oapi_validate_test.go

package irismiddleware

import (
	"bytes"
	"context"
	_ "embed"
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"net/http"
	"net/http/httptest"
	"net/url"
	"testing"

	"github.com/getkin/kin-openapi/openapi3"
	"github.com/getkin/kin-openapi/openapi3filter"
	"github.com/kataras/iris/v12"
	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

//go:embed test_spec.yaml
var testSchema []byte

func doGet(t *testing.T, i *iris.Application, rawURL string) *httptest.ResponseRecorder {
	u, err := url.Parse(rawURL)
	if err != nil {
		t.Fatalf("Invalid url: %s", rawURL)
	}

	r, err := http.NewRequest(http.MethodGet, u.String(), nil)
	if err != nil {
		t.Fatalf("Could not construct a request: %s", rawURL)
	}
	r.Header.Set("accept", "application/json")
	r.Header.Set("host", u.Host)

	tt := httptest.NewRecorder()

	i.ServeHTTP(tt, r)

	return tt
}

func doPost(t *testing.T, i *iris.Application, rawURL string, jsonBody interface{}) *httptest.ResponseRecorder {
	u, err := url.Parse(rawURL)
	if err != nil {
		t.Fatalf("Invalid url: %s", rawURL)
	}

	body, err := json.Marshal(jsonBody)
	if err != nil {
		t.Fatalf("Could not marshal request body: %v", err)
	}

	r, err := http.NewRequest(http.MethodPost, u.String(), bytes.NewReader(body))
	if err != nil {
		t.Fatalf("Could not construct a request for URL %s: %v", rawURL, err)
	}
	r.Header.Set("accept", "application/json")
	r.Header.Set("content-type", "application/json")
	r.Header.Set("host", u.Host)

	tt := httptest.NewRecorder()

	i.ServeHTTP(tt, r)

	return tt
}

func TestOapiRequestValidator(t *testing.T) {
	swagger, err := openapi3.NewLoader().LoadFromData(testSchema)
	require.NoError(t, err, "Error initializing swagger")

	// Create a new iris router
	i := iris.New()

	// Set up an authenticator to check authenticated function. It will allow
	// access to "someScope", but disallow others.
	options := Options{
		ErrorHandler: func(ctx iris.Context, message string, statusCode int) {
			ctx.StopWithText(statusCode, "test: %s", message)
		},
		Options: openapi3filter.Options{
			AuthenticationFunc: func(ctx context.Context, input *openapi3filter.AuthenticationInput) error {
				// The iris context should be propagated into here.
				iCtx := GetIrisContext(ctx)
				assert.NotNil(t, iCtx)
				// As should user data
				assert.EqualValues(t, "hi!", GetUserData(ctx))

				for _, s := range input.Scopes {
					if s == "someScope" {
						return nil
					}
					if s == "unauthorized" {
						return errors.New("unauthorized")
					}
				}
				return errors.New("forbidden")
			},
		},
		UserData: "hi!",
	}

	// Install our OpenApi based request validator
	i.Use(OapiRequestValidatorWithOptions(swagger, &options))

	called := false

	// Install a request handler for /resource. We want to make sure it doesn't
	// get called.
	i.Get("/resource", func(ctx iris.Context) {
		called = true
	})

	// Add a handler for the POST message
	i.Post("/resource", func(ctx iris.Context) {
		called = true
		ctx.StatusCode(http.StatusNoContent)
	})

	i.Get("/protected_resource", func(ctx iris.Context) {
		called = true
		ctx.StatusCode(http.StatusNoContent)
	})

	i.Get("/protected_resource2", func(ctx iris.Context) {
		called = true
		ctx.StatusCode(http.StatusNoContent)
	})

	i.Get("/protected_resource_401", func(ctx iris.Context) {
		called = true
		ctx.StatusCode(http.StatusNoContent)
	})

	if err := i.Build(); err != nil {
		t.Fatalf("Error building iris: %s", err)
	}

	// Let's send the request to the wrong server, this should fail validation
	{
		res := doGet(t, i, "http://not.deepmap.ai/resource")
		assert.Equal(t, http.StatusBadRequest, res.Code)
		assert.False(t, called, "Handler should not have been called")
	}

	// Let's send a good request, it should pass
	{
		res := doGet(t, i, "http://deepmap.ai/resource")
		assert.Equal(t, http.StatusOK, res.Code)
		assert.True(t, called, "Handler should have been called")
		called = false
	}

	// Send an out-of-spec parameter
	{
		res := doGet(t, i, "http://deepmap.ai/resource?id=500")
		assert.Equal(t, http.StatusBadRequest, res.Code)
		assert.False(t, called, "Handler should not have been called")
		called = false
	}

	// Send a bad parameter type
	{
		res := doGet(t, i, "http://deepmap.ai/resource?id=foo")
		assert.Equal(t, http.StatusBadRequest, res.Code)
		assert.False(t, called, "Handler should not have been called")
		called = false
	}

	called = false
	// Send a good request body
	{
		body := struct {
			Name string `json:"name"`
		}{
			Name: "Marcin",
		}
		res := doPost(t, i, "http://deepmap.ai/resource", body)
		assert.Equal(t, http.StatusNoContent, res.Code)
		assert.True(t, called, "Handler should have been called")
		called = false
	}

	// Send a malformed body
	{
		body := struct {
			Name int `json:"name"`
		}{
			Name: 7,
		}
		res := doPost(t, i, "http://deepmap.ai/resource", body)
		assert.Equal(t, http.StatusBadRequest, res.Code)
		assert.False(t, called, "Handler should not have been called")
		called = false
	}

	// Call a protected function to which we have access
	{
		res := doGet(t, i, "http://deepmap.ai/protected_resource")
		assert.Equal(t, http.StatusNoContent, res.Code)
		assert.True(t, called, "Handler should have been called")
		called = false
	}

	// Call a protected function to which we don't have access
	{
		res := doGet(t, i, "http://deepmap.ai/protected_resource2")
		assert.Equal(t, http.StatusBadRequest, res.Code)
		assert.False(t, called, "Handler should not have been called")
		called = false
	}

	// Call a protected function without credentials
	{
		res := doGet(t, i, "http://deepmap.ai/protected_resource_401")
		assert.Equal(t, http.StatusBadRequest, res.Code)
		body, err := io.ReadAll(res.Body)
		if assert.NoError(t, err) {
			assert.Equal(t, "test: error in openapi3filter.SecurityRequirementsError: security requirements failed: unauthorized", string(body))
		}
		assert.False(t, called, "Handler should not have been called")
		called = false
	}
}

func TestOapiRequestValidatorWithOptionsMultiError(t *testing.T) {
	swagger, err := openapi3.NewLoader().LoadFromData(testSchema)
	require.NoError(t, err, "Error initializing swagger")

	i := iris.New()

	// Set up an authenticator to check authenticated function. It will allow
	// access to "someScope", but disallow others.
	options := Options{
		Options: openapi3filter.Options{
			ExcludeRequestBody:    false,
			ExcludeResponseBody:   false,
			IncludeResponseStatus: true,
			MultiError:            true,
		},
	}

	// register middleware
	i.Use(OapiRequestValidatorWithOptions(swagger, &options))

	called := false

	// Install a request handler for /resource. We want to make sure it doesn't
	// get called.
	i.Get("/multiparamresource", func(ctx iris.Context) {
		called = true
	})

	if err := i.Build(); err != nil {
		t.Fatalf("Error building iris: %s", err)
	}

	// Let's send a good request, it should pass
	{
		res := doGet(t, i, "http://deepmap.ai/multiparamresource?id=50&id2=50")
		assert.Equal(t, http.StatusOK, res.Code)
		assert.True(t, called, "Handler should have been called")
		called = false
	}

	// Let's send a request with a missing parameter, it should return
	// a bad status
	{
		res := doGet(t, i, "http://deepmap.ai/multiparamresource?id=50")
		assert.Equal(t, http.StatusBadRequest, res.Code)
		body, err := io.ReadAll(res.Body)
		if assert.NoError(t, err) {
			assert.Contains(t, string(body), "multiple errors encountered")
			assert.Contains(t, string(body), "parameter \"id2\"")
			assert.Contains(t, string(body), "value is required but missing")
		}
		assert.False(t, called, "Handler should not have been called")
		called = false
	}

	// Let's send a request with a 2 missing parameters, it should return
	// a bad status
	{
		res := doGet(t, i, "http://deepmap.ai/multiparamresource")
		assert.Equal(t, http.StatusBadRequest, res.Code)
		body, err := io.ReadAll(res.Body)
		if assert.NoError(t, err) {
			assert.Contains(t, string(body), "multiple errors encountered")
			assert.Contains(t, string(body), "parameter \"id\"")
			assert.Contains(t, string(body), "value is required but missing")
			assert.Contains(t, string(body), "parameter \"id2\"")
			assert.Contains(t, string(body), "value is required but missing")
		}
		assert.False(t, called, "Handler should not have been called")
		called = false
	}

	// Let's send a request with a 1 missing parameter, and another outside
	// or the parameters. It should return a bad status
	{
		res := doGet(t, i, "http://deepmap.ai/multiparamresource?id=500")
		assert.Equal(t, http.StatusBadRequest, res.Code)
		body, err := io.ReadAll(res.Body)
		if assert.NoError(t, err) {
			assert.Contains(t, string(body), "multiple errors encountered")
			assert.Contains(t, string(body), "parameter \"id\"")
			assert.Contains(t, string(body), "number must be at most 100")
			assert.Contains(t, string(body), "parameter \"id2\"")
			assert.Contains(t, string(body), "value is required but missing")
		}
		assert.False(t, called, "Handler should not have been called")
		called = false
	}

	// Let's send a request with a parameters that do not meet spec. It should
	// return a bad status
	{
		res := doGet(t, i, "http://deepmap.ai/multiparamresource?id=abc&id2=1")
		assert.Equal(t, http.StatusBadRequest, res.Code)
		body, err := io.ReadAll(res.Body)
		if assert.NoError(t, err) {
			assert.Contains(t, string(body), "multiple errors encountered")
			assert.Contains(t, string(body), "parameter \"id\"")
			assert.Contains(t, string(body), "value abc: an invalid integer: invalid syntax")
			assert.Contains(t, string(body), "parameter \"id2\"")
			assert.Contains(t, string(body), "number must be at least 10")
		}
		assert.False(t, called, "Handler should not have been called")
		called = false
	}
}

func TestOapiRequestValidatorWithOptionsMultiErrorAndCustomHandler(t *testing.T) {
	swagger, err := openapi3.NewLoader().LoadFromData(testSchema)
	require.NoError(t, err, "Error initializing swagger")

	i := iris.New()

	// Set up an authenticator to check authenticated function. It will allow
	// access to "someScope", but disallow others.
	options := Options{
		Options: openapi3filter.Options{
			ExcludeRequestBody:    false,
			ExcludeResponseBody:   false,
			IncludeResponseStatus: true,
			MultiError:            true,
		},
		MultiErrorHandler: func(me openapi3.MultiError) error {
			return fmt.Errorf("Bad stuff -  %s", me.Error())
		},
	}

	// register middleware
	i.Use(OapiRequestValidatorWithOptions(swagger, &options))

	called := false

	// Install a request handler for /resource. We want to make sure it doesn't
	// get called.
	i.Get("/multiparamresource", func(ctx iris.Context) {
		called = true
	})

	if err := i.Build(); err != nil {
		t.Fatalf("Error building iris: %s", err)
	}

	// Let's send a good request, it should pass
	{
		res := doGet(t, i, "http://deepmap.ai/multiparamresource?id=50&id2=50")
		assert.Equal(t, http.StatusOK, res.Code)
		assert.True(t, called, "Handler should have been called")
		called = false
	}

	// Let's send a request with a missing parameter, it should return
	// a bad status
	{
		res := doGet(t, i, "http://deepmap.ai/multiparamresource?id=50")
		assert.Equal(t, http.StatusBadRequest, res.Code)
		body, err := io.ReadAll(res.Body)
		if assert.NoError(t, err) {
			assert.Contains(t, string(body), "Bad stuff")
			assert.Contains(t, string(body), "parameter \"id2\"")
			assert.Contains(t, string(body), "value is required but missing")
		}
		assert.False(t, called, "Handler should not have been called")
		called = false
	}

	// Let's send a request with a 2 missing parameters, it should return
	// a bad status
	{
		res := doGet(t, i, "http://deepmap.ai/multiparamresource")
		assert.Equal(t, http.StatusBadRequest, res.Code)
		body, err := io.ReadAll(res.Body)
		if assert.NoError(t, err) {
			assert.Contains(t, string(body), "Bad stuff")
			assert.Contains(t, string(body), "parameter \"id\"")
			assert.Contains(t, string(body), "value is required but missing")
			assert.Contains(t, string(body), "parameter \"id2\"")
			assert.Contains(t, string(body), "value is required but missing")
		}
		assert.False(t, called, "Handler should not have been called")
		called = false
	}

	// Let's send a request with a 1 missing parameter, and another outside
	// or the parameters. It should return a bad status
	{
		res := doGet(t, i, "http://deepmap.ai/multiparamresource?id=500")
		assert.Equal(t, http.StatusBadRequest, res.Code)
		body, err := io.ReadAll(res.Body)
		if assert.NoError(t, err) {
			assert.Contains(t, string(body), "Bad stuff")
			assert.Contains(t, string(body), "parameter \"id\"")
			assert.Contains(t, string(body), "number must be at most 100")
			assert.Contains(t, string(body), "parameter \"id2\"")
			assert.Contains(t, string(body), "value is required but missing")
		}
		assert.False(t, called, "Handler should not have been called")
		called = false
	}

	// Let's send a request with a parameters that do not meet spec. It should
	// return a bad status
	{
		res := doGet(t, i, "http://deepmap.ai/multiparamresource?id=abc&id2=1")
		assert.Equal(t, http.StatusBadRequest, res.Code)
		body, err := io.ReadAll(res.Body)
		if assert.NoError(t, err) {
			assert.Contains(t, string(body), "Bad stuff")
			assert.Contains(t, string(body), "parameter \"id\"")
			assert.Contains(t, string(body), "value abc: an invalid integer: invalid syntax")
			assert.Contains(t, string(body), "parameter \"id2\"")
			assert.Contains(t, string(body), "number must be at least 10")
		}
		assert.False(t, called, "Handler should not have been called")
		called = false
	}
}

func TestOapiRequestValidatorKeepValidatedValue(t *testing.T) {
	swagger, err := openapi3.NewLoader().LoadFromData(testSchema)
	require.NoError(t, err, "Error initializing swagger")

	type validatedValuer interface {
		ValidatedValue() any
	}

	tests := []struct {
		name string
		// options is nil to exercise OapiRequestValidator(spec).
		options *Options
		// wantValidatedValue is whether the handler should see a request body
		// exposing ValidatedValue().
		wantValidatedValue bool
	}{
		{
			name:               "no options",
			options:            nil,
			wantValidatedValue: true,
		},
		{
			name:               "empty options",
			options:            &Options{},
			wantValidatedValue: true,
		},
		{
			name:               "discard validated value",
			options:            &Options{DiscardValidatedValue: true},
			wantValidatedValue: false,
		},
		{
			name: "exclude request body",
			options: &Options{
				Options: openapi3filter.Options{ExcludeRequestBody: true},
			},
			// The body is not validated, so there is no validated value.
			wantValidatedValue: false,
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			i := iris.New()
			if tc.options == nil {
				i.Use(OapiRequestValidator(swagger))
			} else {
				i.Use(OapiRequestValidatorWithOptions(swagger, tc.options))
			}

			called := false
			var (
				isValidatedValuer bool
				validatedValue    any
				bodyBytes         []byte
				readErr           error
			)
			i.Post("/resource", func(ctx iris.Context) {
				called = true
				body := ctx.Request().Body
				var vv validatedValuer
				vv, isValidatedValuer = body.(validatedValuer)
				if isValidatedValuer {
					validatedValue = vv.ValidatedValue()
				}
				bodyBytes, readErr = io.ReadAll(body)
				ctx.StatusCode(http.StatusNoContent)
			})

			require.NoError(t, i.Build())

			reqBody := struct {
				Name string `json:"name"`
			}{
				Name: "Marcin",
			}
			res := doPost(t, i, "http://deepmap.ai/resource", reqBody)
			assert.Equal(t, http.StatusNoContent, res.Code)
			require.True(t, called, "Handler should have been called")

			// The body must remain readable with the original bytes.
			require.NoError(t, readErr)
			assert.Equal(t, `{"name":"Marcin"}`, string(bodyBytes))

			assert.Equal(t, tc.wantValidatedValue, isValidatedValuer,
				"request body ValidatedValue() presence")
			if tc.wantValidatedValue {
				assert.Equal(t, map[string]any{"name": "Marcin"}, validatedValue)
			}

			// The caller's openapi3filter options must not be mutated.
			if tc.options != nil {
				assert.False(t, tc.options.Options.KeepValidatedValue,
					"caller's openapi3filter.Options should not be modified")
			}
		})
	}
}