@backstage/backend-openapi-utils 0.1.19-next.0 → 0.2.0-next.1

package/dist/schema/response-body-validation.cjs.js

@@ -0,0 +1,125 @@
+'use strict';
+
+var errors = require('./errors.cjs.js');
+
+class DisabledResponseBodyParser {
+  operation;
+  constructor(operation) {
+    this.operation = operation;
+  }
+  async parse(response) {
+    const body = await response.text();
+    if (body?.length) {
+      throw new errors.OperationError(
+        this.operation,
+        "Received a body but no schema was found"
+      );
+    }
+    return void 0;
+  }
+}
+class ResponseBodyParser {
+  operation;
+  ajv;
+  static fromOperation(operation, options) {
+    return operation.schema.responses && Object.keys(operation.schema.responses).length ? new ResponseBodyParser(operation, options) : new DisabledResponseBodyParser(operation);
+  }
+  constructor(operation, options) {
+    this.operation = operation;
+    this.ajv = options.ajv;
+    const responseSchemas = operation.schema.responses;
+    for (const [statusCode, schema] of Object.entries(responseSchemas)) {
+      const contentTypes = schema.content;
+      if (!contentTypes) {
+        continue;
+      }
+      const jsonContentType = Object.keys(contentTypes).find(
+        (contentType) => contentType.split(";").includes("application/json")
+      );
+      if (!jsonContentType) {
+        throw new errors.OperationError(
+          this.operation,
+          `No application/json content type found in response for status code ${statusCode}`
+        );
+      } else if ("$ref" in contentTypes[jsonContentType].schema) {
+        throw new errors.OperationError(
+          this.operation,
+          "Reference objects are not supported"
+        );
+      }
+    }
+  }
+  async parse(response) {
+    const body = await response.text();
+    const responseSchema = this.findResponseSchema(
+      this.operation.schema,
+      response
+    );
+    if (!responseSchema?.content && !body?.length) {
+      return void 0;
+    }
+    if (!responseSchema) {
+      throw new errors.OperationResponseError(
+        this.operation,
+        response,
+        `No schema found.`
+      );
+    }
+    const contentTypes = responseSchema.content;
+    if (!contentTypes && body?.length) {
+      throw new errors.OperationResponseError(
+        this.operation,
+        response,
+        "Received a body but no schema was found"
+      );
+    }
+    const jsonContentType = Object.keys(contentTypes ?? {}).find(
+      (contentType) => contentType.split(";").includes("application/json")
+    );
+    if (!jsonContentType) {
+      throw new errors.OperationResponseError(
+        this.operation,
+        response,
+        "No application/json content type found in response"
+      );
+    }
+    const schema = responseSchema.content[jsonContentType].schema;
+    if (!schema) {
+      throw new errors.OperationError(this.operation, "No schema found in response");
+    }
+    if ("$ref" in schema) {
+      throw new errors.OperationResponseError(
+        this.operation,
+        response,
+        "Reference objects are not supported"
+      );
+    }
+    if (!schema.required && !body?.length) {
+      throw new errors.OperationResponseError(
+        this.operation,
+        response,
+        "Response body is required but missing"
+      );
+    } else if (!schema.required && !body?.length) {
+      return void 0;
+    }
+    const validate = this.ajv.compile(schema);
+    const jsonBody = await response.json();
+    const valid = validate(jsonBody);
+    if (!valid) {
+      throw new errors.OperationParsingResponseError(
+        this.operation,
+        response,
+        "Response body",
+        validate.errors
+      );
+    }
+    return jsonBody;
+  }
+  findResponseSchema(operationSchema, { status }) {
+    return operationSchema.responses?.[status] ?? operationSchema.responses?.default;
+  }
+}
+
+exports.ResponseBodyParser = ResponseBodyParser;
+//# sourceMappingURL=response-body-validation.cjs.js.map

package/dist/schema/response-body-validation.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-body-validation.cjs.js","sources":["../../src/schema/response-body-validation.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { JsonObject } from '@backstage/types';\nimport { Operation, ParserOptions, ResponseParser } from './types';\nimport {\n  OperationError,\n  OperationParsingResponseError,\n  OperationResponseError,\n} from './errors';\nimport Ajv from 'ajv';\nimport { OperationObject, ResponseObject } from 'openapi3-ts';\n\nclass DisabledResponseBodyParser\n  implements ResponseParser<JsonObject | undefined>\n{\n  operation: Operation;\n  constructor(operation: Operation) {\n    this.operation = operation;\n  }\n  async parse(response: Response): Promise<JsonObject | undefined> {\n    const body = await response.text();\n    if (body?.length) {\n      throw new OperationError(\n        this.operation,\n        'Received a body but no schema was found',\n      );\n    }\n    return undefined;\n  }\n}\n\nexport class ResponseBodyParser\n  implements ResponseParser<JsonObject | undefined>\n{\n  operation: Operation;\n  ajv: Ajv;\n\n  static fromOperation(operation: Operation, options: ParserOptions) {\n    return operation.schema.responses &&\n      Object.keys(operation.schema.responses).length\n      ? new ResponseBodyParser(operation, options)\n      : new DisabledResponseBodyParser(operation);\n  }\n\n  constructor(operation: Operation, options: ParserOptions) {\n    this.operation = operation;\n    this.ajv = options.ajv;\n    const responseSchemas = operation.schema.responses;\n    for (const [statusCode, schema] of Object.entries(responseSchemas)) {\n      const contentTypes = schema.content;\n      if (!contentTypes) {\n        // Skip responses without content, eg 204 No Content.\n        continue;\n      }\n      const jsonContentType = Object.keys(contentTypes).find(contentType =>\n        contentType.split(';').includes('application/json'),\n      );\n      if (!jsonContentType) {\n        throw new OperationError(\n          this.operation,\n          `No application/json content type found in response for status code ${statusCode}`,\n        );\n      } else if ('$ref' in contentTypes[jsonContentType].schema) {\n        throw new OperationError(\n          this.operation,\n          'Reference objects are not supported',\n        );\n      }\n    }\n  }\n\n  async parse(response: Response): Promise<JsonObject | undefined> {\n    const body = await response.text();\n    const responseSchema = this.findResponseSchema(\n      this.operation.schema,\n      response,\n    );\n    if (!responseSchema?.content && !body?.length) {\n      // If there is no content in the response schema and no body in the response, then the response is valid.\n      // eg 204 No Content\n      return undefined;\n    }\n    if (!responseSchema) {\n      throw new OperationResponseError(\n        this.operation,\n        response,\n        `No schema found.`,\n      );\n    }\n\n    const contentTypes = responseSchema.content;\n    if (!contentTypes && body?.length) {\n      throw new OperationResponseError(\n        this.operation,\n        response,\n        'Received a body but no schema was found',\n      );\n    }\n    const jsonContentType = Object.keys(contentTypes ?? {}).find(contentType =>\n      contentType.split(';').includes('application/json'),\n    );\n    if (!jsonContentType) {\n      throw new OperationResponseError(\n        this.operation,\n        response,\n        'No application/json content type found in response',\n      );\n    }\n    const schema = responseSchema.content![jsonContentType].schema;\n    // This is a bit of type laziness. Ideally, this would be a type-narrowing function, but I wasn't able to get the types to work.\n    if (!schema) {\n      throw new OperationError(this.operation, 'No schema found in response');\n    }\n    if ('$ref' in schema) {\n      throw new OperationResponseError(\n        this.operation,\n        response,\n        'Reference objects are not supported',\n      );\n    }\n\n    if (!schema.required && !body?.length) {\n      throw new OperationResponseError(\n        this.operation,\n        response,\n        'Response body is required but missing',\n      );\n    } else if (!schema.required && !body?.length) {\n      // If there is no content in the response schema and no body in the response, then the response is valid\n      return undefined;\n    }\n\n    const validate = this.ajv.compile(schema);\n    const jsonBody = (await response.json()) as JsonObject;\n    const valid = validate(jsonBody);\n    if (!valid) {\n      throw new OperationParsingResponseError(\n        this.operation,\n        response,\n        'Response body',\n        validate.errors!,\n      );\n    }\n    return jsonBody;\n  }\n\n  private findResponseSchema(\n    operationSchema: OperationObject,\n    { status }: Response,\n  ): ResponseObject | undefined {\n    return (\n      operationSchema.responses?.[status] ?? operationSchema.responses?.default\n    );\n  }\n}\n"],"names":["OperationError","OperationResponseError","OperationParsingResponseError"],"mappings":";;;;AA0BA,MAAM,0BAEN,CAAA;AAAA,EACE,SAAA,CAAA;AAAA,EACA,YAAY,SAAsB,EAAA;AAChC,IAAA,IAAA,CAAK,SAAY,GAAA,SAAA,CAAA;AAAA,GACnB;AAAA,EACA,MAAM,MAAM,QAAqD,EAAA;AAC/D,IAAM,MAAA,IAAA,GAAO,MAAM,QAAA,CAAS,IAAK,EAAA,CAAA;AACjC,IAAA,IAAI,MAAM,MAAQ,EAAA;AAChB,MAAA,MAAM,IAAIA,qBAAA;AAAA,QACR,IAAK,CAAA,SAAA;AAAA,QACL,yCAAA;AAAA,OACF,CAAA;AAAA,KACF;AACA,IAAO,OAAA,KAAA,CAAA,CAAA;AAAA,GACT;AACF,CAAA;AAEO,MAAM,kBAEb,CAAA;AAAA,EACE,SAAA,CAAA;AAAA,EACA,GAAA,CAAA;AAAA,EAEA,OAAO,aAAc,CAAA,SAAA,EAAsB,OAAwB,EAAA;AACjE,IAAA,OAAO,UAAU,MAAO,CAAA,SAAA,IACtB,MAAO,CAAA,IAAA,CAAK,UAAU,MAAO,CAAA,SAAS,CAAE,CAAA,MAAA,GACtC,IAAI,kBAAmB,CAAA,SAAA,EAAW,OAAO,CACzC,GAAA,IAAI,2BAA2B,SAAS,CAAA,CAAA;AAAA,GAC9C;AAAA,EAEA,WAAA,CAAY,WAAsB,OAAwB,EAAA;AACxD,IAAA,IAAA,CAAK,SAAY,GAAA,SAAA,CAAA;AACjB,IAAA,IAAA,CAAK,MAAM,OAAQ,CAAA,GAAA,CAAA;AACnB,IAAM,MAAA,eAAA,GAAkB,UAAU,MAAO,CAAA,SAAA,CAAA;AACzC,IAAA,KAAA,MAAW,CAAC,UAAY,EAAA,MAAM,KAAK,MAAO,CAAA,OAAA,CAAQ,eAAe,CAAG,EAAA;AAClE,MAAA,MAAM,eAAe,MAAO,CAAA,OAAA,CAAA;AAC5B,MAAA,IAAI,CAAC,YAAc,EAAA;AAEjB,QAAA,SAAA;AAAA,OACF;AACA,MAAA,MAAM,eAAkB,GAAA,MAAA,CAAO,IAAK,CAAA,YAAY,CAAE,CAAA,IAAA;AAAA,QAAK,iBACrD,WAAY,CAAA,KAAA,CAAM,GAAG,CAAA,CAAE,SAAS,kBAAkB,CAAA;AAAA,OACpD,CAAA;AACA,MAAA,IAAI,CAAC,eAAiB,EAAA;AACpB,QAAA,MAAM,IAAIA,qBAAA;AAAA,UACR,IAAK,CAAA,SAAA;AAAA,UACL,sEAAsE,UAAU,CAAA,CAAA;AAAA,SAClF,CAAA;AAAA,OACS,MAAA,IAAA,MAAA,IAAU,YAAa,CAAA,eAAe,EAAE,MAAQ,EAAA;AACzD,QAAA,MAAM,IAAIA,qBAAA;AAAA,UACR,IAAK,CAAA,SAAA;AAAA,UACL,qCAAA;AAAA,SACF,CAAA;AAAA,OACF;AAAA,KACF;AAAA,GACF;AAAA,EAEA,MAAM,MAAM,QAAqD,EAAA;AAC/D,IAAM,MAAA,IAAA,GAAO,MAAM,QAAA,CAAS,IAAK,EAAA,CAAA;AACjC,IAAA,MAAM,iBAAiB,IAAK,CAAA,kBAAA;AAAA,MAC1B,KAAK,SAAU,CAAA,MAAA;AAAA,MACf,QAAA;AAAA,KACF,CAAA;AACA,IAAA,IAAI,CAAC,cAAA,EAAgB,OAAW,IAAA,CAAC,MAAM,MAAQ,EAAA;AAG7C,MAAO,OAAA,KAAA,CAAA,CAAA;AAAA,KACT;AACA,IAAA,IAAI,CAAC,cAAgB,EAAA;AACnB,MAAA,MAAM,IAAIC,6BAAA;AAAA,QACR,IAAK,CAAA,SAAA;AAAA,QACL,QAAA;AAAA,QACA,CAAA,gBAAA,CAAA;AAAA,OACF,CAAA;AAAA,KACF;AAEA,IAAA,MAAM,eAAe,cAAe,CAAA,OAAA,CAAA;AACpC,IAAI,IAAA,CAAC,YAAgB,IAAA,IAAA,EAAM,MAAQ,EAAA;AACjC,MAAA,MAAM,IAAIA,6BAAA;AAAA,QACR,IAAK,CAAA,SAAA;AAAA,QACL,QAAA;AAAA,QACA,yCAAA;AAAA,OACF,CAAA;AAAA,KACF;AACA,IAAA,MAAM,kBAAkB,MAAO,CAAA,IAAA,CAAK,YAAgB,IAAA,EAAE,CAAE,CAAA,IAAA;AAAA,MAAK,iBAC3D,WAAY,CAAA,KAAA,CAAM,GAAG,CAAA,CAAE,SAAS,kBAAkB,CAAA;AAAA,KACpD,CAAA;AACA,IAAA,IAAI,CAAC,eAAiB,EAAA;AACpB,MAAA,MAAM,IAAIA,6BAAA;AAAA,QACR,IAAK,CAAA,SAAA;AAAA,QACL,QAAA;AAAA,QACA,oDAAA;AAAA,OACF,CAAA;AAAA,KACF;AACA,IAAA,MAAM,MAAS,GAAA,cAAA,CAAe,OAAS,CAAA,eAAe,CAAE,CAAA,MAAA,CAAA;AAExD,IAAA,IAAI,CAAC,MAAQ,EAAA;AACX,MAAA,MAAM,IAAID,qBAAA,CAAe,IAAK,CAAA,SAAA,EAAW,6BAA6B,CAAA,CAAA;AAAA,KACxE;AACA,IAAA,IAAI,UAAU,MAAQ,EAAA;AACpB,MAAA,MAAM,IAAIC,6BAAA;AAAA,QACR,IAAK,CAAA,SAAA;AAAA,QACL,QAAA;AAAA,QACA,qCAAA;AAAA,OACF,CAAA;AAAA,KACF;AAEA,IAAA,IAAI,CAAC,MAAA,CAAO,QAAY,IAAA,CAAC,MAAM,MAAQ,EAAA;AACrC,MAAA,MAAM,IAAIA,6BAAA;AAAA,QACR,IAAK,CAAA,SAAA;AAAA,QACL,QAAA;AAAA,QACA,uCAAA;AAAA,OACF,CAAA;AAAA,eACS,CAAC,MAAA,CAAO,QAAY,IAAA,CAAC,MAAM,MAAQ,EAAA;AAE5C,MAAO,OAAA,KAAA,CAAA,CAAA;AAAA,KACT;AAEA,IAAA,MAAM,QAAW,GAAA,IAAA,CAAK,GAAI,CAAA,OAAA,CAAQ,MAAM,CAAA,CAAA;AACxC,IAAM,MAAA,QAAA,GAAY,MAAM,QAAA,CAAS,IAAK,EAAA,CAAA;AACtC,IAAM,MAAA,KAAA,GAAQ,SAAS,QAAQ,CAAA,CAAA;AAC/B,IAAA,IAAI,CAAC,KAAO,EAAA;AACV,MAAA,MAAM,IAAIC,oCAAA;AAAA,QACR,IAAK,CAAA,SAAA;AAAA,QACL,QAAA;AAAA,QACA,eAAA;AAAA,QACA,QAAS,CAAA,MAAA;AAAA,OACX,CAAA;AAAA,KACF;AACA,IAAO,OAAA,QAAA,CAAA;AAAA,GACT;AAAA,EAEQ,kBACN,CAAA,eAAA,EACA,EAAE,MAAA,EAC0B,EAAA;AAC5B,IAAA,OACE,eAAgB,CAAA,SAAA,GAAY,MAAM,CAAA,IAAK,gBAAgB,SAAW,EAAA,OAAA,CAAA;AAAA,GAEtE;AACF;;;;"}

package/dist/schema/utils.cjs.js

@@ -0,0 +1,38 @@
+'use strict';
+
+function mockttpToFetchRequest(request) {
+  const headers = new Headers(request.rawHeaders);
+  return {
+    url: request.url,
+    method: request.method,
+    headers,
+    json: () => request.body.getJson(),
+    text: () => request.body.getText()
+  };
+}
+function mockttpToFetchResponse(response) {
+  const headers = new Headers(response.rawHeaders);
+  return {
+    status: response.statusCode,
+    headers,
+    json: () => response.body?.getJson(),
+    text: () => response.body?.getText()
+  };
+}
+function humanifyAjvError(error) {
+  switch (error.keyword) {
+    case "required":
+      return `The "${error.params.missingProperty}" property is required`;
+    case "type":
+      return `${error.instancePath ? `"${error.instancePath}"` : "Value"} should be of type ${error.params.type}`;
+    case "additionalProperties":
+      return `The "${error.params.additionalProperty}" property is not allowed`;
+    default:
+      return error.message;
+  }
+}
+
+exports.humanifyAjvError = humanifyAjvError;
+exports.mockttpToFetchRequest = mockttpToFetchRequest;
+exports.mockttpToFetchResponse = mockttpToFetchResponse;
+//# sourceMappingURL=utils.cjs.js.map

package/dist/schema/utils.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.cjs.js","sources":["../../src/schema/utils.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { CompletedRequest, CompletedResponse } from 'mockttp';\nimport { ErrorObject } from 'ajv';\n\nexport function mockttpToFetchRequest(request: CompletedRequest) {\n  const headers = new Headers(request.rawHeaders);\n  return {\n    url: request.url,\n    method: request.method,\n    headers,\n    json: () => request.body.getJson(),\n    text: () => request.body.getText(),\n  } as Request;\n}\nexport function mockttpToFetchResponse(response: CompletedResponse) {\n  const headers = new Headers(response.rawHeaders);\n  return {\n    status: response.statusCode,\n    headers,\n    json: () => response.body?.getJson(),\n    text: () => response.body?.getText(),\n  } as Response;\n}\n\nexport function humanifyAjvError(error: ErrorObject) {\n  switch (error.keyword) {\n    case 'required':\n      return `The \"${error.params.missingProperty}\" property is required`;\n    case 'type':\n      return `${\n        error.instancePath ? `\"${error.instancePath}\"` : 'Value'\n      } should be of type ${error.params.type}`;\n    case 'additionalProperties':\n      return `The \"${error.params.additionalProperty}\" property is not allowed`;\n    default:\n      return error.message;\n  }\n}\n"],"names":[],"mappings":";;AAkBO,SAAS,sBAAsB,OAA2B,EAAA;AAC/D,EAAA,MAAM,OAAU,GAAA,IAAI,OAAQ,CAAA,OAAA,CAAQ,UAAU,CAAA,CAAA;AAC9C,EAAO,OAAA;AAAA,IACL,KAAK,OAAQ,CAAA,GAAA;AAAA,IACb,QAAQ,OAAQ,CAAA,MAAA;AAAA,IAChB,OAAA;AAAA,IACA,IAAM,EAAA,MAAM,OAAQ,CAAA,IAAA,CAAK,OAAQ,EAAA;AAAA,IACjC,IAAM,EAAA,MAAM,OAAQ,CAAA,IAAA,CAAK,OAAQ,EAAA;AAAA,GACnC,CAAA;AACF,CAAA;AACO,SAAS,uBAAuB,QAA6B,EAAA;AAClE,EAAA,MAAM,OAAU,GAAA,IAAI,OAAQ,CAAA,QAAA,CAAS,UAAU,CAAA,CAAA;AAC/C,EAAO,OAAA;AAAA,IACL,QAAQ,QAAS,CAAA,UAAA;AAAA,IACjB,OAAA;AAAA,IACA,IAAM,EAAA,MAAM,QAAS,CAAA,IAAA,EAAM,OAAQ,EAAA;AAAA,IACnC,IAAM,EAAA,MAAM,QAAS,CAAA,IAAA,EAAM,OAAQ,EAAA;AAAA,GACrC,CAAA;AACF,CAAA;AAEO,SAAS,iBAAiB,KAAoB,EAAA;AACnD,EAAA,QAAQ,MAAM,OAAS;AAAA,IACrB,KAAK,UAAA;AACH,MAAO,OAAA,CAAA,KAAA,EAAQ,KAAM,CAAA,MAAA,CAAO,eAAe,CAAA,sBAAA,CAAA,CAAA;AAAA,IAC7C,KAAK,MAAA;AACH,MAAO,OAAA,CAAA,EACL,KAAM,CAAA,YAAA,GAAe,CAAI,CAAA,EAAA,KAAA,CAAM,YAAY,CAAA,CAAA,CAAA,GAAM,OACnD,CAAA,mBAAA,EAAsB,KAAM,CAAA,MAAA,CAAO,IAAI,CAAA,CAAA,CAAA;AAAA,IACzC,KAAK,sBAAA;AACH,MAAO,OAAA,CAAA,KAAA,EAAQ,KAAM,CAAA,MAAA,CAAO,kBAAkB,CAAA,yBAAA,CAAA,CAAA;AAAA,IAChD;AACE,MAAA,OAAO,KAAM,CAAA,OAAA,CAAA;AAAA,GACjB;AACF;;;;;;"}

package/dist/schema/validation.cjs.js

@@ -0,0 +1,116 @@
+'use strict';
+
+var Ajv = require('ajv');
+var Parser = require('@apidevtools/swagger-parser');
+var parameterValidation = require('./parameter-validation.cjs.js');
+var errors = require('./errors.cjs.js');
+var requestBodyValidation = require('./request-body-validation.cjs.js');
+var utils = require('./utils.cjs.js');
+var responseBodyValidation = require('./response-body-validation.cjs.js');
+
+function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
+
+var Ajv__default = /*#__PURE__*/_interopDefaultCompat(Ajv);
+var Parser__default = /*#__PURE__*/_interopDefaultCompat(Parser);
+
+const ajv = new Ajv__default.default({ allErrors: true });
+class RequestBodyValidator {
+  schema;
+  constructor(schema) {
+    this.schema = schema;
+  }
+  async validate({ pair, operation }) {
+    const { request, response } = pair;
+    if (response.statusCode === 400) {
+      return;
+    }
+    const parser = requestBodyValidation.RequestBodyParser.fromOperation(operation, { ajv });
+    const fetchRequest = utils.mockttpToFetchRequest(request);
+    await parser.parse(fetchRequest);
+  }
+}
+class ResponseBodyValidator {
+  schema;
+  constructor(schema) {
+    this.schema = schema;
+  }
+  async validate({ pair, operation }) {
+    const { response } = pair;
+    const parser = responseBodyValidation.ResponseBodyParser.fromOperation(operation, { ajv });
+    const fetchResponse = utils.mockttpToFetchResponse(response);
+    await parser.parse(fetchResponse);
+  }
+}
+function findOperationByRequest(openApiSchema, request) {
+  const { url } = request;
+  const { pathname } = new URL(url);
+  const parts = pathname.split("/");
+  for (const [path, schema] of Object.entries(openApiSchema.paths)) {
+    const pathParts = path.split("/");
+    if (parts.length !== pathParts.length) {
+      continue;
+    }
+    let found = true;
+    for (let i = 0; i < parts.length; i++) {
+      if (pathParts[i] === parts[i]) {
+        continue;
+      }
+      if (pathParts[i].startsWith("{") && pathParts[i].endsWith("}")) {
+        continue;
+      }
+      found = false;
+      break;
+    }
+    if (!found) {
+      continue;
+    }
+    let matchingOperationType = void 0;
+    for (const [operationType, operation] of Object.entries(schema)) {
+      if (operationType === request.method.toLowerCase()) {
+        matchingOperationType = operation;
+        break;
+      }
+    }
+    if (!matchingOperationType) {
+      continue;
+    }
+    return [path, matchingOperationType];
+  }
+  return void 0;
+}
+class OpenApiProxyValidator {
+  schema;
+  validators;
+  async initialize(url) {
+    this.schema = await Parser__default.default.dereference(url);
+    this.validators = [
+      new parameterValidation.ParameterValidator(this.schema),
+      new RequestBodyValidator(this.schema),
+      new ResponseBodyValidator(this.schema)
+    ];
+  }
+  async validate(request, response) {
+    const operationPathTuple = findOperationByRequest(this.schema, request);
+    if (!operationPathTuple) {
+      throw new errors.OperationError(
+        { path: request.path, method: request.method },
+        `No operation schema found for ${request.url}`
+      );
+    }
+    const [path, operationSchema] = operationPathTuple;
+    const operation = { path, method: request.method, schema: operationSchema };
+    const validators = this.validators;
+    await Promise.all(
+      validators.map(
+        (validator) => validator.validate({
+          pair: { request, response },
+          operation
+        })
+      )
+    );
+  }
+}
+
+exports.OpenApiProxyValidator = OpenApiProxyValidator;
+exports.findOperationByRequest = findOperationByRequest;
+//# sourceMappingURL=validation.cjs.js.map

package/dist/schema/validation.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.cjs.js","sources":["../../src/schema/validation.ts"],"sourcesContent":["/*\n * Copyright 2024 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { CompletedRequest, CompletedResponse } from 'mockttp';\nimport { OpenAPIObject, OperationObject } from 'openapi3-ts';\nimport Ajv from 'ajv';\nimport Parser from '@apidevtools/swagger-parser';\nimport { Operation, Validator, ValidatorParams } from './types';\nimport { ParameterValidator } from './parameter-validation';\nimport { OperationError } from './errors';\nimport { RequestBodyParser } from './request-body-validation';\nimport { mockttpToFetchRequest, mockttpToFetchResponse } from './utils';\nimport { ResponseBodyParser } from './response-body-validation';\n\nconst ajv = new Ajv({ allErrors: true });\n\nclass RequestBodyValidator implements Validator {\n  schema: OpenAPIObject;\n  constructor(schema: OpenAPIObject) {\n    this.schema = schema;\n  }\n\n  async validate({ pair, operation }: ValidatorParams) {\n    const { request, response } = pair;\n    if (response.statusCode === 400) {\n      // If the response is a 400, then the request is invalid and we shouldn't validate the parameters\n      return;\n    }\n\n    // NOTE: There may be a worthwhile optimization here to cache these results to avoid re-parsing the schema for every request. As is, I don't think this is a big deal.\n    const parser = RequestBodyParser.fromOperation(operation, { ajv });\n    const fetchRequest = mockttpToFetchRequest(request);\n    await parser.parse(fetchRequest);\n  }\n}\n\nclass ResponseBodyValidator implements Validator {\n  schema: OpenAPIObject;\n  constructor(schema: OpenAPIObject) {\n    this.schema = schema;\n  }\n\n  async validate({ pair, operation }: ValidatorParams) {\n    const { response } = pair;\n    // NOTE: There may be a worthwhile optimization here to cache these results to avoid re-parsing the schema for every request. As is, I don't think this is a big deal.\n    const parser = ResponseBodyParser.fromOperation(operation, { ajv });\n    const fetchResponse = mockttpToFetchResponse(response);\n    await parser.parse(fetchResponse);\n  }\n}\n\n/**\n * Find an operation in an OpenAPI schema that matches a request. This is done by comparing the request URL to the paths in the schema.\n * @param openApiSchema - The OpenAPI schema to search for the operation in.\n * @param request - The request to find the operation for.\n * @returns A tuple of the path and the operation object that matches the request.\n */\nexport function findOperationByRequest(\n  openApiSchema: OpenAPIObject,\n  request: CompletedRequest,\n): [string, OperationObject] | undefined {\n  const { url } = request;\n  const { pathname } = new URL(url);\n\n  const parts = pathname.split('/');\n  for (const [path, schema] of Object.entries(openApiSchema.paths)) {\n    const pathParts = path.split('/');\n    if (parts.length !== pathParts.length) {\n      continue;\n    }\n    let found = true;\n    for (let i = 0; i < parts.length; i++) {\n      if (pathParts[i] === parts[i]) {\n        continue;\n      }\n      // If the path part is a parameter, we can count it as a match. eg /api/{id} will match /api/1\n      if (pathParts[i].startsWith('{') && pathParts[i].endsWith('}')) {\n        continue;\n      }\n      found = false;\n      break;\n    }\n    if (!found) {\n      continue;\n    }\n    let matchingOperationType: OperationObject | undefined = undefined;\n    for (const [operationType, operation] of Object.entries(schema)) {\n      if (operationType === request.method.toLowerCase()) {\n        matchingOperationType = operation as OperationObject;\n        break;\n      }\n    }\n    if (!matchingOperationType) {\n      continue;\n    }\n    return [path, matchingOperationType];\n  }\n\n  return undefined;\n}\n\nexport class OpenApiProxyValidator {\n  schema: OpenAPIObject | undefined;\n  validators: Validator[] | undefined;\n\n  async initialize(url: string) {\n    this.schema = (await Parser.dereference(url)) as unknown as OpenAPIObject;\n    this.validators = [\n      new ParameterValidator(this.schema),\n      new RequestBodyValidator(this.schema),\n      new ResponseBodyValidator(this.schema),\n    ];\n  }\n\n  async validate(request: CompletedRequest, response: CompletedResponse) {\n    const operationPathTuple = findOperationByRequest(this.schema!, request);\n    if (!operationPathTuple) {\n      throw new OperationError(\n        { path: request.path, method: request.method } as Operation,\n        `No operation schema found for ${request.url}`,\n      );\n    }\n\n    const [path, operationSchema] = operationPathTuple;\n    const operation = { path, method: request.method, schema: operationSchema };\n\n    const validators = this.validators!;\n    await Promise.all(\n      validators.map(validator =>\n        validator.validate({\n          pair: { request, response },\n          operation,\n        }),\n      ),\n    );\n  }\n}\n"],"names":["Ajv","RequestBodyParser","mockttpToFetchRequest","ResponseBodyParser","mockttpToFetchResponse","Parser","ParameterValidator","OperationError"],"mappings":";;;;;;;;;;;;;;;AA0BA,MAAM,MAAM,IAAIA,oBAAA,CAAI,EAAE,SAAA,EAAW,MAAM,CAAA,CAAA;AAEvC,MAAM,oBAA0C,CAAA;AAAA,EAC9C,MAAA,CAAA;AAAA,EACA,YAAY,MAAuB,EAAA;AACjC,IAAA,IAAA,CAAK,MAAS,GAAA,MAAA,CAAA;AAAA,GAChB;AAAA,EAEA,MAAM,QAAA,CAAS,EAAE,IAAA,EAAM,WAA8B,EAAA;AACnD,IAAM,MAAA,EAAE,OAAS,EAAA,QAAA,EAAa,GAAA,IAAA,CAAA;AAC9B,IAAI,IAAA,QAAA,CAAS,eAAe,GAAK,EAAA;AAE/B,MAAA,OAAA;AAAA,KACF;AAGA,IAAA,MAAM,SAASC,uCAAkB,CAAA,aAAA,CAAc,SAAW,EAAA,EAAE,KAAK,CAAA,CAAA;AACjE,IAAM,MAAA,YAAA,GAAeC,4BAAsB,OAAO,CAAA,CAAA;AAClD,IAAM,MAAA,MAAA,CAAO,MAAM,YAAY,CAAA,CAAA;AAAA,GACjC;AACF,CAAA;AAEA,MAAM,qBAA2C,CAAA;AAAA,EAC/C,MAAA,CAAA;AAAA,EACA,YAAY,MAAuB,EAAA;AACjC,IAAA,IAAA,CAAK,MAAS,GAAA,MAAA,CAAA;AAAA,GAChB;AAAA,EAEA,MAAM,QAAA,CAAS,EAAE,IAAA,EAAM,WAA8B,EAAA;AACnD,IAAM,MAAA,EAAE,UAAa,GAAA,IAAA,CAAA;AAErB,IAAA,MAAM,SAASC,yCAAmB,CAAA,aAAA,CAAc,SAAW,EAAA,EAAE,KAAK,CAAA,CAAA;AAClE,IAAM,MAAA,aAAA,GAAgBC,6BAAuB,QAAQ,CAAA,CAAA;AACrD,IAAM,MAAA,MAAA,CAAO,MAAM,aAAa,CAAA,CAAA;AAAA,GAClC;AACF,CAAA;AAQgB,SAAA,sBAAA,CACd,eACA,OACuC,EAAA;AACvC,EAAM,MAAA,EAAE,KAAQ,GAAA,OAAA,CAAA;AAChB,EAAA,MAAM,EAAE,QAAA,EAAa,GAAA,IAAI,IAAI,GAAG,CAAA,CAAA;AAEhC,EAAM,MAAA,KAAA,GAAQ,QAAS,CAAA,KAAA,CAAM,GAAG,CAAA,CAAA;AAChC,EAAW,KAAA,MAAA,CAAC,MAAM,MAAM,CAAA,IAAK,OAAO,OAAQ,CAAA,aAAA,CAAc,KAAK,CAAG,EAAA;AAChE,IAAM,MAAA,SAAA,GAAY,IAAK,CAAA,KAAA,CAAM,GAAG,CAAA,CAAA;AAChC,IAAI,IAAA,KAAA,CAAM,MAAW,KAAA,SAAA,CAAU,MAAQ,EAAA;AACrC,MAAA,SAAA;AAAA,KACF;AACA,IAAA,IAAI,KAAQ,GAAA,IAAA,CAAA;AACZ,IAAA,KAAA,IAAS,CAAI,GAAA,CAAA,EAAG,CAAI,GAAA,KAAA,CAAM,QAAQ,CAAK,EAAA,EAAA;AACrC,MAAA,IAAI,SAAU,CAAA,CAAC,CAAM,KAAA,KAAA,CAAM,CAAC,CAAG,EAAA;AAC7B,QAAA,SAAA;AAAA,OACF;AAEA,MAAI,IAAA,SAAA,CAAU,CAAC,CAAA,CAAE,UAAW,CAAA,GAAG,CAAK,IAAA,SAAA,CAAU,CAAC,CAAA,CAAE,QAAS,CAAA,GAAG,CAAG,EAAA;AAC9D,QAAA,SAAA;AAAA,OACF;AACA,MAAQ,KAAA,GAAA,KAAA,CAAA;AACR,MAAA,MAAA;AAAA,KACF;AACA,IAAA,IAAI,CAAC,KAAO,EAAA;AACV,MAAA,SAAA;AAAA,KACF;AACA,IAAA,IAAI,qBAAqD,GAAA,KAAA,CAAA,CAAA;AACzD,IAAA,KAAA,MAAW,CAAC,aAAe,EAAA,SAAS,KAAK,MAAO,CAAA,OAAA,CAAQ,MAAM,CAAG,EAAA;AAC/D,MAAA,IAAI,aAAkB,KAAA,OAAA,CAAQ,MAAO,CAAA,WAAA,EAAe,EAAA;AAClD,QAAwB,qBAAA,GAAA,SAAA,CAAA;AACxB,QAAA,MAAA;AAAA,OACF;AAAA,KACF;AACA,IAAA,IAAI,CAAC,qBAAuB,EAAA;AAC1B,MAAA,SAAA;AAAA,KACF;AACA,IAAO,OAAA,CAAC,MAAM,qBAAqB,CAAA,CAAA;AAAA,GACrC;AAEA,EAAO,OAAA,KAAA,CAAA,CAAA;AACT,CAAA;AAEO,MAAM,qBAAsB,CAAA;AAAA,EACjC,MAAA,CAAA;AAAA,EACA,UAAA,CAAA;AAAA,EAEA,MAAM,WAAW,GAAa,EAAA;AAC5B,IAAA,IAAA,CAAK,MAAU,GAAA,MAAMC,uBAAO,CAAA,WAAA,CAAY,GAAG,CAAA,CAAA;AAC3C,IAAA,IAAA,CAAK,UAAa,GAAA;AAAA,MAChB,IAAIC,sCAAmB,CAAA,IAAA,CAAK,MAAM,CAAA;AAAA,MAClC,IAAI,oBAAqB,CAAA,IAAA,CAAK,MAAM,CAAA;AAAA,MACpC,IAAI,qBAAsB,CAAA,IAAA,CAAK,MAAM,CAAA;AAAA,KACvC,CAAA;AAAA,GACF;AAAA,EAEA,MAAM,QAAS,CAAA,OAAA,EAA2B,QAA6B,EAAA;AACrE,IAAA,MAAM,kBAAqB,GAAA,sBAAA,CAAuB,IAAK,CAAA,MAAA,EAAS,OAAO,CAAA,CAAA;AACvE,IAAA,IAAI,CAAC,kBAAoB,EAAA;AACvB,MAAA,MAAM,IAAIC,qBAAA;AAAA,QACR,EAAE,IAAM,EAAA,OAAA,CAAQ,IAAM,EAAA,MAAA,EAAQ,QAAQ,MAAO,EAAA;AAAA,QAC7C,CAAA,8BAAA,EAAiC,QAAQ,GAAG,CAAA,CAAA;AAAA,OAC9C,CAAA;AAAA,KACF;AAEA,IAAM,MAAA,CAAC,IAAM,EAAA,eAAe,CAAI,GAAA,kBAAA,CAAA;AAChC,IAAA,MAAM,YAAY,EAAE,IAAA,EAAM,QAAQ,OAAQ,CAAA,MAAA,EAAQ,QAAQ,eAAgB,EAAA,CAAA;AAE1E,IAAA,MAAM,aAAa,IAAK,CAAA,UAAA,CAAA;AACxB,IAAA,MAAM,OAAQ,CAAA,GAAA;AAAA,MACZ,UAAW,CAAA,GAAA;AAAA,QAAI,CAAA,SAAA,KACb,UAAU,QAAS,CAAA;AAAA,UACjB,IAAA,EAAM,EAAE,OAAA,EAAS,QAAS,EAAA;AAAA,UAC1B,SAAA;AAAA,SACD,CAAA;AAAA,OACH;AAAA,KACF,CAAA;AAAA,GACF;AACF;;;;;"}

package/dist/stub.cjs.js

@@ -0,0 +1,89 @@
+'use strict';
+
+var PromiseRouter = require('express-promise-router');
+var express = require('express');
+var errors = require('@backstage/errors');
+var expressOpenapiValidator = require('express-openapi-validator');
+var constants = require('./constants.cjs.js');
+var openapiMerge = require('openapi-merge');
+
+function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
+
+var PromiseRouter__default = /*#__PURE__*/_interopDefaultCompat(PromiseRouter);
+
+const baseUrlSymbol = Symbol();
+const originalUrlSymbol = Symbol();
+function validatorErrorTransformer() {
+  return (error, _, _2, next) => {
+    next(new errors.InputError(error.message));
+  };
+}
+function getDefaultRouterMiddleware() {
+  return [express.json()];
+}
+function getOpenApiSpecRoute(baseUrl) {
+  return `${baseUrl}${constants.OPENAPI_SPEC_ROUTE}`;
+}
+function createValidatedOpenApiRouter(spec, options) {
+  const router = PromiseRouter__default.default();
+  router.use(options?.middleware || getDefaultRouterMiddleware());
+  router.use((req, _, next) => {
+    const customRequest = req;
+    customRequest[baseUrlSymbol] = customRequest.baseUrl;
+    customRequest.baseUrl = "";
+    customRequest[originalUrlSymbol] = customRequest.originalUrl;
+    customRequest.originalUrl = customRequest.url;
+    next();
+  });
+  router.use(
+    expressOpenapiValidator.middleware({
+      validateRequests: {
+        coerceTypes: false,
+        allowUnknownQueryParameters: false
+      },
+      ignoreUndocumented: true,
+      validateResponses: false,
+      ...options?.validatorOptions,
+      apiSpec: spec
+    })
+  );
+  router.use((req, _, next) => {
+    const customRequest = req;
+    customRequest.baseUrl = customRequest[baseUrlSymbol];
+    customRequest.originalUrl = customRequest[originalUrlSymbol];
+    delete customRequest[baseUrlSymbol];
+    delete customRequest[originalUrlSymbol];
+    next();
+  });
+  router.use(validatorErrorTransformer());
+  router.get(constants.OPENAPI_SPEC_ROUTE, async (req, res) => {
+    const mergeOutput = openapiMerge.merge([
+      {
+        oas: spec,
+        pathModification: {
+          /**
+           * Get the route that this OpenAPI spec is hosted on. The other
+           *  approach of using the discovery API increases the router constructor
+           *  significantly and since we're just looking for path and not full URL,
+           *  this works.
+           *
+           * If we wanted to add a list of servers, there may be a case for adding
+           *  discovery API to get an exhaustive list of upstream servers, but that's
+           *  also not currently supported.
+           */
+          prepend: req.originalUrl.replace(constants.OPENAPI_SPEC_ROUTE, "")
+        }
+      }
+    ]);
+    if (openapiMerge.isErrorResult(mergeOutput)) {
+      throw new errors.InputError("Invalid spec defined");
+    }
+    res.json(mergeOutput.output);
+  });
+  return router;
+}
+
+exports.createValidatedOpenApiRouter = createValidatedOpenApiRouter;
+exports.getDefaultRouterMiddleware = getDefaultRouterMiddleware;
+exports.getOpenApiSpecRoute = getOpenApiSpecRoute;
+//# sourceMappingURL=stub.cjs.js.map

package/dist/stub.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stub.cjs.js","sources":["../src/stub.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport PromiseRouter from 'express-promise-router';\nimport { ApiRouter } from './router';\nimport { RequiredDoc } from './types';\nimport {\n  ErrorRequestHandler,\n  RequestHandler,\n  NextFunction,\n  Request,\n  Response,\n  json,\n} from 'express';\nimport { InputError } from '@backstage/errors';\nimport { middleware as OpenApiValidator } from 'express-openapi-validator';\nimport { OPENAPI_SPEC_ROUTE } from './constants';\nimport { isErrorResult, merge } from 'openapi-merge';\n\ntype PropertyOverrideRequest = Request & {\n  [key: symbol]: string;\n};\n\nconst baseUrlSymbol = Symbol();\nconst originalUrlSymbol = Symbol();\n\nfunction validatorErrorTransformer(): ErrorRequestHandler {\n  return (error: Error, _: Request, _2: Response, next: NextFunction) => {\n    next(new InputError(error.message));\n  };\n}\n\nexport function getDefaultRouterMiddleware() {\n  return [json()];\n}\n\n/**\n * Given a base url for a plugin, find the given OpenAPI spec for that plugin.\n * @param baseUrl - Plugin base url.\n * @returns OpenAPI spec route for the base url.\n * @public\n */\nexport function getOpenApiSpecRoute(baseUrl: string) {\n  return `${baseUrl}${OPENAPI_SPEC_ROUTE}`;\n}\n\n/**\n * Create a new OpenAPI router with some default middleware.\n * @param spec - Your OpenAPI spec imported as a JSON object.\n * @param validatorOptions - `openapi-express-validator` options to override the defaults.\n * @returns A new express router with validation middleware.\n * @public\n */\nexport function createValidatedOpenApiRouter<T extends RequiredDoc>(\n  spec: T,\n  options?: {\n    validatorOptions?: Partial<Parameters<typeof OpenApiValidator>['0']>;\n    middleware?: RequestHandler[];\n  },\n) {\n  const router = PromiseRouter();\n  router.use(options?.middleware || getDefaultRouterMiddleware());\n\n  /**\n   * Middleware to setup the routing for OpenApiValidator. OpenApiValidator expects `req.originalUrl`\n   *    and `req.baseUrl` to be the full path. We adjust them here to basically be nothing and then\n   *    revive the old values in the last function in this method. We could instead update `req.path`\n   *    but that might affect the routing and I'd rather not.\n   *\n   * TODO: I opened https://github.com/cdimascio/express-openapi-validator/issues/843\n   *    to track this on the middleware side, but there was a similar ticket, https://github.com/cdimascio/express-openapi-validator/issues/113\n   *    that has had minimal activity. If that changes, update this to use a new option on their side.\n   */\n  router.use((req: Request, _, next) => {\n    /**\n     * Express typings are weird. They don't recognize PropertyOverrideRequest as a valid\n     *  Request child and try to overload as PathParams. Just cast it here, since we know\n     *  what we're doing.\n     */\n    const customRequest = req as PropertyOverrideRequest;\n    customRequest[baseUrlSymbol] = customRequest.baseUrl;\n    customRequest.baseUrl = '';\n    customRequest[originalUrlSymbol] = customRequest.originalUrl;\n    customRequest.originalUrl = customRequest.url;\n    next();\n  });\n\n  // TODO: Handle errors by converting from OpenApiValidator errors to known @backstage/errors errors.\n  router.use(\n    OpenApiValidator({\n      validateRequests: {\n        coerceTypes: false,\n        allowUnknownQueryParameters: false,\n      },\n      ignoreUndocumented: true,\n      validateResponses: false,\n      ...options?.validatorOptions,\n      apiSpec: spec as any,\n    }),\n  );\n\n  /**\n   * Revert `req.baseUrl` and `req.originalUrl` changes. This ensures that any further usage\n   *    of these variables will be unchanged.\n   */\n  router.use((req: Request, _, next) => {\n    const customRequest = req as PropertyOverrideRequest;\n    customRequest.baseUrl = customRequest[baseUrlSymbol];\n    customRequest.originalUrl = customRequest[originalUrlSymbol];\n    delete customRequest[baseUrlSymbol];\n    delete customRequest[originalUrlSymbol];\n    next();\n  });\n\n  // Any errors from the middleware get through here.\n  router.use(validatorErrorTransformer());\n\n  router.get(OPENAPI_SPEC_ROUTE, async (req, res) => {\n    const mergeOutput = merge([\n      {\n        oas: spec as any,\n        pathModification: {\n          /**\n           * Get the route that this OpenAPI spec is hosted on. The other\n           *  approach of using the discovery API increases the router constructor\n           *  significantly and since we're just looking for path and not full URL,\n           *  this works.\n           *\n           * If we wanted to add a list of servers, there may be a case for adding\n           *  discovery API to get an exhaustive list of upstream servers, but that's\n           *  also not currently supported.\n           */\n          prepend: req.originalUrl.replace(OPENAPI_SPEC_ROUTE, ''),\n        },\n      },\n    ]);\n    if (isErrorResult(mergeOutput)) {\n      throw new InputError('Invalid spec defined');\n    }\n    res.json(mergeOutput.output);\n  });\n\n  return router as ApiRouter<typeof spec>;\n}\n"],"names":["InputError","json","OPENAPI_SPEC_ROUTE","PromiseRouter","OpenApiValidator","merge","isErrorResult"],"mappings":";;;;;;;;;;;;;AAoCA,MAAM,gBAAgB,MAAO,EAAA,CAAA;AAC7B,MAAM,oBAAoB,MAAO,EAAA,CAAA;AAEjC,SAAS,yBAAiD,GAAA;AACxD,EAAA,OAAO,CAAC,KAAA,EAAc,CAAY,EAAA,EAAA,EAAc,IAAuB,KAAA;AACrE,IAAA,IAAA,CAAK,IAAIA,iBAAA,CAAW,KAAM,CAAA,OAAO,CAAC,CAAA,CAAA;AAAA,GACpC,CAAA;AACF,CAAA;AAEO,SAAS,0BAA6B,GAAA;AAC3C,EAAO,OAAA,CAACC,cAAM,CAAA,CAAA;AAChB,CAAA;AAQO,SAAS,oBAAoB,OAAiB,EAAA;AACnD,EAAO,OAAA,CAAA,EAAG,OAAO,CAAA,EAAGC,4BAAkB,CAAA,CAAA,CAAA;AACxC,CAAA;AASgB,SAAA,4BAAA,CACd,MACA,OAIA,EAAA;AACA,EAAA,MAAM,SAASC,8BAAc,EAAA,CAAA;AAC7B,EAAA,MAAA,CAAO,GAAI,CAAA,OAAA,EAAS,UAAc,IAAA,0BAAA,EAA4B,CAAA,CAAA;AAY9D,EAAA,MAAA,CAAO,GAAI,CAAA,CAAC,GAAc,EAAA,CAAA,EAAG,IAAS,KAAA;AAMpC,IAAA,MAAM,aAAgB,GAAA,GAAA,CAAA;AACtB,IAAc,aAAA,CAAA,aAAa,IAAI,aAAc,CAAA,OAAA,CAAA;AAC7C,IAAA,aAAA,CAAc,OAAU,GAAA,EAAA,CAAA;AACxB,IAAc,aAAA,CAAA,iBAAiB,IAAI,aAAc,CAAA,WAAA,CAAA;AACjD,IAAA,aAAA,CAAc,cAAc,aAAc,CAAA,GAAA,CAAA;AAC1C,IAAK,IAAA,EAAA,CAAA;AAAA,GACN,CAAA,CAAA;AAGD,EAAO,MAAA,CAAA,GAAA;AAAA,IACLC,kCAAiB,CAAA;AAAA,MACf,gBAAkB,EAAA;AAAA,QAChB,WAAa,EAAA,KAAA;AAAA,QACb,2BAA6B,EAAA,KAAA;AAAA,OAC/B;AAAA,MACA,kBAAoB,EAAA,IAAA;AAAA,MACpB,iBAAmB,EAAA,KAAA;AAAA,MACnB,GAAG,OAAS,EAAA,gBAAA;AAAA,MACZ,OAAS,EAAA,IAAA;AAAA,KACV,CAAA;AAAA,GACH,CAAA;AAMA,EAAA,MAAA,CAAO,GAAI,CAAA,CAAC,GAAc,EAAA,CAAA,EAAG,IAAS,KAAA;AACpC,IAAA,MAAM,aAAgB,GAAA,GAAA,CAAA;AACtB,IAAc,aAAA,CAAA,OAAA,GAAU,cAAc,aAAa,CAAA,CAAA;AACnD,IAAc,aAAA,CAAA,WAAA,GAAc,cAAc,iBAAiB,CAAA,CAAA;AAC3D,IAAA,OAAO,cAAc,aAAa,CAAA,CAAA;AAClC,IAAA,OAAO,cAAc,iBAAiB,CAAA,CAAA;AACtC,IAAK,IAAA,EAAA,CAAA;AAAA,GACN,CAAA,CAAA;AAGD,EAAO,MAAA,CAAA,GAAA,CAAI,2BAA2B,CAAA,CAAA;AAEtC,EAAA,MAAA,CAAO,GAAI,CAAAF,4BAAA,EAAoB,OAAO,GAAA,EAAK,GAAQ,KAAA;AACjD,IAAA,MAAM,cAAcG,kBAAM,CAAA;AAAA,MACxB;AAAA,QACE,GAAK,EAAA,IAAA;AAAA,QACL,gBAAkB,EAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAWhB,OAAS,EAAA,GAAA,CAAI,WAAY,CAAA,OAAA,CAAQH,8BAAoB,EAAE,CAAA;AAAA,SACzD;AAAA,OACF;AAAA,KACD,CAAA,CAAA;AACD,IAAI,IAAAI,0BAAA,CAAc,WAAW,CAAG,EAAA;AAC9B,MAAM,MAAA,IAAIN,kBAAW,sBAAsB,CAAA,CAAA;AAAA,KAC7C;AACA,IAAI,GAAA,CAAA,IAAA,CAAK,YAAY,MAAM,CAAA,CAAA;AAAA,GAC5B,CAAA,CAAA;AAED,EAAO,OAAA,MAAA,CAAA;AACT;;;;;;"}

package/dist/testUtils.cjs.js

@@ -0,0 +1,43 @@
+'use strict';
+
+var setup = require('./proxy/setup.cjs.js');
+
+const proxiesToCleanup = [];
+async function wrapServer(app) {
+  const proxy = new setup.Proxy();
+  proxiesToCleanup.push(proxy);
+  await proxy.setup();
+  const server = app.listen(proxy.forwardTo.port);
+  await proxy.initialize(`http://localhost:${proxy.forwardTo.port}`, server);
+  return { ...server, address: () => new URL(proxy.url) };
+}
+let registered = false;
+function registerHooks() {
+  if (typeof afterAll !== "function" || typeof beforeAll !== "function") {
+    return;
+  }
+  if (registered) {
+    return;
+  }
+  registered = true;
+  afterAll(() => {
+    for (const proxy of proxiesToCleanup) {
+      proxy.stop();
+    }
+  });
+}
+registerHooks();
+const wrapInOpenApiTestServer = (app) => {
+  if (process.env.OPTIC_PROXY) {
+    const server = app.listen(+process.env.PORT);
+    return {
+      ...server,
+      address: () => new URL(process.env.OPTIC_PROXY)
+    };
+  }
+  return app;
+};
+
+exports.wrapInOpenApiTestServer = wrapInOpenApiTestServer;
+exports.wrapServer = wrapServer;
+//# sourceMappingURL=testUtils.cjs.js.map

package/dist/testUtils.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"testUtils.cjs.js","sources":["../src/testUtils.ts"],"sourcesContent":["/*\n * Copyright 2023 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { Express } from 'express';\nimport { Server } from 'http';\nimport { Proxy } from './proxy/setup';\n\nconst proxiesToCleanup: Proxy[] = [];\n\n/**\n * !!! THIS CURRENTLY ONLY SUPPORTS SUPERTEST !!!\n * Setup a server with a custom OpenAPI proxy. This proxy will capture all requests and responses and make sure they\n *  conform to the spec.\n * @param app - express server, needed to ensure we have the correct ports for the proxy.\n * @returns - a configured HTTP server that should be used with supertest.\n * @public\n */\nexport async function wrapServer(app: Express): Promise<Server> {\n  const proxy = new Proxy();\n  proxiesToCleanup.push(proxy);\n  await proxy.setup();\n\n  const server = app.listen(proxy.forwardTo.port);\n  await proxy.initialize(`http://localhost:${proxy.forwardTo.port}`, server);\n\n  return { ...server, address: () => new URL(proxy.url) } as any;\n}\n\nlet registered = false;\nfunction registerHooks() {\n  if (typeof afterAll !== 'function' || typeof beforeAll !== 'function') {\n    return;\n  }\n  if (registered) {\n    return;\n  }\n  registered = true;\n\n  afterAll(() => {\n    for (const proxy of proxiesToCleanup) {\n      proxy.stop();\n    }\n  });\n}\n\nregisterHooks();\n\n/**\n * !!! THIS CURRENTLY ONLY SUPPORTS SUPERTEST !!!\n * Running against supertest, we need some way to hit the optic proxy. This ensures that\n *  that happens at runtime when in the context of a `yarn optic capture` command.\n * @param app - Express router that would be passed to supertest's `request`.\n * @returns A wrapper around the express router (or the router untouched) that still works with supertest.\n * @public\n */\nexport const wrapInOpenApiTestServer = (app: Express): Server | Express => {\n  if (process.env.OPTIC_PROXY) {\n    const server = app.listen(+process.env.PORT!);\n    return {\n      ...server,\n      address: () => new URL(process.env.OPTIC_PROXY!),\n    } as any;\n  }\n  return app;\n};\n"],"names":["Proxy"],"mappings":";;;;AAmBA,MAAM,mBAA4B,EAAC,CAAA;AAUnC,eAAsB,WAAW,GAA+B,EAAA;AAC9D,EAAM,MAAA,KAAA,GAAQ,IAAIA,WAAM,EAAA,CAAA;AACxB,EAAA,gBAAA,CAAiB,KAAK,KAAK,CAAA,CAAA;AAC3B,EAAA,MAAM,MAAM,KAAM,EAAA,CAAA;AAElB,EAAA,MAAM,MAAS,GAAA,GAAA,CAAI,MAAO,CAAA,KAAA,CAAM,UAAU,IAAI,CAAA,CAAA;AAC9C,EAAA,MAAM,MAAM,UAAW,CAAA,CAAA,iBAAA,EAAoB,MAAM,SAAU,CAAA,IAAI,IAAI,MAAM,CAAA,CAAA;AAEzE,EAAO,OAAA,EAAE,GAAG,MAAQ,EAAA,OAAA,EAAS,MAAM,IAAI,GAAA,CAAI,KAAM,CAAA,GAAG,CAAE,EAAA,CAAA;AACxD,CAAA;AAEA,IAAI,UAAa,GAAA,KAAA,CAAA;AACjB,SAAS,aAAgB,GAAA;AACvB,EAAA,IAAI,OAAO,QAAA,KAAa,UAAc,IAAA,OAAO,cAAc,UAAY,EAAA;AACrE,IAAA,OAAA;AAAA,GACF;AACA,EAAA,IAAI,UAAY,EAAA;AACd,IAAA,OAAA;AAAA,GACF;AACA,EAAa,UAAA,GAAA,IAAA,CAAA;AAEb,EAAA,QAAA,CAAS,MAAM;AACb,IAAA,KAAA,MAAW,SAAS,gBAAkB,EAAA;AACpC,MAAA,KAAA,CAAM,IAAK,EAAA,CAAA;AAAA,KACb;AAAA,GACD,CAAA,CAAA;AACH,CAAA;AAEA,aAAc,EAAA,CAAA;AAUD,MAAA,uBAAA,GAA0B,CAAC,GAAmC,KAAA;AACzE,EAAI,IAAA,OAAA,CAAQ,IAAI,WAAa,EAAA;AAC3B,IAAA,MAAM,SAAS,GAAI,CAAA,MAAA,CAAO,CAAC,OAAA,CAAQ,IAAI,IAAK,CAAA,CAAA;AAC5C,IAAO,OAAA;AAAA,MACL,GAAG,MAAA;AAAA,MACH,SAAS,MAAM,IAAI,GAAI,CAAA,OAAA,CAAQ,IAAI,WAAY,CAAA;AAAA,KACjD,CAAA;AAAA,GACF;AACA,EAAO,OAAA,GAAA,CAAA;AACT;;;;;"}

package/dist/types/index.cjs.js

@@ -0,0 +1,3 @@
+'use strict';
+
+//# sourceMappingURL=index.cjs.js.map

package/dist/types/index.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/backend-openapi-utils",
-  "version": "0.1.19-next.0",
+  "version": "0.2.0-next.1",
   "description": "OpenAPI typescript support.",
   "backstage": {
     "role": "node-library"
@@ -33,20 +33,27 @@
     "test": "backstage-cli package test"
   },
   "dependencies": {
-    "@backstage/backend-plugin-api": "^1.0.1-next.0",
-    "@backstage/errors": "^1.2.4",
+    "@apidevtools/swagger-parser": "^10.1.0",
+    "@backstage/backend-plugin-api": "1.0.1-next.1",
+    "@backstage/errors": "1.2.4",
+    "@backstage/types": "1.1.1",
     "@types/express": "^4.17.6",
     "@types/express-serve-static-core": "^4.17.5",
+    "ajv": "^8.16.0",
     "express": "^4.17.1",
     "express-openapi-validator": "^5.0.4",
     "express-promise-router": "^4.1.0",
+    "get-port": "^5.1.1",
     "json-schema-to-ts": "^3.0.0",
     "lodash": "^4.17.21",
+    "mockttp": "^3.13.0",
+    "msw": "^1.0.0",
     "openapi-merge": "^1.3.2",
     "openapi3-ts": "^3.1.2"
   },
   "devDependencies": {
-    "@backstage/cli": "^0.28.0-next.0",
+    "@backstage/cli": "0.28.0-next.2",
+    "@backstage/test-utils": "1.6.1-next.2",
     "supertest": "^7.0.0"
   },
   "module": "dist/index.esm.js"