Skip to content

Feature Request: Enable Type Validation for Response Bodies #445

@SamuelFrost

Description

@SamuelFrost

Feature Request: Enable Type Validation for Response Bodies

Problem Description

Currently, the Committee gem doesn't properly validate response body types against the OpenAPI schema, even when coerce_value: true is set in the configuration. This means that string values like "726.0" pass validation for fields defined as type: number in the schema.

Current Behavior

When using assert_response_schema_confirm with an OpenAPI schema that defines number types:

properties:
  totalAmount:
    type: number
    description: "Total amount"
    example: 12.34
    format: float

The following JSON response passes validation even though it contains strings instead of numbers:

{
  "data": [
    {
      "id": "244e2418-9f43-47fb-8e90-f439b53b632c",
      "name": "Test Item",
      "totalQuantity": "726.0",  // String instead of number
      "totalAmount": "9988.0",   // String instead of number
      "unit": "kg"
    }
  ]
}

Root Cause

I'm not familiar with the library at all, so I stuck an AI assistant to investigating the source code, and propose a solution. So take the following with a grain of salt and make sure it's not all BS. It recommends that:

  1. In operation_wrapper.rb, the response_validate_options method only passes strict and validate_header parameters to OpenAPIParser:
def response_validate_options(strict, check_header)
  ::OpenAPIParser::SchemaValidator::ResponseValidateOptions.new(strict: strict, validate_header: check_header)
end
  1. In OpenAPIParser's validators (e.g., float_validator.rb), type validation only happens when @coerce_value is true:
value = coerce(value) if @coerce_value
  1. The coerce_value option is nil by default in OpenAPIParser, which disables type coercion.

  2. While Committee passes coerce_value for request validation, it doesn't pass it for response validation.

Proposed Solution

I propose adding a new option response_type_validation to enable type validation for response bodies. Again, the following is AI generated, so take it with a grain of salt. This could be implemented by:

  1. Adding the new option to Committee's options class:
# In committee/schema_validator/option.rb
attr_accessor :response_type_validation
  1. Modifying the response_validate_options method in operation_wrapper.rb to use this option:
def response_validate_options(strict, check_header)
  ::OpenAPIParser::SchemaValidator::ResponseValidateOptions.new(
    strict: strict, 
    validate_header: check_header,
    validator_options: { coerce_value: @validator_option.response_type_validation }
  )
end
  1. Setting a default value (probably false for backward compatibility):
def initialize(...)
  @response_type_validation = false
  # ...
end

Benefits

This change would:

  1. Ensure proper type validation for response bodies when enabled
  2. Provide a clear, specific option for controlling response type validation
  3. Maintain backward compatibility with existing code
  4. Provide more accurate schema validation against the OpenAPI specification

Environment

  • Committee version: 5.0.0
  • OpenAPIParser version: ~> 1.0
  • Ruby version: 3.x
  • Rails version: 6.1.x

Thank you for considering this feature request!

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions