Question: Validation for Responses...

[darrin]

Chris -

Yeah - it's me again...

Perhaps just food for thought... BUT it seems like we have everything we'd need to build out validation on the response (res.body)... Goodness knows it would be handy in ensuring the API contract in tact.

I honestly don't know much about express but it seems like we'd either need to hook something in to intercept the outbound response so that we could directly look at the res.body or validate the response before it's sent (which of course would require a code change for every method we want to do this for) - something like:

    var ret = swaggerValidateResponse(spec, responseBody, model);
    if(ret.length) {
        var errors = _.pluck(_.pluck(ret, 'error'), 'message');
        var message = 'validation failure - ' + errors.join();
        return { 'code' : 400, 'message': message };
    }

Which looks awfully familiar... I should hope.

I'd expect that the logic to do the validation is much like how our body.js works... all we'd be doing is validating the response against the responseModel...

As mentioned in another thread I'm a bit swamped but something like this would save many people (and me) lots of time in the long run and might be worth carving out some time for... EVEN if I had to manually add that statement at the end of every swaggerized api call.

Have you given this type of thing any thought?

-Darrin

[wonderlic-chrisk]

@darrin, I personally have not.

I know there are other swagger tools that validate the request as well but, as you mentioned, it would be relatively trivial to add it at this point. However, I am a little hesitant to do this without additional changes I have been thinking about for getting the error messages. In short, this would be an additional 5 lines of validation logic. In our code, most of the logic for an action of a swagger method is broken out to other files so most of the code would be validating input and output. There is also not any way to add this directly to swagger-node-express (as my pull request is still a pull request, mostly waiting on 2.0 at this point), so most of the code of an action would be validating the contract as opposed to either having an array of actions or middleware or ...

TL;DR. I agree with your idea but also don't really have time.