feat: OpenAPI response validation with array/JSON:API schema support#288
Merged
feat: OpenAPI response validation with array/JSON:API schema support#288
Conversation
- Extend openAPIResponse with Content/schema for response body validation
- Extend openAPISchema with Items, MinItems, MaxItems, AdditionalProperties
- Add responseCapturingWriter for buffering responses before validation
- Add validateResponse() for checking status, content-type, and body schema
- Add writeAndValidatePipelineResponse() for pipeline context responses
- Add array type validation in validateJSONValue (items, minItems, maxItems)
- Add ResponseAction config field ("warn" logs, "error" rejects with 500)
- Add comprehensive tests for response validation scenarios
- Add JSON:API complex response validation tests
- Update petstore example spec with response schemas
- Create JSON:API articles example spec and workflow config
- Update DOCUMENTATION.md
Co-authored-by: intel352 <77607+intel352@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Add validation for OpenAPI responses in workflow
feat: OpenAPI response validation with array/JSON:API schema support
Mar 11, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Adds response-side OpenAPI validation to the openapi module so that outgoing HTTP responses (status/content-type/body) can be checked against the spec, including array schemas and vendor media types (e.g., JSON:API).
Changes:
- Extend OpenAPI parsing/validation to support response schemas plus array constraints (
items,minItems,maxItems) and map schemas (additionalProperties). - Buffer direct-write responses for validation prior to flushing, and add
"warn"vs"error"behavior viaresponse_action. - Add extensive test coverage and update example specs/configs and documentation.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 8 comments.
Show a summary per file
| File | Description |
|---|---|
| module/openapi.go | Implements response validation flow, buffering for direct-write, and array schema validation; adds response_action. |
| module/openapi_test.go | Adds response validation fixtures and tests (valid/invalid, warn/error, JSON:API, direct write, array constraints). |
| example/specs/petstore.yaml | Adds response content schemas so examples can be validated. |
| example/specs/jsonapi-articles.yaml | New JSON:API example spec with nested response schemas. |
| example/openapi-petstore.yaml | Enables response validation in the petstore example config. |
| example/openapi-jsonapi-articles.yaml | New runnable example config demonstrating JSON:API response validation. |
| DOCUMENTATION.md | Documents openapi module as supporting request + response validation. |
⏱ Benchmark Results✅ No significant performance regressions detected. benchstat comparison (baseline → PR)
|
Contributor
|
@copilot apply changes based on the comments in this thread Also fix failing lint, failing test, and failing example configs. |
- responseCapturingWriter uses own header map to prevent header leakage when validation fails and a 500 is returned instead of the pipeline response - validateJSONBody accepts bodyLabel parameter so error messages correctly say 'request body' or 'response body' depending on context (was always hardcoded to 'request body') - Implement additionalProperties validation in validateJSONBody — keys not in Properties are now validated against AdditionalProperties schema when defined - Rename TestOpenAPIModule_ResponseValidation_DefaultFallback_Valid to TestOpenAPIModule_ResponseValidation_DefaultFallback_InvalidFallback (test asserts 500 for schema mismatch, not a valid response) - Add nil guards for router.findHandler() in all 4 array constraint and warn-action subtests Co-authored-by: intel352 <77607+intel352@users.noreply.github.com>
Contributor
Author
Applied all review changes in ef2128d:
|
Contributor
|
@copilot apply changes based on the comments in this thread |
Contributor
Author
All items from that review thread were already applied in ef2128d:
|
Contributor
|
@copilot fix all build, test, linter, and validating issues in the codebase |
Co-authored-by: intel352 <77607+intel352@users.noreply.github.com>
Contributor
Author
Fixed all CI failures in 6ce6502:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The OpenAPI module validated incoming requests against the spec but had no mechanism to validate outgoing responses. Responses could silently deviate from the spec, including complex formats like JSON:API.
Core changes
openAPIResponsenow parsescontentwith schemas from the spec (previously only haddescription)openAPISchemaextended withitems,minItems,maxItems(arrays) andadditionalProperties(maps)responseCapturingWriterbuffers response body/status/headers for validation before flushing to the clientvalidateResponse()checks status code, content-type (including vendor types likeapplication/vnd.api+json), and body against schemavalidateJSONValue— validates item schemas and cardinality constraintsresponse_actionconfig:"warn"(default) logs violations,"error"rejects with HTTP 500Config
Response flow
All three response paths are covered:
ResponseWriter→ captured, validated, then flushed or rejectedresponse_status/response_body/response_headersin output → validated before writingExamples & docs
example/specs/petstore.yamlwith response schemasexample/specs/jsonapi-articles.yaml— JSON:API envelope with nesteddata[].type,data[].id,data[].attributesvalidationexample/openapi-jsonapi-articles.yaml— working workflow configDOCUMENTATION.mdmodule table✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.