jhthorsen / mojolicious-plugin-openapi

OpenAPI / Swagger plugin for Mojolicious
54 stars 42 forks source link

enforce checking of enums in api response #156

Closed rmallah closed 4 years ago

rmallah commented 4 years ago

looks like it is possible to send across responses that bear some field which is defined as an enum in spec but has a value other than the enumerated ones.

Eg

 responses:
        200:
          description: search results matching criteria
          schema:
            type: object
            required:
              - apiresponse
            properties:
              records:
                type: array
                items:
                  $ref: '#/definitions/PartyGroup'
              apiresponse:
                $ref: '#/definitions/ApiResponse'
        404:
          description: No schools found matching query.
        400:
          description: bad input parameter

and somewhere else:

definitions:
  PartyGroup:
    type: object
    required:
    - party_id
    - group_name
    - type
    properties:
      party_id:
        type: string
        example: "10001"
      group_name:
        type: string
        example: "St. Mary School"
      party_type:
        type: string
        enum:
          - VAL1
          - VAL2

While sending the response it was possible to set party_type to 'VAL3' and the openapi renderer did not complain on the violation of enum.

jhthorsen commented 4 years ago

Can't replicate the issue, without a failing case. Please open an issue in https://github.com/mojolicious/json-validator/ with a failing test case. You can look at https://github.com/mojolicious/json-validator/blob/master/t/jv-enum.t for examples.

rmallah commented 4 years ago

Thanks for responding. Will do the need ful.