-
Notifications
You must be signed in to change notification settings - Fork 141
Description
Feature Request: Enable Type Validation for Response Bodies
Problem Description
Currently, the Committee gem doesn't properly validate response body types against the OpenAPI schema, even when coerce_value: true is set in the configuration. This means that string values like "726.0" pass validation for fields defined as type: number in the schema.
Current Behavior
When using assert_response_schema_confirm with an OpenAPI schema that defines number types:
properties:
totalAmount:
type: number
description: "Total amount"
example: 12.34
format: floatThe following JSON response passes validation even though it contains strings instead of numbers:
{
"data": [
{
"id": "244e2418-9f43-47fb-8e90-f439b53b632c",
"name": "Test Item",
"totalQuantity": "726.0", // String instead of number
"totalAmount": "9988.0", // String instead of number
"unit": "kg"
}
]
}Root Cause
I'm not familiar with the library at all, so I stuck an AI assistant to investigating the source code, and propose a solution. So take the following with a grain of salt and make sure it's not all BS. It recommends that:
- In
operation_wrapper.rb, theresponse_validate_optionsmethod only passesstrictandvalidate_headerparameters to OpenAPIParser:
def response_validate_options(strict, check_header)
::OpenAPIParser::SchemaValidator::ResponseValidateOptions.new(strict: strict, validate_header: check_header)
end- In OpenAPIParser's validators (e.g.,
float_validator.rb), type validation only happens when@coerce_valueis true:
value = coerce(value) if @coerce_value-
The
coerce_valueoption isnilby default in OpenAPIParser, which disables type coercion. -
While Committee passes
coerce_valuefor request validation, it doesn't pass it for response validation.
Proposed Solution
I propose adding a new option response_type_validation to enable type validation for response bodies. Again, the following is AI generated, so take it with a grain of salt. This could be implemented by:
- Adding the new option to Committee's options class:
# In committee/schema_validator/option.rb
attr_accessor :response_type_validation- Modifying the
response_validate_optionsmethod inoperation_wrapper.rbto use this option:
def response_validate_options(strict, check_header)
::OpenAPIParser::SchemaValidator::ResponseValidateOptions.new(
strict: strict,
validate_header: check_header,
validator_options: { coerce_value: @validator_option.response_type_validation }
)
end- Setting a default value (probably
falsefor backward compatibility):
def initialize(...)
@response_type_validation = false
# ...
endBenefits
This change would:
- Ensure proper type validation for response bodies when enabled
- Provide a clear, specific option for controlling response type validation
- Maintain backward compatibility with existing code
- Provide more accurate schema validation against the OpenAPI specification
Environment
- Committee version: 5.0.0
- OpenAPIParser version: ~> 1.0
- Ruby version: 3.x
- Rails version: 6.1.x
Thank you for considering this feature request!