knowledge-governance/internal/httpapi/openapi_contract_test.go

package httpapi

import (
	"encoding/json"
	"os"
	"regexp"
	"strings"
	"testing"
)

func TestOpenAPIContractMatchesRegisteredRoutesAndOmitsSecrets(t *testing.T) {
	contract, err := os.ReadFile("../../api/openapi.yaml")
	if err != nil {
		t.Fatalf("read OpenAPI contract: %v", err)
	}

	var document struct {
		OpenAPI    string                    `json:"openapi"`
		Info       map[string]any            `json:"info"`
		Paths      map[string]map[string]any `json:"paths"`
		Components map[string]map[string]any `json:"components"`
	}
	if err := json.Unmarshal(contract, &document); err != nil {
		t.Fatalf("OpenAPI contract must use JSON-compatible YAML: %v", err)
	}
	if document.OpenAPI != "3.1.0" || document.Info["title"] != "Knowledge Governance API" || len(document.Paths) == 0 {
		t.Fatalf("invalid OpenAPI header: %#v", document)
	}

	routes, err := os.ReadFile("server.go")
	if err != nil {
		t.Fatalf("read registered routes: %v", err)
	}
	matcher := regexp.MustCompile(`mux\.HandleFunc\("(GET|POST|PUT|DELETE) ([^"]+)"`)
	for _, match := range matcher.FindAllStringSubmatch(string(routes), -1) {
		method, path := strings.ToLower(match[1]), match[2]
		operation, ok := document.Paths[path][method].(map[string]any)
		if !ok {
			t.Fatalf("OpenAPI is missing %s %s", strings.ToUpper(method), path)
		}
		if strings.TrimSpace(stringValue(operation["operationId"])) == "" {
			t.Fatalf("OpenAPI operation %s %s has no operationId", strings.ToUpper(method), path)
		}
		responses, ok := operation["responses"].(map[string]any)
		if !ok || responses["400"] == nil || responses["500"] == nil {
			t.Fatalf("OpenAPI operation %s %s must document 400 and 500 responses", strings.ToUpper(method), path)
		}
	}

	lower := strings.ToLower(string(contract))
	for _, forbidden := range []string{"secret_ref", "authorization_code", "manifest_sha256", "knowledge_id", "test_kb_id", "base_url", "download_code", "cookie"} {
		if strings.Contains(lower, forbidden) {
			t.Fatalf("OpenAPI contract must not expose %q", forbidden)
		}
	}
}

func TestOpenAPICatalogMutationsRequireIdempotencyKeyHeader(t *testing.T) {
	contract, err := os.ReadFile("../../api/openapi.yaml")
	if err != nil {
		t.Fatal(err)
	}
	var document struct {
		Paths      map[string]map[string]any `json:"paths"`
		Components struct {
			Parameters map[string]map[string]any `json:"parameters"`
		} `json:"components"`
	}
	if err := json.Unmarshal(contract, &document); err != nil {
		t.Fatal(err)
	}
	parameter, ok := document.Components.Parameters["IdempotencyKey"]
	if !ok || parameter["name"] != "Idempotency-Key" || parameter["in"] != "header" || parameter["required"] != true {
		t.Fatalf("IdempotencyKey header must be required: %#v", parameter)
	}
	schema, ok := parameter["schema"].(map[string]any)
	if !ok || schema["type"] != "string" || schema["minLength"] != float64(1) || schema["maxLength"] != float64(128) {
		t.Fatalf("IdempotencyKey header schema is unsafe: %#v", parameter["schema"])
	}
	for _, path := range []string{"/api/v1/source-catalog/route", "/api/v1/source-catalog/sources/{id}/refresh"} {
		operation, ok := document.Paths[path]["post"].(map[string]any)
		if !ok {
			t.Fatalf("missing POST %s", path)
		}
		parameters, ok := operation["parameters"].([]any)
		if !ok {
			t.Fatalf("POST %s must declare the idempotency header", path)
		}
		found := false
		for _, value := range parameters {
			parameterRef, _ := value.(map[string]any)
			if parameterRef["$ref"] == "#/components/parameters/IdempotencyKey" {
				found = true
			}
		}
		if !found {
			t.Fatalf("POST %s must reference IdempotencyKey", path)
		}
		responses, _ := operation["responses"].(map[string]any)
		accepted, _ := responses["202"].(map[string]any)
		if accepted["$ref"] != "#/components/responses/OperationEnvelope" {
			t.Fatalf("POST %s must document created/replayed operation response: %#v", path, accepted)
		}
	}
}

func stringValue(value any) string {
	result, _ := value.(string)
	return result
}