1828

pending completion

Build # 1828

Build Type

Pull #695

travis-ci

Committed by

web-flow

Commit Message

<a href="https://github.com/kogosoftwarellc/open-api/commit/<a class=hub.com/kogosoftwarellc/open-api/commit/<a class="double-link" href="https://git"><a class=hub.com/kogosoftwarellc/open-api/commit/<a class="double-link" href="https://git"><a class=hub.com/kogosoftwarellc/open-api/commit/<a class="double-link" href="https://git"><a class=hub.com/kogosoftwarellc/open-api/commit/b188b0ff7162de6e073a3c5974593d6e60f6b974">b188b0ff7">&lt;a href=&quot;https://github.com/kogosoftwarellc/open-api/commit/</a><a class="double-link" href="https://github.com/kogosoftwarellc/open-api/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/kogosoftwarellc/open-api/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/kogosoftwarellc/open-api/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/kogosoftwarellc/open-api/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/kogosoftwarellc/open-api/commit/b188b0ff7162de6e073a3c5974593d6e60f6b974">b188b0ff7</a><a href="https://github.com/kogosoftwarellc/open-api/commit/b188b0ff7162de6e073a3c5974593d6e60f6b974">&quot;&gt;&amp;lt;a href=&amp;quot;https://github.com/kogosoftwarellc/open-api/commit/&lt;/a&gt;&lt;a class=&quot;double-link&quot; href=&quot;https://github.com/kogosoftwarellc/open-api/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/kogosoftwarellc/open-api/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/kogosoftwarellc/open-api/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/kogosoftwarellc/open-api/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/kogosoftwarellc/open-api/commit/b188b0ff7162de6e073a3c5974593d6e60f6b974&quot;&gt;b188b0ff7&lt;/a&gt;&lt;a href=&quot;https://github.com/kogosoftwarellc/open-api/commit/b188b0ff7162de6e073a3c5974593d6e60f6b974&quot;&gt;&amp;quot;&amp;gt;&amp;amp;lt;a href=&amp;amp;quot;https://github.com/kogosoftwarellc/open-api/commit/&amp;lt;/a&amp;gt;&amp;lt;a... (continued)

Pull Request Pull Request #695: Add support for customKeywords in openapi-request-validator

Run Details

932 of 1010 branches covered (92.28%)

Branch coverage included in aggregate %.

4 of 4 new or added lines in 2 files covered. (100.0%)

1326 of 1378 relevant lines covered (96.23%)

64.33 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

92.83

/packages/openapi-request-validator/index.ts

import * as Ajv from 'ajv';
import { convertParametersToJSONSchema } from 'openapi-jsonschema-parameters';
import { IJsonSchema, OpenAPI, OpenAPIV3 } from 'openapi-types';
import { dummyLogger, Logger } from 'ts-log';
const contentTypeParser = require('content-type');
const LOCAL_DEFINITION_REGEX = /^#\/([^\/]+)\/([^\/]+)$/;

export interface IOpenAPIRequestValidator {
  validateRequest(request: OpenAPI.Request);
}

export interface OpenAPIRequestValidatorArgs {
  customFormats?: {
    [formatName: string]: Ajv.FormatValidator | Ajv.FormatDefinition;
  };
  customKeywords?: {
    [keywordName: string]: Ajv.KeywordDefinition;
  };
  externalSchemas?: {
    [index: string]: IJsonSchema;
  };
  loggingKey?: string;
  logger?: Logger;
  parameters: OpenAPI.Parameters;
  requestBody?: OpenAPIV3.RequestBodyObject;
  schemas?: IJsonSchema[];
  componentSchemas?: IJsonSchema[];
  errorTransformer?(
    openAPIResponseValidatorValidationError: OpenAPIRequestValidatorError,
    ajvError: Ajv.ErrorObject
  ): any;
}

export interface OpenAPIRequestValidatorError {
  errorCode: string;
  location?: string;
  message: string;
  path?: string;
  schema?: any;
}

export default class OpenAPIRequestValidator
  implements IOpenAPIRequestValidator {
  private bodySchema: IJsonSchema;
  private errorMapper: (ajvError: Ajv.ErrorObject) => any;
  private isBodyRequired: boolean;
  private logger: Logger = dummyLogger;
  private loggingKey: string = '';
  private requestBody: OpenAPIV3.RequestBodyObject;
  private requestBodyValidators: RequestBodyValidators = {};
  private validateBody: Ajv.ValidateFunction;
  private validateFormData: Ajv.ValidateFunction;
  private validateHeaders: Ajv.ValidateFunction;
  private validatePath: Ajv.ValidateFunction;
  private validateQuery: Ajv.ValidateFunction;

  constructor(args: OpenAPIRequestValidatorArgs) {
    const loggingKey = args && args.loggingKey ? args.loggingKey + ': ' : '';
    this.loggingKey = loggingKey;
    if (!args) {
      throw new Error(`${loggingKey}missing args argument`);
    }

    if (args.logger) {
      this.logger = args.logger;
    }

    const errorTransformer =
      typeof args.errorTransformer === 'function' && args.errorTransformer;
    const errorMapper = errorTransformer
      ? extendedErrorMapper(errorTransformer)
      : toOpenapiValidationError;
    let bodyValidationSchema;
    let bodySchema;
    let headersSchema;
    let formDataSchema;
    let pathSchema;
    let querySchema;
    let isBodyRequired;

    if (args.parameters !== undefined) {
      if (Array.isArray(args.parameters)) {
        const schemas = convertParametersToJSONSchema(args.parameters);
        bodySchema = schemas.body;
        headersSchema = lowercasedHeaders(schemas.headers);
        formDataSchema = schemas.formData;
        pathSchema = schemas.path;
        querySchema = schemas.query;
        isBodyRequired =
          // @ts-ignore
          args.parameters.filter(byRequiredBodyParameters).length > 0;
      } else {
        throw new Error(`${loggingKey}args.parameters must be an Array`);
      }
    }

    const v = new Ajv({
      useDefaults: true,
      allErrors: true,
      unknownFormats: 'ignore',
      missingRefs: 'fail',
      // @ts-ignore TODO get Ajv updated to account for logger
      logger: false,
    });

    v.removeKeyword('readOnly');
    v.addKeyword('readOnly', {
      modifying: true,
      compile: (sch) => {
        if (sch) {
          return function validate(data, path, obj, propName) {
            const isValid = !(sch === true && data != null);
            (validate as any).errors = [
              {
                keyword: 'readOnly',
                dataPath: path,
                message: 'is read-only',
                params: { readOnly: propName },
              },
            ];
            return isValid;
          };
        }
        return () => true;
      },
    });

    if (args.requestBody) {
      isBodyRequired = args.requestBody.required || false;
    }

    if (args.customFormats) {
      let hasNonFunctionProperty;
      Object.keys(args.customFormats).forEach((format) => {
        const func = args.customFormats[format];
        if (typeof func === 'function') {
          v.addFormat(format, func);
        } else {
          hasNonFunctionProperty = true;
        }
      });
      if (hasNonFunctionProperty) {
        throw new Error(
          `${loggingKey}args.customFormats properties must be functions`
        );
      }
    }

    if (args.customKeywords) {
      for (const [keywordName, keywordDefinition] of Object.entries(
        args.customKeywords
      )) {
        v.addKeyword(keywordName, keywordDefinition);
      }
    }

    if (bodySchema) {
      bodyValidationSchema = {
        properties: {
          body: bodySchema,
        },
      };
    }
    if (args.componentSchemas) {
      // openapi v3:
      Object.keys(args.componentSchemas).forEach((id) => {
        v.addSchema(args.componentSchemas[id], `#/components/schemas/${id}`);
      });
    } else if (args.schemas) {
      if (Array.isArray(args.schemas)) {
        args.schemas.forEach((schema) => {
          const id = schema.id;

          if (id) {
            const localSchemaPath = LOCAL_DEFINITION_REGEX.exec(id);

            if (localSchemaPath && bodyValidationSchema) {
              let definitions = bodyValidationSchema[localSchemaPath[1]];

              if (!definitions) {
                definitions = bodyValidationSchema[localSchemaPath[1]] = {};
              }

              definitions[localSchemaPath[2]] = schema;
            }

            v.addSchema(schema, id);
          } else {
            this.logger.warn(loggingKey, 'igorning schema without id property');
          }
        });
      } else if (bodySchema) {
        bodyValidationSchema.definitions = args.schemas;
        bodyValidationSchema.components = {
          schemas: args.schemas,
        };
      }
    }

    if (args.externalSchemas) {
      Object.keys(args.externalSchemas).forEach((id) => {
        v.addSchema(args.externalSchemas[id], id);
      });
    }

    if (args.requestBody) {
      /* tslint:disable-next-line:forin */
      for (const mediaTypeKey in args.requestBody.content) {
        const bodyContentSchema = args.requestBody.content[mediaTypeKey].schema;
        const copied = JSON.parse(JSON.stringify(bodyContentSchema));
        const resolvedSchema = resolveAndSanitizeRequestBodySchema(copied, v);
        this.requestBodyValidators[mediaTypeKey] = v.compile(
          transformOpenAPIV3Definitions({
            properties: {
              body: resolvedSchema,
            },
            definitions: args.schemas || {},
            components: { schemas: args.schemas },
          })
        );
      }
    }

    this.bodySchema = bodySchema;
    this.errorMapper = errorMapper;
    this.isBodyRequired = isBodyRequired;
    this.requestBody = args.requestBody;
    this.validateBody =
      bodyValidationSchema &&
      v.compile(transformOpenAPIV3Definitions(bodyValidationSchema));
    this.validateFormData =
      formDataSchema &&
      v.compile(transformOpenAPIV3Definitions(formDataSchema));
    this.validateHeaders =
      headersSchema && v.compile(transformOpenAPIV3Definitions(headersSchema));
    this.validatePath =
      pathSchema && v.compile(transformOpenAPIV3Definitions(pathSchema));
    this.validateQuery =
      querySchema && v.compile(transformOpenAPIV3Definitions(querySchema));
  }

  public validateRequest(request) {
    const errors = [];
    let err;
    let schemaError;
    let mediaTypeError;

    if (this.bodySchema) {
      if (request.body) {
        if (!this.validateBody({ body: request.body })) {
          errors.push.apply(
            errors,
            withAddedLocation('body', this.validateBody.errors)
          );
        }
      } else if (this.isBodyRequired) {
        schemaError = {
          location: 'body',
          message:
            'request.body was not present in the request.  Is a body-parser being used?',
          schema: this.bodySchema,
        };
      }
    }

    if (this.requestBody) {
      const contentType = request.headers['content-type'];
      const mediaTypeMatch = getSchemaForMediaType(
        contentType,
        this.requestBody,
        this.logger,
        this.loggingKey
      );
      if (!mediaTypeMatch) {
        if (contentType) {
          mediaTypeError = {
            message: `Unsupported Content-Type ${contentType}`,
          };
        } else if (this.isBodyRequired) {
          errors.push({
            keyword: 'required',
            dataPath: '.body',
            params: {},
            message: 'media type is not specified',
            location: 'body',
          });
        }
      } else {
        const bodySchema = this.requestBody.content[mediaTypeMatch].schema;
        if (request.body) {
          const validateBody = this.requestBodyValidators[mediaTypeMatch];
          if (!validateBody({ body: request.body })) {
            errors.push.apply(
              errors,
              withAddedLocation('body', validateBody.errors)
            );
          }
        } else if (this.isBodyRequired) {
          schemaError = {
            location: 'body',
            message:
              'request.body was not present in the request.  Is a body-parser being used?',
            schema: bodySchema,
          };
        }
      }
    }

    if (this.validateFormData && !schemaError) {
      if (!this.validateFormData(request.body)) {
        errors.push.apply(
          errors,
          withAddedLocation('formData', this.validateFormData.errors)
        );
      }
    }

    if (this.validatePath) {
      if (!this.validatePath(request.params || {})) {
        errors.push.apply(
          errors,
          withAddedLocation('path', this.validatePath.errors)
        );
      }
    }

    if (this.validateHeaders) {
      if (
        !this.validateHeaders(lowercaseRequestHeaders(request.headers || {}))
      ) {
        errors.push.apply(
          errors,
          withAddedLocation('headers', this.validateHeaders.errors)
        );
      }
    }

    if (this.validateQuery) {
      if (!this.validateQuery(request.query || {})) {
        errors.push.apply(
          errors,
          withAddedLocation('query', this.validateQuery.errors)
        );
      }
    }

    if (errors.length) {
      err = {
        status: 400,
        errors: errors.map(this.errorMapper),
      };
    } else if (schemaError) {
      err = {
        status: 400,
        errors: [schemaError],
      };
    } else if (mediaTypeError) {
      err = {
        status: 415,
        errors: [mediaTypeError],
      };
    }

    return err;
  }

  public validate(request) {
    console.warn('validate is deprecated, use validateRequest instead.');
    this.validateRequest(request);
  }
}
interface RequestBodyValidators {
  [mediaType: string]: Ajv.ValidateFunction;
}

function byRequiredBodyParameters<T>(param: T): boolean {
  // @ts-ignore
  return (param.in === 'body' || param.in === 'formData') && param.required;
}

function extendedErrorMapper(mapper) {
  return (ajvError) => mapper(toOpenapiValidationError(ajvError), ajvError);
}

function getSchemaForMediaType(
  contentTypeHeader: string,
  requestBodySpec: OpenAPIV3.RequestBodyObject,
  logger: Logger,
  loggingKey: string
): string {
  if (!contentTypeHeader) {
    return;
  }
  let contentType: string;
  try {
    contentType = contentTypeParser.parse(contentTypeHeader).type;
  } catch (e) {
    logger.warn(
      loggingKey,
      'failed to parse content-type',
      contentTypeHeader,
      e
    );
    if (e instanceof TypeError && e.message === 'invalid media type') {
      return;
    }
    throw e;
  }
  const content = requestBodySpec.content;
  const subTypeWildCardPoints = 2;
  const wildcardMatchPoints = 1;
  let match: string;
  let matchPoints = 0;
  for (const mediaTypeKey in content) {
    if (content.hasOwnProperty(mediaTypeKey)) {
      if (mediaTypeKey.indexOf(contentType) > -1) {
        return mediaTypeKey;
      } else if (mediaTypeKey === '*/*' && wildcardMatchPoints > matchPoints) {
        match = mediaTypeKey;
        matchPoints = wildcardMatchPoints;
      }
      const contentTypeParts = contentType.split('/');
      const mediaTypeKeyParts = mediaTypeKey.split('/');
      if (mediaTypeKeyParts[1] !== '*') {
        continue;
      } else if (
        contentTypeParts[0] === mediaTypeKeyParts[0] &&
        subTypeWildCardPoints > matchPoints
      ) {
        match = mediaTypeKey;
        matchPoints = subTypeWildCardPoints;
      }
    }
  }
  return match;
}

function lowercaseRequestHeaders(headers) {
  const lowerCasedHeaders = {};
  Object.keys(headers).forEach((header) => {
    lowerCasedHeaders[header.toLowerCase()] = headers[header];
  });
  return lowerCasedHeaders;
}

function lowercasedHeaders(headersSchema) {
  if (headersSchema) {
    const properties = headersSchema.properties;
    Object.keys(properties).forEach((header) => {
      const property = properties[header];
      delete properties[header];
      properties[header.toLowerCase()] = property;
    });

    if (headersSchema.required && headersSchema.required.length) {
      headersSchema.required = headersSchema.required.map((header) => {
        return header.toLowerCase();
      });
    }
  }

  return headersSchema;
}

function toOpenapiValidationError(error): OpenAPIRequestValidatorError {
  const validationError: OpenAPIRequestValidatorError = {
    path: 'instance' + error.dataPath,
    errorCode: `${error.keyword}.openapi.requestValidation`,
    message: error.message,
    location: error.location,
  };

  if (error.keyword === '$ref') {
    delete validationError.errorCode;
    validationError.schema = { $ref: error.params.ref };
  }

  if (error.params.missingProperty) {
    validationError.path += '.' + error.params.missingProperty;
  }

  validationError.path = validationError.path.replace(
    error.location === 'body' ? /^instance\.body\.?/ : /^instance\.?/,
    ''
  );

  if (!validationError.path) {
    delete validationError.path;
  }

  return stripBodyInfo(validationError);
}

function stripBodyInfo(error) {
  if (error.location === 'body') {
    if (typeof error.path === 'string') {
      error.path = error.path.replace(/^body\./, '');
    } else {
      // Removing to avoid breaking clients that are expecting strings.
      delete error.path;
    }

    error.message = error.message.replace(/^instance\.body\./, 'instance.');
    error.message = error.message.replace(/^instance\.body /, 'instance ');
  }

  return error;
}

function withAddedLocation(location, errors) {
  errors.forEach((error) => {
    error.location = location;
  });

  return errors;
}

function resolveAndSanitizeRequestBodySchema(
  requestBodySchema:
    | OpenAPIV3.ReferenceObject
    | OpenAPIV3.NonArraySchemaObject
    | OpenAPIV3.ArraySchemaObject,
  v: Ajv.Ajv
) {
  let resolved;
  let copied;

  if ('properties' in requestBodySchema) {
    const schema = requestBodySchema as OpenAPIV3.NonArraySchemaObject;
    Object.keys(schema.properties).forEach((property) => {
      let prop = schema.properties[property];
      prop = sanitizeReadonlyPropertiesFromRequired(prop);
      if (!prop.hasOwnProperty('$ref') && !prop.hasOwnProperty('items')) {
        prop = resolveAndSanitizeRequestBodySchema(prop, v);
      }
    });
    requestBodySchema = sanitizeReadonlyPropertiesFromRequired(
      requestBodySchema
    );
  } else if ('$ref' in requestBodySchema) {
    resolved = v.getSchema(requestBodySchema.$ref);
    if (resolved && resolved.schema) {
      copied = JSON.parse(JSON.stringify(resolved.schema));
      copied = sanitizeReadonlyPropertiesFromRequired(copied);
      copied = resolveAndSanitizeRequestBodySchema(copied, v);
      requestBodySchema = copied;
    }
  } else if ('items' in requestBodySchema) {
    if ('$ref' in requestBodySchema.items) {
      resolved = v.getSchema(requestBodySchema.items.$ref);
      if (resolved && resolved.schema) {
        copied = JSON.parse(JSON.stringify(resolved.schema));
        copied = sanitizeReadonlyPropertiesFromRequired(copied);
        copied = resolveAndSanitizeRequestBodySchema(copied, v);
        requestBodySchema.items = copied;
      }
    }
  } else if ('allOf' in requestBodySchema) {
    requestBodySchema.allOf = requestBodySchema.allOf.map((val):
      | OpenAPIV3.ReferenceObject
      | OpenAPIV3.NonArraySchemaObject
      | OpenAPIV3.ArraySchemaObject => {
      val = sanitizeReadonlyPropertiesFromRequired(val);
      return resolveAndSanitizeRequestBodySchema(val, v);
    });
  } else if ('oneOf' in requestBodySchema) {
    requestBodySchema.oneOf = requestBodySchema.oneOf.map((val):
      | OpenAPIV3.ReferenceObject
      | OpenAPIV3.NonArraySchemaObject
      | OpenAPIV3.ArraySchemaObject => {
      val = sanitizeReadonlyPropertiesFromRequired(val);
      return resolveAndSanitizeRequestBodySchema(val, v);
    });
  } else if ('anyOf' in requestBodySchema) {
    requestBodySchema.anyOf = requestBodySchema.anyOf.map((val):
      | OpenAPIV3.ReferenceObject
      | OpenAPIV3.NonArraySchemaObject
      | OpenAPIV3.ArraySchemaObject => {
      val = sanitizeReadonlyPropertiesFromRequired(val);
      return resolveAndSanitizeRequestBodySchema(val, v);
    });
  }
  return requestBodySchema;
}

function sanitizeReadonlyPropertiesFromRequired(
  schema:
    | OpenAPIV3.ReferenceObject
    | OpenAPIV3.NonArraySchemaObject
    | OpenAPIV3.ArraySchemaObject
) {
  if ('properties' in schema && 'required' in schema) {
    const readOnlyProps = Object.keys(schema.properties).map((key) => {
      const prop = schema.properties[key];
      if (prop && 'readOnly' in prop) {
        if (prop.readOnly === true) {
          return key;
        }
      }
      return;
    });
    readOnlyProps
      .filter((i) => i !== undefined)
      .forEach((value) => {
        const index = schema.required.indexOf(value);
        schema.required.splice(index, 1);
      });
  }
  return schema;
}

function recursiveTransformOpenAPIV3Definitions(object) {
  // Transformations //
  // OpenAPIV3 nullable
  if (object.nullable === true) {
    if (object.enum) {
      // Enums can not be null with type null
      object.oneOf = [
        { type: 'null' },
        {
          type: object.type,
          enum: object.enum,
        },
      ];
      delete object.type;
      delete object.enum;
    } else if (object.type) {
      object.type = [object.type, 'null'];
    } else if (object.allOf) {
      object.anyOf = [{ allOf: object.allOf }, { type: 'null' }];
      delete object.allOf;
    } else if (object.oneOf || object.anyOf) {
      const arr: any[] = object.oneOf || object.anyOf;
      arr.push({ type: 'null' });
    }

    delete object.nullable;
  }
  Object.keys(object).forEach((attr) => {
    if (typeof object[attr] === 'object' && object[attr] !== null) {
      recursiveTransformOpenAPIV3Definitions(object[attr]);
    } else if (Array.isArray(object[attr])) {
      object[attr].forEach((obj) =>
        recursiveTransformOpenAPIV3Definitions(obj)
      );
    }
  });
}

function transformOpenAPIV3Definitions(schema) {
  if (typeof schema !== 'object') {
    return schema;
  }
  const res = JSON.parse(JSON.stringify(schema));
  recursiveTransformOpenAPIV3Definitions(res);
  return res;
}

1	import * as Ajv from 'ajv';	2✔
2	import { convertParametersToJSONSchema } from 'openapi-jsonschema-parameters';	2✔
3	import { IJsonSchema, OpenAPI, OpenAPIV3 } from 'openapi-types';
4	import { dummyLogger, Logger } from 'ts-log';	2✔
5	const contentTypeParser = require('content-type');	2✔
6	const LOCAL_DEFINITION_REGEX = /^#\/([^\/]+)\/([^\/]+)$/;	2✔
7
8	export interface IOpenAPIRequestValidator {
9	validateRequest(request: OpenAPI.Request);
10	}
11
12	export interface OpenAPIRequestValidatorArgs {
13	customFormats?: {
14	[formatName: string]: Ajv.FormatValidator \| Ajv.FormatDefinition;
15	};
16	customKeywords?: {
17	[keywordName: string]: Ajv.KeywordDefinition;
18	};
19	externalSchemas?: {
20	[index: string]: IJsonSchema;
21	};
22	loggingKey?: string;
23	logger?: Logger;
24	parameters: OpenAPI.Parameters;
25	requestBody?: OpenAPIV3.RequestBodyObject;
26	schemas?: IJsonSchema[];
27	componentSchemas?: IJsonSchema[];
28	errorTransformer?(
29	openAPIResponseValidatorValidationError: OpenAPIRequestValidatorError,
30	ajvError: Ajv.ErrorObject
31	): any;
32	}
33
34	export interface OpenAPIRequestValidatorError {
35	errorCode: string;
36	location?: string;
37	message: string;
38	path?: string;
39	schema?: any;
40	}
41
42	export default class OpenAPIRequestValidator	2✔
43	implements IOpenAPIRequestValidator {
44	private bodySchema: IJsonSchema;
45	private errorMapper: (ajvError: Ajv.ErrorObject) => any;
46	private isBodyRequired: boolean;
47	private logger: Logger = dummyLogger;	148✔
48	private loggingKey: string = '';	148✔
49	private requestBody: OpenAPIV3.RequestBodyObject;
50	private requestBodyValidators: RequestBodyValidators = {};	148✔
51	private validateBody: Ajv.ValidateFunction;
52	private validateFormData: Ajv.ValidateFunction;
53	private validateHeaders: Ajv.ValidateFunction;
54	private validatePath: Ajv.ValidateFunction;
55	private validateQuery: Ajv.ValidateFunction;
56
57	constructor(args: OpenAPIRequestValidatorArgs) {	148✔
58	const loggingKey = args && args.loggingKey ? args.loggingKey + ': ' : '';	148✔
59	this.loggingKey = loggingKey;	148✔
60	if (!args) {	148✔
61	throw new Error(`${loggingKey}missing args argument`);	2✔
62	}
63
64	if (args.logger) {	146✔
65	this.logger = args.logger;	2✔
66	}
67
68	const errorTransformer =
69	typeof args.errorTransformer === 'function' && args.errorTransformer;	146✔
70	const errorMapper = errorTransformer	146✔
71	? extendedErrorMapper(errorTransformer)
72	: toOpenapiValidationError;
73	let bodyValidationSchema;
74	let bodySchema;
75	let headersSchema;
76	let formDataSchema;
77	let pathSchema;
78	let querySchema;
79	let isBodyRequired;
80
81	if (args.parameters !== undefined) {	146✔
82	if (Array.isArray(args.parameters)) {	142✔
83	const schemas = convertParametersToJSONSchema(args.parameters);	140✔
84	bodySchema = schemas.body;	140✔
85	headersSchema = lowercasedHeaders(schemas.headers);	140✔
86	formDataSchema = schemas.formData;	140✔
87	pathSchema = schemas.path;	140✔
88	querySchema = schemas.query;	140✔
89	isBodyRequired =	140✔
90	// @ts-ignore
91	args.parameters.filter(byRequiredBodyParameters).length > 0;
92	} else {
93	throw new Error(`${loggingKey}args.parameters must be an Array`);	2✔
94	}
95	}
96
97	const v = new Ajv({	144✔
98	useDefaults: true,
99	allErrors: true,
100	unknownFormats: 'ignore',
101	missingRefs: 'fail',
102	// @ts-ignore TODO get Ajv updated to account for logger
103	logger: false,
104	});
105
106	v.removeKeyword('readOnly');	144✔
107	v.addKeyword('readOnly', {	144✔
108	modifying: true,
109	compile: (sch) => {
110	if (sch) {	88✔
111	return function validate(data, path, obj, propName) {	84✔
112	const isValid = !(sch === true && data != null);	2✔
113	(validate as any).errors = [	2✔
114	{
115	keyword: 'readOnly',
116	dataPath: path,
117	message: 'is read-only',
118	params: { readOnly: propName },
119	},
120	];
121	return isValid;	2✔
122	};
123	}
124	return () => true;	4✔
125	},
126	});
127
128	if (args.requestBody) {	144✔
129	isBodyRequired = args.requestBody.required \|\| false;	56✔
130	}
131
132	if (args.customFormats) {	144✔
133	let hasNonFunctionProperty;
134	Object.keys(args.customFormats).forEach((format) => {	10✔
135	const func = args.customFormats[format];	8✔
136	if (typeof func === 'function') {	8✔
137	v.addFormat(format, func);	6✔
138	} else {
139	hasNonFunctionProperty = true;	2✔
140	}
141	});
142	if (hasNonFunctionProperty) {	10✔
143	throw new Error(	2✔
144	`${loggingKey}args.customFormats properties must be functions`
145	);
146	}
147	}
148
149	if (args.customKeywords) {	142✔
150	for (const [keywordName, keywordDefinition] of Object.entries(	×
151	args.customKeywords
152	)) {
153	v.addKeyword(keywordName, keywordDefinition);	×
154	}
155	}
156
157	if (bodySchema) {	142✔
158	bodyValidationSchema = {	38✔
159	properties: {
160	body: bodySchema,
161	},
162	};
163	}
164	if (args.componentSchemas) {	142✔
165	// openapi v3:
166	Object.keys(args.componentSchemas).forEach((id) => {	24✔
167	v.addSchema(args.componentSchemas[id], `#/components/schemas/${id}`);	42✔
168	});
169	} else if (args.schemas) {	118✔
170	if (Array.isArray(args.schemas)) {	48✔
171	args.schemas.forEach((schema) => {	16✔
172	const id = schema.id;	24✔
173
174	if (id) {	24✔
175	const localSchemaPath = LOCAL_DEFINITION_REGEX.exec(id);	20✔
176
177	if (localSchemaPath && bodyValidationSchema) {	20✔
178	let definitions = bodyValidationSchema[localSchemaPath[1]];	18✔
179
180	if (!definitions) {	18✔
181	definitions = bodyValidationSchema[localSchemaPath[1]] = {};	10✔
182	}
183
184	definitions[localSchemaPath[2]] = schema;	18✔
185	}
186
187	v.addSchema(schema, id);	20✔
188	} else {
189	this.logger.warn(loggingKey, 'igorning schema without id property');	4✔
190	}
191	});
192	} else if (bodySchema) {	32✔
193	bodyValidationSchema.definitions = args.schemas;	18✔
194	bodyValidationSchema.components = {	18✔
195	schemas: args.schemas,
196	};
197	}
198	}
199
200	if (args.externalSchemas) {	142✔
201	Object.keys(args.externalSchemas).forEach((id) => {	8✔
202	v.addSchema(args.externalSchemas[id], id);	16✔
203	});
204	}
205
206	if (args.requestBody) {	142✔
207	/* tslint:disable-next-line:forin */
208	for (const mediaTypeKey in args.requestBody.content) {	56✔
209	const bodyContentSchema = args.requestBody.content[mediaTypeKey].schema;	56✔
210	const copied = JSON.parse(JSON.stringify(bodyContentSchema));	56✔
211	const resolvedSchema = resolveAndSanitizeRequestBodySchema(copied, v);	56✔
212	this.requestBodyValidators[mediaTypeKey] = v.compile(	56✔
213	transformOpenAPIV3Definitions({
214	properties: {
215	body: resolvedSchema,
216	},
217	definitions: args.schemas \|\| {},
218	components: { schemas: args.schemas },
219	})
220	);
221	}
222	}
223
224	this.bodySchema = bodySchema;	142✔
225	this.errorMapper = errorMapper;	142✔
226	this.isBodyRequired = isBodyRequired;	142✔
227	this.requestBody = args.requestBody;	142✔
228	this.validateBody =	142✔
229	bodyValidationSchema &&
230	v.compile(transformOpenAPIV3Definitions(bodyValidationSchema));
231	this.validateFormData =	142✔
232	formDataSchema &&
233	v.compile(transformOpenAPIV3Definitions(formDataSchema));
234	this.validateHeaders =	142✔
235	headersSchema && v.compile(transformOpenAPIV3Definitions(headersSchema));
236	this.validatePath =	142✔
237	pathSchema && v.compile(transformOpenAPIV3Definitions(pathSchema));
238	this.validateQuery =	142✔
239	querySchema && v.compile(transformOpenAPIV3Definitions(querySchema));
240	}
241
242	public validateRequest(request) {	2✔
243	const errors = [];	138✔
244	let err;
245	let schemaError;
246	let mediaTypeError;
247
248	if (this.bodySchema) {	138✔
249	if (request.body) {	36✔
250	if (!this.validateBody({ body: request.body })) {	32✔
251	errors.push.apply(	18✔
252	errors,
253	withAddedLocation('body', this.validateBody.errors)
254	);
255	}
256	} else if (this.isBodyRequired) {	4✔
257	schemaError = {	2✔
258	location: 'body',
259	message:
260	'request.body was not present in the request. Is a body-parser being used?',
261	schema: this.bodySchema,
262	};
263	}
264	}
265
266	if (this.requestBody) {	138✔
267	const contentType = request.headers['content-type'];	56✔
268	const mediaTypeMatch = getSchemaForMediaType(	56✔
269	contentType,
270	this.requestBody,
271	this.logger,
272	this.loggingKey
273	);
274	if (!mediaTypeMatch) {	56✔
275	if (contentType) {	6✔
276	mediaTypeError = {	4✔
277	message: `Unsupported Content-Type ${contentType}`,
278	};
279	} else if (this.isBodyRequired) {	2✔
280	errors.push({	2✔
281	keyword: 'required',
282	dataPath: '.body',
283	params: {},
284	message: 'media type is not specified',
285	location: 'body',
286	});
287	}
288	} else {
289	const bodySchema = this.requestBody.content[mediaTypeMatch].schema;	50✔
290	if (request.body) {	50✔
291	const validateBody = this.requestBodyValidators[mediaTypeMatch];	50✔
292	if (!validateBody({ body: request.body })) {	50✔
293	errors.push.apply(	6✔
294	errors,
295	withAddedLocation('body', validateBody.errors)
296	);
297	}
298	} else if (this.isBodyRequired) {	×
299	schemaError = {	×
300	location: 'body',
301	message:
302	'request.body was not present in the request. Is a body-parser being used?',
303	schema: bodySchema,
304	};
305	}
306	}
307	}
308
309	if (this.validateFormData && !schemaError) {	138✔
310	if (!this.validateFormData(request.body)) {	2✔
311	errors.push.apply(	2✔
312	errors,
313	withAddedLocation('formData', this.validateFormData.errors)
314	);
315	}
316	}
317
318	if (this.validatePath) {	138✔
319	if (!this.validatePath(request.params \|\| {})) {	10✔
320	errors.push.apply(	6✔
321	errors,
322	withAddedLocation('path', this.validatePath.errors)
323	);
324	}
325	}
326
327	if (this.validateHeaders) {	138✔
328	if (	8✔
329	!this.validateHeaders(lowercaseRequestHeaders(request.headers \|\| {}))
330	) {
331	errors.push.apply(	2✔
332	errors,
333	withAddedLocation('headers', this.validateHeaders.errors)
334	);
335	}
336	}
337
338	if (this.validateQuery) {	138✔
339	if (!this.validateQuery(request.query \|\| {})) {	16✔
340	errors.push.apply(	8✔
341	errors,
342	withAddedLocation('query', this.validateQuery.errors)
343	);
344	}
345	}
346
347	if (errors.length) {	138✔
348	err = {	44✔
349	status: 400,
350	errors: errors.map(this.errorMapper),
351	};
352	} else if (schemaError) {	94✔
353	err = {	2✔
354	status: 400,
355	errors: [schemaError],
356	};
357	} else if (mediaTypeError) {	92✔
358	err = {	4✔
359	status: 415,
360	errors: [mediaTypeError],
361	};
362	}
363
364	return err;	138✔
365	}
366
367	public validate(request) {	2✔
368	console.warn('validate is deprecated, use validateRequest instead.');	×
369	this.validateRequest(request);	×
370	}
371	}	2✔
372	interface RequestBodyValidators {
373	[mediaType: string]: Ajv.ValidateFunction;
374	}
375
376	function byRequiredBodyParameters<T>(param: T): boolean {
377	// @ts-ignore
378	return (param.in === 'body' \|\| param.in === 'formData') && param.required;	80✔
379	}
380
381	function extendedErrorMapper(mapper) {
382	return (ajvError) => mapper(toOpenapiValidationError(ajvError), ajvError);	2✔
383	}
384
385	function getSchemaForMediaType(
386	contentTypeHeader: string,
387	requestBodySpec: OpenAPIV3.RequestBodyObject,
388	logger: Logger,
389	loggingKey: string
390	): string {
391	if (!contentTypeHeader) {	56✔
392	return;	2✔
393	}
394	let contentType: string;
395	try {	54✔
396	contentType = contentTypeParser.parse(contentTypeHeader).type;	54✔
397	} catch (e) {
398	logger.warn(	2✔
399	loggingKey,
400	'failed to parse content-type',
401	contentTypeHeader,
402	e
403	);
404	if (e instanceof TypeError && e.message === 'invalid media type') {	2✔
405	return;	2✔
406	}
407	throw e;	×
408	}
409	const content = requestBodySpec.content;	52✔
410	const subTypeWildCardPoints = 2;	52✔
411	const wildcardMatchPoints = 1;	52✔
412	let match: string;
413	let matchPoints = 0;	52✔
414	for (const mediaTypeKey in content) {	52✔
415	if (content.hasOwnProperty(mediaTypeKey)) {	52✔
416	if (mediaTypeKey.indexOf(contentType) > -1) {	52✔
417	return mediaTypeKey;	50✔
418	} else if (mediaTypeKey === '/' && wildcardMatchPoints > matchPoints) {	2✔
419	match = mediaTypeKey;	×
420	matchPoints = wildcardMatchPoints;	×
421	}
422	const contentTypeParts = contentType.split('/');	2✔
423	const mediaTypeKeyParts = mediaTypeKey.split('/');	2✔
424	if (mediaTypeKeyParts[1] !== '*') {	2✔
425	continue;	2✔
426	} else if (	×
427	contentTypeParts[0] === mediaTypeKeyParts[0] &&
428	subTypeWildCardPoints > matchPoints
429	) {
430	match = mediaTypeKey;	×
431	matchPoints = subTypeWildCardPoints;	×
432	}
433	}
434	}
435	return match;	2✔
436	}
437
438	function lowercaseRequestHeaders(headers) {
439	const lowerCasedHeaders = {};	8✔
440	Object.keys(headers).forEach((header) => {	8✔
441	lowerCasedHeaders[header.toLowerCase()] = headers[header];	6✔
442	});
443	return lowerCasedHeaders;	8✔
444	}
445
446	function lowercasedHeaders(headersSchema) {
447	if (headersSchema) {	140✔
448	const properties = headersSchema.properties;	8✔
449	Object.keys(properties).forEach((header) => {	8✔
450	const property = properties[header];	10✔
451	delete properties[header];	10✔
452	properties[header.toLowerCase()] = property;	10✔
453	});
454
455	if (headersSchema.required && headersSchema.required.length) {	8✔
456	headersSchema.required = headersSchema.required.map((header) => {	6✔
457	return header.toLowerCase();	8✔
458	});
459	}
460	}
461
462	return headersSchema;	140✔
463	}
464
465	function toOpenapiValidationError(error): OpenAPIRequestValidatorError {
466	const validationError: OpenAPIRequestValidatorError = {	54✔
467	path: 'instance' + error.dataPath,
468	errorCode: `${error.keyword}.openapi.requestValidation`,
469	message: error.message,
470	location: error.location,
471	};
472
473	if (error.keyword === '$ref') {	54✔
474	delete validationError.errorCode;	2✔
475	validationError.schema = { $ref: error.params.ref };	2✔
476	}
477
478	if (error.params.missingProperty) {	54✔
479	validationError.path += '.' + error.params.missingProperty;	32✔
480	}
481
482	validationError.path = validationError.path.replace(	54✔
483	error.location === 'body' ? /^instance\.body\.?/ : /^instance\.?/,
484	''
485	);
486
487	if (!validationError.path) {	54✔
488	delete validationError.path;	8✔
489	}
490
491	return stripBodyInfo(validationError);	54✔
492	}
493
494	function stripBodyInfo(error) {
495	if (error.location === 'body') {	54✔
496	if (typeof error.path === 'string') {	34✔
497	error.path = error.path.replace(/^body\./, '');	26✔
498	} else {
499	// Removing to avoid breaking clients that are expecting strings.
500	delete error.path;	8✔
501	}
502
503	error.message = error.message.replace(/^instance\.body\./, 'instance.');	34✔
504	error.message = error.message.replace(/^instance\.body /, 'instance ');	34✔
505	}
506
507	return error;	54✔
508	}
509
510	function withAddedLocation(location, errors) {
511	errors.forEach((error) => {	42✔
512	error.location = location;	52✔
513	});
514
515	return errors;	42✔
516	}
517
518	function resolveAndSanitizeRequestBodySchema(
519	requestBodySchema:
520	\| OpenAPIV3.ReferenceObject
521	\| OpenAPIV3.NonArraySchemaObject
522	\| OpenAPIV3.ArraySchemaObject,
523	v: Ajv.Ajv
524	) {
525	let resolved;
526	let copied;
527
528	if ('properties' in requestBodySchema) {	268✔
529	const schema = requestBodySchema as OpenAPIV3.NonArraySchemaObject;	78✔
530	Object.keys(schema.properties).forEach((property) => {	78✔
531	let prop = schema.properties[property];	106✔
532	prop = sanitizeReadonlyPropertiesFromRequired(prop);	106✔
533	if (!prop.hasOwnProperty('$ref') && !prop.hasOwnProperty('items')) {	106✔
534	prop = resolveAndSanitizeRequestBodySchema(prop, v);	100✔
535	}
536	});
537	requestBodySchema = sanitizeReadonlyPropertiesFromRequired(	78✔
538	requestBodySchema
539	);
540	} else if ('$ref' in requestBodySchema) {	190✔
541	resolved = v.getSchema(requestBodySchema.$ref);	48✔
542	if (resolved && resolved.schema) {	48✔
543	copied = JSON.parse(JSON.stringify(resolved.schema));	36✔
544	copied = sanitizeReadonlyPropertiesFromRequired(copied);	36✔
545	copied = resolveAndSanitizeRequestBodySchema(copied, v);	36✔
546	requestBodySchema = copied;	36✔
547	}
548	} else if ('items' in requestBodySchema) {	142✔
549	if ('$ref' in requestBodySchema.items) {	6✔
550	resolved = v.getSchema(requestBodySchema.items.$ref);	6✔
551	if (resolved && resolved.schema) {	6✔
552	copied = JSON.parse(JSON.stringify(resolved.schema));	6✔
553	copied = sanitizeReadonlyPropertiesFromRequired(copied);	6✔
554	copied = resolveAndSanitizeRequestBodySchema(copied, v);	6✔
555	requestBodySchema.items = copied;	6✔
556	}
557	}
558	} else if ('allOf' in requestBodySchema) {	136✔
559	requestBodySchema.allOf = requestBodySchema.allOf.map((val):	28✔
560	\| OpenAPIV3.ReferenceObject
561	\| OpenAPIV3.NonArraySchemaObject
562	\| OpenAPIV3.ArraySchemaObject => {
563	val = sanitizeReadonlyPropertiesFromRequired(val);	50✔
564	return resolveAndSanitizeRequestBodySchema(val, v);	50✔
565	});
566	} else if ('oneOf' in requestBodySchema) {	108✔
567	requestBodySchema.oneOf = requestBodySchema.oneOf.map((val):	6✔
568	\| OpenAPIV3.ReferenceObject
569	\| OpenAPIV3.NonArraySchemaObject
570	\| OpenAPIV3.ArraySchemaObject => {
571	val = sanitizeReadonlyPropertiesFromRequired(val);	12✔
572	return resolveAndSanitizeRequestBodySchema(val, v);	12✔
573	});
574	} else if ('anyOf' in requestBodySchema) {	102✔
575	requestBodySchema.anyOf = requestBodySchema.anyOf.map((val):	4✔
576	\| OpenAPIV3.ReferenceObject
577	\| OpenAPIV3.NonArraySchemaObject
578	\| OpenAPIV3.ArraySchemaObject => {
579	val = sanitizeReadonlyPropertiesFromRequired(val);	8✔
580	return resolveAndSanitizeRequestBodySchema(val, v);	8✔
581	});
582	}
583	return requestBodySchema;	268✔
584	}
585
586	function sanitizeReadonlyPropertiesFromRequired(
587	schema:
588	\| OpenAPIV3.ReferenceObject
589	\| OpenAPIV3.NonArraySchemaObject
590	\| OpenAPIV3.ArraySchemaObject
591	) {
592	if ('properties' in schema && 'required' in schema) {	296✔
593	const readOnlyProps = Object.keys(schema.properties).map((key) => {	116✔
594	const prop = schema.properties[key];	170✔
595	if (prop && 'readOnly' in prop) {	170✔
596	if (prop.readOnly === true) {	86✔
597	return key;	82✔
598	}
599	}
600	return;	88✔
601	});
602	readOnlyProps	116✔
603	.filter((i) => i !== undefined)	170✔
604	.forEach((value) => {
605	const index = schema.required.indexOf(value);	82✔
606	schema.required.splice(index, 1);	82✔
607	});
608	}
609	return schema;	296✔
610	}
611
612	function recursiveTransformOpenAPIV3Definitions(object) {
613	// Transformations //
614	// OpenAPIV3 nullable
615	if (object.nullable === true) {	1,390✔
616	if (object.enum) {	12✔
617	// Enums can not be null with type null
618	object.oneOf = [	2✔
619	{ type: 'null' },
620	{
621	type: object.type,
622	enum: object.enum,
623	},
624	];
625	delete object.type;	2✔
626	delete object.enum;	2✔
627	} else if (object.type) {	10✔
628	object.type = [object.type, 'null'];	2✔
629	} else if (object.allOf) {	8✔
630	object.anyOf = [{ allOf: object.allOf }, { type: 'null' }];	4✔
631	delete object.allOf;	4✔
632	} else if (object.oneOf \|\| object.anyOf) {	4✔
633	const arr: any[] = object.oneOf \|\| object.anyOf;	4✔
634	arr.push({ type: 'null' });	4✔
635	}
636
637	delete object.nullable;	12✔
638	}
639	Object.keys(object).forEach((attr) => {	1,390✔
640	if (typeof object[attr] === 'object' && object[attr] !== null) {	1,876✔
641	recursiveTransformOpenAPIV3Definitions(object[attr]);	1,260✔
642	} else if (Array.isArray(object[attr])) {	616✔
643	object[attr].forEach((obj) =>	×
644	recursiveTransformOpenAPIV3Definitions(obj)	×
645	);
646	}
647	});
648	}
649
650	function transformOpenAPIV3Definitions(schema) {
651	if (typeof schema !== 'object') {	130✔
652	return schema;	×
653	}
654	const res = JSON.parse(JSON.stringify(schema));	130✔
655	recursiveTransformOpenAPIV3Definitions(res);	130✔
656	return res;	130✔
657	}

kogosoftwarellc / open-api / 1828

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous