@postman-cse/onboarding-bootstrap 2.2.0 → 2.4.0

package/README.md

@@ -6,7 +6,7 @@ Provisions a [Postman workspace](https://learning.postman.com/docs/collaborating
 
 Part of the [Postman API Onboarding suite](https://github.com/postman-cs/postman-api-onboarding-action).
 
-> **Standards-grounded assertion generation.** Every collection this action generates ships with executable contract tests compiled from your spec: JSON Schema (draft-07 / 2020-12) body validation with RFC-checked formats (RFC 3339 timestamps, RFC 4122 UUIDs, RFC 3986 URIs, and more), RFC 9110 `Authorization` scheme checks plus status-code requirement checks (`WWW-Authenticate` on 401, `Allow` on 405, no body on 304, `Content-Range` on 206), RFC 9457 `application/problem+json` error-body validation with RFC 8259 encoding and RFC 8288 `Link` checks, canonical proto3 JSON well-known-type validation for gRPC, version-aware SOAP 1.1/1.2 media-type and Fault-status checks, and GraphQL-over-HTTP media-type/status discipline. The full test inventory and the standard behind each check: [Generated assertions](docs/generated-assertions.md).
+> **Standards-grounded assertion generation.** Every collection this action generates ships with executable contract tests compiled from your spec. For OpenAPI: operation mapping, status-code, `Content-Type`, response-header, request/response body, parameter, security-credential, and `Content-Length` checks, with JSON Schema (draft-07 / 2020-12) body validation, dialect-exclusive keyword rejection, and RFC-checked formats (RFC 3339 timestamps, RFC 4122 UUIDs, RFC 3986 URIs, and more). Layered on top: RFC 9110 status-code, framing, and field-syntax requirements, RFC 9457 `application/problem+json` error bodies with RFC 8259 encoding and RFC 8288 `Link` checks, RFC 6265 `Set-Cookie`, RFC 6797 HSTS and security headers, WHATWG Fetch CORS, RFC 9651 structured fields, RFC 9209 typed `Proxy-Status`, RFC 9421 message signatures, RFC 9530 body digests, `Accept` negotiation, media-type conventions (NDJSON, multipart boundaries, HAL, JSON:API), authentication-scheme credential grammar, preconditions and RFC 6902 / RFC 7386 patch bodies, `Deprecation`/`Sunset` advisories, and OpenAPI links/servers resolution. Beyond REST: canonical proto3 JSON well-known-type validation for gRPC, version-aware SOAP 1.1/1.2 media-type and Fault-status checks, GraphQL-over-HTTP media-type/status discipline, static AsyncAPI WebSocket / Socket.IO / MQTT message validation, and static MCP server-manifest contract checks. The full test inventory and the standard behind each check: [Generated assertions](docs/generated-assertions.md) and [Multi-Protocol Contract Assertions](docs/MULTIPROTOCOL-ASSERTIONS.md).
 
 ## Which action should I use?
 
@@ -339,13 +339,25 @@ Dynamic contract failures and warnings use `CONTRACT_` error codes. Remediation
 | `CONTRACT_READONLY_PROPERTY_IN_REQUEST` | A generated request body includes properties the schema marks `readOnly`. | Remove readOnly properties from request examples; they belong in responses. |
 | `CONTRACT_UNDOCUMENTED_QUERY_PARAM` | A generated request sends a query parameter the operation does not declare. | Declare the parameter in the OpenAPI operation or remove it from the generated request. |
 | `CONTRACT_LINKS_NOT_VALIDATED` | Response links were present but link traversal is not part of dynamic contract coverage. | Validate linked operation chains with dedicated workflow tests. |
-| `CONTRACT_PARAM_SERIALIZATION_NOT_VALIDATED` | A parameter declares `allowReserved`, `content`, or a style/explode combination the runtime cannot decode. Exploded `form` arrays and non-exploded `form`/`spaceDelimited`/`pipeDelimited` arrays of scalars are decoded and validated, so they no longer warn. | Validate the remaining serialized forms with dedicated tests. |
+| `CONTRACT_LINKS_PARTIALLY_VALIDATED` | Evaluable link expressions (`$response.body#/...`, `$response.header....`) are asserted at runtime; the remaining expressions (`$request.*`, `$url`, whole-body) are skipped. | Validate the skipped link expressions with dedicated workflow tests. |
+| `CONTRACT_UNKNOWN_HTTP_AUTH_SCHEME` | An `http`-type security scheme names an auth scheme outside the IANA HTTP Authentication Scheme registry. | Use a registered scheme name, or ignore if the scheme is intentionally private. |
+| `CONTRACT_CREDENTIALS_IN_QUERY` | An `apiKey` security scheme sends credentials in the query string, which leaks into logs and referrers. | Move the credential to a header or cookie. |
+| `CONTRACT_SECURITY_SCHEME_URL` | An OAuth2 flow URL or openIdConnect discovery URL is malformed, not HTTPS, or not a discovery-document path. | Fix the URL in `components.securitySchemes`. |
+| `CONTRACT_OAUTH2_UNDECLARED_SCOPE` | An operation requires an OAuth2 scope that no flow of the referenced scheme declares. | Add the scope to the flow's `scopes` map or correct the operation's requirement. |
+| `CONTRACT_SECURITY_RESPONSES_INCOMPLETE` | A secured operation documents no 401 (or a scoped operation no 403) and no 4XX/default catch-all. | Document the authentication and authorization failure responses. |
+| `CONTRACT_UNSECURED_AUTH_RESPONSES` | An operation documents a 401/403 response but declares no security requirement. | Declare the operation's security or remove the auth error responses. |
+| `CONTRACT_INVALID_STATUS_CODE` | A declared response key is outside RFC 9110's 100-599, 1XX-5XX, or `default` forms. | Fix the response key in the OpenAPI document. |
+| `CONTRACT_BODYLESS_STATUS_WITH_CONTENT` | The spec declares response content for 204/205/304, which RFC 9110 forbids on the wire. | Remove the content declaration or use a different status code. |
+| `CONTRACT_METHOD_BODY_SEMANTICS` | A GET/HEAD/DELETE operation declares or sends a request body; RFC 9110 defines no request-body semantics for those methods. | Move the payload to a method with body semantics or drop it. |
+| `CONTRACT_PARAM_SERIALIZATION_NOT_VALIDATED` | A parameter declares `allowReserved`, `content`, or a style/explode combination the runtime cannot decode. Exploded `form` arrays and non-exploded `form`/`spaceDelimited`/`pipeDelimited` arrays of scalars are decoded and validated, so they no longer warn; `deepObject` query objects of scalars and `label`/`matrix` path scalars are likewise decoded and validated. | Validate the remaining serialized forms with dedicated tests. |
 | `CONTRACT_NONJSON_SCHEMA_NOT_VALIDATED` | A non-JSON response media type declares an object schema that runtime tests cannot validate. | Validate XML or other non-JSON payloads with dedicated tests; Content-Type and body presence are still checked. |
 | `CONTRACT_REQUEST_SCHEMA_NOT_VALIDATED` | A JSON request body schema could not be compiled into a runtime request validator. | Simplify the unsupported request schema construct named in the warning. |
 | `CONTRACT_SCHEMA_NOT_COMPILED` | One schema could not be compiled by the validator engine, so its runtime check is skipped. | Review the named schema construct; other checks for the operation still run. |
 | `CONTRACT_EXAMPLE_SCHEMA_MISMATCH` | A media-type example does not validate against its own schema. | Fix the example or the schema so the spec is self-consistent; generated requests are built from these examples. |
 | `CONTRACT_ENCODING_MISMATCH` | A generated form-body field does not match its OpenAPI encoding object: a declared multipart per-part `contentType` is missing or different, a binary-typed field was not generated as a file part, or a field declaring a JSON `contentType` carries an unparseable value. | Regenerate the collection or align the encoding object with the intended part layout. |
 | `CONTRACT_ENCODING_HEADERS_NOT_VALIDATED` | A multipart encoding object declares per-part `headers`, which Postman formdata entries cannot carry, so they are not asserted. | Validate per-part headers with dedicated tests if the server depends on them. |
+| `CONTRACT_MULTIPART_ENCODING_FIELD_UNKNOWN` | A form-body `encoding` map names a field that is not a property of the request body schema, so the encoding entry can never apply. | Rename the encoding key to a declared schema property or remove it. |
+| `CONTRACT_WELL_KNOWN_UNREGISTERED` | A path under `/.well-known/` uses a suffix that is not in the vendored IANA Well-Known URIs registry snapshot (RFC 8615). | Register the suffix, use a registered one, or move the resource out of `/.well-known/`. |
 | `CONTRACT_FORM_FIELD_SCHEMA_MISMATCH` | A generated urlencoded or multipart text value does not validate against its scalar property schema. | Fix the spec example feeding the generated body, or correct the property schema. |
 | `CONTRACT_DISCRIMINATOR_NOT_VALIDATED` | A `discriminator` has no sibling `oneOf`/`anyOf` of same-spec `$ref` members (typically allOf-parent inheritance), so its dispatch is not validated. | Restructure to the oneOf-plus-discriminator form, or rely on the still-validated composition keywords. |
 | `CONTRACT_HEADER_SCHEMA_NOT_VALIDATED` | A response header declares an object or otherwise undecodable schema, so its serialized value is checked for presence only. Arrays of scalars are split on commas and validated. | Use a scalar or array-of-scalars header schema, or validate the serialized header form with dedicated tests. |