Re: [PR] feat: add oas-validator plugin [apisix]
AlinsRan merged PR #13344: URL: https://github.com/apache/apisix/pull/13344 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
Re: [PR] feat: add oas-validator plugin [apisix]
AlinsRan commented on code in PR #13344:
URL: https://github.com/apache/apisix/pull/13344#discussion_r3215955799
##
apisix/plugins/oas-validator.lua:
##
@@ -0,0 +1,298 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+
+local core = require("apisix.core")
+local secret = require("apisix.secret")
+local plugin = require("apisix.plugin")
+local ov = require("resty.openapi_validator")
+local http = require("resty.http")
+local ngx_req = ngx.req
+local ngx_md5 = ngx.md5
+local pairs = pairs
+local ipairs = ipairs
+local tostring = tostring
+local tab_sort = table.sort
+local tab_concat = table.concat
+
+local plugin_name = "oas-validator"
+
+local DEFAULT_SPEC_URL_TTL = 3600
+
+local schema = {
+type = "object",
+properties = {
+spec = {
+description = "schema against which the request/response will be
validated",
+type = "string",
+minLength = 1
+},
+spec_url = {
Review Comment:
no, it support http
`https?` match oneOf `http` of `https`.
ref:
https://github.com/apache/apisix/pull/13344/changes#diff-ad598e1c79a6882d92774e7d1ed2b8687a038e121a1246740a8cab4076712e52R480
```
=== TEST 19: create route with spec_url for TTL test
--- config
location /t {
content_by_lua_block {
local t = require("lib.test_admin")
local code, body = t.test('/apisix/admin/routes/1',
ngx.HTTP_PUT,
[[{
"uri": "/*",
"plugins": {
"oas-validator": {
"spec_url": "http://127.0.0.1:1979/spec.json";
}
},
"upstream": {
"type": "roundrobin",
"nodes": {
"127.0.0.1:1970": 1
}
}
}]]
)
if code >= 300 then
ngx.status = code
end
ngx.say(body)
}
}
--- response_body
passed
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
Re: [PR] feat: add oas-validator plugin [apisix]
AlinsRan commented on code in PR #13344:
URL: https://github.com/apache/apisix/pull/13344#discussion_r3215974676
##
apisix/plugins/oas-validator.lua:
##
@@ -0,0 +1,298 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+
+local core = require("apisix.core")
+local secret = require("apisix.secret")
+local plugin = require("apisix.plugin")
+local ov = require("resty.openapi_validator")
+local http = require("resty.http")
+local ngx_req = ngx.req
+local ngx_md5 = ngx.md5
+local pairs = pairs
+local ipairs = ipairs
+local tostring = tostring
+local tab_sort = table.sort
+local tab_concat = table.concat
+
+local plugin_name = "oas-validator"
+
+local DEFAULT_SPEC_URL_TTL = 3600
+
+local schema = {
+type = "object",
+properties = {
+spec = {
+description = "schema against which the request/response will be
validated",
+type = "string",
+minLength = 1
+},
+spec_url = {
+description = "URL to fetch the OpenAPI spec from",
+type = "string",
+pattern = [[^https?://]],
+},
+spec_url_request_headers = {
+description = "custom HTTP headers to include when fetching
spec_url",
+type = "object",
+additionalProperties = {
+type = "string",
+},
+},
+ssl_verify = {
+description = "whether to verify SSL certificate when fetching
spec_url",
+type = "boolean",
+default = false,
+},
+timeout = {
+description = "HTTP request timeout in milliseconds for fetching
spec_url",
+type = "integer",
+minimum = 1000,
+maximum = 6,
+default = 1,
+},
+verbose_errors = {
+type = "boolean",
+default = false
+},
+skip_request_body_validation = {
+type = "boolean",
+default = false
+},
+skip_request_header_validation = {
+type = "boolean",
+default = false
+},
+skip_query_param_validation = {
+type = "boolean",
+default = false
+},
+skip_path_params_validation = {
+type = "boolean",
+default = false
+},
+reject_if_not_match = {
+type = "boolean",
+default = true
+},
+rejection_status_code = {
+description = "HTTP status code to return when request validation
fails",
+type = "integer",
+minimum = 400,
+maximum = 599,
+default = 400
+}
+},
+oneOf = {
+{required = {"spec"}},
+{required = {"spec_url"}},
+},
+}
+
+local metadata_schema = {
+type = "object",
+properties = {
+spec_url_ttl = {
+description = "TTL in seconds for cached spec fetched from
spec_url",
+type = "integer",
+minimum = 1,
+default = DEFAULT_SPEC_URL_TTL,
+},
+},
+}
+
+local spec_url_lrucache
+local spec_url_lrucache_ttl
+
+local function get_spec_url_ttl()
+local metadata = plugin.plugin_metadata(plugin_name)
+if metadata and metadata.value and metadata.value.spec_url_ttl then
+return metadata.value.spec_url_ttl
+end
+return DEFAULT_SPEC_URL_TTL
+end
+
+local function get_spec_url_lrucache()
+local ttl = get_spec_url_ttl()
+if not spec_url_lrucache or spec_url_lrucache_ttl ~= ttl then
+spec_url_lrucache = core.lrucache.new({
+ttl = ttl,
+count = 512,
+invalid_stale = true,
+refresh_stale = true,
+serial_creating = true,
+})
+spec_url_lrucache_ttl = ttl
+end
+return spec_url_lrucache
+end
+
+local function fetch_and_compile(conf)
+local httpc = http.new()
+httpc:set_timeout(conf.timeout or 1)
+
+local params = {
+method = "GET",
+ssl_verify = conf.ssl_verify or false,
+}
+if conf.spec_url_request_headers then
+params.headers = conf.spec_url_request_headers
+end
+
+local res, err = httpc:
Re: [PR] feat: add oas-validator plugin [apisix]
AlinsRan commented on code in PR #13344:
URL: https://github.com/apache/apisix/pull/13344#discussion_r3215955799
##
apisix/plugins/oas-validator.lua:
##
@@ -0,0 +1,298 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+
+local core = require("apisix.core")
+local secret = require("apisix.secret")
+local plugin = require("apisix.plugin")
+local ov = require("resty.openapi_validator")
+local http = require("resty.http")
+local ngx_req = ngx.req
+local ngx_md5 = ngx.md5
+local pairs = pairs
+local ipairs = ipairs
+local tostring = tostring
+local tab_sort = table.sort
+local tab_concat = table.concat
+
+local plugin_name = "oas-validator"
+
+local DEFAULT_SPEC_URL_TTL = 3600
+
+local schema = {
+type = "object",
+properties = {
+spec = {
+description = "schema against which the request/response will be
validated",
+type = "string",
+minLength = 1
+},
+spec_url = {
Review Comment:
no, it support http
`https?` match oneOf `http` of `https`.
ref:
https://github.com/apache/apisix/pull/13344/changes#diff-ad598e1c79a6882d92774e7d1ed2b8687a038e121a1246740a8cab4076712e52R480
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
Re: [PR] feat: add oas-validator plugin [apisix]
membphis commented on code in PR #13344:
URL: https://github.com/apache/apisix/pull/13344#discussion_r3215950410
##
apisix/plugins/oas-validator.lua:
##
@@ -0,0 +1,298 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+
+local core = require("apisix.core")
+local secret = require("apisix.secret")
+local plugin = require("apisix.plugin")
+local ov = require("resty.openapi_validator")
+local http = require("resty.http")
+local ngx_req = ngx.req
+local ngx_md5 = ngx.md5
+local pairs = pairs
+local ipairs = ipairs
+local tostring = tostring
+local tab_sort = table.sort
+local tab_concat = table.concat
+
+local plugin_name = "oas-validator"
+
+local DEFAULT_SPEC_URL_TTL = 3600
+
+local schema = {
+type = "object",
+properties = {
+spec = {
+description = "schema against which the request/response will be
validated",
+type = "string",
+minLength = 1
+},
+spec_url = {
+description = "URL to fetch the OpenAPI spec from",
+type = "string",
+pattern = [[^https?://]],
+},
+spec_url_request_headers = {
+description = "custom HTTP headers to include when fetching
spec_url",
+type = "object",
+additionalProperties = {
+type = "string",
+},
+},
+ssl_verify = {
+description = "whether to verify SSL certificate when fetching
spec_url",
+type = "boolean",
+default = false,
+},
+timeout = {
+description = "HTTP request timeout in milliseconds for fetching
spec_url",
+type = "integer",
+minimum = 1000,
+maximum = 6,
+default = 1,
+},
+verbose_errors = {
+type = "boolean",
+default = false
+},
+skip_request_body_validation = {
+type = "boolean",
+default = false
+},
+skip_request_header_validation = {
+type = "boolean",
+default = false
+},
+skip_query_param_validation = {
+type = "boolean",
+default = false
+},
+skip_path_params_validation = {
+type = "boolean",
+default = false
+},
+reject_if_not_match = {
+type = "boolean",
+default = true
+},
+rejection_status_code = {
+description = "HTTP status code to return when request validation
fails",
+type = "integer",
+minimum = 400,
+maximum = 599,
+default = 400
+}
+},
+oneOf = {
+{required = {"spec"}},
+{required = {"spec_url"}},
+},
+}
+
+local metadata_schema = {
+type = "object",
+properties = {
+spec_url_ttl = {
+description = "TTL in seconds for cached spec fetched from
spec_url",
+type = "integer",
+minimum = 1,
+default = DEFAULT_SPEC_URL_TTL,
+},
+},
+}
+
+local spec_url_lrucache
+local spec_url_lrucache_ttl
+
+local function get_spec_url_ttl()
+local metadata = plugin.plugin_metadata(plugin_name)
+if metadata and metadata.value and metadata.value.spec_url_ttl then
+return metadata.value.spec_url_ttl
+end
+return DEFAULT_SPEC_URL_TTL
+end
+
+local function get_spec_url_lrucache()
+local ttl = get_spec_url_ttl()
+if not spec_url_lrucache or spec_url_lrucache_ttl ~= ttl then
+spec_url_lrucache = core.lrucache.new({
+ttl = ttl,
+count = 512,
+invalid_stale = true,
+refresh_stale = true,
+serial_creating = true,
+})
+spec_url_lrucache_ttl = ttl
+end
+return spec_url_lrucache
+end
+
+local function fetch_and_compile(conf)
+local httpc = http.new()
+httpc:set_timeout(conf.timeout or 1)
+
+local params = {
+method = "GET",
+ssl_verify = conf.ssl_verify or false,
+}
+if conf.spec_url_request_headers then
+params.headers = conf.spec_url_request_headers
+end
+
+local res, err = httpc:
Re: [PR] feat: add oas-validator plugin [apisix]
membphis commented on code in PR #13344:
URL: https://github.com/apache/apisix/pull/13344#discussion_r3215898982
##
apisix/plugins/oas-validator.lua:
##
@@ -0,0 +1,298 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+
+local core = require("apisix.core")
+local secret = require("apisix.secret")
+local plugin = require("apisix.plugin")
+local ov = require("resty.openapi_validator")
+local http = require("resty.http")
+local ngx_req = ngx.req
+local ngx_md5 = ngx.md5
+local pairs = pairs
+local ipairs = ipairs
+local tostring = tostring
+local tab_sort = table.sort
+local tab_concat = table.concat
+
+local plugin_name = "oas-validator"
+
+local DEFAULT_SPEC_URL_TTL = 3600
+
+local schema = {
+type = "object",
+properties = {
+spec = {
+description = "schema against which the request/response will be
validated",
+type = "string",
+minLength = 1
+},
+spec_url = {
Review Comment:
both support `http` and `https`
only https is not enough
##
apisix/plugins/oas-validator.lua:
##
@@ -0,0 +1,298 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+
+local core = require("apisix.core")
+local secret = require("apisix.secret")
+local plugin = require("apisix.plugin")
+local ov = require("resty.openapi_validator")
+local http = require("resty.http")
+local ngx_req = ngx.req
+local ngx_md5 = ngx.md5
+local pairs = pairs
+local ipairs = ipairs
+local tostring = tostring
+local tab_sort = table.sort
+local tab_concat = table.concat
+
+local plugin_name = "oas-validator"
+
+local DEFAULT_SPEC_URL_TTL = 3600
+
+local schema = {
+type = "object",
+properties = {
+spec = {
+description = "schema against which the request/response will be
validated",
+type = "string",
+minLength = 1
+},
+spec_url = {
+description = "URL to fetch the OpenAPI spec from",
+type = "string",
+pattern = [[^https?://]],
+},
+spec_url_request_headers = {
+description = "custom HTTP headers to include when fetching
spec_url",
+type = "object",
+additionalProperties = {
+type = "string",
+},
+},
+ssl_verify = {
+description = "whether to verify SSL certificate when fetching
spec_url",
+type = "boolean",
+default = false,
+},
+timeout = {
+description = "HTTP request timeout in milliseconds for fetching
spec_url",
+type = "integer",
+minimum = 1000,
+maximum = 6,
+default = 1,
+},
+verbose_errors = {
+type = "boolean",
+default = false
+},
+skip_request_body_validation = {
+type = "boolean",
+default = false
+},
+skip_request_header_validation = {
+type = "boolean",
+default = false
+},
+skip_query_param_validation = {
+type = "boolean",
+default = false
+},
+skip_path_params_validation = {
+type = "boolean",
+default = false
+},
+reject_if_not_match = {
+type = "boolean",
+default = true
+},
+rejection_status_code = {
+description = "HTTP statu
[PR] feat: add oas-validator plugin [apisix]
AlinsRan opened a new pull request, #13344: URL: https://github.com/apache/apisix/pull/13344 ## Summary This PR introduces the oas-validator plugin, which validates inbound HTTP requests against an OpenAPI Specification (OAS) 3.x document before forwarding them to upstream services. ## Description The oas-validator plugin rejects requests that do not conform to the configured OpenAPI spec, returning a configurable HTTP error code. Validation scope (each independently configurable): - Request method and path - Query parameters - Request headers - Request body Spec delivery: - Inline: spec provided as a JSON string in the plugin config - Remote URL: spec fetched from a URL; cached for a configurable TTL (plugin metadata spec_url_ttl, default 3600 s) Use cases: - Enforce API contracts without modifying upstream services - Reject malformed requests early (shift-left validation) - Protect backends from unexpected inputs ## Dependencies This plugin depends on the lua-resty-openapi-validator LuaRocks package (>= 1.0.5-1), added to apisix-master-0.rockspec. https://luarocks.org/modules/membphis/lua-resty-openapi-validator ## Files changed - apisix/plugins/oas-validator.lua -- plugin implementation - t/plugin/oas-validator.t -- basic test cases - t/plugin/oas-validator2.t -- extended test cases (plugin metadata, remote spec) - docs/en/latest/plugins/oas-validator.md -- English documentation - docs/zh/latest/plugins/oas-validator.md -- Chinese documentation - apisix-master-0.rockspec -- add lua-resty-openapi-validator dependency - apisix/cli/config.lua -- register plugin in default list - docs/en/latest/config.json / docs/zh/latest/config.json -- add to sidebar -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
