapiFirst.error!(400, :request_body, validation_result:) if validation_result.error?
-      body
+      validate_body!(parsed_request_body, schema)
+      parsed_request_body
+    rescue BodyParsingError => e
+      RequestValidation.fail!(400, :body, message: e.message)
     end
 
-    def validate_request_body_presence!(body, operation)
-      return unless operation.request_body['required'] && body.nil?
+    private
+
+    def validate_body!(parsed_request_body, schema)
+      request_body_schema = schema
+      return unless request_body_schema
 
-      OpenapiFirst.error!(400, :request_body, title: 'Request body is required')
+      schema_validation = request_body_schema.validate(parsed_request_body)
+      RequestValidation.fail!(400, :body, schema_validation:) if schema_validation.error?
     end
   end
 end

data/lib/openapi_first/request_validation.rb

@@ -5,16 +5,38 @@ require 'multi_json'
 require_relative 'use_router'
 require_relative 'error_response'
 require_relative 'request_body_validator'
-require_relative 'string_keyed_hash'
+require_relative 'request_validation_error'
 require 'openapi_parameters'
 
 module OpenapiFirst
+  # A Rack middleware to validate requests against an OpenAPI API description
   class RequestValidation
     prepend UseRouter
 
+    FAIL = :request_validation_failed
+    private_constant :FAIL
+
+    # @param status [Integer] The intended HTTP status code (usually 400)
+    # @param location [Symbol] One of :body, :header, :cookie, :query, :path
+    # @param schema_validation [OpenapiFirst::Schema::Result]
+    def self.fail!(status, location, message: nil, schema_validation: nil)
+      throw FAIL, RequestValidationError.new(
+        status:,
+        location:,
+        message:,
+        schema_validation:
+      )
+    end
+
+    # @param app The parent Rack application
+    # @param options An optional Hash of configuration options to override defaults
+    #   :error_response A Boolean indicating whether to raise an error if validation fails.
+    #                   default: OpenapiFirst::ErrorResponses::Default (Config.default_options.error_response)
+    #   :raise_error    The Class to use for error responses.
+    #                   default: false (Config.default_options.request_validation_raise_error)
     def initialize(app, options = {})
       @app = app
-      @raise = options.fetch(:raise_error, false)
+      @raise = options.fetch(:raise_error, Config.default_options.request_validation_raise_error)
       @error_response_class =
         Plugins.find_error_response(options.fetch(:error_response, Config.default_options.error_response))
     end
@@ -25,88 +47,76 @@ module OpenapiFirst
 
       error = validate_request(operation, env)
       if error
-        location, title = error.values_at(:location, :title)
-        raise RequestInvalidError, error_message(title, location) if @raise
+        raise RequestInvalidError, error.error_message if @raise
 
-        return error_response(error).render
+        return @error_response_class.new(env, error).render
       end
+
       @app.call(env)
     end
 
     private
 
-    def error_message(title, location)
-      return title unless location
-
-      "#{TOPICS.fetch(location)} #{title}"
-    end
-
-    TOPICS = {
-      request_body: 'Request body invalid:',
-      query: 'Query parameter invalid:',
-      header: 'Header parameter invalid:',
-      path: 'Path segment invalid:',
-      cookie: 'Cookie value invalid:'
-    }.freeze
-    private_constant :TOPICS
-
-    def error_response(error_object)
-      @error_response_class.new(**error_object)
-    end
-
     def validate_request(operation, env)
-      catch(:error) do
+      catch(FAIL) do
         env[PARAMS] = {}
-        validate_query_params!(operation, env)
-        validate_path_params!(operation, env)
-        validate_cookie_params!(operation, env)
-        validate_header_params!(operation, env)
-        RequestBodyValidator.new(operation, env).validate! if operation.request_body
+        validate_parameters!(operation, env)
+        validate_request_body!(operation, env)
         nil
       end
     end
 
+    def validate_parameters!(operation, env)
+      validate_query_params!(operation, env)
+      validate_path_params!(operation, env)
+      validate_cookie_params!(operation, env)
+      validate_header_params!(operation, env)
+    end
+
     def validate_path_params!(operation, env)
-      path_parameters = operation.path_parameters
-      return if path_parameters.empty?
-
-      hashy = StringKeyedHash.new(env[Router::RAW_PATH_PARAMS])
-      unpacked_path_params = OpenapiParameters::Path.new(path_parameters).unpack(hashy)
-      validation_result = operation.schemas.path_parameters_schema.validate(unpacked_path_params)
-      OpenapiFirst.error!(400, :path, validation_result:) if validation_result.error?
-      env[PATH_PARAMS] = unpacked_path_params
-      env[PARAMS].merge!(unpacked_path_params)
+      parameters = operation.path_parameters
+      return unless parameters
+
+      unpacked_params = parameters.unpack(env)
+      schema_validation = parameters.schema.validate(unpacked_params)
+      RequestValidation.fail!(400, :path, schema_validation:) if schema_validation.error?
+      env[PATH_PARAMS] = unpacked_params
+      env[PARAMS].merge!(unpacked_params)
     end
 
     def validate_query_params!(operation, env)
-      query_parameters = operation.query_parameters
-      return if operation.query_parameters.empty?
-
-      unpacked_query_params = OpenapiParameters::Query.new(query_parameters).unpack(env['QUERY_STRING'])
-      validation_result = operation.schemas.query_parameters_schema.validate(unpacked_query_params)
-      OpenapiFirst.error!(400, :query, validation_result:) if validation_result.error?
-      env[QUERY_PARAMS] = unpacked_query_params
-      env[PARAMS].merge!(unpacked_query_params)
+      parameters = operation.query_parameters
+      return unless parameters
+
+      unpacked_params = parameters.unpack(env)
+      schema_validation = parameters.schema.validate(unpacked_params)
+      RequestValidation.fail!(400, :query, schema_validation:) if schema_validation.error?
+      env[QUERY_PARAMS] = unpacked_params
+      env[PARAMS].merge!(unpacked_params)
     end
 
     def validate_cookie_params!(operation, env)
-      cookie_parameters = operation.cookie_parameters
-      return unless cookie_parameters&.any?
+      parameters = operation.cookie_parameters
+      return unless parameters
 
-      unpacked_params = OpenapiParameters::Cookie.new(cookie_parameters).unpack(env['HTTP_COOKIE'])
-      validation_result = operation.schemas.cookie_parameters_schema.validate(unpacked_params)
-      OpenapiFirst.error!(400, :cookie, validation_result:) if validation_result.error?
+      unpacked_params = parameters.unpack(env)
+      schema_validation = parameters.schema.validate(unpacked_params)
+      RequestValidation.fail!(400, :cookie, schema_validation:) if schema_validation.error?
       env[COOKIE_PARAMS] = unpacked_params
     end
 
     def validate_header_params!(operation, env)
-      header_parameters = operation.header_parameters
-      return if header_parameters.empty?
+      parameters = operation.header_parameters
+      return unless parameters
+
+      unpacked_params = parameters.unpack(env)
+      schema_validation = parameters.schema.validate(unpacked_params)
+      RequestValidation.fail!(400, :header, schema_validation:) if schema_validation.error?
+      env[HEADER_PARAMS] = unpacked_params
+    end
 
-      unpacked_header_params = OpenapiParameters::Header.new(header_parameters).unpack_env(env)
-      validation_result = operation.schemas.header_parameters_schema.validate(unpacked_header_params)
-      OpenapiFirst.error!(400, :header, validation_result:) if validation_result.error?
-      env[HEADER_PARAMS] = unpacked_header_params
+    def validate_request_body!(operation, env)
+      env[REQUEST_BODY] = RequestBodyValidator.new(operation, env).validate!
     end
   end
 end

data/lib/openapi_first/request_validation_error.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module OpenapiFirst
+  class RequestValidationError
+    def initialize(status:, location:, message: nil, schema_validation: nil)
+      @status = status
+      @location = location
+      @message = message
+      @schema_validation = schema_validation
+    end
+
+    attr_reader :status, :request, :location, :schema_validation
+
+    def message
+      @message || schema_validation&.message || Rack::Utils::HTTP_STATUS_CODES[status]
+    end
+
+    def error_message
+      "#{TOPICS.fetch(location)} #{message}"
+    end
+
+    TOPICS = {
+      body: 'Request body invalid:',
+      query: 'Query parameter invalid:',
+      header: 'Header parameter invalid:',
+      path: 'Path segment invalid:',
+      cookie: 'Cookie value invalid:'
+    }.freeze
+    private_constant :TOPICS
+  end
+end

data/lib/openapi_first/response_validation.rb

@@ -22,18 +22,39 @@ module OpenapiFirst
 
     def validate(response, operation)
       status, headers, body = response.to_a
-      return validate_status_only(operation, status) if status == 204
+      response_definition = response_for(operation, status)
 
-      content_type = headers[Rack::CONTENT_TYPE]
-      response_schema = operation.response_body_schema(status, content_type)
-      validate_response_body(response_schema, body) if response_schema
-      validate_response_headers(operation, status, headers)
+      validate_response_headers(response_definition.headers, headers, openapi_version: operation.openapi_version)
+
+      return if no_content?(response_definition)
+
+      content_type = Rack::Response[status, headers, body].content_type
+      raise ResponseInvalid, "Response has no content-type for '#{operation.name}'" unless content_type
+
+      response_schema = response_definition.schema_for(content_type)
+      unless response_schema
+        message = "Response content type not found '#{content_type}' for '#{operation.name}'"
+        raise ResponseContentTypeNotFoundError, message
+      end
+      validate_response_body(response_schema, body)
     end
 
     private
 
+    def no_content?(response_definition)
+      response_definition.status == 204 || !response_definition.content?
+    end
+
+    def response_for(operation, status)
+      response = operation.response_for(status)
+      return response if response
+
+      message = "Response status code or default not found: #{status} for '#{operation.name}'"
+      raise OpenapiFirst::ResponseCodeNotFoundError, message
+    end
+
     def validate_status_only(operation, status)
-      operation.response_for(status)
+      response_for(operation, status)
     end
 
     def validate_response_body(schema, response)
@@ -44,15 +65,14 @@ module OpenapiFirst
       raise ResponseBodyInvalidError, validation.message if validation.error?
     end
 
-    def validate_response_headers(operation, status, response_headers)
-      response_header_definitions = operation.response_for(status)&.dig('headers')
+    def validate_response_headers(response_header_definitions, response_headers, openapi_version:)
       return unless response_header_definitions
 
       unpacked_headers = unpack_response_headers(response_header_definitions, response_headers)
       response_header_definitions.each do |name, definition|
         next if name == 'Content-Type'
 
-        validate_response_header(name, definition, unpacked_headers, openapi_version: operation.openapi_version)
+        validate_response_header(name, definition, unpacked_headers, openapi_version:)
       end
     end
 
@@ -65,15 +85,15 @@ module OpenapiFirst
 
       return unless definition.key?('schema')
 
-      validation = SchemaValidation.new(definition['schema'], openapi_version:)
+      validation = Schema.new(definition['schema'], openapi_version:)
       value = unpacked_headers[name]
-      validation_result = validation.validate(value)
-      raise ResponseHeaderInvalidError, validation_result.message if validation_result.error?
+      schema_validation = validation.validate(value)
+      raise ResponseHeaderInvalidError, schema_validation.message if schema_validation.error?
     end
 
     def unpack_response_headers(response_header_definitions, response_headers)
       headers_as_parameters = response_header_definitions.map do |name, definition|
-        definition.merge('name' => name)
+        definition.merge('name' => name, 'in' => 'header')
       end
       OpenapiParameters::Header.new(headers_as_parameters).unpack(response_headers)
     end

data/lib/openapi_first/response_validator.rb

@@ -4,6 +4,7 @@ require_relative 'response_validation'
 require_relative 'router'
 
 module OpenapiFirst
+  # A class to run manual response validation
   class ResponseValidator
     def initialize(spec)
       @spec = spec