Repository navigation
fix(openapi): validate --data JSON without a schema and harden validation - #1674
Merged
Merged
Conversation
…tion - Parse --data JSON before the no-schema early return so malformed payloads fail locally instead of being sent to the API as-is. - Add a StatusUnknown zero value to ValidationStatus so an unset result fails closed rather than reading as valid. - Inject a fixture-backed schema manager in the roles --data tests so the unit suite validates offline instead of fetching the live OpenAPI document. - Correct the ValidateRequest doc comment and soften the schemaless test note.
ReadAndValidate now rejects StatusUnknown instead of letting an unrecorded outcome fall through as an unvalidated send. Also note that useFixtureSchema swaps a package-level global, so its tests must not use t.Parallel().
developerkunal
enabled auto-merge (squash)
September 17, 2026 14:27
ramya18101
approved these changes
Sep 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🔧 Changes
Follow-up to the re-review of #1673. This hardens the
--dataschema validation path without changing how any wired command behaves today.ValidateRequestnow parses the JSON body before the no-schema early return, so malformed--datafails locally with a clear message even for operations that define no request schema, instead of being sent to the API as-is. Every wired--datacommand targets a schema-bearing operation, so this branch is reached today only by a future schemaless command.StatusUnknownzero value toValidationStatusand madeDataJSONHandler.ReadAndValidatereturn an error when it sees it, so an unsetValidationResultfails closed rather than being treated as validated.--datatests now inject a fixture-backed schema manager (newNewSchemaManagerFromDocandLoadDocFromDatahelpers, wired through anewSchemaManagerseam) so the unit suite validates offline and no longer depends on fetching the live OpenAPI document or on the remote spec keeping a particular operation schemaless.ValidateRequestdoc comment to describe the actualVisitJSONbehavior, and softened the schemaless test comment so it reads as a forward-looking guard.CHANGELOGentry for the schemaless well-formed-JSON check.📚 References
Follow-up to #1673.
🔬 Testing
go build,go vet, and theopenapiandclisuites pass, including under-racewith repeated runs.StatusNoSchemafor well-formed JSON andStatusInvalidfor malformed JSON.--datatests pass with the network blocked, while a control test using the real fetcher fails, confirming the suite is now offline-safe.roles create --schema, an invalid payload, and malformed JSON all behave as before for the wired commands.📝 Checklist