@vellumai/vellum-gateway 0.3.20 → 0.3.22

package/ARCHITECTURE.md

@@ -25,6 +25,7 @@ Internet
        v
      Gateway (http://127.0.0.1:7830)
        |
+       +-- Dedicated /v1/health --> Runtime /v1/health
        +-- Runtime proxy /v1/* --> Runtime (http://127.0.0.1:7821)
        +-- /webhooks/* --> BLOCKED (404, never forwarded to runtime)
 ```
@@ -99,6 +100,60 @@ Guardian verification endpoints are exposed directly by the gateway and forwarde
 | `gateway/src/http/routes/guardian-control-plane-proxy.ts` | Guardian control-plane proxy handlers and upstream forwarding |
 | `gateway/src/index.ts` | Route registration and bearer-auth enforcement for `/v1/integrations/guardian/*` |
 
+### Runtime Health Proxy
+
+Runtime health is exposed directly by the gateway at `GET /v1/health` and forwarded to the runtime's `GET /v1/health` endpoint even when the broad runtime proxy is disabled.
+
+**Authentication boundary:**
+
+- Gateway validates caller bearer auth against the runtime token.
+- Gateway forwards the request to runtime with the runtime bearer token and `X-Gateway-Origin` proof header.
+- Upstream 4xx/5xx responses are passed through, while connection errors return `502` and timeouts return `504`.
+
+**Key source files:**
+
+| File | Purpose |
+|------|---------|
+| `gateway/src/http/routes/runtime-health-proxy.ts` | Runtime health proxy handler and upstream forwarding |
+| `gateway/src/index.ts` | Route registration and bearer-auth enforcement for `/v1/health` |
+
+### Telegram + Ingress Control-Plane Proxies
+
+Telegram integration setup/config endpoints and ingress members/invites endpoints are also exposed directly by the gateway and forwarded to runtime handlers even when the broad runtime proxy is disabled.
+
+**Forwarded Telegram endpoints:**
+
+| Method | Path |
+|--------|------|
+| GET/POST/DELETE | `/v1/integrations/telegram/config` |
+| POST | `/v1/integrations/telegram/commands` |
+| POST | `/v1/integrations/telegram/setup` |
+
+**Forwarded ingress endpoints:**
+
+| Method | Path |
+|--------|------|
+| GET/POST | `/v1/ingress/members` |
+| DELETE | `/v1/ingress/members/:memberId` |
+| POST | `/v1/ingress/members/:memberId/block` |
+| GET/POST | `/v1/ingress/invites` |
+| DELETE | `/v1/ingress/invites/:inviteId` |
+| POST | `/v1/ingress/invites/redeem` |
+
+**Authentication boundary:**
+
+- Gateway validates caller bearer auth against the runtime token.
+- Gateway forwards requests to runtime with the runtime bearer token and `X-Gateway-Origin` proof header.
+- Upstream 4xx/5xx responses are passed through, while connection errors return `502` and timeouts return `504`.
+
+**Key source files:**
+
+| File | Purpose |
+|------|---------|
+| `gateway/src/http/routes/telegram-control-plane-proxy.ts` | Telegram control-plane proxy handlers and upstream forwarding |
+| `gateway/src/http/routes/ingress-control-plane-proxy.ts` | Ingress control-plane proxy handlers and upstream forwarding |
+| `gateway/src/index.ts` | Route registration and bearer-auth enforcement for `/v1/integrations/telegram/*` and `/v1/ingress/*` |
+
 ### Channel Binding Lifecycle (Lane Separation)
 
 Each channel (desktop, Telegram, etc.) operates in its own **lane**: conversations created by an external channel are never displayed in the desktop thread list, and desktop conversations are never exposed to external channels. The `channelBinding` metadata on a conversation is used solely for routing inbound/outbound messages within that lane and for filtering sessions during desktop session restoration.

package/README.md

@@ -221,6 +221,16 @@ The gateway serves as the single public ingress point for all external callbacks
 | `/v1/integrations/guardian/outbound/start` | POST | Authenticated control-plane proxy for starting outbound guardian verification |
 | `/v1/integrations/guardian/outbound/resend` | POST | Authenticated control-plane proxy for resending outbound guardian verification |
 | `/v1/integrations/guardian/outbound/cancel` | POST | Authenticated control-plane proxy for cancelling outbound guardian verification |
+| `/v1/integrations/telegram/config` | GET/POST/DELETE | Authenticated control-plane proxy for Telegram integration config |
+| `/v1/integrations/telegram/commands` | POST | Authenticated control-plane proxy for Telegram command registration |
+| `/v1/integrations/telegram/setup` | POST | Authenticated control-plane proxy for Telegram setup orchestration |
+| `/v1/ingress/members` | GET/POST | Authenticated control-plane proxy for listing/upserting ingress members |
+| `/v1/ingress/members/:id` | DELETE | Authenticated control-plane proxy for revoking an ingress member |
+| `/v1/ingress/members/:id/block` | POST | Authenticated control-plane proxy for blocking an ingress member |
+| `/v1/ingress/invites` | GET/POST | Authenticated control-plane proxy for listing/creating ingress invites |
+| `/v1/ingress/invites/:id` | DELETE | Authenticated control-plane proxy for revoking an ingress invite |
+| `/v1/ingress/invites/redeem` | POST | Authenticated control-plane proxy for redeeming an ingress invite |
+| `/v1/health` | GET | Authenticated runtime health proxy (`/v1/health` on runtime) |
 | `/healthz` | GET | Liveness probe |
 | `/readyz` | GET | Readiness probe |
 | `/schema` | GET | Returns the OpenAPI 3.1 schema for this gateway |
@@ -290,7 +300,7 @@ When `INGRESS_PUBLIC_BASE_URL` is configured, the gateway prioritizes it as the
 
 ## Default Mode: Dedicated Routes Only
 
-By default, the broad runtime proxy is disabled. Dedicated gateway-managed routes (webhooks, delivery endpoints, and explicit control-plane proxies such as `/v1/integrations/guardian/*`) remain available, but arbitrary runtime passthrough routes return `404` unless `GATEWAY_RUNTIME_PROXY_ENABLED=true`.
+By default, the broad runtime proxy is disabled. Dedicated gateway-managed routes (webhooks, delivery endpoints, explicit control-plane proxies such as `/v1/integrations/guardian/*`, `/v1/integrations/telegram/*`, and `/v1/ingress/*`, plus the authenticated runtime health route `/v1/health`) remain available, but arbitrary runtime passthrough routes return `404` unless `GATEWAY_RUNTIME_PROXY_ENABLED=true`.
 
 ## Runtime Proxy Mode
 
@@ -340,6 +350,7 @@ Text and attachments are sent separately — the text reply goes first via `send
 
 | Endpoint | Method | Behavior |
 |----------|--------|----------|
+| `/v1/health` | GET | Authenticated proxy to runtime health (`/v1/health`) |
 | `/healthz` | GET | Always returns `200` while the process is alive |
 | `/readyz` | GET | Returns `200` while accepting traffic; `503` during graceful shutdown drain |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/vellum-gateway",
-  "version": "0.3.20",
+  "version": "0.3.22",
   "type": "module",
   "scripts": {
     "dev": "bun run --watch src/index.ts",

package/src/__tests__/ingress-control-plane-proxy.test.ts

@@ -0,0 +1,180 @@
+import { describe, test, expect, mock, afterEach } from "bun:test";
+import type { GatewayConfig } from "../config.js";
+
+type FetchFn = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+let fetchMock: ReturnType<typeof mock<FetchFn>> = mock(async () => new Response());
+
+mock.module("../fetch.js", () => ({
+  fetchImpl: (...args: Parameters<FetchFn>) => fetchMock(...args),
+}));
+
+const { createIngressControlPlaneProxyHandler } = await import(
+  "../http/routes/ingress-control-plane-proxy.js"
+);
+
+function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
+  const merged: GatewayConfig = {
+    telegramBotToken: "tok",
+    telegramWebhookSecret: "wh-ver",
+    telegramApiBaseUrl: "https://api.telegram.org",
+    assistantRuntimeBaseUrl: "http://localhost:7821",
+    routingEntries: [],
+    defaultAssistantId: undefined,
+    unmappedPolicy: "reject",
+    port: 7830,
+    runtimeBearerToken: "runtime-token",
+    runtimeGatewayOriginSecret: "gateway-origin",
+    runtimeProxyEnabled: false,
+    runtimeProxyRequireAuth: true,
+    runtimeProxyBearerToken: undefined,
+    shutdownDrainMs: 5000,
+    runtimeTimeoutMs: 30000,
+    runtimeMaxRetries: 2,
+    runtimeInitialBackoffMs: 500,
+    telegramDeliverAuthBypass: false,
+    telegramInitialBackoffMs: 1000,
+    telegramMaxRetries: 3,
+    telegramTimeoutMs: 15000,
+    maxWebhookPayloadBytes: 1048576,
+    logFile: { dir: undefined, retentionDays: 30 },
+    maxAttachmentBytes: 20971520,
+    maxAttachmentConcurrency: 3,
+    twilioAuthToken: undefined,
+    twilioAccountSid: undefined,
+    twilioPhoneNumber: undefined,
+    smsDeliverAuthBypass: false,
+    ingressPublicBaseUrl: undefined,
+    gatewayInternalBaseUrl: "http://127.0.0.1:7830",
+    whatsappPhoneNumberId: undefined,
+    whatsappAccessToken: undefined,
+    whatsappAppSecret: undefined,
+    whatsappWebhookVerifyToken: undefined,
+    whatsappDeliverAuthBypass: false,
+    whatsappTimeoutMs: 15000,
+    whatsappMaxRetries: 3,
+    whatsappInitialBackoffMs: 1000,
+    slackChannelBotToken: undefined,
+    slackChannelAppToken: undefined,
+    slackDeliverAuthBypass: false,
+    trustProxy: false,
+    ...overrides,
+  };
+  if (merged.runtimeGatewayOriginSecret === undefined) {
+    merged.runtimeGatewayOriginSecret = merged.runtimeBearerToken;
+  }
+  return merged;
+}
+
+afterEach(() => {
+  fetchMock = mock(async () => new Response());
+});
+
+describe("ingress control-plane proxy", () => {
+  test("forwards ingress endpoints to the runtime", async () => {
+    const captured: string[] = [];
+    fetchMock = mock(async (input: string | URL | Request) => {
+      captured.push(String(input));
+      return new Response(JSON.stringify({ ok: true }), {
+        status: 200,
+        headers: { "content-type": "application/json" },
+      });
+    });
+
+    const handler = createIngressControlPlaneProxyHandler(makeConfig());
+
+    await handler.handleListMembers(
+      new Request("http://localhost:7830/v1/ingress/members?sourceChannel=telegram"),
+    );
+    await handler.handleUpsertMember(
+      new Request("http://localhost:7830/v1/ingress/members", { method: "POST" }),
+    );
+    await handler.handleRevokeMember(
+      new Request("http://localhost:7830/v1/ingress/members/mbr_123", { method: "DELETE" }),
+      "mbr_123",
+    );
+    await handler.handleBlockMember(
+      new Request("http://localhost:7830/v1/ingress/members/mbr_123/block", { method: "POST" }),
+      "mbr_123",
+    );
+    await handler.handleListInvites(
+      new Request("http://localhost:7830/v1/ingress/invites?status=active"),
+    );
+    await handler.handleCreateInvite(
+      new Request("http://localhost:7830/v1/ingress/invites", { method: "POST" }),
+    );
+    await handler.handleRedeemInvite(
+      new Request("http://localhost:7830/v1/ingress/invites/redeem", { method: "POST" }),
+    );
+    await handler.handleRevokeInvite(
+      new Request("http://localhost:7830/v1/ingress/invites/inv_123", { method: "DELETE" }),
+      "inv_123",
+    );
+
+    expect(captured).toEqual([
+      "http://localhost:7821/v1/ingress/members?sourceChannel=telegram",
+      "http://localhost:7821/v1/ingress/members",
+      "http://localhost:7821/v1/ingress/members/mbr_123",
+      "http://localhost:7821/v1/ingress/members/mbr_123/block",
+      "http://localhost:7821/v1/ingress/invites?status=active",
+      "http://localhost:7821/v1/ingress/invites",
+      "http://localhost:7821/v1/ingress/invites/redeem",
+      "http://localhost:7821/v1/ingress/invites/inv_123",
+    ]);
+  });
+
+  test("replaces caller auth with runtime auth and forwards gateway-origin proof", async () => {
+    let capturedHeaders: Headers | undefined;
+    fetchMock = mock(async (_input: string | URL | Request, init?: RequestInit) => {
+      capturedHeaders = init?.headers as unknown as Headers;
+      return new Response("ok", { status: 200 });
+    });
+
+    const handler = createIngressControlPlaneProxyHandler(makeConfig());
+    const res = await handler.handleUpsertMember(
+      new Request("http://localhost:7830/v1/ingress/members", {
+        method: "POST",
+        headers: {
+          authorization: "Bearer caller-token",
+          host: "localhost:7830",
+        },
+        body: JSON.stringify({ sourceChannel: "telegram", externalUserId: "u_1" }),
+      }),
+    );
+
+    expect(res.status).toBe(200);
+    expect(capturedHeaders?.get("authorization")).toBe("Bearer runtime-token");
+    expect(capturedHeaders?.get("X-Gateway-Origin")).toBe("gateway-origin");
+    expect(capturedHeaders?.has("host")).toBe(false);
+  });
+
+  test("passes through upstream client errors", async () => {
+    fetchMock = mock(async () => {
+      return new Response(JSON.stringify({ ok: false, error: "sourceChannel is required" }), {
+        status: 400,
+        headers: { "content-type": "application/json" },
+      });
+    });
+
+    const handler = createIngressControlPlaneProxyHandler(makeConfig());
+    const res = await handler.handleCreateInvite(
+      new Request("http://localhost:7830/v1/ingress/invites", { method: "POST" }),
+    );
+
+    expect(res.status).toBe(400);
+    expect(await res.json()).toEqual({ ok: false, error: "sourceChannel is required" });
+  });
+
+  test("returns 504 when upstream times out", async () => {
+    fetchMock = mock(async () => {
+      throw new DOMException("The operation was aborted due to timeout", "TimeoutError");
+    });
+
+    const handler = createIngressControlPlaneProxyHandler(makeConfig({ runtimeTimeoutMs: 100 }));
+    const res = await handler.handleListMembers(
+      new Request("http://localhost:7830/v1/ingress/members"),
+    );
+
+    expect(res.status).toBe(504);
+    expect(await res.json()).toEqual({ error: "Gateway Timeout" });
+  });
+});

package/src/__tests__/ingress-control-plane-route-match.test.ts

@@ -0,0 +1,53 @@
+import { describe, expect, test } from "bun:test";
+import { matchIngressControlPlaneRoute } from "../http/routes/ingress-control-plane-route-match.js";
+
+describe("matchIngressControlPlaneRoute", () => {
+  test("matches redeem invite only for POST", () => {
+    expect(matchIngressControlPlaneRoute("/v1/ingress/invites/redeem", "POST")).toEqual({
+      kind: "redeemInvite",
+    });
+
+    // DELETE should treat `redeem` as an invite ID so revoke routing still works.
+    expect(matchIngressControlPlaneRoute("/v1/ingress/invites/redeem", "DELETE")).toEqual({
+      kind: "revokeInvite",
+      inviteId: "redeem",
+    });
+  });
+
+  test("matches ingress member routes", () => {
+    expect(matchIngressControlPlaneRoute("/v1/ingress/members", "GET")).toEqual({
+      kind: "listMembers",
+    });
+    expect(matchIngressControlPlaneRoute("/v1/ingress/members", "POST")).toEqual({
+      kind: "upsertMember",
+    });
+    expect(matchIngressControlPlaneRoute("/v1/ingress/members/mbr_1/block", "POST")).toEqual({
+      kind: "blockMember",
+      memberId: "mbr_1",
+    });
+    expect(matchIngressControlPlaneRoute("/v1/ingress/members/mbr_1", "DELETE")).toEqual({
+      kind: "revokeMember",
+      memberId: "mbr_1",
+    });
+  });
+
+  test("matches ingress invite routes", () => {
+    expect(matchIngressControlPlaneRoute("/v1/ingress/invites", "GET")).toEqual({
+      kind: "listInvites",
+    });
+    expect(matchIngressControlPlaneRoute("/v1/ingress/invites", "POST")).toEqual({
+      kind: "createInvite",
+    });
+    expect(matchIngressControlPlaneRoute("/v1/ingress/invites/inv_1", "DELETE")).toEqual({
+      kind: "revokeInvite",
+      inviteId: "inv_1",
+    });
+  });
+
+  test("returns null for unsupported method/path combinations", () => {
+    expect(matchIngressControlPlaneRoute("/v1/ingress/invites/redeem", "GET")).toBeNull();
+    expect(matchIngressControlPlaneRoute("/v1/ingress/invites/inv_1", "POST")).toBeNull();
+    expect(matchIngressControlPlaneRoute("/v1/ingress/members/mbr_1", "POST")).toBeNull();
+    expect(matchIngressControlPlaneRoute("/v1/ingress/unknown", "GET")).toBeNull();
+  });
+});

package/src/__tests__/runtime-health-proxy.test.ts

@@ -0,0 +1,129 @@
+import { describe, test, expect, mock, afterEach } from "bun:test";
+import type { GatewayConfig } from "../config.js";
+
+type FetchFn = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+let fetchMock: ReturnType<typeof mock<FetchFn>> = mock(async () => new Response());
+
+mock.module("../fetch.js", () => ({
+  fetchImpl: (...args: Parameters<FetchFn>) => fetchMock(...args),
+}));
+
+const { createRuntimeHealthProxyHandler } = await import(
+  "../http/routes/runtime-health-proxy.js"
+);
+
+function makeConfig(overrides: Partial<GatewayConfig> = {}): GatewayConfig {
+  const merged: GatewayConfig = {
+    telegramBotToken: "tok",
+    telegramWebhookSecret: "wh-ver",
+    telegramApiBaseUrl: "https://api.telegram.org",
+    assistantRuntimeBaseUrl: "http://localhost:7821",
+    routingEntries: [],
+    defaultAssistantId: undefined,
+    unmappedPolicy: "reject",
+    port: 7830,
+    runtimeBearerToken: "runtime-token",
+    runtimeGatewayOriginSecret: "gateway-origin",
+    runtimeProxyEnabled: false,
+    runtimeProxyRequireAuth: true,
+    runtimeProxyBearerToken: undefined,
+    shutdownDrainMs: 5000,
+    runtimeTimeoutMs: 30000,
+    runtimeMaxRetries: 2,
+    runtimeInitialBackoffMs: 500,
+    telegramDeliverAuthBypass: false,
+    telegramInitialBackoffMs: 1000,
+    telegramMaxRetries: 3,
+    telegramTimeoutMs: 15000,
+    maxWebhookPayloadBytes: 1048576,
+    logFile: { dir: undefined, retentionDays: 30 },
+    maxAttachmentBytes: 20971520,
+    maxAttachmentConcurrency: 3,
+    twilioAuthToken: undefined,
+    twilioAccountSid: undefined,
+    twilioPhoneNumber: undefined,
+    smsDeliverAuthBypass: false,
+    ingressPublicBaseUrl: undefined,
+    gatewayInternalBaseUrl: "http://127.0.0.1:7830",
+    whatsappPhoneNumberId: undefined,
+    whatsappAccessToken: undefined,
+    whatsappAppSecret: undefined,
+    whatsappWebhookVerifyToken: undefined,
+    whatsappDeliverAuthBypass: false,
+    whatsappTimeoutMs: 15000,
+    whatsappMaxRetries: 3,
+    whatsappInitialBackoffMs: 1000,
+    slackChannelBotToken: undefined,
+    slackChannelAppToken: undefined,
+    slackDeliverAuthBypass: false,
+    trustProxy: false,
+    ...overrides,
+  };
+  if (merged.runtimeGatewayOriginSecret === undefined) {
+    merged.runtimeGatewayOriginSecret = merged.runtimeBearerToken;
+  }
+  return merged;
+}
+
+afterEach(() => {
+  fetchMock = mock(async () => new Response());
+});
+
+describe("runtime health proxy", () => {
+  test("forwards to runtime /v1/health", async () => {
+    const captured: string[] = [];
+    fetchMock = mock(async (input: string | URL | Request) => {
+      captured.push(String(input));
+      return new Response(JSON.stringify({ status: "healthy" }), {
+        status: 200,
+        headers: { "content-type": "application/json" },
+      });
+    });
+
+    const handler = createRuntimeHealthProxyHandler(makeConfig());
+    const res = await handler.handleRuntimeHealth(
+      new Request("http://localhost:7830/v1/health"),
+    );
+
+    expect(res.status).toBe(200);
+    expect(captured).toEqual(["http://localhost:7821/v1/health"]);
+    expect(await res.json()).toEqual({ status: "healthy" });
+  });
+
+  test("replaces caller auth with runtime auth and forwards gateway-origin proof", async () => {
+    let capturedHeaders: Headers | undefined;
+    fetchMock = mock(async (_input: string | URL | Request, init?: RequestInit) => {
+      capturedHeaders = init?.headers as unknown as Headers;
+      return new Response("ok", { status: 200 });
+    });
+
+    const handler = createRuntimeHealthProxyHandler(makeConfig());
+    const res = await handler.handleRuntimeHealth(
+      new Request("http://localhost:7830/v1/health", {
+        headers: {
+          authorization: "Bearer caller-token",
+          host: "localhost:7830",
+        },
+      }),
+    );
+
+    expect(res.status).toBe(200);
+    expect(capturedHeaders?.get("authorization")).toBe("Bearer runtime-token");
+    expect(capturedHeaders?.get("X-Gateway-Origin")).toBe("gateway-origin");
+    expect(capturedHeaders?.has("host")).toBe(false);
+  });
+
+  test("returns 504 on timeout", async () => {
+    fetchMock = mock(async () => {
+      throw new DOMException("The operation was aborted due to timeout", "TimeoutError");
+    });
+
+    const handler = createRuntimeHealthProxyHandler(makeConfig({ runtimeTimeoutMs: 100 }));
+    const res = await handler.handleRuntimeHealth(
+      new Request("http://localhost:7830/v1/health"),
+    );
+
+    expect(res.status).toBe(504);
+    expect(await res.json()).toEqual({ error: "Gateway Timeout" });
+  });
+});

package/src/__tests__/schema.test.ts

@@ -54,12 +54,22 @@ describe("/schema route", () => {
     expect(body.paths["/healthz"]).toBeDefined();
     expect(body.paths["/readyz"]).toBeDefined();
     expect(body.paths["/schema"]).toBeDefined();
+    expect(body.paths["/v1/health"]).toBeDefined();
     expect(body.paths["/webhooks/telegram"]).toBeDefined();
     expect(body.paths["/webhooks/twilio/voice"]).toBeDefined();
     expect(body.paths["/webhooks/twilio/status"]).toBeDefined();
     expect(body.paths["/webhooks/twilio/connect-action"]).toBeDefined();
     expect(body.paths["/webhooks/twilio/relay"]).toBeDefined();
     expect(body.paths["/webhooks/oauth/callback"]).toBeDefined();
+    expect(body.paths["/v1/integrations/telegram/config"]).toBeDefined();
+    expect(body.paths["/v1/integrations/telegram/commands"]).toBeDefined();
+    expect(body.paths["/v1/integrations/telegram/setup"]).toBeDefined();
+    expect(body.paths["/v1/ingress/members"]).toBeDefined();
+    expect(body.paths["/v1/ingress/members/{memberId}"]).toBeDefined();
+    expect(body.paths["/v1/ingress/members/{memberId}/block"]).toBeDefined();
+    expect(body.paths["/v1/ingress/invites"]).toBeDefined();
+    expect(body.paths["/v1/ingress/invites/redeem"]).toBeDefined();
+    expect(body.paths["/v1/ingress/invites/{inviteId}"]).toBeDefined();
     expect(body.paths["/v1/integrations/guardian/challenge"]).toBeDefined();
     expect(body.paths["/v1/integrations/guardian/status"]).toBeDefined();
     expect(body.paths["/v1/integrations/guardian/outbound/start"]).toBeDefined();
@@ -147,4 +157,20 @@ describe("buildSchema()", () => {
     });
     expect(telegramDeliver.anyOf).toContainEqual({ required: ["chatAction"] });
   });
+
+  test("ingress member block request body is required", () => {
+    const schema = buildSchema() as {
+      paths: Record<string, {
+        post?: {
+          requestBody?: {
+            required?: boolean;
+          };
+        };
+      }>;
+    };
+
+    const ingressMemberBlockPost = schema.paths["/v1/ingress/members/{memberId}/block"]?.post;
+    expect(ingressMemberBlockPost).toBeDefined();
+    expect(ingressMemberBlockPost?.requestBody?.required).toBe(true);
+  });
 });