Wala shell

Advanced PHP File Manager

Server IP: 127.0.0.1 | PHP Version: 8.3.30 | Domains Hosted: 54

Name	Size	Last Modified
📁 ..	-	2025-05-25 12:27
📄 body_test.go package middleware import ( "context" "io" "net/http" "path" "testing" "github.com/go-openapi/runtime" "github.com/go-openapi/runtime/internal/testing/petstore" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) type eofReader struct { } func (r eofReader) Read(_ []byte) (int, error) { return 0, io.EOF } func (r eofReader) Close() error { return nil } type rbn func(http.Request, MatchedRoute) error func (b rbn) BindRequest(r http.Request, rr MatchedRoute) error { return b(r, rr) } func TestBindRequest_BodyValidation(t testing.T) { spec, api := petstore.NewAPI(t) ctx := NewContext(spec, api, nil) api.DefaultConsumes = runtime.JSONMime ctx.router = DefaultRouter(spec, ctx.api) req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, path.Join(spec.BasePath(), "/pets"), new(eofReader)) require.NoError(t, err) req.Header.Set("Content-Type", runtime.JSONMime) ri, rCtx, ok := ctx.RouteInfo(req) require.True(t, ok) req = rCtx err = ctx.BindValidRequest(req, ri, rbn(func(r http.Request, _ MatchedRoute) error { defer r.Body.Close() var data interface{} e := runtime.JSONConsumer().Consume(r.Body, &data) _ = data return e })) require.Error(t, err) assert.Equal(t, io.EOF, err) } func TestBindRequest_DeleteNoBody(t testing.T) { spec, api := petstore.NewAPI(t) ctx := NewContext(spec, api, nil) api.DefaultConsumes = runtime.JSONMime ctx.router = DefaultRouter(spec, ctx.api) req, err := http.NewRequestWithContext(context.Background(), http.MethodDelete, path.Join(spec.BasePath(), "/pets/123"), new(eofReader)) require.NoError(t, err) req.Header.Set("Accept", "/") ri, rCtx, ok := ctx.RouteInfo(req) require.True(t, ok) req = rCtx err = ctx.BindValidRequest(req, ri, rbn(func(_ http.Request, _ MatchedRoute) error { return nil })) require.NoError(t, err) // assert.Equal(t, io.EOF, bverr) req, err = http.NewRequestWithContext(context.Background(), http.MethodDelete, path.Join(spec.BasePath(), "/pets/123"), new(eofReader)) require.NoError(t, err) req.Header.Set("Accept", "/") req.Header.Set("Content-Type", runtime.JSONMime) req.ContentLength = 1 ri, rCtx, ok = ctx.RouteInfo(req) require.True(t, ok) req = rCtx err = ctx.BindValidRequest(req, ri, rbn(func(r http.Request, _ MatchedRoute) error { defer r.Body.Close() var data interface{} e := runtime.JSONConsumer().Consume(r.Body, &data) _ = data return e })) require.Error(t, err) assert.Equal(t, io.EOF, err) }	2.47 KB	2025-05-25 12:27
📄 context.go // Copyright 2015 go-swagger maintainers // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package middleware import ( stdContext "context" "fmt" "net/http" "net/url" "path" "strings" "sync" "github.com/go-openapi/analysis" "github.com/go-openapi/errors" "github.com/go-openapi/loads" "github.com/go-openapi/spec" "github.com/go-openapi/strfmt" "github.com/go-openapi/runtime" "github.com/go-openapi/runtime/logger" "github.com/go-openapi/runtime/middleware/untyped" "github.com/go-openapi/runtime/security" ) // Debug when true turns on verbose logging var Debug = logger.DebugEnabled() // Logger is the standard libray logger used for printing debug messages var Logger logger.Logger = logger.StandardLogger{} func debugLogfFunc(lg logger.Logger) func(string, ...any) { if logger.DebugEnabled() { if lg == nil { return Logger.Debugf } return lg.Debugf } // muted logger return func(_ string, _ ...any) {} } // A Builder can create middlewares type Builder func(http.Handler) http.Handler // PassthroughBuilder returns the handler, aka the builder identity function func PassthroughBuilder(handler http.Handler) http.Handler { return handler } // RequestBinder is an interface for types to implement // when they want to be able to bind from a request type RequestBinder interface { BindRequest(http.Request, MatchedRoute) error } // Responder is an interface for types to implement // when they want to be considered for writing HTTP responses type Responder interface { WriteResponse(http.ResponseWriter, runtime.Producer) } // ResponderFunc wraps a func as a Responder interface type ResponderFunc func(http.ResponseWriter, runtime.Producer) // WriteResponse writes to the response func (fn ResponderFunc) WriteResponse(rw http.ResponseWriter, pr runtime.Producer) { fn(rw, pr) } // Context is a type safe wrapper around an untyped request context // used throughout to store request context with the standard context attached // to the http.Request type Context struct { spec loads.Document analyzer analysis.Spec api RoutableAPI router Router debugLogf func(string, ...any) // a logging function to debug context and all components using it } type routableUntypedAPI struct { api untyped.API hlock sync.Mutex handlers map[string]map[string]http.Handler defaultConsumes string defaultProduces string } func newRoutableUntypedAPI(spec loads.Document, api untyped.API, context Context) routableUntypedAPI { var handlers map[string]map[string]http.Handler if spec == nil \|\| api == nil { return nil } analyzer := analysis.New(spec.Spec()) for method, hls := range analyzer.Operations() { um := strings.ToUpper(method) for path, op := range hls { schemes := analyzer.SecurityRequirementsFor(op) if oh, ok := api.OperationHandlerFor(method, path); ok { if handlers == nil { handlers = make(map[string]map[string]http.Handler) } if b, ok := handlers[um]; !ok \|\| b == nil { handlers[um] = make(map[string]http.Handler) } var handler http.Handler = http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { // lookup route info in the context route, rCtx, _ := context.RouteInfo(r) if rCtx != nil { r = rCtx } // bind and validate the request using reflection var bound interface{} var validation error bound, r, validation = context.BindAndValidate(r, route) if validation != nil { context.Respond(w, r, route.Produces, route, validation) return } // actually handle the request result, err := oh.Handle(bound) if err != nil { // respond with failure context.Respond(w, r, route.Produces, route, err) return } // respond with success context.Respond(w, r, route.Produces, route, result) }) if len(schemes) > 0 { handler = newSecureAPI(context, handler) } handlers[um][path] = handler } } } return &routableUntypedAPI{ api: api, hlock: new(sync.Mutex), handlers: handlers, defaultProduces: api.DefaultProduces, defaultConsumes: api.DefaultConsumes, } } func (r routableUntypedAPI) HandlerFor(method, path string) (http.Handler, bool) { r.hlock.Lock() paths, ok := r.handlers[strings.ToUpper(method)] if !ok { r.hlock.Unlock() return nil, false } handler, ok := paths[path] r.hlock.Unlock() return handler, ok } func (r routableUntypedAPI) ServeErrorFor(_ string) func(http.ResponseWriter, http.Request, error) { return r.api.ServeError } func (r routableUntypedAPI) ConsumersFor(mediaTypes []string) map[string]runtime.Consumer { return r.api.ConsumersFor(mediaTypes) } func (r routableUntypedAPI) ProducersFor(mediaTypes []string) map[string]runtime.Producer { return r.api.ProducersFor(mediaTypes) } func (r routableUntypedAPI) AuthenticatorsFor(schemes map[string]spec.SecurityScheme) map[string]runtime.Authenticator { return r.api.AuthenticatorsFor(schemes) } func (r routableUntypedAPI) Authorizer() runtime.Authorizer { return r.api.Authorizer() } func (r routableUntypedAPI) Formats() strfmt.Registry { return r.api.Formats() } func (r routableUntypedAPI) DefaultProduces() string { return r.defaultProduces } func (r routableUntypedAPI) DefaultConsumes() string { return r.defaultConsumes } // NewRoutableContext creates a new context for a routable API. // // If a nil Router is provided, the DefaultRouter (denco-based) will be used. func NewRoutableContext(spec loads.Document, routableAPI RoutableAPI, routes Router) Context { var an analysis.Spec if spec != nil { an = analysis.New(spec.Spec()) } return NewRoutableContextWithAnalyzedSpec(spec, an, routableAPI, routes) } // NewRoutableContextWithAnalyzedSpec is like NewRoutableContext but takes as input an already analysed spec. // // If a nil Router is provided, the DefaultRouter (denco-based) will be used. func NewRoutableContextWithAnalyzedSpec(spec loads.Document, an analysis.Spec, routableAPI RoutableAPI, routes Router) Context { // Either there are no spec doc and analysis, or both of them. if !((spec == nil && an == nil) \|\| (spec != nil && an != nil)) { panic(errors.New(http.StatusInternalServerError, "routable context requires either both spec doc and analysis, or none of them")) } return &Context{ spec: spec, api: routableAPI, analyzer: an, router: routes, debugLogf: debugLogfFunc(nil), } } // NewContext creates a new context wrapper. // // If a nil Router is provided, the DefaultRouter (denco-based) will be used. func NewContext(spec loads.Document, api untyped.API, routes Router) Context { var an analysis.Spec if spec != nil { an = analysis.New(spec.Spec()) } ctx := &Context{ spec: spec, analyzer: an, router: routes, debugLogf: debugLogfFunc(nil), } ctx.api = newRoutableUntypedAPI(spec, api, ctx) return ctx } // Serve serves the specified spec with the specified api registrations as a http.Handler func Serve(spec loads.Document, api untyped.API) http.Handler { return ServeWithBuilder(spec, api, PassthroughBuilder) } // ServeWithBuilder serves the specified spec with the specified api registrations as a http.Handler that is decorated // by the Builder func ServeWithBuilder(spec loads.Document, api untyped.API, builder Builder) http.Handler { context := NewContext(spec, api, nil) return context.APIHandler(builder) } type contextKey int8 const ( _ contextKey = iota ctxContentType ctxResponseFormat ctxMatchedRoute ctxBoundParams ctxSecurityPrincipal ctxSecurityScopes ) // MatchedRouteFrom request context value. func MatchedRouteFrom(req http.Request) MatchedRoute { mr := req.Context().Value(ctxMatchedRoute) if mr == nil { return nil } if res, ok := mr.(MatchedRoute); ok { return res } return nil } // SecurityPrincipalFrom request context value. func SecurityPrincipalFrom(req http.Request) interface{} { return req.Context().Value(ctxSecurityPrincipal) } // SecurityScopesFrom request context value. func SecurityScopesFrom(req http.Request) []string { rs := req.Context().Value(ctxSecurityScopes) if res, ok := rs.([]string); ok { return res } return nil } type contentTypeValue struct { MediaType string Charset string } // BasePath returns the base path for this API func (c Context) BasePath() string { return c.spec.BasePath() } // SetLogger allows for injecting a logger to catch debug entries. // // The logger is enabled in DEBUG mode only. func (c Context) SetLogger(lg logger.Logger) { c.debugLogf = debugLogfFunc(lg) } // RequiredProduces returns the accepted content types for responses func (c Context) RequiredProduces() []string { return c.analyzer.RequiredProduces() } // BindValidRequest binds a params object to a request but only when the request is valid // if the request is not valid an error will be returned func (c Context) BindValidRequest(request http.Request, route MatchedRoute, binder RequestBinder) error { var res []error var requestContentType string // check and validate content type, select consumer if runtime.HasBody(request) { ct, _, err := runtime.ContentType(request.Header) if err != nil { res = append(res, err) } else { c.debugLogf("validating content type for %q against [%s]", ct, strings.Join(route.Consumes, ", ")) if err := validateContentType(route.Consumes, ct); err != nil { res = append(res, err) } if len(res) == 0 { cons, ok := route.Consumers[ct] if !ok { res = append(res, errors.New(500, "no consumer registered for %s", ct)) } else { route.Consumer = cons requestContentType = ct } } } } // check and validate the response format if len(res) == 0 { // if the route does not provide Produces and a default contentType could not be identified // based on a body, typical for GET and DELETE requests, then default contentType to. if len(route.Produces) == 0 && requestContentType == "" { requestContentType = "/" } if str := NegotiateContentType(request, route.Produces, requestContentType); str == "" { res = append(res, errors.InvalidResponseFormat(request.Header.Get(runtime.HeaderAccept), route.Produces)) } } // now bind the request with the provided binder // it's assumed the binder will also validate the request and return an error if the // request is invalid if binder != nil && len(res) == 0 { if err := binder.BindRequest(request, route); err != nil { return err } } if len(res) > 0 { return errors.CompositeValidationError(res...) } return nil } // ContentType gets the parsed value of a content type // Returns the media type, its charset and a shallow copy of the request // when its context doesn't contain the content type value, otherwise it returns // the same request // Returns the error that runtime.ContentType may retunrs. func (c Context) ContentType(request http.Request) (string, string, http.Request, error) { var rCtx = request.Context() if v, ok := rCtx.Value(ctxContentType).(contentTypeValue); ok { return v.MediaType, v.Charset, request, nil } mt, cs, err := runtime.ContentType(request.Header) if err != nil { return "", "", nil, err } rCtx = stdContext.WithValue(rCtx, ctxContentType, &contentTypeValue{mt, cs}) return mt, cs, request.WithContext(rCtx), nil } // LookupRoute looks a route up and returns true when it is found func (c Context) LookupRoute(request http.Request) (MatchedRoute, bool) { if route, ok := c.router.Lookup(request.Method, request.URL.EscapedPath()); ok { return route, ok } return nil, false } // RouteInfo tries to match a route for this request // Returns the matched route, a shallow copy of the request if its context // contains the matched router, otherwise the same request, and a bool to // indicate if it the request matches one of the routes, if it doesn't // then it returns false and nil for the other two return values func (c Context) RouteInfo(request http.Request) (MatchedRoute, http.Request, bool) { var rCtx = request.Context() if v, ok := rCtx.Value(ctxMatchedRoute).(MatchedRoute); ok { return v, request, ok } if route, ok := c.LookupRoute(request); ok { rCtx = stdContext.WithValue(rCtx, ctxMatchedRoute, route) return route, request.WithContext(rCtx), ok } return nil, nil, false } // ResponseFormat negotiates the response content type // Returns the response format and a shallow copy of the request if its context // doesn't contain the response format, otherwise the same request func (c Context) ResponseFormat(r http.Request, offers []string) (string, http.Request) { var rCtx = r.Context() if v, ok := rCtx.Value(ctxResponseFormat).(string); ok { c.debugLogf("[%s %s] found response format %q in context", r.Method, r.URL.Path, v) return v, r } format := NegotiateContentType(r, offers, "") if format != "" { c.debugLogf("[%s %s] set response format %q in context", r.Method, r.URL.Path, format) r = r.WithContext(stdContext.WithValue(rCtx, ctxResponseFormat, format)) } c.debugLogf("[%s %s] negotiated response format %q", r.Method, r.URL.Path, format) return format, r } // AllowedMethods gets the allowed methods for the path of this request func (c Context) AllowedMethods(request http.Request) []string { return c.router.OtherMethods(request.Method, request.URL.EscapedPath()) } // ResetAuth removes the current principal from the request context func (c Context) ResetAuth(request http.Request) http.Request { rctx := request.Context() rctx = stdContext.WithValue(rctx, ctxSecurityPrincipal, nil) rctx = stdContext.WithValue(rctx, ctxSecurityScopes, nil) return request.WithContext(rctx) } // Authorize authorizes the request // Returns the principal object and a shallow copy of the request when its // context doesn't contain the principal, otherwise the same request or an error // (the last) if one of the authenticators returns one or an Unauthenticated error func (c Context) Authorize(request http.Request, route MatchedRoute) (interface{}, http.Request, error) { if route == nil \|\| !route.HasAuth() { return nil, nil, nil } var rCtx = request.Context() if v := rCtx.Value(ctxSecurityPrincipal); v != nil { return v, request, nil } applies, usr, err := route.Authenticators.Authenticate(request, route) if !applies \|\| err != nil \|\| !route.Authenticators.AllowsAnonymous() && usr == nil { if err != nil { return nil, nil, err } return nil, nil, errors.Unauthenticated("invalid credentials") } if route.Authorizer != nil { if err := route.Authorizer.Authorize(request, usr); err != nil { if _, ok := err.(errors.Error); ok { return nil, nil, err } return nil, nil, errors.New(http.StatusForbidden, err.Error()) } } rCtx = request.Context() rCtx = stdContext.WithValue(rCtx, ctxSecurityPrincipal, usr) rCtx = stdContext.WithValue(rCtx, ctxSecurityScopes, route.Authenticator.AllScopes()) return usr, request.WithContext(rCtx), nil } // BindAndValidate binds and validates the request // Returns the validation map and a shallow copy of the request when its context // doesn't contain the validation, otherwise it returns the same request or an // CompositeValidationError error func (c Context) BindAndValidate(request http.Request, matched MatchedRoute) (interface{}, http.Request, error) { var rCtx = request.Context() if v, ok := rCtx.Value(ctxBoundParams).(validation); ok { c.debugLogf("got cached validation (valid: %t)", len(v.result) == 0) if len(v.result) > 0 { return v.bound, request, errors.CompositeValidationError(v.result...) } return v.bound, request, nil } result := validateRequest(c, request, matched) rCtx = stdContext.WithValue(rCtx, ctxBoundParams, result) request = request.WithContext(rCtx) if len(result.result) > 0 { return result.bound, request, errors.CompositeValidationError(result.result...) } c.debugLogf("no validation errors found") return result.bound, request, nil } // NotFound the default not found responder for when no route has been matched yet func (c Context) NotFound(rw http.ResponseWriter, r http.Request) { c.Respond(rw, r, []string{c.api.DefaultProduces()}, nil, errors.NotFound("not found")) } // Respond renders the response after doing some content negotiation func (c Context) Respond(rw http.ResponseWriter, r http.Request, produces []string, route MatchedRoute, data interface{}) { c.debugLogf("responding to %s %s with produces: %v", r.Method, r.URL.Path, produces) offers := []string{} for _, mt := range produces { if mt != c.api.DefaultProduces() { offers = append(offers, mt) } } // the default producer is last so more specific producers take precedence offers = append(offers, c.api.DefaultProduces()) c.debugLogf("offers: %v", offers) var format string format, r = c.ResponseFormat(r, offers) rw.Header().Set(runtime.HeaderContentType, format) if resp, ok := data.(Responder); ok { producers := route.Producers // producers contains keys with normalized format, if a format has MIME type parameter such as `text/plain; charset=utf-8` // then you must provide `text/plain` to get the correct producer. HOWEVER, format here is not normalized. prod, ok := producers[normalizeOffer(format)] if !ok { prods := c.api.ProducersFor(normalizeOffers([]string{c.api.DefaultProduces()})) pr, ok := prods[c.api.DefaultProduces()] if !ok { panic(errors.New(http.StatusInternalServerError, cantFindProducer(format))) } prod = pr } resp.WriteResponse(rw, prod) return } if err, ok := data.(error); ok { if format == "" { rw.Header().Set(runtime.HeaderContentType, runtime.JSONMime) } if realm := security.FailedBasicAuth(r); realm != "" { rw.Header().Set("WWW-Authenticate", fmt.Sprintf("Basic realm=%q", realm)) } if route == nil \|\| route.Operation == nil { c.api.ServeErrorFor("")(rw, r, err) return } c.api.ServeErrorFor(route.Operation.ID)(rw, r, err) return } if route == nil \|\| route.Operation == nil { rw.WriteHeader(http.StatusOK) if r.Method == http.MethodHead { return } producers := c.api.ProducersFor(normalizeOffers(offers)) prod, ok := producers[format] if !ok { panic(errors.New(http.StatusInternalServerError, cantFindProducer(format))) } if err := prod.Produce(rw, data); err != nil { panic(err) // let the recovery middleware deal with this } return } if _, code, ok := route.Operation.SuccessResponse(); ok { rw.WriteHeader(code) if code == http.StatusNoContent \|\| r.Method == http.MethodHead { return } producers := route.Producers prod, ok := producers[format] if !ok { if !ok { prods := c.api.ProducersFor(normalizeOffers([]string{c.api.DefaultProduces()})) pr, ok := prods[c.api.DefaultProduces()] if !ok { panic(errors.New(http.StatusInternalServerError, cantFindProducer(format))) } prod = pr } } if err := prod.Produce(rw, data); err != nil { panic(err) // let the recovery middleware deal with this } return } c.api.ServeErrorFor(route.Operation.ID)(rw, r, errors.New(http.StatusInternalServerError, "can't produce response")) } // APIHandlerSwaggerUI returns a handler to serve the API. // // This handler includes a swagger spec, router and the contract defined in the swagger spec. // // A spec UI (SwaggerUI) is served at {API base path}/docs and the spec document at /swagger.json // (these can be modified with uiOptions). func (c Context) APIHandlerSwaggerUI(builder Builder, opts ...UIOption) http.Handler { b := builder if b == nil { b = PassthroughBuilder } specPath, uiOpts, specOpts := c.uiOptionsForHandler(opts) var swaggerUIOpts SwaggerUIOpts fromCommonToAnyOptions(uiOpts, &swaggerUIOpts) return Spec(specPath, c.spec.Raw(), SwaggerUI(swaggerUIOpts, c.RoutesHandler(b)), specOpts...) } // APIHandlerRapiDoc returns a handler to serve the API. // // This handler includes a swagger spec, router and the contract defined in the swagger spec. // // A spec UI (RapiDoc) is served at {API base path}/docs and the spec document at /swagger.json // (these can be modified with uiOptions). func (c Context) APIHandlerRapiDoc(builder Builder, opts ...UIOption) http.Handler { b := builder if b == nil { b = PassthroughBuilder } specPath, uiOpts, specOpts := c.uiOptionsForHandler(opts) var rapidocUIOpts RapiDocOpts fromCommonToAnyOptions(uiOpts, &rapidocUIOpts) return Spec(specPath, c.spec.Raw(), RapiDoc(rapidocUIOpts, c.RoutesHandler(b)), specOpts...) } // APIHandler returns a handler to serve the API. // // This handler includes a swagger spec, router and the contract defined in the swagger spec. // // A spec UI (Redoc) is served at {API base path}/docs and the spec document at /swagger.json // (these can be modified with uiOptions). func (c Context) APIHandler(builder Builder, opts ...UIOption) http.Handler { b := builder if b == nil { b = PassthroughBuilder } specPath, uiOpts, specOpts := c.uiOptionsForHandler(opts) var redocOpts RedocOpts fromCommonToAnyOptions(uiOpts, &redocOpts) return Spec(specPath, c.spec.Raw(), Redoc(redocOpts, c.RoutesHandler(b)), specOpts...) } func (c Context) uiOptionsForHandler(opts []UIOption) (string, uiOptions, []SpecOption) { var title string sp := c.spec.Spec() if sp != nil && sp.Info != nil && sp.Info.Title != "" { title = sp.Info.Title } // default options (may be overridden) optsForContext := []UIOption{ WithUIBasePath(c.BasePath()), WithUITitle(title), } optsForContext = append(optsForContext, opts...) uiOpts := uiOptionsWithDefaults(optsForContext) // If spec URL is provided, there is a non-default path to serve the spec. // This makes sure that the UI middleware is aligned with the Spec middleware. u, _ := url.Parse(uiOpts.SpecURL) var specPath string if u != nil { specPath = u.Path } pth, doc := path.Split(specPath) if pth == "." { pth = "" } return pth, uiOpts, []SpecOption{WithSpecDocument(doc)} } // RoutesHandler returns a handler to serve the API, just the routes and the contract defined in the swagger spec func (c Context) RoutesHandler(builder Builder) http.Handler { b := builder if b == nil { b = PassthroughBuilder } return NewRouter(c, b(NewOperationExecutor(c))) } func cantFindProducer(format string) string { return "can't find a producer for " + format }	22.45 KB	2025-05-25 12:27
📄 context_test.go // Copyright 2015 go-swagger maintainers // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package middleware import ( stdcontext "context" "errors" "fmt" "net/http" "net/http/httptest" "strings" "testing" apierrors "github.com/go-openapi/errors" "github.com/go-openapi/loads" "github.com/go-openapi/loads/fmts" "github.com/go-openapi/runtime" "github.com/go-openapi/runtime/internal/testing/petstore" "github.com/go-openapi/runtime/middleware/untyped" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) type stubBindRequester struct { } func (s stubBindRequester) BindRequest(http.Request, MatchedRoute) error { return nil } type stubOperationHandler struct { } func (s stubOperationHandler) ParameterModel() interface{} { return nil } func (s stubOperationHandler) Handle(_ interface{}) (interface{}, error) { return map[string]interface{}{}, nil } func init() { loads.AddLoader(fmts.YAMLMatcher, fmts.YAMLDoc) } func assertAPIError(t testing.T, wantCode int, err error) { t.Helper() require.Error(t, err) ce, ok := err.(apierrors.CompositeError) assert.True(t, ok) assert.NotEmpty(t, ce.Errors) ae, ok := ce.Errors[0].(apierrors.Error) assert.True(t, ok) assert.Equal(t, wantCode, int(ae.Code())) } func TestContentType_Issue264(t testing.T) { swspec, err := loads.Spec("../fixtures/bugs/264/swagger.yml") require.NoError(t, err) api := untyped.NewAPI(swspec) api.RegisterConsumer(applicationJSON, runtime.JSONConsumer()) api.RegisterProducer(applicationJSON, runtime.JSONProducer()) api.RegisterOperation("delete", "/key/{id}", new(stubOperationHandler)) handler := Serve(swspec, api) request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodDelete, "/key/1", nil) require.NoError(t, err) recorder := httptest.NewRecorder() handler.ServeHTTP(recorder, request) assert.Equal(t, http.StatusOK, recorder.Code) } func TestContentType_Issue172(t testing.T) { swspec, err := loads.Spec("../fixtures/bugs/172/swagger.yml") require.NoError(t, err) api := untyped.NewAPI(swspec) api.RegisterConsumer("application/vnd.cia.v1+json", runtime.JSONConsumer()) api.RegisterProducer("application/vnd.cia.v1+json", runtime.JSONProducer()) api.RegisterOperation("get", "/pets", new(stubOperationHandler)) handler := Serve(swspec, api) request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, "/pets", nil) require.NoError(t, err) request.Header.Add("Accept", "application/json+special") recorder := httptest.NewRecorder() handler.ServeHTTP(recorder, request) assert.Equal(t, http.StatusNotAcceptable, recorder.Code) // acceptable as defined as default by the API (not explicit in the spec) request.Header.Add("Accept", applicationJSON) recorder = httptest.NewRecorder() handler.ServeHTTP(recorder, request) assert.Equal(t, http.StatusOK, recorder.Code) } func TestContentType_Issue174(t testing.T) { swspec, err := loads.Spec("../fixtures/bugs/174/swagger.yml") require.NoError(t, err) api := untyped.NewAPI(swspec) api.RegisterConsumer(applicationJSON, runtime.JSONConsumer()) api.RegisterProducer(applicationJSON, runtime.JSONProducer()) api.RegisterOperation("get", "/pets", new(stubOperationHandler)) handler := Serve(swspec, api) request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, "/pets", nil) require.NoError(t, err) recorder := httptest.NewRecorder() handler.ServeHTTP(recorder, request) assert.Equal(t, http.StatusOK, recorder.Code) } const ( testHost = "https://localhost:8080" // how to get the spec document? defaultSpecPath = "/swagger.json" defaultSpecURL = testHost + defaultSpecPath // how to get the UI asset? defaultUIURL = testHost + "/api/docs" ) func TestServe(t testing.T) { spec, api := petstore.NewAPI(t) handler := Serve(spec, api) t.Run("serve spec document", func(t testing.T) { request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, defaultSpecURL, nil) require.NoError(t, err) request.Header.Add("Content-Type", runtime.JSONMime) request.Header.Add("Accept", runtime.JSONMime) recorder := httptest.NewRecorder() handler.ServeHTTP(recorder, request) assert.Equal(t, http.StatusOK, recorder.Code) }) t.Run("should not find UI there", func(t testing.T) { request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, testHost+"/swagger-ui", nil) require.NoError(t, err) recorder := httptest.NewRecorder() handler.ServeHTTP(recorder, request) assert.Equal(t, http.StatusNotFound, recorder.Code) }) t.Run("should find UI here", func(t testing.T) { request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, defaultUIURL, nil) require.NoError(t, err) recorder := httptest.NewRecorder() handler.ServeHTTP(recorder, request) assert.Equal(t, http.StatusOK, recorder.Code) htmlResponse := recorder.Body.String() assert.Containsf(t, htmlResponse, "<title>Swagger Petstore</title>", "should default to the API's title") assert.Containsf(t, htmlResponse, "<redoc", "should default to Redoc UI") assert.Containsf(t, htmlResponse, "spec-url='/swagger.json'>", "should default to /swagger.json spec document") }) } func TestServeWithUIs(t testing.T) { spec, api := petstore.NewAPI(t) ctx := NewContext(spec, api, nil) const ( alternateSpecURL = testHost + "/specs/petstore.json" alternateSpecPath = "/specs/petstore.json" alternateUIURL = testHost + "/ui/docs" ) uiOpts := []UIOption{ WithUIBasePath("ui"), // override the base path from the spec, implies /ui WithUIPath("docs"), WithUISpecURL("/specs/petstore.json"), } t.Run("with APIHandler", func(t testing.T) { t.Run("with defaults", func(t testing.T) { handler := ctx.APIHandler(nil) t.Run("should find UI", func(t testing.T) { request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, defaultUIURL, nil) require.NoError(t, err) recorder := httptest.NewRecorder() handler.ServeHTTP(recorder, request) assert.Equal(t, http.StatusOK, recorder.Code) htmlResponse := recorder.Body.String() assert.Containsf(t, htmlResponse, "<redoc", "should default to Redoc UI") }) t.Run("should find spec", func(t testing.T) { request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, defaultSpecURL, nil) require.NoError(t, err) recorder := httptest.NewRecorder() handler.ServeHTTP(recorder, request) assert.Equal(t, http.StatusOK, recorder.Code) }) }) t.Run("with options", func(t testing.T) { handler := ctx.APIHandler(nil, uiOpts...) t.Run("should find UI", func(t testing.T) { request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, alternateUIURL, nil) require.NoError(t, err) recorder := httptest.NewRecorder() handler.ServeHTTP(recorder, request) assert.Equal(t, http.StatusOK, recorder.Code) htmlResponse := recorder.Body.String() assert.Contains(t, htmlResponse, fmt.Sprintf("<redoc spec-url='%s'></redoc>", alternateSpecPath)) }) t.Run("should find spec", func(t testing.T) { request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, alternateSpecURL, nil) require.NoError(t, err) recorder := httptest.NewRecorder() handler.ServeHTTP(recorder, request) assert.Equal(t, http.StatusOK, recorder.Code) }) }) }) t.Run("with APIHandlerSwaggerUI", func(t testing.T) { t.Run("with defaults", func(t testing.T) { handler := ctx.APIHandlerSwaggerUI(nil) t.Run("should find UI", func(t testing.T) { request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, defaultUIURL, nil) require.NoError(t, err) recorder := httptest.NewRecorder() handler.ServeHTTP(recorder, request) assert.Equal(t, http.StatusOK, recorder.Code) htmlResponse := recorder.Body.String() assert.Contains(t, htmlResponse, fmt.Sprintf(`url: '%s',`, strings.ReplaceAll(defaultSpecPath, `/`, `\/`))) }) t.Run("should find spec", func(t testing.T) { request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, defaultSpecURL, nil) require.NoError(t, err) recorder := httptest.NewRecorder() handler.ServeHTTP(recorder, request) assert.Equal(t, http.StatusOK, recorder.Code) }) }) t.Run("with options", func(t testing.T) { handler := ctx.APIHandlerSwaggerUI(nil, uiOpts...) t.Run("should find UI", func(t testing.T) { request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, alternateUIURL, nil) require.NoError(t, err) recorder := httptest.NewRecorder() handler.ServeHTTP(recorder, request) assert.Equal(t, http.StatusOK, recorder.Code) htmlResponse := recorder.Body.String() assert.Contains(t, htmlResponse, fmt.Sprintf(`url: '%s',`, strings.ReplaceAll(alternateSpecPath, `/`, `\/`))) }) t.Run("should find spec", func(t testing.T) { request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, alternateSpecURL, nil) require.NoError(t, err) recorder := httptest.NewRecorder() handler.ServeHTTP(recorder, request) assert.Equal(t, http.StatusOK, recorder.Code) }) }) }) t.Run("with APIHandlerRapiDoc", func(t testing.T) { t.Run("with defaults", func(t testing.T) { handler := ctx.APIHandlerRapiDoc(nil) t.Run("should find UI", func(t testing.T) { request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, defaultUIURL, nil) require.NoError(t, err) recorder := httptest.NewRecorder() handler.ServeHTTP(recorder, request) assert.Equal(t, http.StatusOK, recorder.Code) htmlResponse := recorder.Body.String() assert.Contains(t, htmlResponse, fmt.Sprintf("<rapi-doc spec-url=%q></rapi-doc>", defaultSpecPath)) }) t.Run("should find spec", func(t testing.T) { request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, defaultSpecURL, nil) require.NoError(t, err) recorder := httptest.NewRecorder() handler.ServeHTTP(recorder, request) assert.Equal(t, http.StatusOK, recorder.Code) }) }) t.Run("with options", func(t testing.T) { handler := ctx.APIHandlerRapiDoc(nil, uiOpts...) t.Run("should find UI", func(t testing.T) { request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, alternateUIURL, nil) require.NoError(t, err) recorder := httptest.NewRecorder() handler.ServeHTTP(recorder, request) assert.Equal(t, http.StatusOK, recorder.Code) htmlResponse := recorder.Body.String() assert.Contains(t, htmlResponse, fmt.Sprintf("<rapi-doc spec-url=%q></rapi-doc>", alternateSpecPath)) }) t.Run("should find spec", func(t testing.T) { request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, alternateSpecURL, nil) require.NoError(t, err) recorder := httptest.NewRecorder() handler.ServeHTTP(recorder, request) assert.Equal(t, http.StatusOK, recorder.Code) }) }) }) } func TestContextAuthorize(t testing.T) { spec, api := petstore.NewAPI(t) ctx := NewContext(spec, api, nil) ctx.router = DefaultRouter(spec, ctx.api) request, err := runtime.JSONRequest(http.MethodGet, "/api/pets", nil) require.NoError(t, err) request = request.WithContext(stdcontext.Background()) ri, reqWithCtx, ok := ctx.RouteInfo(request) assert.True(t, ok) require.NotNil(t, reqWithCtx) request = reqWithCtx p, reqWithCtx, err := ctx.Authorize(request, ri) require.Error(t, err) assert.Nil(t, p) assert.Nil(t, reqWithCtx) v := request.Context().Value(ctxSecurityPrincipal) assert.Nil(t, v) request.SetBasicAuth("wrong", "wrong") p, reqWithCtx, err = ctx.Authorize(request, ri) require.Error(t, err) assert.Nil(t, p) assert.Nil(t, reqWithCtx) v = request.Context().Value(ctxSecurityPrincipal) assert.Nil(t, v) request.SetBasicAuth("admin", "admin") p, reqWithCtx, err = ctx.Authorize(request, ri) require.NoError(t, err) assert.Equal(t, "admin", p) require.NotNil(t, reqWithCtx) // Assign the new returned request to follow with the test request = reqWithCtx v, ok = request.Context().Value(ctxSecurityPrincipal).(string) assert.True(t, ok) assert.Equal(t, "admin", v) // Once the request context contains the principal the authentication // isn't rechecked request.SetBasicAuth("doesn't matter", "doesn't") pp, reqCtx, rr := ctx.Authorize(request, ri) assert.Equal(t, p, pp) assert.Equal(t, err, rr) assert.Equal(t, request, reqCtx) } func TestContextAuthorize_WithAuthorizer(t testing.T) { spec, api := petstore.NewAPI(t) ctx := NewContext(spec, api, nil) ctx.router = DefaultRouter(spec, ctx.api) request, err := runtime.JSONRequest(http.MethodPost, "/api/pets", nil) require.NoError(t, err) request = request.WithContext(stdcontext.Background()) ri, reqWithCtx, ok := ctx.RouteInfo(request) assert.True(t, ok) require.NotNil(t, reqWithCtx) request = reqWithCtx request.SetBasicAuth("topuser", "topuser") p, reqWithCtx, err := ctx.Authorize(request, ri) assertAPIError(t, apierrors.InvalidTypeCode, err) assert.Nil(t, p) assert.Nil(t, reqWithCtx) request.SetBasicAuth("admin", "admin") p, reqWithCtx, err = ctx.Authorize(request, ri) require.NoError(t, err) assert.Equal(t, "admin", p) require.NotNil(t, reqWithCtx) request.SetBasicAuth("anyother", "anyother") p, reqWithCtx, err = ctx.Authorize(request, ri) require.Error(t, err) ae, ok := err.(apierrors.Error) assert.True(t, ok) assert.Equal(t, http.StatusForbidden, int(ae.Code())) assert.Nil(t, p) assert.Nil(t, reqWithCtx) } func TestContextNegotiateContentType(t testing.T) { spec, api := petstore.NewAPI(t) ctx := NewContext(spec, api, nil) ctx.router = DefaultRouter(spec, ctx.api) request, _ := http.NewRequestWithContext(stdcontext.Background(), http.MethodPost, "/api/pets", nil) // request.Header.Add("Accept", "/") request.Header.Add("content-type", "text/html") v := request.Context().Value(ctxBoundParams) assert.Nil(t, v) ri, request, _ := ctx.RouteInfo(request) res := NegotiateContentType(request, ri.Produces, "text/plain") assert.Equal(t, ri.Produces[0], res) } func TestContextBindValidRequest(t testing.T) { spec, api := petstore.NewAPI(t) ctx := NewContext(spec, api, nil) ctx.router = DefaultRouter(spec, ctx.api) // invalid content-type value request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodPost, "/api/pets", strings.NewReader(`{"name":"dog"}`)) require.NoError(t, err) request.Header.Add("content-type", "/json") ri, request, _ := ctx.RouteInfo(request) assertAPIError(t, 400, ctx.BindValidRequest(request, ri, new(stubBindRequester))) // unsupported content-type value request, err = http.NewRequestWithContext(stdcontext.Background(), http.MethodPost, "/api/pets", strings.NewReader(`{"name":"dog"}`)) require.NoError(t, err) request.Header.Add("content-type", "text/html") ri, request, _ = ctx.RouteInfo(request) assertAPIError(t, http.StatusUnsupportedMediaType, ctx.BindValidRequest(request, ri, new(stubBindRequester))) // unacceptable accept value request, err = http.NewRequestWithContext(stdcontext.Background(), http.MethodPost, "/api/pets", nil) require.NoError(t, err) request.Header.Add("Accept", "application/vnd.cia.v1+json") request.Header.Add("content-type", applicationJSON) ri, request, _ = ctx.RouteInfo(request) assertAPIError(t, http.StatusNotAcceptable, ctx.BindValidRequest(request, ri, new(stubBindRequester))) } func TestContextBindValidRequest_Issue174(t testing.T) { spec, err := loads.Spec("../fixtures/bugs/174/swagger.yml") require.NoError(t, err) api := untyped.NewAPI(spec) api.RegisterConsumer(applicationJSON, runtime.JSONConsumer()) api.RegisterProducer(applicationJSON, runtime.JSONProducer()) api.RegisterOperation("get", "/pets", new(stubOperationHandler)) ctx := NewContext(spec, api, nil) ctx.router = DefaultRouter(spec, ctx.api) request, _ := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, "/pets", nil) ri, request, _ := ctx.RouteInfo(request) require.NoError(t, ctx.BindValidRequest(request, ri, new(stubBindRequester))) } func TestContextBindAndValidate(t testing.T) { spec, api := petstore.NewAPI(t) ctx := NewContext(spec, api, nil) ctx.router = DefaultRouter(spec, ctx.api) request, _ := http.NewRequestWithContext(stdcontext.Background(), http.MethodPost, "/api/pets", nil) request.Header.Add("Accept", "/") request.Header.Add("content-type", "text/html") request.ContentLength = 1 v := request.Context().Value(ctxBoundParams) assert.Nil(t, v) ri, request, _ := ctx.RouteInfo(request) data, request, result := ctx.BindAndValidate(request, ri) // this requires a much more thorough test assert.NotNil(t, data) require.Error(t, result) v, ok := request.Context().Value(ctxBoundParams).(validation) assert.True(t, ok) assert.NotNil(t, v) dd, rCtx, rr := ctx.BindAndValidate(request, ri) assert.Equal(t, data, dd) assert.Equal(t, result, rr) assert.Equal(t, rCtx, request) } func TestContextRender(t testing.T) { ct := runtime.JSONMime spec, api := petstore.NewAPI(t) assert.NotNil(t, spec) assert.NotNil(t, api) ctx := NewContext(spec, api, nil) ctx.router = DefaultRouter(spec, ctx.api) request, _ := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, "/api/pets", nil) request.Header.Set(runtime.HeaderAccept, ct) ri, request, _ := ctx.RouteInfo(request) recorder := httptest.NewRecorder() ctx.Respond(recorder, request, []string{ct}, ri, map[string]interface{}{"name": "hello"}) assert.Equal(t, http.StatusOK, recorder.Code) assert.Equal(t, "{\"name\":\"hello\"}\n", recorder.Body.String()) recorder = httptest.NewRecorder() ctx.Respond(recorder, request, []string{ct}, ri, errors.New("this went wrong")) assert.Equal(t, 500, recorder.Code) // recorder = httptest.NewRecorder() // assert.Panics(t, func() { ctx.Respond(recorder, request, []string{ct}, ri, map[int]interface{}{1: "hello"}) }) // Panic when route is nil and there is not a producer for the requested response format recorder = httptest.NewRecorder() request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, "/api/pets", nil) require.NoError(t, err) request.Header.Set(runtime.HeaderAccept, "text/xml") assert.Panics(t, func() { ctx.Respond(recorder, request, []string{}, nil, map[string]interface{}{"name": "hello"}) }) request, err = http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, "/api/pets", nil) require.NoError(t, err) request.Header.Set(runtime.HeaderAccept, ct) ri, request, _ = ctx.RouteInfo(request) recorder = httptest.NewRecorder() ctx.Respond(recorder, request, []string{ct}, ri, map[string]interface{}{"name": "hello"}) assert.Equal(t, http.StatusOK, recorder.Code) assert.Equal(t, "{\"name\":\"hello\"}\n", recorder.Body.String()) recorder = httptest.NewRecorder() ctx.Respond(recorder, request, []string{ct}, ri, errors.New("this went wrong")) assert.Equal(t, 500, recorder.Code) // recorder = httptest.NewRecorder() // assert.Panics(t, func() { ctx.Respond(recorder, request, []string{ct}, ri, map[int]interface{}{1: "hello"}) }) // recorder = httptest.NewRecorder() // request, _ = http.NewRequestWithContext(stdcontext.Background(),http.MethodGet, "/pets", nil) // assert.Panics(t, func() { ctx.Respond(recorder, request, []string{}, ri, map[string]interface{}{"name": "hello"}) }) recorder = httptest.NewRecorder() request, err = http.NewRequestWithContext(stdcontext.Background(), http.MethodDelete, "/api/pets/1", nil) require.NoError(t, err) ri, request, _ = ctx.RouteInfo(request) ctx.Respond(recorder, request, ri.Produces, ri, nil) assert.Equal(t, 204, recorder.Code) } func TestContextValidResponseFormat(t testing.T) { const ct = applicationJSON spec, api := petstore.NewAPI(t) ctx := NewContext(spec, api, nil) ctx.router = DefaultRouter(spec, ctx.api) request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, "http://localhost:8080", nil) require.NoError(t, err) request.Header.Set(runtime.HeaderAccept, ct) // check there's nothing there cached, ok := request.Context().Value(ctxResponseFormat).(string) assert.False(t, ok) assert.Empty(t, cached) // trigger the parse mt, request := ctx.ResponseFormat(request, []string{ct}) assert.Equal(t, ct, mt) // check it was cached cached, ok = request.Context().Value(ctxResponseFormat).(string) assert.True(t, ok) assert.Equal(t, ct, cached) // check if the cast works and fetch from cache too mt, _ = ctx.ResponseFormat(request, []string{ct}) assert.Equal(t, ct, mt) } func TestContextInvalidResponseFormat(t testing.T) { ct := "application/x-yaml" other := "application/sgml" spec, api := petstore.NewAPI(t) ctx := NewContext(spec, api, nil) ctx.router = DefaultRouter(spec, ctx.api) request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, "http://localhost:8080", nil) require.NoError(t, err) request.Header.Set(runtime.HeaderAccept, ct) // check there's nothing there cached, ok := request.Context().Value(ctxResponseFormat).(string) assert.False(t, ok) assert.Empty(t, cached) // trigger the parse mt, request := ctx.ResponseFormat(request, []string{other}) assert.Empty(t, mt) // check it was cached cached, ok = request.Context().Value(ctxResponseFormat).(string) assert.False(t, ok) assert.Empty(t, cached) // check if the cast works and fetch from cache too mt, rCtx := ctx.ResponseFormat(request, []string{other}) assert.Empty(t, mt) assert.Equal(t, request, rCtx) } func TestContextValidRoute(t testing.T) { spec, api := petstore.NewAPI(t) ctx := NewContext(spec, api, nil) ctx.router = DefaultRouter(spec, ctx.api) request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, "/api/pets", nil) require.NoError(t, err) // check there's nothing there cached := request.Context().Value(ctxMatchedRoute) assert.Nil(t, cached) matched, rCtx, ok := ctx.RouteInfo(request) assert.True(t, ok) assert.NotNil(t, matched) assert.NotNil(t, rCtx) assert.NotEqual(t, request, rCtx) request = rCtx // check it was cached _, ok = request.Context().Value(ctxMatchedRoute).(MatchedRoute) assert.True(t, ok) matched, rCtx, ok = ctx.RouteInfo(request) assert.True(t, ok) assert.NotNil(t, matched) assert.Equal(t, request, rCtx) } func TestContextInvalidRoute(t testing.T) { spec, api := petstore.NewAPI(t) ctx := NewContext(spec, api, nil) ctx.router = DefaultRouter(spec, ctx.api) request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodDelete, "pets", nil) require.NoError(t, err) // check there's nothing there cached := request.Context().Value(ctxMatchedRoute) assert.Nil(t, cached) matched, rCtx, ok := ctx.RouteInfo(request) assert.False(t, ok) assert.Nil(t, matched) assert.Nil(t, rCtx) // check it was not cached cached = request.Context().Value(ctxMatchedRoute) assert.Nil(t, cached) matched, rCtx, ok = ctx.RouteInfo(request) assert.False(t, ok) assert.Nil(t, matched) assert.Nil(t, rCtx) } func TestContextValidContentType(t testing.T) { ct := applicationJSON ctx := NewContext(nil, nil, nil) request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, "http://localhost:8080", nil) require.NoError(t, err) request.Header.Set(runtime.HeaderContentType, ct) // check there's nothing there cached := request.Context().Value(ctxContentType) assert.Nil(t, cached) // trigger the parse mt, _, rCtx, err := ctx.ContentType(request) require.NoError(t, err) assert.Equal(t, ct, mt) assert.NotNil(t, rCtx) assert.NotEqual(t, request, rCtx) request = rCtx // check it was cached cached = request.Context().Value(ctxContentType) assert.NotNil(t, cached) // check if the cast works and fetch from cache too mt, _, rCtx, err = ctx.ContentType(request) require.NoError(t, err) assert.Equal(t, ct, mt) assert.Equal(t, request, rCtx) } func TestContextInvalidContentType(t *testing.T) { ct := "application(" ctx := NewContext(nil, nil, nil) request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, "http://localhost:8080", nil) require.NoError(t, err) request.Header.Set(runtime.HeaderContentType, ct) // check there's nothing there cached := request.Context().Value(ctxContentType) assert.Nil(t, cached) // trigger the parse mt, _, rCtx, err := ctx.ContentType(request) require.Error(t, err) assert.Empty(t, mt) assert.Nil(t, rCtx) // check it was not cached cached = request.Context().Value(ctxContentType) assert.Nil(t, cached) // check if the failure continues _, _, rCtx, err = ctx.ContentType(request) require.Error(t, err) assert.Nil(t, rCtx) }	24.93 KB	2025-05-25 12:27
📄 debug_test.go package middleware import ( "bytes" stdcontext "context" "log" "net/http" "net/http/httptest" "testing" "github.com/go-openapi/runtime/internal/testing/petstore" "github.com/go-openapi/runtime/logger" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) type customLogger struct { logger.StandardLogger lg log.Logger } func (l customLogger) Debugf(format string, args ...interface{}) { l.lg.Printf(format, args...) } func TestDebugMode(t testing.T) { t.Run("with normal mode", func(t testing.T) { t.Setenv("DEBUG", "") logFunc := debugLogfFunc(nil) require.NotNil(t, logFunc) }) t.Run("with debug mode", func(t testing.T) { t.Setenv("DEBUG", "true") t.Run("debugLogFunc with nil logger yields standard logger", func(t testing.T) { logFunc := debugLogfFunc(nil) require.NotNil(t, logFunc) }) t.Run("debugLogFunc with custom logger", func(t testing.T) { var capture bytes.Buffer logger := customLogger{lg: log.New(&capture, "test", log.Lshortfile)} logFunc := debugLogfFunc(logger) require.NotNil(t, logFunc) logFunc("debug") assert.NotEmpty(t, capture.String()) }) }) } func TestDebugRouterOptions(t testing.T) { t.Run("with normal mode", func(t testing.T) { t.Setenv("DEBUG", "") t.Run("should capture debug from context & router", func(t testing.T) { var capture bytes.Buffer logger := customLogger{lg: log.New(&capture, "test", log.Lshortfile)} t.Run("run some activiy", doCheckWithContext(logger)) assert.Empty(t, capture.String()) }) t.Run("should capture debug from standalone DefaultRouter", func(t testing.T) { var capture bytes.Buffer logger := customLogger{lg: log.New(&capture, "test", log.Lshortfile)} t.Run("run some activiy", doCheckWithDefaultRouter(logger)) assert.Empty(t, capture.String()) }) }) t.Run("with debug mode", func(t testing.T) { t.Setenv("DEBUG", "1") t.Run("should capture debug from context & router", func(t testing.T) { var capture bytes.Buffer logger := customLogger{lg: log.New(&capture, "test", log.Lshortfile)} t.Run("run some activiy", doCheckWithContext(logger)) assert.NotEmpty(t, capture.String()) }) t.Run("should capture debug from standalone DefaultRouter", func(t testing.T) { var capture bytes.Buffer logger := customLogger{lg: log.New(&capture, "test", log.Lshortfile)} t.Run("run some activiy", doCheckWithDefaultRouter(logger)) assert.NotEmpty(t, capture.String()) }) }) } func doCheckWithContext(logger logger.Logger) func(testing.T) { return func(t testing.T) { spec, api := petstore.NewAPI(t) context := NewContext(spec, api, nil) context.SetLogger(logger) mw := NewRouter(context, http.HandlerFunc(terminator)) recorder := httptest.NewRecorder() request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, "/api/pets", nil) require.NoError(t, err) mw.ServeHTTP(recorder, request) assert.Equal(t, http.StatusOK, recorder.Code) } } func doCheckWithDefaultRouter(lg logger.Logger) func(testing.T) { return func(t *testing.T) { spec, api := petstore.NewAPI(t) context := NewContext(spec, api, nil) context.SetLogger(lg) router := DefaultRouter( spec, newRoutableUntypedAPI(spec, api, new(Context)), WithDefaultRouterLogger(lg)) _ = router.OtherMethods("post", "/api/pets/{id}") } }	3.31 KB	2025-05-25 12:27
📁 denco	-	2025-05-25 12:27
📄 doc.go // Copyright 2015 go-swagger maintainers // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. /* Package middleware provides the library with helper functions for serving swagger APIs. Pseudo middleware handler import ( "net/http" "github.com/go-openapi/errors" ) func newCompleteMiddleware(ctx Context) http.Handler { return http.HandlerFunc(func(rw http.ResponseWriter, r http.Request) { // use context to lookup routes if matched, ok := ctx.RouteInfo(r); ok { if matched.NeedsAuth() { if _, err := ctx.Authorize(r, matched); err != nil { ctx.Respond(rw, r, matched.Produces, matched, err) return } } bound, validation := ctx.BindAndValidate(r, matched) if validation != nil { ctx.Respond(rw, r, matched.Produces, matched, validation) return } result, err := matched.Handler.Handle(bound) if err != nil { ctx.Respond(rw, r, matched.Produces, matched, err) return } ctx.Respond(rw, r, matched.Produces, matched, result) return } // Not found, check if it exists in the other methods first if others := ctx.AllowedMethods(r); len(others) > 0 { ctx.Respond(rw, r, ctx.spec.RequiredProduces(), nil, errors.MethodNotAllowed(r.Method, others)) return } ctx.Respond(rw, r, ctx.spec.RequiredProduces(), nil, errors.NotFound("path %s was not found", r.URL.Path)) }) } */ package middleware	1.88 KB	2025-05-25 12:27
📁 header	-	2025-05-25 12:27
📄 negotiate.go // Copyright 2013 The Go Authors. All rights reserved. // // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file or at // https://developers.google.com/open-source/licenses/bsd. // this file was taken from the github.com/golang/gddo repository package middleware import ( "net/http" "strings" "github.com/go-openapi/runtime/middleware/header" ) // NegotiateContentEncoding returns the best offered content encoding for the // request's Accept-Encoding header. If two offers match with equal weight and // then the offer earlier in the list is preferred. If no offers are // acceptable, then "" is returned. func NegotiateContentEncoding(r http.Request, offers []string) string { bestOffer := "identity" bestQ := -1.0 specs := header.ParseAccept(r.Header, "Accept-Encoding") for _, offer := range offers { for _, spec := range specs { if spec.Q > bestQ && (spec.Value == "" \|\| spec.Value == offer) { bestQ = spec.Q bestOffer = offer } } } if bestQ == 0 { bestOffer = "" } return bestOffer } // NegotiateContentType returns the best offered content type for the request's // Accept header. If two offers match with equal weight, then the more specific // offer is preferred. For example, text/* trumps /. If two offers match // with equal weight and specificity, then the offer earlier in the list is // preferred. If no offers match, then defaultOffer is returned. func NegotiateContentType(r http.Request, offers []string, defaultOffer string) string { bestOffer := defaultOffer bestQ := -1.0 bestWild := 3 specs := header.ParseAccept(r.Header, "Accept") for _, rawOffer := range offers { offer := normalizeOffer(rawOffer) // No Accept header: just return the first offer. if len(specs) == 0 { return rawOffer } for _, spec := range specs { switch { case spec.Q == 0.0: // ignore case spec.Q < bestQ: // better match found case spec.Value == "/": if spec.Q > bestQ \|\| bestWild > 2 { bestQ = spec.Q bestWild = 2 bestOffer = rawOffer } case strings.HasSuffix(spec.Value, "/"): if strings.HasPrefix(offer, spec.Value[:len(spec.Value)-1]) && (spec.Q > bestQ \|\| bestWild > 1) { bestQ = spec.Q bestWild = 1 bestOffer = rawOffer } default: if spec.Value == offer && (spec.Q > bestQ \|\| bestWild > 0) { bestQ = spec.Q bestWild = 0 bestOffer = rawOffer } } } } return bestOffer } func normalizeOffers(orig []string) (norm []string) { for _, o := range orig { norm = append(norm, normalizeOffer(o)) } return } func normalizeOffer(orig string) string { return strings.SplitN(orig, ";", 2)[0] }	2.65 KB	2025-05-25 12:27
📄 negotiate_test.go // Copyright 2013 The Go Authors. All rights reserved. // // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file or at // https://developers.google.com/open-source/licenses/bsd. package middleware import ( "net/http" "testing" ) var negotiateContentEncodingTests = []struct { s string offers []string expect string }{ {"", []string{"identity", "gzip"}, "identity"}, {";q=0", []string{"identity", "gzip"}, ""}, {"gzip", []string{"identity", "gzip"}, "gzip"}, } func TestNegotiateContentEnoding(t testing.T) { for _, tt := range negotiateContentEncodingTests { r := &http.Request{Header: http.Header{"Accept-Encoding": {tt.s}}} actual := NegotiateContentEncoding(r, tt.offers) if actual != tt.expect { t.Errorf("NegotiateContentEncoding(%q, %#v)=%q, want %q", tt.s, tt.offers, actual, tt.expect) } } } var negotiateContentTypeTests = []struct { s string offers []string defaultOffer string expect string }{ {"text/html, /;q=0", []string{"x/y"}, "", ""}, {"text/html, /", []string{"x/y"}, "", "x/y"}, {"text/html, image/png", []string{"text/html", "image/png"}, "", "text/html"}, {"text/html, image/png", []string{"image/png", "text/html"}, "", "image/png"}, {"text/html, image/png; q=0.5", []string{"image/png"}, "", "image/png"}, {"text/html, image/png; q=0.5", []string{"text/html"}, "", "text/html"}, {"text/html, image/png; q=0.5", []string{"foo/bar"}, "", ""}, {"text/html, image/png; q=0.5", []string{"image/png", "text/html"}, "", "text/html"}, {"text/html, image/png; q=0.5", []string{"text/html", "image/png"}, "", "text/html"}, {"text/html;q=0.5, image/png", []string{"image/png"}, "", "image/png"}, {"text/html;q=0.5, image/png", []string{"text/html"}, "", "text/html"}, {"text/html;q=0.5, image/png", []string{"image/png", "text/html"}, "", "image/png"}, {"text/html;q=0.5, image/png", []string{"text/html", "image/png"}, "", "image/png"}, {"text/html;q=0.5, image/png", []string{"text/html", "image/png"}, "", "image/png"}, {"image/png, image/;q=0.5", []string{"image/jpg", "image/png"}, "", "image/png"}, {"image/png, image/;q=0.5", []string{"image/jpg"}, "", "image/jpg"}, {"image/png, image/;q=0.5", []string{"image/jpg", "image/gif"}, "", "image/jpg"}, {"image/png, image/", []string{"image/jpg", "image/gif"}, "", "image/jpg"}, {"image/png, image/", []string{"image/gif", "image/jpg"}, "", "image/gif"}, {"image/png, image/", []string{"image/gif", "image/png"}, "", "image/png"}, {"image/png, image/", []string{"image/png", "image/gif"}, "", "image/png"}, {"application/vnd.google.protobuf;proto=io.prometheus.client.MetricFamily;encoding=delimited;q=0.7,text/plain;version=0.0.4;q=0.3", []string{"text/plain"}, "", "text/plain"}, {"application/json", []string{"application/json; charset=utf-8", "image/png"}, "", "application/json; charset=utf-8"}, {"application/json; charset=utf-8", []string{"application/json; charset=utf-8", "image/png"}, "", "application/json; charset=utf-8"}, {"application/json", []string{"application/vnd.cia.v1+json"}, "", ""}, // Default header of java clients {"text/html, image/gif, image/jpeg, ; q=.2, /; q=.2", []string{"application/json"}, "", "application/json"}, } func TestNegotiateContentType(t testing.T) { for _, tt := range negotiateContentTypeTests { r := &http.Request{Header: http.Header{"Accept": {tt.s}}} actual := NegotiateContentType(r, tt.offers, tt.defaultOffer) if actual != tt.expect { t.Errorf("NegotiateContentType(%q, %#v, %q)=%q, want %q", tt.s, tt.offers, tt.defaultOffer, actual, tt.expect) } } } func TestNegotiateContentTypeNoAcceptHeader(t testing.T) { r := &http.Request{Header: http.Header{}} offers := []string{"application/json", "text/xml"} actual := NegotiateContentType(r, offers, "") if actual != "application/json" { t.Errorf("NegotiateContentType(empty, %#v, empty)=%q, want %q", offers, actual, "application/json") } }	3.89 KB	2025-05-25 12:27
📄 not_implemented.go // Copyright 2015 go-swagger maintainers // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package middleware import ( "net/http" "github.com/go-openapi/runtime" ) type errorResp struct { code int response interface{} headers http.Header } func (e *errorResp) WriteResponse(rw http.ResponseWriter, producer runtime.Producer) { for k, v := range e.headers { for _, val := range v { rw.Header().Add(k, val) } } if e.code > 0 { rw.WriteHeader(e.code) } else { rw.WriteHeader(http.StatusInternalServerError) } if err := producer.Produce(rw, e.response); err != nil { Logger.Printf("failed to write error response: %v", err) } } // NotImplemented the error response when the response is not implemented func NotImplemented(message string) Responder { return Error(http.StatusNotImplemented, message) } // Error creates a generic responder for returning errors, the data will be serialized // with the matching producer for the request func Error(code int, data interface{}, headers ...http.Header) Responder { var hdr http.Header for _, h := range headers { for k, v := range h { if hdr == nil { hdr = make(http.Header) } hdr[k] = v } } return &errorResp{ code: code, response: data, headers: hdr, } }	1.73 KB	2025-05-25 12:27
📄 not_implemented_test.go package middleware import ( "net/http" "net/http/httptest" "testing" "github.com/go-openapi/runtime" "github.com/stretchr/testify/require" ) func TestErrorResponder(t *testing.T) { resp := Error(http.StatusBadRequest, map[string]string{"message": "this is the error body"}) rec := httptest.NewRecorder() resp.WriteResponse(rec, runtime.JSONProducer()) require.Equal(t, http.StatusBadRequest, rec.Code) require.Equal(t, "{\"message\":\"this is the error body\"}\n", rec.Body.String()) }	501 B	2025-05-25 12:27
📄 operation.go // Copyright 2015 go-swagger maintainers // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package middleware import "net/http" // NewOperationExecutor creates a context aware middleware that handles the operations after routing func NewOperationExecutor(ctx Context) http.Handler { return http.HandlerFunc(func(rw http.ResponseWriter, r http.Request) { // use context to lookup routes route, rCtx, _ := ctx.RouteInfo(r) if rCtx != nil { r = rCtx } route.Handler.ServeHTTP(rw, r) }) }	1013 B	2025-05-25 12:27
📄 operation_test.go // Copyright 2015 go-swagger maintainers // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package middleware import ( stdcontext "context" "net/http" "net/http/httptest" "testing" "github.com/go-openapi/errors" "github.com/go-openapi/runtime" "github.com/go-openapi/runtime/internal/testing/petstore" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) func TestOperationExecutor(t *testing.T) { spec, api := petstore.NewAPI(t) api.RegisterOperation("get", "/pets", runtime.OperationHandlerFunc(func(_ interface{}) (interface{}, error) { return []interface{}{ map[string]interface{}{"id": 1, "name": "a dog"}, }, nil })) context := NewContext(spec, api, nil) context.router = DefaultRouter(spec, context.api) mw := NewOperationExecutor(context) recorder := httptest.NewRecorder() request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, "/api/pets", nil) require.NoError(t, err) request.Header.Add("Accept", "application/json") request.SetBasicAuth("admin", "admin") mw.ServeHTTP(recorder, request) assert.Equal(t, http.StatusOK, recorder.Code) assert.Equal(t, `[{"id":1,"name":"a dog"}]`+"\n", recorder.Body.String()) spec, api = petstore.NewAPI(t) api.RegisterOperation("get", "/pets", runtime.OperationHandlerFunc(func(_ interface{}) (interface{}, error) { return nil, errors.New(http.StatusUnprocessableEntity, "expected") })) context = NewContext(spec, api, nil) context.router = DefaultRouter(spec, context.api) mw = NewOperationExecutor(context) recorder = httptest.NewRecorder() request, err = http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, "/api/pets", nil) require.NoError(t, err) request.Header.Add("Accept", "application/json") request.SetBasicAuth("admin", "admin") mw.ServeHTTP(recorder, request) assert.Equal(t, http.StatusUnprocessableEntity, recorder.Code) assert.Equal(t, `{"code":422,"message":"expected"}`, recorder.Body.String()) }	2.43 KB	2025-05-25 12:27
📄 parameter.go // Copyright 2015 go-swagger maintainers // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package middleware import ( "encoding" "encoding/base64" "fmt" "io" "net/http" "reflect" "strconv" "github.com/go-openapi/errors" "github.com/go-openapi/spec" "github.com/go-openapi/strfmt" "github.com/go-openapi/swag" "github.com/go-openapi/validate" "github.com/go-openapi/runtime" ) const defaultMaxMemory = 32 << 20 const ( typeString = "string" typeArray = "array" ) var textUnmarshalType = reflect.TypeOf(new(encoding.TextUnmarshaler)).Elem() func newUntypedParamBinder(param spec.Parameter, spec spec.Swagger, formats strfmt.Registry) untypedParamBinder { binder := new(untypedParamBinder) binder.Name = param.Name binder.parameter = &param binder.formats = formats if param.In != "body" { binder.validator = validate.NewParamValidator(&param, formats) } else { binder.validator = validate.NewSchemaValidator(param.Schema, spec, param.Name, formats) } return binder } type untypedParamBinder struct { parameter spec.Parameter formats strfmt.Registry Name string validator validate.EntityValidator } func (p untypedParamBinder) Type() reflect.Type { return p.typeForSchema(p.parameter.Type, p.parameter.Format, p.parameter.Items) } func (p untypedParamBinder) typeForSchema(tpe, format string, items spec.Items) reflect.Type { switch tpe { case "boolean": return reflect.TypeOf(true) case typeString: if tt, ok := p.formats.GetType(format); ok { return tt } return reflect.TypeOf("") case "integer": switch format { case "int8": return reflect.TypeOf(int8(0)) case "int16": return reflect.TypeOf(int16(0)) case "int32": return reflect.TypeOf(int32(0)) case "int64": return reflect.TypeOf(int64(0)) default: return reflect.TypeOf(int64(0)) } case "number": switch format { case "float": return reflect.TypeOf(float32(0)) case "double": return reflect.TypeOf(float64(0)) } case typeArray: if items == nil { return nil } itemsType := p.typeForSchema(items.Type, items.Format, items.Items) if itemsType == nil { return nil } return reflect.MakeSlice(reflect.SliceOf(itemsType), 0, 0).Type() case "file": return reflect.TypeOf(&runtime.File{}).Elem() case "object": return reflect.TypeOf(map[string]interface{}{}) } return nil } func (p untypedParamBinder) allowsMulti() bool { return p.parameter.In == "query" \|\| p.parameter.In == "formData" } func (p untypedParamBinder) readValue(values runtime.Gettable, target reflect.Value) ([]string, bool, bool, error) { name, in, cf, tpe := p.parameter.Name, p.parameter.In, p.parameter.CollectionFormat, p.parameter.Type if tpe == typeArray { if cf == "multi" { if !p.allowsMulti() { return nil, false, false, errors.InvalidCollectionFormat(name, in, cf) } vv, hasKey, _ := values.GetOK(name) return vv, false, hasKey, nil } v, hk, hv := values.GetOK(name) if !hv { return nil, false, hk, nil } d, c, e := p.readFormattedSliceFieldValue(v[len(v)-1], target) return d, c, hk, e } vv, hk, _ := values.GetOK(name) return vv, false, hk, nil } func (p untypedParamBinder) Bind(request http.Request, routeParams RouteParams, consumer runtime.Consumer, target reflect.Value) error { // fmt.Println("binding", p.name, "as", p.Type()) switch p.parameter.In { case "query": data, custom, hasKey, err := p.readValue(runtime.Values(request.URL.Query()), target) if err != nil { return err } if custom { return nil } return p.bindValue(data, hasKey, target) case "header": data, custom, hasKey, err := p.readValue(runtime.Values(request.Header), target) if err != nil { return err } if custom { return nil } return p.bindValue(data, hasKey, target) case "path": data, custom, hasKey, err := p.readValue(routeParams, target) if err != nil { return err } if custom { return nil } return p.bindValue(data, hasKey, target) case "formData": var err error var mt string mt, _, e := runtime.ContentType(request.Header) if e != nil { // because of the interface conversion go thinks the error is not nil // so we first check for nil and then set the err var if it's not nil err = e } if err != nil { return errors.InvalidContentType("", []string{"multipart/form-data", "application/x-www-form-urlencoded"}) } if mt != "multipart/form-data" && mt != "application/x-www-form-urlencoded" { return errors.InvalidContentType(mt, []string{"multipart/form-data", "application/x-www-form-urlencoded"}) } if mt == "multipart/form-data" { if err = request.ParseMultipartForm(defaultMaxMemory); err != nil { return errors.NewParseError(p.Name, p.parameter.In, "", err) } } if err = request.ParseForm(); err != nil { return errors.NewParseError(p.Name, p.parameter.In, "", err) } if p.parameter.Type == "file" { file, header, ffErr := request.FormFile(p.parameter.Name) if ffErr != nil { if p.parameter.Required { return errors.NewParseError(p.Name, p.parameter.In, "", ffErr) } return nil } target.Set(reflect.ValueOf(runtime.File{Data: file, Header: header})) return nil } if request.MultipartForm != nil { data, custom, hasKey, rvErr := p.readValue(runtime.Values(request.MultipartForm.Value), target) if rvErr != nil { return rvErr } if custom { return nil } return p.bindValue(data, hasKey, target) } data, custom, hasKey, err := p.readValue(runtime.Values(request.PostForm), target) if err != nil { return err } if custom { return nil } return p.bindValue(data, hasKey, target) case "body": newValue := reflect.New(target.Type()) if !runtime.HasBody(request) { if p.parameter.Default != nil { target.Set(reflect.ValueOf(p.parameter.Default)) } return nil } if err := consumer.Consume(request.Body, newValue.Interface()); err != nil { if err == io.EOF && p.parameter.Default != nil { target.Set(reflect.ValueOf(p.parameter.Default)) return nil } tpe := p.parameter.Type if p.parameter.Format != "" { tpe = p.parameter.Format } return errors.InvalidType(p.Name, p.parameter.In, tpe, nil) } target.Set(reflect.Indirect(newValue)) return nil default: return errors.New(500, fmt.Sprintf("invalid parameter location %q", p.parameter.In)) } } func (p untypedParamBinder) bindValue(data []string, hasKey bool, target reflect.Value) error { if p.parameter.Type == typeArray { return p.setSliceFieldValue(target, p.parameter.Default, data, hasKey) } var d string if len(data) > 0 { d = data[len(data)-1] } return p.setFieldValue(target, p.parameter.Default, d, hasKey) } func (p untypedParamBinder) setFieldValue(target reflect.Value, defaultValue interface{}, data string, hasKey bool) error { //nolint:gocyclo tpe := p.parameter.Type if p.parameter.Format != "" { tpe = p.parameter.Format } if (!hasKey \|\| (!p.parameter.AllowEmptyValue && data == "")) && p.parameter.Required && p.parameter.Default == nil { return errors.Required(p.Name, p.parameter.In, data) } ok, err := p.tryUnmarshaler(target, defaultValue, data) if err != nil { return errors.InvalidType(p.Name, p.parameter.In, tpe, data) } if ok { return nil } defVal := reflect.Zero(target.Type()) if defaultValue != nil { defVal = reflect.ValueOf(defaultValue) } if tpe == "byte" { if data == "" { if target.CanSet() { target.SetBytes(defVal.Bytes()) } return nil } b, err := base64.StdEncoding.DecodeString(data) if err != nil { b, err = base64.URLEncoding.DecodeString(data) if err != nil { return errors.InvalidType(p.Name, p.parameter.In, tpe, data) } } if target.CanSet() { target.SetBytes(b) } return nil } switch target.Kind() { //nolint:exhaustive // we want to check only types that map from a swagger parameter case reflect.Bool: if data == "" { if target.CanSet() { target.SetBool(defVal.Bool()) } return nil } b, err := swag.ConvertBool(data) if err != nil { return err } if target.CanSet() { target.SetBool(b) } case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64: if data == "" { if target.CanSet() { rd := defVal.Convert(reflect.TypeOf(int64(0))) target.SetInt(rd.Int()) } return nil } i, err := strconv.ParseInt(data, 10, 64) if err != nil { return errors.InvalidType(p.Name, p.parameter.In, tpe, data) } if target.OverflowInt(i) { return errors.InvalidType(p.Name, p.parameter.In, tpe, data) } if target.CanSet() { target.SetInt(i) } case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64: if data == "" { if target.CanSet() { rd := defVal.Convert(reflect.TypeOf(uint64(0))) target.SetUint(rd.Uint()) } return nil } u, err := strconv.ParseUint(data, 10, 64) if err != nil { return errors.InvalidType(p.Name, p.parameter.In, tpe, data) } if target.OverflowUint(u) { return errors.InvalidType(p.Name, p.parameter.In, tpe, data) } if target.CanSet() { target.SetUint(u) } case reflect.Float32, reflect.Float64: if data == "" { if target.CanSet() { rd := defVal.Convert(reflect.TypeOf(float64(0))) target.SetFloat(rd.Float()) } return nil } f, err := strconv.ParseFloat(data, 64) if err != nil { return errors.InvalidType(p.Name, p.parameter.In, tpe, data) } if target.OverflowFloat(f) { return errors.InvalidType(p.Name, p.parameter.In, tpe, data) } if target.CanSet() { target.SetFloat(f) } case reflect.String: value := data if value == "" { value = defVal.String() } // validate string if target.CanSet() { target.SetString(value) } case reflect.Ptr: if data == "" && defVal.Kind() == reflect.Ptr { if target.CanSet() { target.Set(defVal) } return nil } newVal := reflect.New(target.Type().Elem()) if err := p.setFieldValue(reflect.Indirect(newVal), defVal, data, hasKey); err != nil { return err } if target.CanSet() { target.Set(newVal) } default: return errors.InvalidType(p.Name, p.parameter.In, tpe, data) } return nil } func (p untypedParamBinder) tryUnmarshaler(target reflect.Value, defaultValue interface{}, data string) (bool, error) { if !target.CanSet() { return false, nil } // When a type implements encoding.TextUnmarshaler we'll use that instead of reflecting some more if reflect.PtrTo(target.Type()).Implements(textUnmarshalType) { if defaultValue != nil && len(data) == 0 { target.Set(reflect.ValueOf(defaultValue)) return true, nil } value := reflect.New(target.Type()) if err := value.Interface().(encoding.TextUnmarshaler).UnmarshalText([]byte(data)); err != nil { return true, err } target.Set(reflect.Indirect(value)) return true, nil } return false, nil } func (p untypedParamBinder) readFormattedSliceFieldValue(data string, target reflect.Value) ([]string, bool, error) { ok, err := p.tryUnmarshaler(target, p.parameter.Default, data) if err != nil { return nil, true, err } if ok { return nil, true, nil } return swag.SplitByFormat(data, p.parameter.CollectionFormat), false, nil } func (p *untypedParamBinder) setSliceFieldValue(target reflect.Value, defaultValue interface{}, data []string, hasKey bool) error { sz := len(data) if (!hasKey \|\| (!p.parameter.AllowEmptyValue && (sz == 0 \|\| (sz == 1 && data[0] == "")))) && p.parameter.Required && defaultValue == nil { return errors.Required(p.Name, p.parameter.In, data) } defVal := reflect.Zero(target.Type()) if defaultValue != nil { defVal = reflect.ValueOf(defaultValue) } if !target.CanSet() { return nil } if sz == 0 { target.Set(defVal) return nil } value := reflect.MakeSlice(reflect.SliceOf(target.Type().Elem()), sz, sz) for i := 0; i < sz; i++ { if err := p.setFieldValue(value.Index(i), nil, data[i], hasKey); err != nil { return err } } target.Set(value) return nil }	12.28 KB	2025-05-25 12:27
📄 parameter_test.go // Copyright 2015 go-swagger maintainers // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package middleware import ( "math" "net/url" "reflect" "strconv" "testing" "github.com/go-openapi/errors" "github.com/go-openapi/spec" "github.com/go-openapi/strfmt" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" "github.com/go-openapi/runtime" ) type paramFactory func(string) spec.Parameter var paramFactories = []paramFactory{ spec.QueryParam, spec.HeaderParam, spec.PathParam, spec.FormDataParam, } func np(param spec.Parameter) untypedParamBinder { return newUntypedParamBinder(param, new(spec.Swagger), strfmt.Default) } var stringItems = new(spec.Items) func init() { stringItems.Type = typeString } func testCollectionFormat(t testing.T, param spec.Parameter, valid bool) { binder := &untypedParamBinder{ parameter: param, } _, _, _, err := binder.readValue(runtime.Values(nil), reflect.ValueOf(nil)) //nolint:dogsled // we just want to test the error if valid { require.NoError(t, err) } else { require.Error(t, err) require.EqualError(t, err, errors.InvalidCollectionFormat(param.Name, param.In, param.CollectionFormat).Error()) } } func requiredError(param spec.Parameter, data interface{}) errors.Validation { return errors.Required(param.Name, param.In, data) } func validateRequiredTest(t testing.T, param spec.Parameter, value reflect.Value) { binder := np(param) err := binder.bindValue([]string{}, true, value) require.Error(t, err) assert.NotNil(t, param) require.EqualError(t, requiredError(param, value.Interface()), err.Error()) err = binder.bindValue([]string{""}, true, value) require.Error(t, err) require.EqualError(t, requiredError(param, value.Interface()), err.Error()) // should be impossible data, but let's go with it err = binder.bindValue([]string{"a"}, false, value) require.Error(t, err) require.EqualError(t, err, requiredError(param, value.Interface()).Error()) err = binder.bindValue([]string{""}, false, value) require.Error(t, err) require.EqualError(t, requiredError(param, value.Interface()), err.Error()) } func validateRequiredAllowEmptyTest(t testing.T, param spec.Parameter, value reflect.Value) { param.AllowEmptyValue = true binder := np(param) err := binder.bindValue([]string{}, true, value) require.NoError(t, err) require.NotNil(t, param) err = binder.bindValue([]string{""}, true, value) require.NoError(t, err) err = binder.bindValue([]string{"1"}, false, value) require.Error(t, err) require.EqualError(t, requiredError(param, value.Interface()), err.Error()) err = binder.bindValue([]string{""}, false, value) require.Error(t, err) require.EqualError(t, requiredError(param, value.Interface()), err.Error()) } func TestRequiredValidation(t testing.T) { strParam := spec.QueryParam("name").Typed(typeString, "").AsRequired() validateRequiredTest(t, strParam, reflect.ValueOf("")) validateRequiredAllowEmptyTest(t, strParam, reflect.ValueOf("")) intParam := spec.QueryParam("id").Typed("integer", "int32").AsRequired() validateRequiredTest(t, intParam, reflect.ValueOf(int32(0))) validateRequiredAllowEmptyTest(t, intParam, reflect.ValueOf(int32(0))) longParam := spec.QueryParam("id").Typed("integer", "int64").AsRequired() validateRequiredTest(t, longParam, reflect.ValueOf(int64(0))) validateRequiredAllowEmptyTest(t, longParam, reflect.ValueOf(int64(0))) floatParam := spec.QueryParam("score").Typed("number", "float").AsRequired() validateRequiredTest(t, floatParam, reflect.ValueOf(float32(0))) validateRequiredAllowEmptyTest(t, floatParam, reflect.ValueOf(float32(0))) doubleParam := spec.QueryParam("score").Typed("number", "double").AsRequired() validateRequiredTest(t, doubleParam, reflect.ValueOf(float64(0))) validateRequiredAllowEmptyTest(t, doubleParam, reflect.ValueOf(float64(0))) dateTimeParam := spec.QueryParam("registered").Typed(typeString, "date-time").AsRequired() validateRequiredTest(t, dateTimeParam, reflect.ValueOf(strfmt.DateTime{})) // validateRequiredAllowEmptyTest(t, dateTimeParam, reflect.ValueOf(strfmt.DateTime{})) dateParam := spec.QueryParam("registered").Typed(typeString, "date").AsRequired() validateRequiredTest(t, dateParam, reflect.ValueOf(strfmt.Date{})) // validateRequiredAllowEmptyTest(t, dateParam, reflect.ValueOf(strfmt.DateTime{})) sliceParam := spec.QueryParam("tags").CollectionOf(stringItems, "").AsRequired() validateRequiredTest(t, sliceParam, reflect.MakeSlice(reflect.TypeOf([]string{}), 0, 0)) validateRequiredAllowEmptyTest(t, sliceParam, reflect.MakeSlice(reflect.TypeOf([]string{}), 0, 0)) } func TestInvalidCollectionFormat(t testing.T) { validCf1 := spec.QueryParam("validFmt").CollectionOf(stringItems, "multi") validCf2 := spec.FormDataParam("validFmt2").CollectionOf(stringItems, "multi") invalidCf1 := spec.HeaderParam("invalidHdr").CollectionOf(stringItems, "multi") invalidCf2 := spec.PathParam("invalidPath").CollectionOf(stringItems, "multi") testCollectionFormat(t, validCf1, true) testCollectionFormat(t, validCf2, true) testCollectionFormat(t, invalidCf1, false) testCollectionFormat(t, invalidCf2, false) } func invalidTypeError(param spec.Parameter, data interface{}) errors.Validation { tpe := param.Type if param.Format != "" { tpe = param.Format } return errors.InvalidType(param.Name, param.In, tpe, data) } func TestTypeValidation(t testing.T) { for _, newParam := range paramFactories { intParam := newParam("badInt").Typed("integer", "int32") value := reflect.ValueOf(int32(0)) binder := np(intParam) err := binder.bindValue([]string{"yada"}, true, value) // fails for invalid string require.Error(t, err) require.EqualError(t, err, invalidTypeError(intParam, "yada").Error()) // fails for overflow val := int64(math.MaxInt32) str := strconv.FormatInt(val, 10) + "0" v := int32(0) value = reflect.ValueOf(&v).Elem() binder = np(intParam) err = binder.bindValue([]string{str}, true, value) require.Error(t, err) require.EqualError(t, err, invalidTypeError(intParam, str).Error()) // fails for invalid string longParam := newParam("badLong").Typed("integer", "int64") value = reflect.ValueOf(int64(0)) binder = np(longParam) err = binder.bindValue([]string{"yada"}, true, value) require.Error(t, err) require.EqualError(t, err, invalidTypeError(longParam, "yada").Error()) // fails for overflow str2 := strconv.FormatInt(math.MaxInt64, 10) + "0" v2 := int64(0) vv2 := reflect.ValueOf(&v2).Elem() binder = np(longParam) err = binder.bindValue([]string{str2}, true, vv2) require.Error(t, err) require.EqualError(t, err, invalidTypeError(longParam, str2).Error()) // fails for invalid string floatParam := newParam("badFloat").Typed("number", "float") value = reflect.ValueOf(float64(0)) binder = np(floatParam) err = binder.bindValue([]string{"yada"}, true, value) require.Error(t, err) require.EqualError(t, err, invalidTypeError(floatParam, "yada").Error()) // fails for overflow str3 := strconv.FormatFloat(math.MaxFloat64, 'f', 5, 64) v3 := reflect.TypeOf(float32(0)) value = reflect.New(v3).Elem() binder = np(floatParam) err = binder.bindValue([]string{str3}, true, value) require.Error(t, err) require.EqualError(t, err, invalidTypeError(floatParam, str3).Error()) // fails for invalid string doubleParam := newParam("badDouble").Typed("number", "double") value = reflect.ValueOf(float64(0)) binder = np(doubleParam) err = binder.bindValue([]string{"yada"}, true, value) require.Error(t, err) require.EqualError(t, err, invalidTypeError(doubleParam, "yada").Error()) // fails for overflow str4 := "9" + strconv.FormatFloat(math.MaxFloat64, 'f', 5, 64) v4 := reflect.TypeOf(float64(0)) value = reflect.New(v4).Elem() binder = np(doubleParam) err = binder.bindValue([]string{str4}, true, value) require.Error(t, err) require.EqualError(t, err, invalidTypeError(doubleParam, str4).Error()) // fails for invalid string dateParam := newParam("badDate").Typed(typeString, "date") value = reflect.ValueOf(strfmt.Date{}) binder = np(dateParam) err = binder.bindValue([]string{"yada"}, true, value) require.Error(t, err) require.EqualError(t, err, invalidTypeError(dateParam, "yada").Error()) // fails for invalid string dateTimeParam := newParam("badDateTime").Typed(typeString, "date-time") value = reflect.ValueOf(strfmt.DateTime{}) binder = np(dateTimeParam) err = binder.bindValue([]string{"yada"}, true, value) require.Error(t, err) require.EqualError(t, err, invalidTypeError(dateTimeParam, "yada").Error()) // fails for invalid string byteParam := newParam("badByte").Typed(typeString, "byte") values := url.Values(map[string][]string{}) values.Add("badByte", "yaüda") v5 := []byte{} value = reflect.ValueOf(&v5).Elem() binder = np(byteParam) err = binder.bindValue([]string{"yaüda"}, true, value) require.Error(t, err) require.EqualError(t, err, invalidTypeError(byteParam, "yaüda").Error()) } } func TestTypeDetectionInvalidItems(t testing.T) { withoutItems := spec.QueryParam("without").CollectionOf(nil, "") binder := &untypedParamBinder{ Name: "without", parameter: withoutItems, } assert.Nil(t, binder.Type()) items := new(spec.Items) items.Type = typeArray withInvalidItems := spec.QueryParam("invalidItems").CollectionOf(items, "") binder = &untypedParamBinder{ Name: "invalidItems", parameter: withInvalidItems, } assert.Nil(t, binder.Type()) noType := spec.QueryParam("invalidType") noType.Type = "invalid" binder = &untypedParamBinder{ Name: "invalidType", parameter: noType, } assert.Nil(t, binder.Type()) } // type emailStrFmt struct { // name string // tpe reflect.Type // validator FormatValidator // } // // func (e emailStrFmt) Name() string { // return e.name // } // // func (e emailStrFmt) Type() reflect.Type { // return e.tpe // } // // func (e emailStrFmt) Matches(str string) bool { // return e.validator(str) // } // // func TestTypeDetectionValid(t testing.T) { // // emlFmt := &emailStrFmt{ // // name: "email", // // tpe: reflect.TypeOf(email{}), // // } // // formats := []StringFormat{emlFmt} // // expected := map[string]reflect.Type{ // "name": reflect.TypeOf(""), // "id": reflect.TypeOf(int64(0)), // "age": reflect.TypeOf(int32(0)), // "score": reflect.TypeOf(float32(0)), // "factor": reflect.TypeOf(float64(0)), // "friend": reflect.TypeOf(map[string]interface{}{}), // "X-Request-Id": reflect.TypeOf(int64(0)), // "tags": reflect.TypeOf([]string{}), // "confirmed": reflect.TypeOf(true), // "planned": reflect.TypeOf(swagger.Date{}), // "delivered": reflect.TypeOf(swagger.DateTime{}), // "email": reflect.TypeOf(email{}), // "picture": reflect.TypeOf([]byte{}), // "file": reflect.TypeOf(&swagger.File{}).Elem(), // } // // params := parametersForAllTypes("") // emailParam := spec.QueryParam("email").Typed(typeString, "email") // params["email"] = emailParam // // fileParam := spec.FileParam("file") // params["file"] = fileParam // // for _, v := range params { // binder := &paramBinder{ // formats: formats, // name: v.Name, // parameter: &v, // } // assert.Equal(t, expected[v.Name], binder.Type(), "name: %s", v.Name) // } // }	11.71 KB	2025-05-25 12:27
📄 rapidoc.go package middleware import ( "bytes" "fmt" "html/template" "net/http" "path" ) // RapiDocOpts configures the RapiDoc middlewares type RapiDocOpts struct { // BasePath for the UI, defaults to: / BasePath string // Path combines with BasePath to construct the path to the UI, defaults to: "docs". Path string // SpecURL is the URL of the spec document. // // Defaults to: /swagger.json SpecURL string // Title for the documentation site, default to: API documentation Title string // Template specifies a custom template to serve the UI Template string // RapiDocURL points to the js asset that generates the rapidoc site. // // Defaults to https://unpkg.com/rapidoc/dist/rapidoc-min.js RapiDocURL string } func (r *RapiDocOpts) EnsureDefaults() { common := toCommonUIOptions(r) common.EnsureDefaults() fromCommonToAnyOptions(common, r) // rapidoc-specifics if r.RapiDocURL == "" { r.RapiDocURL = rapidocLatest } if r.Template == "" { r.Template = rapidocTemplate } } // RapiDoc creates a middleware to serve a documentation site for a swagger spec. // // This allows for altering the spec before starting the http listener. func RapiDoc(opts RapiDocOpts, next http.Handler) http.Handler { opts.EnsureDefaults() pth := path.Join(opts.BasePath, opts.Path) tmpl := template.Must(template.New("rapidoc").Parse(opts.Template)) assets := bytes.NewBuffer(nil) if err := tmpl.Execute(assets, opts); err != nil { panic(fmt.Errorf("cannot execute template: %w", err)) } return serveUI(pth, assets.Bytes(), next) } const ( rapidocLatest = "https://unpkg.com/rapidoc/dist/rapidoc-min.js" rapidocTemplate = `<!doctype html> <html> <head> <title>{{ .Title }}</title> <meta charset="utf-8"> <!-- Important: rapi-doc uses utf8 characters --> <script type="module" src="{{ .RapiDocURL }}"></script> </head> <body> <rapi-doc spec-url="{{ .SpecURL }}"></rapi-doc> </body> </html> ` )	1.88 KB	2025-05-25 12:27
📄 rapidoc_test.go package middleware import ( "context" "fmt" "net/http" "net/http/httptest" "testing" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) func TestRapiDocMiddleware(t testing.T) { t.Run("with defaults", func(t testing.T) { rapidoc := RapiDoc(RapiDocOpts{}, nil) req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, "/docs", nil) require.NoError(t, err) recorder := httptest.NewRecorder() rapidoc.ServeHTTP(recorder, req) assert.Equal(t, http.StatusOK, recorder.Code) assert.Equal(t, "text/html; charset=utf-8", recorder.Header().Get(contentTypeHeader)) var o RapiDocOpts o.EnsureDefaults() assert.Contains(t, recorder.Body.String(), fmt.Sprintf("<title>%s</title>", o.Title)) assert.Contains(t, recorder.Body.String(), fmt.Sprintf("<rapi-doc spec-url=%q></rapi-doc>", o.SpecURL)) assert.Contains(t, recorder.Body.String(), rapidocLatest) }) t.Run("edge cases", func(t testing.T) { t.Run("with custom template that fails to execute", func(t testing.T) { assert.Panics(t, func() { RapiDoc(RapiDocOpts{ Template: `<!DOCTYPE html> <html> spec-url='{{ .Unknown }}' </html> `, }, nil) }) }) }) }	1.18 KB	2025-05-25 12:27
📄 redoc.go package middleware import ( "bytes" "fmt" "html/template" "net/http" "path" ) // RedocOpts configures the Redoc middlewares type RedocOpts struct { // BasePath for the UI, defaults to: / BasePath string // Path combines with BasePath to construct the path to the UI, defaults to: "docs". Path string // SpecURL is the URL of the spec document. // // Defaults to: /swagger.json SpecURL string // Title for the documentation site, default to: API documentation Title string // Template specifies a custom template to serve the UI Template string // RedocURL points to the js that generates the redoc site. // // Defaults to: https://cdn.jsdelivr.net/npm/redoc/bundles/redoc.standalone.js RedocURL string } // EnsureDefaults in case some options are missing func (r *RedocOpts) EnsureDefaults() { common := toCommonUIOptions(r) common.EnsureDefaults() fromCommonToAnyOptions(common, r) // redoc-specifics if r.RedocURL == "" { r.RedocURL = redocLatest } if r.Template == "" { r.Template = redocTemplate } } // Redoc creates a middleware to serve a documentation site for a swagger spec. // // This allows for altering the spec before starting the http listener. func Redoc(opts RedocOpts, next http.Handler) http.Handler { opts.EnsureDefaults() pth := path.Join(opts.BasePath, opts.Path) tmpl := template.Must(template.New("redoc").Parse(opts.Template)) assets := bytes.NewBuffer(nil) if err := tmpl.Execute(assets, opts); err != nil { panic(fmt.Errorf("cannot execute template: %w", err)) } return serveUI(pth, assets.Bytes(), next) } const ( redocLatest = "https://cdn.jsdelivr.net/npm/redoc/bundles/redoc.standalone.js" redocTemplate = `<!DOCTYPE html> <html> <head> <title>{{ .Title }}</title> <!-- needed for adaptive design --> <meta charset="utf-8"/> <meta name="viewport" content="width=device-width, initial-scale=1"> <link href="https://fonts.googleapis.com/css?family=Montserrat:300,400,700\|Roboto:300,400,700" rel="stylesheet"> <!-- ReDoc doesn't change outer page styles --> <style> body { margin: 0; padding: 0; } </style> </head> <body> <redoc spec-url='{{ .SpecURL }}'></redoc> <script src="{{ .RedocURL }}"> </script> </body> </html> ` )	2.23 KB	2025-05-25 12:27
📄 redoc_test.go package middleware import ( "context" "fmt" "net/http" "net/http/httptest" "testing" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) func TestRedocMiddleware(t testing.T) { t.Run("with defaults", func(t testing.T) { redoc := Redoc(RedocOpts{}, nil) req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, "/docs", nil) require.NoError(t, err) recorder := httptest.NewRecorder() redoc.ServeHTTP(recorder, req) assert.Equal(t, http.StatusOK, recorder.Code) assert.Equal(t, "text/html; charset=utf-8", recorder.Header().Get(contentTypeHeader)) var o RedocOpts o.EnsureDefaults() assert.Contains(t, recorder.Body.String(), fmt.Sprintf("<title>%s</title>", o.Title)) assert.Contains(t, recorder.Body.String(), fmt.Sprintf("<redoc spec-url='%s'></redoc>", o.SpecURL)) assert.Contains(t, recorder.Body.String(), redocLatest) }) t.Run("with alternate path and spec URL", func(t testing.T) { redoc := Redoc(RedocOpts{ BasePath: "/base", Path: "ui", SpecURL: "/ui/swagger.json", }, nil) req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, "/base/ui", nil) require.NoError(t, err) recorder := httptest.NewRecorder() redoc.ServeHTTP(recorder, req) assert.Equal(t, http.StatusOK, recorder.Code) assert.Contains(t, recorder.Body.String(), "<redoc spec-url='/ui/swagger.json'></redoc>") }) t.Run("with custom template", func(t testing.T) { redoc := Redoc(RedocOpts{ Template: `<!DOCTYPE html> <html> <head> <title>{{ .Title }}</title> <meta charset="utf-8"/> <meta name="viewport" content="width=device-width, initial-scale=1"> <link href="https://fonts.googleapis.com/css?family=Montserrat:300,400,700\|Roboto:300,400,700" rel="stylesheet"> <!-- ReDoc doesn't change outer page styles --> <style> body { margin: 0; padding: 0; } </style> </head> <body> <redoc spec-url='{{ .SpecURL }}' required-props-first=true theme='{ "sidebar": { "backgroundColor": "lightblue" } }' ></redoc> <script src="{{ .RedocURL }}"> </script> </body> </html> `, }, nil) req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, "/docs", nil) require.NoError(t, err) recorder := httptest.NewRecorder() redoc.ServeHTTP(recorder, req) assert.Equal(t, http.StatusOK, recorder.Code) assert.Contains(t, recorder.Body.String(), "required-props-first=true") }) t.Run("edge cases", func(t testing.T) { t.Run("with invalid custom template", func(t testing.T) { assert.Panics(t, func() { Redoc(RedocOpts{ Template: `<!DOCTYPE html> <html> <head> spec-url='{{ .Spec </html> `, }, nil) }) }) t.Run("with custom template that fails to execute", func(t *testing.T) { assert.Panics(t, func() { Redoc(RedocOpts{ Template: `<!DOCTYPE html> <html> spec-url='{{ .Unknown }}' </html> `, }, nil) }) }) }) }	2.96 KB	2025-05-25 12:27
📄 request.go // Copyright 2015 go-swagger maintainers // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package middleware import ( "net/http" "reflect" "github.com/go-openapi/errors" "github.com/go-openapi/runtime" "github.com/go-openapi/runtime/logger" "github.com/go-openapi/spec" "github.com/go-openapi/strfmt" ) // UntypedRequestBinder binds and validates the data from a http request type UntypedRequestBinder struct { Spec spec.Swagger Parameters map[string]spec.Parameter Formats strfmt.Registry paramBinders map[string]untypedParamBinder debugLogf func(string, ...any) // a logging function to debug context and all components using it } // NewUntypedRequestBinder creates a new binder for reading a request. func NewUntypedRequestBinder(parameters map[string]spec.Parameter, spec spec.Swagger, formats strfmt.Registry) UntypedRequestBinder { binders := make(map[string]untypedParamBinder) for fieldName, param := range parameters { binders[fieldName] = newUntypedParamBinder(param, spec, formats) } return &UntypedRequestBinder{ Parameters: parameters, paramBinders: binders, Spec: spec, Formats: formats, debugLogf: debugLogfFunc(nil), } } // Bind perform the databinding and validation func (o UntypedRequestBinder) Bind(request http.Request, routeParams RouteParams, consumer runtime.Consumer, data interface{}) error { val := reflect.Indirect(reflect.ValueOf(data)) isMap := val.Kind() == reflect.Map var result []error o.debugLogf("binding %d parameters for %s %s", len(o.Parameters), request.Method, request.URL.EscapedPath()) for fieldName, param := range o.Parameters { binder := o.paramBinders[fieldName] o.debugLogf("binding parameter %s for %s %s", fieldName, request.Method, request.URL.EscapedPath()) var target reflect.Value if !isMap { binder.Name = fieldName target = val.FieldByName(fieldName) } if isMap { tpe := binder.Type() if tpe == nil { if param.Schema.Type.Contains(typeArray) { tpe = reflect.TypeOf([]interface{}{}) } else { tpe = reflect.TypeOf(map[string]interface{}{}) } } target = reflect.Indirect(reflect.New(tpe)) } if !target.IsValid() { result = append(result, errors.New(500, "parameter name %q is an unknown field", binder.Name)) continue } if err := binder.Bind(request, routeParams, consumer, target); err != nil { result = append(result, err) continue } if binder.validator != nil { rr := binder.validator.Validate(target.Interface()) if rr != nil && rr.HasErrors() { result = append(result, rr.AsError()) } } if isMap { val.SetMapIndex(reflect.ValueOf(param.Name), target) } } if len(result) > 0 { return errors.CompositeValidationError(result...) } return nil } // SetLogger allows for injecting a logger to catch debug entries. // // The logger is enabled in DEBUG mode only. func (o UntypedRequestBinder) SetLogger(lg logger.Logger) { o.debugLogf = debugLogfFunc(lg) } func (o *UntypedRequestBinder) setDebugLogf(fn func(string, ...any)) { o.debugLogf = fn }	3.52 KB	2025-05-25 12:27
📄 request_test.go // Copyright 2015 go-swagger maintainers // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package middleware import ( "bytes" "context" "io" "mime/multipart" "net/http" "net/url" "strings" "testing" "time" "github.com/go-openapi/runtime" "github.com/go-openapi/spec" "github.com/go-openapi/strfmt" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) const ( csvFormat = "csv" testURL = "http://localhost:8002/hello" ) type stubConsumer struct { } func (s stubConsumer) Consume(_ io.Reader, _ interface{}) error { return nil } type friend struct { Name string `json:"name"` Age int `json:"age"` } type jsonRequestParams struct { ID int64 // path Name string // query Friend friend // body RequestID int64 // header Tags []string // csv } type jsonRequestPtr struct { ID int64 // path Name string // query RequestID int64 // header Tags []string // csv Friend friend } type jsonRequestSlice struct { ID int64 // path Name string // query RequestID int64 // header Tags []string // csv Friend []friend } func parametersForAllTypes(fmt string) map[string]spec.Parameter { if fmt == "" { fmt = csvFormat } nameParam := spec.QueryParam("name").Typed(typeString, "") idParam := spec.PathParam("id").Typed("integer", "int64") ageParam := spec.QueryParam("age").Typed("integer", "int32") scoreParam := spec.QueryParam("score").Typed("number", "float") factorParam := spec.QueryParam("factor").Typed("number", "double") friendSchema := new(spec.Schema).Typed("object", "") friendParam := spec.BodyParam("friend", friendSchema) requestIDParam := spec.HeaderParam("X-Request-Id").Typed("integer", "int64") requestIDParam.Extensions = spec.Extensions(map[string]interface{}{}) requestIDParam.Extensions.Add("go-name", "RequestID") items := new(spec.Items) items.Type = typeString tagsParam := spec.QueryParam("tags").CollectionOf(items, fmt) confirmedParam := spec.QueryParam("confirmed").Typed("boolean", "") plannedParam := spec.QueryParam("planned").Typed(typeString, "date") deliveredParam := spec.QueryParam("delivered").Typed(typeString, "date-time") pictureParam := spec.QueryParam("picture").Typed(typeString, "byte") // base64 encoded during transport return map[string]spec.Parameter{ "ID": idParam, "Name": nameParam, "RequestID": requestIDParam, "Friend": friendParam, "Tags": tagsParam, "Age": ageParam, "Score": scoreParam, "Factor": factorParam, "Confirmed": confirmedParam, "Planned": plannedParam, "Delivered": deliveredParam, "Picture": pictureParam, } } func parametersForJSONRequestParams(fmt string) map[string]spec.Parameter { if fmt == "" { fmt = csvFormat } nameParam := spec.QueryParam("name").Typed(typeString, "") idParam := spec.PathParam("id").Typed("integer", "int64") friendSchema := new(spec.Schema).Typed("object", "") friendParam := spec.BodyParam("friend", friendSchema) requestIDParam := spec.HeaderParam("X-Request-Id").Typed("integer", "int64") requestIDParam.Extensions = spec.Extensions(map[string]interface{}{}) requestIDParam.Extensions.Add("go-name", "RequestID") items := new(spec.Items) items.Type = typeString tagsParam := spec.QueryParam("tags").CollectionOf(items, fmt) return map[string]spec.Parameter{ "ID": idParam, "Name": nameParam, "RequestID": requestIDParam, "Friend": friendParam, "Tags": tagsParam, } } func parametersForJSONRequestSliceParams(fmt string) map[string]spec.Parameter { if fmt == "" { fmt = csvFormat } nameParam := spec.QueryParam("name").Typed(typeString, "") idParam := spec.PathParam("id").Typed("integer", "int64") friendSchema := new(spec.Schema).Typed("object", "") friendParam := spec.BodyParam("friend", spec.ArrayProperty(friendSchema)) requestIDParam := spec.HeaderParam("X-Request-Id").Typed("integer", "int64") requestIDParam.Extensions = spec.Extensions(map[string]interface{}{}) requestIDParam.Extensions.Add("go-name", "RequestID") items := new(spec.Items) items.Type = typeString tagsParam := spec.QueryParam("tags").CollectionOf(items, fmt) return map[string]spec.Parameter{ "ID": idParam, "Name": nameParam, "RequestID": requestIDParam, "Friend": friendParam, "Tags": tagsParam, } } func TestRequestBindingDefaultValue(t testing.T) { confirmed := true name := "thomas" friend := map[string]interface{}{"name": "toby", "age": float64(32)} id, age, score, factor := int64(7575), int32(348), float32(5.309), float64(37.403) requestID := 19394858 tags := []string{"one", "two", "three"} dt1 := time.Date(2014, 8, 9, 0, 0, 0, 0, time.UTC) planned := strfmt.Date(dt1) dt2 := time.Date(2014, 10, 12, 8, 5, 5, 0, time.UTC) delivered := strfmt.DateTime(dt2) uri, err := url.Parse(testURL) require.NoError(t, err) defaults := map[string]interface{}{ "id": id, "age": age, "score": score, "factor": factor, "name": name, "friend": friend, "X-Request-Id": requestID, "tags": tags, "confirmed": confirmed, "planned": planned, "delivered": delivered, "picture": []byte("hello"), } op2 := parametersForAllTypes("") op3 := make(map[string]spec.Parameter) for k, p := range op2 { p.Default = defaults[p.Name] op3[k] = p } req, err := http.NewRequestWithContext(context.Background(), http.MethodPost, uri.String(), bytes.NewBuffer(nil)) require.NoError(t, err) req.Header.Set("Content-Type", "application/json") binder := NewUntypedRequestBinder(op3, new(spec.Swagger), strfmt.Default) data := make(map[string]interface{}) err = binder.Bind(req, RouteParams(nil), runtime.JSONConsumer(), &data) require.NoError(t, err) assert.Equal(t, defaults["id"], data["id"]) assert.Equal(t, name, data["name"]) assert.Equal(t, friend, data["friend"]) assert.EqualValues(t, requestID, data["X-Request-Id"]) assert.Equal(t, tags, data["tags"]) assert.Equal(t, planned, data["planned"]) assert.Equal(t, delivered, data["delivered"]) assert.Equal(t, confirmed, data["confirmed"]) assert.Equal(t, age, data["age"]) assert.InDelta(t, factor, data["factor"], 1e-6) assert.InDelta(t, score, data["score"], 1e-6) assert.Equal(t, "hello", string(data["picture"].(strfmt.Base64))) } func TestRequestBindingForInvalid(t testing.T) { invalidParam := spec.QueryParam("some") op1 := map[string]spec.Parameter{"Some": invalidParam} binder := NewUntypedRequestBinder(op1, new(spec.Swagger), strfmt.Default) req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, "http://localhost:8002/hello?name=the-name", nil) require.NoError(t, err) err = binder.Bind(req, nil, new(stubConsumer), new(jsonRequestParams)) require.Error(t, err) op2 := parametersForJSONRequestParams("") binder = NewUntypedRequestBinder(op2, new(spec.Swagger), strfmt.Default) req, err = http.NewRequestWithContext(context.Background(), http.MethodPost, "http://localhost:8002/hello/1?name=the-name", bytes.NewBufferString(`{"name":"toby","age":32}`)) require.NoError(t, err) req.Header.Set("Content-Type", "application(") data := jsonRequestParams{} err = binder.Bind(req, RouteParams([]RouteParam{{"id", "1"}}), runtime.JSONConsumer(), &data) require.Error(t, err) req, err = http.NewRequestWithContext(context.Background(), http.MethodPost, "http://localhost:8002/hello/1?name=the-name", bytes.NewBufferString(`{]`)) require.NoError(t, err) req.Header.Set("Content-Type", "application/json") data = jsonRequestParams{} err = binder.Bind(req, RouteParams([]RouteParam{{"id", "1"}}), runtime.JSONConsumer(), &data) require.Error(t, err) invalidMultiParam := spec.HeaderParam("tags").CollectionOf(new(spec.Items), "multi") op3 := map[string]spec.Parameter{"Tags": invalidMultiParam} binder = NewUntypedRequestBinder(op3, new(spec.Swagger), strfmt.Default) req, err = http.NewRequestWithContext(context.Background(), http.MethodPost, "http://localhost:8002/hello/1?name=the-name", bytes.NewBufferString(`{}`)) require.NoError(t, err) req.Header.Set("Content-Type", "application/json") data = jsonRequestParams{} err = binder.Bind(req, RouteParams([]RouteParam{{"id", "1"}}), runtime.JSONConsumer(), &data) require.Error(t, err) invalidMultiParam = spec.PathParam("").CollectionOf(new(spec.Items), "multi") op4 := map[string]spec.Parameter{"Tags": invalidMultiParam} binder = NewUntypedRequestBinder(op4, new(spec.Swagger), strfmt.Default) req, err = http.NewRequestWithContext(context.Background(), http.MethodPost, "http://localhost:8002/hello/1?name=the-name", bytes.NewBufferString(`{}`)) require.NoError(t, err) req.Header.Set("Content-Type", "application/json") data = jsonRequestParams{} err = binder.Bind(req, RouteParams([]RouteParam{{"id", "1"}}), runtime.JSONConsumer(), &data) require.Error(t, err) invalidInParam := spec.HeaderParam("tags").Typed(typeString, "") invalidInParam.In = "invalid" op5 := map[string]spec.Parameter{"Tags": invalidInParam} binder = NewUntypedRequestBinder(op5, new(spec.Swagger), strfmt.Default) req, err = http.NewRequestWithContext(context.Background(), http.MethodPost, "http://localhost:8002/hello/1?name=the-name", bytes.NewBufferString(`{}`)) require.NoError(t, err) req.Header.Set("Content-Type", "application/json") data = jsonRequestParams{} err = binder.Bind(req, RouteParams([]RouteParam{{"id", "1"}}), runtime.JSONConsumer(), &data) require.Error(t, err) } func TestRequestBindingForValid(t testing.T) { for _, fmt := range []string{csvFormat, "pipes", "tsv", "ssv", "multi"} { op1 := parametersForJSONRequestParams(fmt) binder := NewUntypedRequestBinder(op1, new(spec.Swagger), strfmt.Default) lval := []string{"one", "two", "three"} var queryString string var skipEscape bool switch fmt { case "multi": skipEscape = true queryString = strings.Join(lval, "&tags=") case "ssv": queryString = strings.Join(lval, " ") case "pipes": queryString = strings.Join(lval, "\|") case "tsv": queryString = strings.Join(lval, "\t") default: queryString = strings.Join(lval, ",") } if !skipEscape { queryString = url.QueryEscape(queryString) } urlStr := "http://localhost:8002/hello/1?name=the-name&tags=" + queryString req, err := http.NewRequestWithContext(context.Background(), http.MethodPost, urlStr, bytes.NewBufferString(`{"name":"toby","age":32}`)) require.NoError(t, err) req.Header.Set("Content-Type", "application/json;charset=utf-8") req.Header.Set("X-Request-Id", "1325959595") data := jsonRequestParams{} err = binder.Bind(req, RouteParams([]RouteParam{{"id", "1"}}), runtime.JSONConsumer(), &data) expected := jsonRequestParams{ ID: 1, Name: "the-name", Friend: friend{"toby", 32}, RequestID: 1325959595, Tags: []string{"one", "two", "three"}, } require.NoError(t, err) assert.Equal(t, expected, data) } op1 := parametersForJSONRequestParams("") binder := NewUntypedRequestBinder(op1, new(spec.Swagger), strfmt.Default) urlStr := "http://localhost:8002/hello/1?name=the-name&tags=one,two,three" req, err := http.NewRequestWithContext(context.Background(), http.MethodPost, urlStr, bytes.NewBufferString(`{"name":"toby","age":32}`)) require.NoError(t, err) req.Header.Set("Content-Type", "application/json;charset=utf-8") req.Header.Set("X-Request-Id", "1325959595") data2 := jsonRequestPtr{} err = binder.Bind(req, []RouteParam{{"id", "1"}}, runtime.JSONConsumer(), &data2) expected2 := jsonRequestPtr{ Friend: &friend{"toby", 32}, Tags: []string{"one", "two", "three"}, } require.NoError(t, err) if data2.Friend == nil { t.Fatal("friend is nil") } assert.Equal(t, expected2.Friend, data2.Friend) assert.Equal(t, expected2.Tags, data2.Tags) req, err = http.NewRequestWithContext(context.Background(), http.MethodPost, urlStr, bytes.NewBufferString(`[{"name":"toby","age":32}]`)) require.NoError(t, err) req.Header.Set("Content-Type", "application/json;charset=utf-8") req.Header.Set("X-Request-Id", "1325959595") op2 := parametersForJSONRequestSliceParams("") binder = NewUntypedRequestBinder(op2, new(spec.Swagger), strfmt.Default) data3 := jsonRequestSlice{} err = binder.Bind(req, []RouteParam{{"id", "1"}}, runtime.JSONConsumer(), &data3) expected3 := jsonRequestSlice{ Friend: []friend{{"toby", 32}}, Tags: []string{"one", "two", "three"}, } require.NoError(t, err) assert.Equal(t, expected3.Friend, data3.Friend) assert.Equal(t, expected3.Tags, data3.Tags) } type formRequest struct { Name string Age int } func parametersForFormUpload() map[string]spec.Parameter { nameParam := spec.FormDataParam("name").Typed(typeString, "") ageParam := spec.FormDataParam("age").Typed("integer", "int32") return map[string]spec.Parameter{"Name": nameParam, "Age": ageParam} } func TestFormUpload(t testing.T) { params := parametersForFormUpload() binder := NewUntypedRequestBinder(params, new(spec.Swagger), strfmt.Default) urlStr := testURL req, err := http.NewRequestWithContext(context.Background(), http.MethodPost, urlStr, bytes.NewBufferString(`name=the-name&age=32`)) require.NoError(t, err) req.Header.Set("Content-Type", "application/x-www-form-urlencoded") data := formRequest{} res := binder.Bind(req, nil, runtime.JSONConsumer(), &data) require.NoError(t, res) assert.Equal(t, "the-name", data.Name) assert.Equal(t, 32, data.Age) req, err = http.NewRequestWithContext(context.Background(), http.MethodPost, urlStr, bytes.NewBufferString(`name=%3&age=32`)) require.NoError(t, err) req.Header.Set("Content-Type", "application/x-www-form-urlencoded") data = formRequest{} require.Error(t, binder.Bind(req, nil, runtime.JSONConsumer(), &data)) } type fileRequest struct { Name string // body File runtime.File // upload } func paramsForFileUpload() UntypedRequestBinder { nameParam := spec.FormDataParam("name").Typed(typeString, "") fileParam := spec.FileParam("file").AsRequired() params := map[string]spec.Parameter{"Name": nameParam, "File": fileParam} return NewUntypedRequestBinder(params, new(spec.Swagger), strfmt.Default) } func TestBindingFileUpload(t testing.T) { binder := paramsForFileUpload() body := bytes.NewBuffer(nil) writer := multipart.NewWriter(body) part, err := writer.CreateFormFile("file", "plain-jane.txt") require.NoError(t, err) _, err = part.Write([]byte("the file contents")) require.NoError(t, err) require.NoError(t, writer.WriteField("name", "the-name")) require.NoError(t, writer.Close()) urlStr := testURL req, err := http.NewRequestWithContext(context.Background(), http.MethodPost, urlStr, body) require.NoError(t, err) req.Header.Set("Content-Type", writer.FormDataContentType()) data := fileRequest{} require.NoError(t, binder.Bind(req, nil, runtime.JSONConsumer(), &data)) assert.Equal(t, "the-name", data.Name) assert.NotNil(t, data.File) assert.NotNil(t, data.File.Header) assert.Equal(t, "plain-jane.txt", data.File.Header.Filename) bb, err := io.ReadAll(data.File.Data) require.NoError(t, err) assert.Equal(t, []byte("the file contents"), bb) req, err = http.NewRequestWithContext(context.Background(), http.MethodPost, urlStr, body) require.NoError(t, err) req.Header.Set("Content-Type", "application/json") data = fileRequest{} require.Error(t, binder.Bind(req, nil, runtime.JSONConsumer(), &data)) req, err = http.NewRequestWithContext(context.Background(), http.MethodPost, urlStr, body) require.NoError(t, err) req.Header.Set("Content-Type", "application(") data = fileRequest{} require.Error(t, binder.Bind(req, nil, runtime.JSONConsumer(), &data)) body = bytes.NewBuffer(nil) writer = multipart.NewWriter(body) part, err = writer.CreateFormFile("bad-name", "plain-jane.txt") require.NoError(t, err) _, err = part.Write([]byte("the file contents")) require.NoError(t, err) require.NoError(t, writer.WriteField("name", "the-name")) require.NoError(t, writer.Close()) req, err = http.NewRequestWithContext(context.Background(), http.MethodPost, urlStr, body) require.NoError(t, err) req.Header.Set("Content-Type", writer.FormDataContentType()) data = fileRequest{} require.Error(t, binder.Bind(req, nil, runtime.JSONConsumer(), &data)) req, err = http.NewRequestWithContext(context.Background(), http.MethodPost, urlStr, body) require.NoError(t, err) req.Header.Set("Content-Type", writer.FormDataContentType()) _, err = req.MultipartReader() require.NoError(t, err) data = fileRequest{} require.Error(t, binder.Bind(req, nil, runtime.JSONConsumer(), &data)) writer = multipart.NewWriter(body) require.NoError(t, writer.WriteField("name", "the-name")) require.NoError(t, writer.Close()) req, err = http.NewRequestWithContext(context.Background(), http.MethodPost, urlStr, body) require.NoError(t, err) req.Header.Set("Content-Type", writer.FormDataContentType()) data = fileRequest{} require.Error(t, binder.Bind(req, nil, runtime.JSONConsumer(), &data)) } func paramsForOptionalFileUpload() UntypedRequestBinder { nameParam := spec.FormDataParam("name").Typed(typeString, "") fileParam := spec.FileParam("file").AsOptional() params := map[string]spec.Parameter{"Name": nameParam, "File": fileParam} return NewUntypedRequestBinder(params, new(spec.Swagger), strfmt.Default) } func TestBindingOptionalFileUpload(t testing.T) { binder := paramsForOptionalFileUpload() body := bytes.NewBuffer(nil) writer := multipart.NewWriter(body) require.NoError(t, writer.WriteField("name", "the-name")) require.NoError(t, writer.Close()) urlStr := testURL req, err := http.NewRequestWithContext(context.Background(), http.MethodPost, urlStr, body) require.NoError(t, err) req.Header.Set("Content-Type", writer.FormDataContentType()) data := fileRequest{} require.NoError(t, binder.Bind(req, nil, runtime.JSONConsumer(), &data)) assert.Equal(t, "the-name", data.Name) assert.Nil(t, data.File.Data) assert.Nil(t, data.File.Header) writer = multipart.NewWriter(body) part, err := writer.CreateFormFile("file", "plain-jane.txt") require.NoError(t, err) _, err = part.Write([]byte("the file contents")) require.NoError(t, err) require.NoError(t, writer.WriteField("name", "the-name")) require.NoError(t, writer.Close()) req, err = http.NewRequestWithContext(context.Background(), http.MethodPost, urlStr, body) require.NoError(t, err) req.Header.Set("Content-Type", writer.FormDataContentType()) require.NoError(t, writer.Close()) data = fileRequest{} require.NoError(t, binder.Bind(req, nil, runtime.JSONConsumer(), &data)) assert.Equal(t, "the-name", data.Name) assert.NotNil(t, data.File) assert.NotNil(t, data.File.Header) assert.Equal(t, "plain-jane.txt", data.File.Header.Filename) bb, err := io.ReadAll(data.File.Data) require.NoError(t, err) assert.Equal(t, []byte("the file contents"), bb) }	19.08 KB	2025-05-25 12:27
📄 route_authenticator_test.go package middleware import ( "context" "errors" "net/http" "testing" "github.com/stretchr/testify/require" "github.com/go-openapi/runtime" ) type countAuthenticator struct { count int applies bool principal interface{} err error } func (c countAuthenticator) Authenticate(_ interface{}) (bool, interface{}, error) { c.count++ return c.applies, c.principal, c.err } func newCountAuthenticator(applies bool, principal interface{}, err error) countAuthenticator { return &countAuthenticator{applies: applies, principal: principal, err: err} } var ( successAuth = runtime.AuthenticatorFunc(func(_ interface{}) (bool, interface{}, error) { return true, "the user", nil }) failAuth = runtime.AuthenticatorFunc(func(_ interface{}) (bool, interface{}, error) { return true, nil, errors.New("unauthenticated") }) noApplyAuth = runtime.AuthenticatorFunc(func(_ interface{}) (bool, interface{}, error) { return false, nil, nil }) ) func TestAuthenticateSingle(t testing.T) { ra := RouteAuthenticator{ Authenticator: map[string]runtime.Authenticator{ "auth1": successAuth, }, Schemes: []string{"auth1"}, Scopes: map[string][]string{"auth1": nil}, } ras := RouteAuthenticators([]RouteAuthenticator{ra}) require.False(t, ras.AllowsAnonymous()) req, _ := http.NewRequestWithContext(context.Background(), http.MethodGet, "/", nil) route := &MatchedRoute{} ok, prin, err := ras.Authenticate(req, route) require.NoError(t, err) require.True(t, ok) require.Equal(t, "the user", prin) require.Equal(t, ra, route.Authenticator) } func TestAuthenticateLogicalOr(t testing.T) { ra1 := RouteAuthenticator{ Authenticator: map[string]runtime.Authenticator{ "auth1": noApplyAuth, }, Schemes: []string{"auth1"}, Scopes: map[string][]string{"auth1": nil}, } ra2 := RouteAuthenticator{ Authenticator: map[string]runtime.Authenticator{ "auth2": successAuth, }, Schemes: []string{"auth2"}, Scopes: map[string][]string{"auth2": nil}, } // right side matches ras := RouteAuthenticators([]RouteAuthenticator{ra1, ra2}) require.False(t, ras.AllowsAnonymous()) req, _ := http.NewRequestWithContext(context.Background(), http.MethodGet, "/", nil) route := &MatchedRoute{} ok, prin, err := ras.Authenticate(req, route) require.NoError(t, err) require.True(t, ok) require.Equal(t, "the user", prin) require.Equal(t, ra2, route.Authenticator) // left side matches ras = RouteAuthenticators([]RouteAuthenticator{ra2, ra1}) require.False(t, ras.AllowsAnonymous()) req, _ = http.NewRequestWithContext(context.Background(), http.MethodGet, "/", nil) route = &MatchedRoute{} ok, prin, err = ras.Authenticate(req, route) require.NoError(t, err) require.True(t, ok) require.Equal(t, "the user", prin) require.Equal(t, ra2, route.Authenticator) } func TestAuthenticateLogicalAnd(t testing.T) { ra1 := RouteAuthenticator{ Authenticator: map[string]runtime.Authenticator{ "auth1": noApplyAuth, }, Schemes: []string{"auth1"}, Scopes: map[string][]string{"auth1": nil}, } authorizer := newCountAuthenticator(true, "the user", nil) ra2 := RouteAuthenticator{ Authenticator: map[string]runtime.Authenticator{ "auth2": authorizer, "auth3": authorizer, }, Schemes: []string{"auth2", "auth3"}, Scopes: map[string][]string{"auth2": nil}, } ras := RouteAuthenticators([]RouteAuthenticator{ra1, ra2}) require.False(t, ras.AllowsAnonymous()) req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, "/", nil) require.NoError(t, err) route := &MatchedRoute{} ok, prin, err := ras.Authenticate(req, route) require.NoError(t, err) require.True(t, ok) require.Equal(t, "the user", prin) require.Equal(t, ra2, route.Authenticator) require.Equal(t, 2, authorizer.count) var count int successA := runtime.AuthenticatorFunc(func(_ interface{}) (bool, interface{}, error) { count++ return true, "the user", nil }) failA := runtime.AuthenticatorFunc(func(_ interface{}) (bool, interface{}, error) { count++ return true, nil, errors.New("unauthenticated") }) ra3 := RouteAuthenticator{ Authenticator: map[string]runtime.Authenticator{ "auth2": successA, "auth3": failA, "auth4": successA, }, Schemes: []string{"auth2", "auth3", "auth4"}, Scopes: map[string][]string{"auth2": nil}, } ras = RouteAuthenticators([]RouteAuthenticator{ra1, ra3}) require.False(t, ras.AllowsAnonymous()) req, _ = http.NewRequestWithContext(context.Background(), http.MethodGet, "/", nil) route = &MatchedRoute{} ok, prin, err = ras.Authenticate(req, route) require.Error(t, err) require.True(t, ok) require.Nil(t, prin) require.Equal(t, ra3, route.Authenticator) require.Equal(t, 2, count) ra4 := RouteAuthenticator{ Authenticator: map[string]runtime.Authenticator{ "auth2": successA, "auth3": successA, "auth4": failA, }, Schemes: []string{"auth2", "auth3", "auth4"}, Scopes: map[string][]string{"auth2": nil}, } ras = RouteAuthenticators([]RouteAuthenticator{ra1, ra4}) require.False(t, ras.AllowsAnonymous()) req, _ = http.NewRequestWithContext(context.Background(), http.MethodGet, "/", nil) route = &MatchedRoute{} ok, prin, err = ras.Authenticate(req, route) require.Error(t, err) require.True(t, ok) require.Nil(t, prin) require.Equal(t, ra4, route.Authenticator) require.Equal(t, 5, count) } func TestAuthenticateOptional(t testing.T) { ra1 := RouteAuthenticator{ Authenticator: map[string]runtime.Authenticator{ "auth1": noApplyAuth, }, Schemes: []string{"auth1"}, Scopes: map[string][]string{"auth1": nil}, } ra2 := RouteAuthenticator{ allowAnonymous: true, Schemes: []string{""}, Scopes: map[string][]string{"": {}}, } ra3 := RouteAuthenticator{ Authenticator: map[string]runtime.Authenticator{ "auth2": noApplyAuth, }, Schemes: []string{"auth2"}, Scopes: map[string][]string{"auth2": nil}, } ras := RouteAuthenticators([]RouteAuthenticator{ra1, ra2, ra3}) require.True(t, ras.AllowsAnonymous()) req, _ := http.NewRequestWithContext(context.Background(), http.MethodGet, "/", nil) route := &MatchedRoute{} ok, prin, err := ras.Authenticate(req, route) require.NoError(t, err) require.True(t, ok) require.Nil(t, prin) require.Equal(t, ra2, route.Authenticator) ra4 := RouteAuthenticator{ Authenticator: map[string]runtime.Authenticator{ "auth1": noApplyAuth, }, Schemes: []string{"auth1"}, Scopes: map[string][]string{"auth1": nil}, } ra5 := RouteAuthenticator{ allowAnonymous: true, } ra6 := RouteAuthenticator{ Authenticator: map[string]runtime.Authenticator{ "auth2": failAuth, }, Schemes: []string{"auth2"}, Scopes: map[string][]string{"auth2": nil}, } ras = RouteAuthenticators([]RouteAuthenticator{ra4, ra5, ra6}) require.True(t, ras.AllowsAnonymous()) req, _ = http.NewRequestWithContext(context.Background(), http.MethodGet, "/", nil) route = &MatchedRoute{} ok, prin, err = ras.Authenticate(req, route) require.Error(t, err) require.True(t, ok) require.Nil(t, prin) require.Equal(t, ra6, route.Authenticator) }	6.96 KB	2025-05-25 12:27
📄 route_param_test.go // Copyright 2015 go-swagger maintainers // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package middleware import ( "testing" "github.com/stretchr/testify/assert" ) func TestRouteParams(t *testing.T) { coll1 := RouteParams([]RouteParam{ {"blah", "foo"}, {"abc", "bar"}, {"ccc", "efg"}, }) v := coll1.Get("blah") assert.Equal(t, "foo", v) v2 := coll1.Get("abc") assert.Equal(t, "bar", v2) v3 := coll1.Get("ccc") assert.Equal(t, "efg", v3) v4 := coll1.Get("ydkdk") assert.Empty(t, v4) }	1018 B	2025-05-25 12:27
📄 router.go // Copyright 2015 go-swagger maintainers // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package middleware import ( "fmt" "net/http" "net/url" fpath "path" "regexp" "strings" "github.com/go-openapi/runtime/logger" "github.com/go-openapi/runtime/security" "github.com/go-openapi/swag" "github.com/go-openapi/analysis" "github.com/go-openapi/errors" "github.com/go-openapi/loads" "github.com/go-openapi/spec" "github.com/go-openapi/strfmt" "github.com/go-openapi/runtime" "github.com/go-openapi/runtime/middleware/denco" ) // RouteParam is a object to capture route params in a framework agnostic way. // implementations of the muxer should use these route params to communicate with the // swagger framework type RouteParam struct { Name string Value string } // RouteParams the collection of route params type RouteParams []RouteParam // Get gets the value for the route param for the specified key func (r RouteParams) Get(name string) string { vv, _, _ := r.GetOK(name) if len(vv) > 0 { return vv[len(vv)-1] } return "" } // GetOK gets the value but also returns booleans to indicate if a key or value // is present. This aids in validation and satisfies an interface in use there // // The returned values are: data, has key, has value func (r RouteParams) GetOK(name string) ([]string, bool, bool) { for _, p := range r { if p.Name == name { return []string{p.Value}, true, p.Value != "" } } return nil, false, false } // NewRouter creates a new context-aware router middleware func NewRouter(ctx Context, next http.Handler) http.Handler { if ctx.router == nil { ctx.router = DefaultRouter(ctx.spec, ctx.api, WithDefaultRouterLoggerFunc(ctx.debugLogf)) } return http.HandlerFunc(func(rw http.ResponseWriter, r http.Request) { if _, rCtx, ok := ctx.RouteInfo(r); ok { next.ServeHTTP(rw, rCtx) return } // Not found, check if it exists in the other methods first if others := ctx.AllowedMethods(r); len(others) > 0 { ctx.Respond(rw, r, ctx.analyzer.RequiredProduces(), nil, errors.MethodNotAllowed(r.Method, others)) return } ctx.Respond(rw, r, ctx.analyzer.RequiredProduces(), nil, errors.NotFound("path %s was not found", r.URL.EscapedPath())) }) } // RoutableAPI represents an interface for things that can serve // as a provider of implementations for the swagger router type RoutableAPI interface { HandlerFor(string, string) (http.Handler, bool) ServeErrorFor(string) func(http.ResponseWriter, http.Request, error) ConsumersFor([]string) map[string]runtime.Consumer ProducersFor([]string) map[string]runtime.Producer AuthenticatorsFor(map[string]spec.SecurityScheme) map[string]runtime.Authenticator Authorizer() runtime.Authorizer Formats() strfmt.Registry DefaultProduces() string DefaultConsumes() string } // Router represents a swagger-aware router type Router interface { Lookup(method, path string) (MatchedRoute, bool) OtherMethods(method, path string) []string } type defaultRouteBuilder struct { spec loads.Document analyzer analysis.Spec api RoutableAPI records map[string][]denco.Record debugLogf func(string, ...any) // a logging function to debug context and all components using it } type defaultRouter struct { spec loads.Document routers map[string]denco.Router debugLogf func(string, ...any) // a logging function to debug context and all components using it } func newDefaultRouteBuilder(spec loads.Document, api RoutableAPI, opts ...DefaultRouterOpt) defaultRouteBuilder { var o defaultRouterOpts for _, apply := range opts { apply(&o) } if o.debugLogf == nil { o.debugLogf = debugLogfFunc(nil) // defaults to standard logger } return &defaultRouteBuilder{ spec: spec, analyzer: analysis.New(spec.Spec()), api: api, records: make(map[string][]denco.Record), debugLogf: o.debugLogf, } } // DefaultRouterOpt allows to inject optional behavior to the default router. type DefaultRouterOpt func(defaultRouterOpts) type defaultRouterOpts struct { debugLogf func(string, ...any) } // WithDefaultRouterLogger sets the debug logger for the default router. // // This is enabled only in DEBUG mode. func WithDefaultRouterLogger(lg logger.Logger) DefaultRouterOpt { return func(o defaultRouterOpts) { o.debugLogf = debugLogfFunc(lg) } } // WithDefaultRouterLoggerFunc sets a logging debug method for the default router. func WithDefaultRouterLoggerFunc(fn func(string, ...any)) DefaultRouterOpt { return func(o defaultRouterOpts) { o.debugLogf = fn } } // DefaultRouter creates a default implementation of the router func DefaultRouter(spec loads.Document, api RoutableAPI, opts ...DefaultRouterOpt) Router { builder := newDefaultRouteBuilder(spec, api, opts...) if spec != nil { for method, paths := range builder.analyzer.Operations() { for path, operation := range paths { fp := fpath.Join(spec.BasePath(), path) builder.debugLogf("adding route %s %s %q", method, fp, operation.ID) builder.AddRoute(method, fp, operation) } } } return builder.Build() } // RouteAuthenticator is an authenticator that can compose several authenticators together. // It also knows when it contains an authenticator that allows for anonymous pass through. // Contains a group of 1 or more authenticators that have a logical AND relationship type RouteAuthenticator struct { Authenticator map[string]runtime.Authenticator Schemes []string Scopes map[string][]string allScopes []string commonScopes []string allowAnonymous bool } func (ra RouteAuthenticator) AllowsAnonymous() bool { return ra.allowAnonymous } // AllScopes returns a list of unique scopes that is the combination // of all the scopes in the requirements func (ra RouteAuthenticator) AllScopes() []string { return ra.allScopes } // CommonScopes returns a list of unique scopes that are common in all the // scopes in the requirements func (ra RouteAuthenticator) CommonScopes() []string { return ra.commonScopes } // Authenticate Authenticator interface implementation func (ra RouteAuthenticator) Authenticate(req http.Request, route MatchedRoute) (bool, interface{}, error) { if ra.allowAnonymous { route.Authenticator = ra return true, nil, nil } // iterate in proper order var lastResult interface{} for _, scheme := range ra.Schemes { if authenticator, ok := ra.Authenticator[scheme]; ok { applies, princ, err := authenticator.Authenticate(&security.ScopedAuthRequest{ Request: req, RequiredScopes: ra.Scopes[scheme], }) if !applies { return false, nil, nil } if err != nil { route.Authenticator = ra return true, nil, err } lastResult = princ } } route.Authenticator = ra return true, lastResult, nil } func stringSliceUnion(slices ...[]string) []string { unique := make(map[string]struct{}) var result []string for _, slice := range slices { for _, entry := range slice { if _, ok := unique[entry]; ok { continue } unique[entry] = struct{}{} result = append(result, entry) } } return result } func stringSliceIntersection(slices ...[]string) []string { unique := make(map[string]int) var intersection []string total := len(slices) var emptyCnt int for _, slice := range slices { if len(slice) == 0 { emptyCnt++ continue } for _, entry := range slice { unique[entry]++ if unique[entry] == total-emptyCnt { // this entry appeared in all the non-empty slices intersection = append(intersection, entry) } } } return intersection } // RouteAuthenticators represents a group of authenticators that represent a logical OR type RouteAuthenticators []RouteAuthenticator // AllowsAnonymous returns true when there is an authenticator that means optional auth func (ras RouteAuthenticators) AllowsAnonymous() bool { for _, ra := range ras { if ra.AllowsAnonymous() { return true } } return false } // Authenticate method implemention so this collection can be used as authenticator func (ras RouteAuthenticators) Authenticate(req http.Request, route MatchedRoute) (bool, interface{}, error) { var lastError error var allowsAnon bool var anonAuth RouteAuthenticator for _, ra := range ras { if ra.AllowsAnonymous() { anonAuth = ra allowsAnon = true continue } applies, usr, err := ra.Authenticate(req, route) if !applies \|\| err != nil \|\| usr == nil { if err != nil { lastError = err } continue } return applies, usr, nil } if allowsAnon && lastError == nil { route.Authenticator = &anonAuth return true, nil, lastError } return lastError != nil, nil, lastError } type routeEntry struct { PathPattern string BasePath string Operation spec.Operation Consumes []string Consumers map[string]runtime.Consumer Produces []string Producers map[string]runtime.Producer Parameters map[string]spec.Parameter Handler http.Handler Formats strfmt.Registry Binder UntypedRequestBinder Authenticators RouteAuthenticators Authorizer runtime.Authorizer } // MatchedRoute represents the route that was matched in this request type MatchedRoute struct { routeEntry Params RouteParams Consumer runtime.Consumer Producer runtime.Producer Authenticator RouteAuthenticator } // HasAuth returns true when the route has a security requirement defined func (m MatchedRoute) HasAuth() bool { return len(m.Authenticators) > 0 } // NeedsAuth returns true when the request still // needs to perform authentication func (m MatchedRoute) NeedsAuth() bool { return m.HasAuth() && m.Authenticator == nil } func (d defaultRouter) Lookup(method, path string) (MatchedRoute, bool) { mth := strings.ToUpper(method) d.debugLogf("looking up route for %s %s", method, path) if Debug { if len(d.routers) == 0 { d.debugLogf("there are no known routers") } for meth := range d.routers { d.debugLogf("got a router for %s", meth) } } if router, ok := d.routers[mth]; ok { if m, rp, ok := router.Lookup(fpath.Clean(path)); ok && m != nil { if entry, ok := m.(routeEntry); ok { d.debugLogf("found a route for %s %s with %d parameters", method, path, len(entry.Parameters)) var params RouteParams for _, p := range rp { v, err := url.PathUnescape(p.Value) if err != nil { d.debugLogf("failed to escape %q: %v", p.Value, err) v = p.Value } // a workaround to handle fragment/composing parameters until they are supported in denco router // check if this parameter is a fragment within a path segment if xpos := strings.Index(entry.PathPattern, fmt.Sprintf("{%s}", p.Name)) + len(p.Name) + 2; xpos < len(entry.PathPattern) && entry.PathPattern[xpos] != '/' { // extract fragment parameters ep := strings.Split(entry.PathPattern[xpos:], "/")[0] pnames, pvalues := decodeCompositParams(p.Name, v, ep, nil, nil) for i, pname := range pnames { params = append(params, RouteParam{Name: pname, Value: pvalues[i]}) } } else { // use the parameter directly params = append(params, RouteParam{Name: p.Name, Value: v}) } } return &MatchedRoute{routeEntry: entry, Params: params}, true } } else { d.debugLogf("couldn't find a route by path for %s %s", method, path) } } else { d.debugLogf("couldn't find a route by method for %s %s", method, path) } return nil, false } func (d defaultRouter) OtherMethods(method, path string) []string { mn := strings.ToUpper(method) var methods []string for k, v := range d.routers { if k != mn { if _, _, ok := v.Lookup(fpath.Clean(path)); ok { methods = append(methods, k) continue } } } return methods } func (d defaultRouter) SetLogger(lg logger.Logger) { d.debugLogf = debugLogfFunc(lg) } // convert swagger parameters per path segment into a denco parameter as multiple parameters per segment are not supported in denco var pathConverter = regexp.MustCompile(`{(.+?)}([^/])`) func decodeCompositParams(name string, value string, pattern string, names []string, values []string) ([]string, []string) { pleft := strings.Index(pattern, "{") names = append(names, name) if pleft < 0 { if strings.HasSuffix(value, pattern) { values = append(values, value[:len(value)-len(pattern)]) } else { values = append(values, "") } } else { toskip := pattern[:pleft] pright := strings.Index(pattern, "}") vright := strings.Index(value, toskip) if vright >= 0 { values = append(values, value[:vright]) } else { values = append(values, "") value = "" } return decodeCompositParams(pattern[pleft+1:pright], value[vright+len(toskip):], pattern[pright+1:], names, values) } return names, values } func (d defaultRouteBuilder) AddRoute(method, path string, operation spec.Operation) { mn := strings.ToUpper(method) bp := fpath.Clean(d.spec.BasePath()) if len(bp) > 0 && bp[len(bp)-1] == '/' { bp = bp[:len(bp)-1] } d.debugLogf("operation: %#v", operation) if handler, ok := d.api.HandlerFor(method, strings.TrimPrefix(path, bp)); ok { consumes := d.analyzer.ConsumesFor(operation) produces := d.analyzer.ProducesFor(operation) parameters := d.analyzer.ParamsFor(method, strings.TrimPrefix(path, bp)) // add API defaults if not part of the spec if defConsumes := d.api.DefaultConsumes(); defConsumes != "" && !swag.ContainsStringsCI(consumes, defConsumes) { consumes = append(consumes, defConsumes) } if defProduces := d.api.DefaultProduces(); defProduces != "" && !swag.ContainsStringsCI(produces, defProduces) { produces = append(produces, defProduces) } requestBinder := NewUntypedRequestBinder(parameters, d.spec.Spec(), d.api.Formats()) requestBinder.setDebugLogf(d.debugLogf) record := denco.NewRecord(pathConverter.ReplaceAllString(path, ":$1"), &routeEntry{ BasePath: bp, PathPattern: path, Operation: operation, Handler: handler, Consumes: consumes, Produces: produces, Consumers: d.api.ConsumersFor(normalizeOffers(consumes)), Producers: d.api.ProducersFor(normalizeOffers(produces)), Parameters: parameters, Formats: d.api.Formats(), Binder: requestBinder, Authenticators: d.buildAuthenticators(operation), Authorizer: d.api.Authorizer(), }) d.records[mn] = append(d.records[mn], record) } } func (d defaultRouteBuilder) buildAuthenticators(operation spec.Operation) RouteAuthenticators { requirements := d.analyzer.SecurityRequirementsFor(operation) auths := make([]RouteAuthenticator, 0, len(requirements)) for _, reqs := range requirements { schemes := make([]string, 0, len(reqs)) scopes := make(map[string][]string, len(reqs)) scopeSlices := make([][]string, 0, len(reqs)) for _, req := range reqs { schemes = append(schemes, req.Name) scopes[req.Name] = req.Scopes scopeSlices = append(scopeSlices, req.Scopes) } definitions := d.analyzer.SecurityDefinitionsForRequirements(reqs) authenticators := d.api.AuthenticatorsFor(definitions) auths = append(auths, RouteAuthenticator{ Authenticator: authenticators, Schemes: schemes, Scopes: scopes, allScopes: stringSliceUnion(scopeSlices...), commonScopes: stringSliceIntersection(scopeSlices...), allowAnonymous: len(reqs) == 1 && reqs[0].Name == "", }) } return auths } func (d defaultRouteBuilder) Build() defaultRouter { routers := make(map[string]denco.Router) for method, records := range d.records { router := denco.New() _ = router.Build(records) routers[method] = router } return &defaultRouter{ spec: d.spec, routers: routers, debugLogf: d.debugLogf, } }	15.92 KB	2025-05-25 12:27
📄 router_test.go // Copyright 2015 go-swagger maintainers // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package middleware import ( stdcontext "context" "net/http" "net/http/httptest" "sort" "strings" "testing" "github.com/go-openapi/analysis" "github.com/go-openapi/loads" "github.com/go-openapi/runtime/internal/testing/petstore" "github.com/go-openapi/runtime/middleware/untyped" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) func terminator(rw http.ResponseWriter, _ http.Request) { rw.WriteHeader(http.StatusOK) } func TestRouterMiddleware(t testing.T) { spec, api := petstore.NewAPI(t) context := NewContext(spec, api, nil) mw := NewRouter(context, http.HandlerFunc(terminator)) recorder := httptest.NewRecorder() request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, "/api/pets", nil) require.NoError(t, err) mw.ServeHTTP(recorder, request) assert.Equal(t, http.StatusOK, recorder.Code) recorder = httptest.NewRecorder() request, err = http.NewRequestWithContext(stdcontext.Background(), http.MethodDelete, "/api/pets", nil) require.NoError(t, err) mw.ServeHTTP(recorder, request) assert.Equal(t, http.StatusMethodNotAllowed, recorder.Code) methods := strings.Split(recorder.Header().Get("Allow"), ",") sort.Strings(methods) assert.Equal(t, "GET,POST", strings.Join(methods, ",")) recorder = httptest.NewRecorder() request, err = http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, "/nopets", nil) require.NoError(t, err) mw.ServeHTTP(recorder, request) assert.Equal(t, http.StatusNotFound, recorder.Code) recorder = httptest.NewRecorder() request, err = http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, "/pets", nil) require.NoError(t, err) mw.ServeHTTP(recorder, request) assert.Equal(t, http.StatusNotFound, recorder.Code) spec, api = petstore.NewRootAPI(t) context = NewContext(spec, api, nil) mw = NewRouter(context, http.HandlerFunc(terminator)) recorder = httptest.NewRecorder() request, err = http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, "/pets", nil) require.NoError(t, err) mw.ServeHTTP(recorder, request) assert.Equal(t, http.StatusOK, recorder.Code) recorder = httptest.NewRecorder() request, err = http.NewRequestWithContext(stdcontext.Background(), http.MethodDelete, "/pets", nil) require.NoError(t, err) mw.ServeHTTP(recorder, request) assert.Equal(t, http.StatusMethodNotAllowed, recorder.Code) methods = strings.Split(recorder.Header().Get("Allow"), ",") sort.Strings(methods) assert.Equal(t, "GET,POST", strings.Join(methods, ",")) recorder = httptest.NewRecorder() request, err = http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, "/nopets", nil) require.NoError(t, err) mw.ServeHTTP(recorder, request) assert.Equal(t, http.StatusNotFound, recorder.Code) } func TestRouterBuilder(t testing.T) { spec, api := petstore.NewAPI(t) analyzed := analysis.New(spec.Spec()) assert.Len(t, analyzed.RequiredConsumes(), 3) assert.Len(t, analyzed.RequiredProduces(), 5) assert.Len(t, analyzed.OperationIDs(), 4) // context := NewContext(spec, api) builder := petAPIRouterBuilder(spec, api, analyzed) getRecords := builder.records[http.MethodGet] postRecords := builder.records[http.MethodPost] deleteRecords := builder.records[http.MethodDelete] assert.Len(t, getRecords, 2) assert.Len(t, postRecords, 1) assert.Len(t, deleteRecords, 1) assert.Empty(t, builder.records[http.MethodPatch]) assert.Empty(t, builder.records[http.MethodOptions]) assert.Empty(t, builder.records[http.MethodHead]) assert.Empty(t, builder.records[http.MethodPut]) rec := postRecords[0] assert.Equal(t, "/pets", rec.Key) val := rec.Value.(routeEntry) assert.Len(t, val.Consumers, 2) assert.Len(t, val.Producers, 2) assert.Len(t, val.Consumes, 2) assert.Len(t, val.Produces, 2) assert.Contains(t, val.Consumers, "application/json") assert.Contains(t, val.Producers, "application/x-yaml") assert.Contains(t, val.Consumes, "application/json") assert.Contains(t, val.Produces, "application/x-yaml") assert.Len(t, val.Parameters, 1) recG := getRecords[0] assert.Equal(t, "/pets", recG.Key) valG := recG.Value.(routeEntry) assert.Len(t, valG.Consumers, 2) assert.Len(t, valG.Producers, 4) assert.Len(t, valG.Consumes, 2) assert.Len(t, valG.Produces, 4) assert.Len(t, valG.Parameters, 2) } func TestRouterCanonicalBasePath(t testing.T) { spec, api := petstore.NewAPI(t) spec.Spec().BasePath = "/api///" context := NewContext(spec, api, nil) mw := NewRouter(context, http.HandlerFunc(terminator)) recorder := httptest.NewRecorder() request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, "/api/pets", nil) require.NoError(t, err) mw.ServeHTTP(recorder, request) assert.Equal(t, http.StatusOK, recorder.Code) } func TestRouter_EscapedPath(t testing.T) { spec, api := petstore.NewAPI(t) spec.Spec().BasePath = "/api/" context := NewContext(spec, api, nil) mw := NewRouter(context, http.HandlerFunc(terminator)) recorder := httptest.NewRecorder() request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, "/api/pets/123", nil) require.NoError(t, err) mw.ServeHTTP(recorder, request) assert.Equal(t, http.StatusOK, recorder.Code) recorder = httptest.NewRecorder() request, err = http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, "/api/pets/abc%2Fdef", nil) require.NoError(t, err) mw.ServeHTTP(recorder, request) assert.Equal(t, http.StatusOK, recorder.Code) ri, _, _ := context.RouteInfo(request) require.NotNil(t, ri) require.NotNil(t, ri.Params) assert.Equal(t, "abc/def", ri.Params.Get("id")) } func TestRouterStruct(t testing.T) { spec, api := petstore.NewAPI(t) router := DefaultRouter(spec, newRoutableUntypedAPI(spec, api, new(Context))) methods := router.OtherMethods("post", "/api/pets/{id}") assert.Len(t, methods, 2) entry, ok := router.Lookup("delete", "/api/pets/{id}") assert.True(t, ok) require.NotNil(t, entry) assert.Len(t, entry.Params, 1) assert.Equal(t, "id", entry.Params[0].Name) _, ok = router.Lookup("delete", "/pets") assert.False(t, ok) _, ok = router.Lookup("post", "/no-pets") assert.False(t, ok) } func petAPIRouterBuilder(spec loads.Document, api untyped.API, analyzed analysis.Spec) defaultRouteBuilder { builder := newDefaultRouteBuilder(spec, newRoutableUntypedAPI(spec, api, new(Context))) builder.AddRoute(http.MethodGet, "/pets", analyzed.AllPaths()["/pets"].Get) builder.AddRoute(http.MethodPost, "/pets", analyzed.AllPaths()["/pets"].Post) builder.AddRoute(http.MethodDelete, "/pets/{id}", analyzed.AllPaths()["/pets/{id}"].Delete) builder.AddRoute(http.MethodGet, "/pets/{id}", analyzed.AllPaths()["/pets/{id}"].Get) return builder } func TestPathConverter(t testing.T) { cases := []struct { swagger string denco string }{ {"/", "/"}, {"/something", "/something"}, {"/{id}", "/:id"}, {"/{id}/something/{anotherId}", "/:id/something/:anotherId"}, {"/{petid}", "/:petid"}, {"/{pet_id}", "/:pet_id"}, {"/{petId}", "/:petId"}, {"/{pet-id}", "/:pet-id"}, // compost parameters tests {"/p_{pet_id}", "/p_:pet_id"}, {"/p_{petId}.{petSubId}", "/p_:petId"}, } for _, tc := range cases { actual := pathConverter.ReplaceAllString(tc.swagger, ":$1") assert.Equal(t, tc.denco, actual, "expected swagger path %s to match %s but got %s", tc.swagger, tc.denco, actual) } } func TestExtractCompositParameters(t testing.T) { // name is the composite parameter's name, value is the value of this compost parameter, pattern is the pattern to be matched cases := []struct { name string value string pattern string names []string values []string }{ {name: "fragment", value: "gie", pattern: "e", names: []string{"fragment"}, values: []string{"gi"}}, {name: "fragment", value: "t.simpson", pattern: ".{subfragment}", names: []string{"fragment", "subfragment"}, values: []string{"t", "simpson"}}, } for _, tc := range cases { names, values := decodeCompositParams(tc.name, tc.value, tc.pattern, nil, nil) assert.EqualValues(t, tc.names, names) assert.EqualValues(t, tc.values, values) } }	8.56 KB	2025-05-25 12:27
📄 security.go // Copyright 2015 go-swagger maintainers // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package middleware import "net/http" func newSecureAPI(ctx Context, next http.Handler) http.Handler { return http.HandlerFunc(func(rw http.ResponseWriter, r http.Request) { route, rCtx, _ := ctx.RouteInfo(r) if rCtx != nil { r = rCtx } if route != nil && !route.NeedsAuth() { next.ServeHTTP(rw, r) return } _, rCtx, err := ctx.Authorize(r, route) if err != nil { ctx.Respond(rw, r, route.Produces, route, err) return } r = rCtx next.ServeHTTP(rw, r) }) }	1.07 KB	2025-05-25 12:27
📄 security_test.go // Copyright 2015 go-swagger maintainers // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package middleware import ( stdcontext "context" "net/http" "net/http/httptest" "testing" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" "github.com/go-openapi/runtime/internal/testing/petstore" ) func TestSecurityMiddleware(t testing.T) { spec, api := petstore.NewAPI(t) context := NewContext(spec, api, nil) context.router = DefaultRouter(spec, context.api) mw := newSecureAPI(context, http.HandlerFunc(terminator)) t.Run("without auth", func(t testing.T) { recorder := httptest.NewRecorder() request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, "/api/pets", nil) require.NoError(t, err) mw.ServeHTTP(recorder, request) assert.Equal(t, http.StatusUnauthorized, recorder.Code) }) t.Run("with wrong password", func(t testing.T) { recorder := httptest.NewRecorder() request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, "/api/pets", nil) require.NoError(t, err) request.SetBasicAuth("admin", "wrong") mw.ServeHTTP(recorder, request) assert.Equal(t, http.StatusUnauthorized, recorder.Code) assert.NotEmpty(t, recorder.Header().Get("WWW-Authenticate")) }) t.Run("with correct password", func(t testing.T) { recorder := httptest.NewRecorder() request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, "/api/pets", nil) require.NoError(t, err) request.SetBasicAuth("admin", "admin") mw.ServeHTTP(recorder, request) assert.Equal(t, http.StatusOK, recorder.Code) }) t.Run("with unauthenticated path", func(t *testing.T) { recorder := httptest.NewRecorder() request, err := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, "//apipets/1", nil) require.NoError(t, err) mw.ServeHTTP(recorder, request) assert.Equal(t, http.StatusOK, recorder.Code) }) }	2.4 KB	2025-05-25 12:27
📄 spec.go // Copyright 2015 go-swagger maintainers // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package middleware import ( "net/http" "path" ) const ( contentTypeHeader = "Content-Type" applicationJSON = "application/json" ) // SpecOption can be applied to the Spec serving middleware type SpecOption func(specOptions) var defaultSpecOptions = specOptions{ Path: "", Document: "swagger.json", } type specOptions struct { Path string Document string } func specOptionsWithDefaults(opts []SpecOption) specOptions { o := defaultSpecOptions for _, apply := range opts { apply(&o) } return o } // Spec creates a middleware to serve a swagger spec as a JSON document. // // This allows for altering the spec before starting the http listener. // // The basePath argument indicates the path of the spec document (defaults to "/"). // Additional SpecOption can be used to change the name of the document (defaults to "swagger.json"). func Spec(basePath string, b []byte, next http.Handler, opts ...SpecOption) http.Handler { if basePath == "" { basePath = "/" } o := specOptionsWithDefaults(opts) pth := path.Join(basePath, o.Path, o.Document) return http.HandlerFunc(func(rw http.ResponseWriter, r http.Request) { if path.Clean(r.URL.Path) == pth { rw.Header().Set(contentTypeHeader, applicationJSON) rw.WriteHeader(http.StatusOK) _, _ = rw.Write(b) return } if next != nil { next.ServeHTTP(rw, r) return } rw.Header().Set(contentTypeHeader, applicationJSON) rw.WriteHeader(http.StatusNotFound) }) } // WithSpecPath sets the path to be joined to the base path of the Spec middleware. // // This is empty by default. func WithSpecPath(pth string) SpecOption { return func(o specOptions) { o.Path = pth } } // WithSpecDocument sets the name of the JSON document served as a spec. // // By default, this is "swagger.json" func WithSpecDocument(doc string) SpecOption { return func(o specOptions) { if doc == "" { return } o.Document = doc } }	2.47 KB	2025-05-25 12:27
📄 spec_test.go // Copyright 2015 go-swagger maintainers // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package middleware import ( "context" "net/http" "net/http/httptest" "testing" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" "github.com/go-openapi/runtime" "github.com/go-openapi/runtime/internal/testing/petstore" ) func TestServeSpecMiddleware(t testing.T) { spec, api := petstore.NewAPI(t) ctx := NewContext(spec, api, nil) t.Run("Spec handler", func(t testing.T) { handler := Spec("", ctx.spec.Raw(), nil) t.Run("serves spec", func(t testing.T) { request, err := http.NewRequestWithContext(context.Background(), http.MethodGet, "/swagger.json", nil) require.NoError(t, err) request.Header.Add(runtime.HeaderContentType, runtime.JSONMime) recorder := httptest.NewRecorder() handler.ServeHTTP(recorder, request) assert.Equal(t, http.StatusOK, recorder.Code) responseHeaders := recorder.Result().Header //nolint:bodyclose // false positive from linter responseContentType := responseHeaders.Get("Content-Type") assert.Equal(t, applicationJSON, responseContentType) responseBody := recorder.Body require.NotNil(t, responseBody) require.JSONEq(t, string(spec.Raw()), responseBody.String()) }) t.Run("returns 404 when no next handler", func(t testing.T) { request, err := http.NewRequestWithContext(context.Background(), http.MethodGet, "/api/pets", nil) require.NoError(t, err) request.Header.Add(runtime.HeaderContentType, runtime.JSONMime) recorder := httptest.NewRecorder() handler.ServeHTTP(recorder, request) assert.Equal(t, http.StatusNotFound, recorder.Code) }) t.Run("forwards to next handler for other url", func(t testing.T) { handler = Spec("", ctx.spec.Raw(), http.HandlerFunc(func(rw http.ResponseWriter, _ http.Request) { rw.WriteHeader(http.StatusOK) })) request, err := http.NewRequestWithContext(context.Background(), http.MethodGet, "/api/pets", nil) require.NoError(t, err) request.Header.Add(runtime.HeaderContentType, runtime.JSONMime) recorder := httptest.NewRecorder() handler.ServeHTTP(recorder, request) assert.Equal(t, http.StatusOK, recorder.Code) }) }) t.Run("Spec handler with options", func(t testing.T) { handler := Spec("/swagger", ctx.spec.Raw(), nil, WithSpecPath("spec"), WithSpecDocument("myapi-swagger.json"), ) t.Run("serves spec", func(t testing.T) { request, err := http.NewRequestWithContext(context.Background(), http.MethodGet, "/swagger/spec/myapi-swagger.json", nil) require.NoError(t, err) request.Header.Add(runtime.HeaderContentType, runtime.JSONMime) recorder := httptest.NewRecorder() handler.ServeHTTP(recorder, request) assert.Equal(t, http.StatusOK, recorder.Code) }) t.Run("should not find spec there", func(t *testing.T) { request, err := http.NewRequestWithContext(context.Background(), http.MethodGet, "/swagger.json", nil) require.NoError(t, err) request.Header.Add(runtime.HeaderContentType, runtime.JSONMime) recorder := httptest.NewRecorder() handler.ServeHTTP(recorder, request) assert.Equal(t, http.StatusNotFound, recorder.Code) }) }) }	3.63 KB	2025-05-25 12:27
📄 string_conversion_test.go // Copyright 2015 go-swagger maintainers // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package middleware import ( "errors" "reflect" "strings" "testing" "time" "github.com/go-openapi/spec" "github.com/go-openapi/strfmt" "github.com/go-openapi/swag" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) var evaluatesAsTrue = []string{"true", "1", "yes", "ok", "y", "on", "selected", "checked", "t", "enabled"} type unmarshallerSlice []string func (u unmarshallerSlice) UnmarshalText(data []byte) error { if len(data) == 0 { return errors.New("an error") } u = strings.Split(string(data), ",") return nil } type SomeOperationParams struct { Name string ID int64 Confirmed bool Age int Visits int32 Count int16 Seq int8 UID uint64 UAge uint UVisits uint32 UCount uint16 USeq uint8 Score float32 Rate float64 Timestamp strfmt.DateTime Birthdate strfmt.Date LastFailure strfmt.DateTime Unsupported struct{} Tags []string Prefs []int32 Categories unmarshallerSlice } func FloatParamTest(t testing.T, _, pName, _ string, val reflect.Value, defVal, expectedDef interface{}, actual func() interface{}) { fld := val.FieldByName(pName) binder := &untypedParamBinder{ parameter: spec.QueryParam(pName).Typed("number", "double").WithDefault(defVal), Name: pName, } err := binder.setFieldValue(fld, defVal, "5", true) require.NoError(t, err) assert.EqualValues(t, 5, actual()) err = binder.setFieldValue(fld, defVal, "", true) require.NoError(t, err) assert.EqualValues(t, expectedDef, actual()) err = binder.setFieldValue(fld, defVal, "yada", true) require.Error(t, err) } func IntParamTest(t testing.T, pName string, val reflect.Value, defVal, expectedDef interface{}, actual func() interface{}) { fld := val.FieldByName(pName) binder := &untypedParamBinder{ parameter: spec.QueryParam(pName).Typed("integer", "int64").WithDefault(defVal), Name: pName, } err := binder.setFieldValue(fld, defVal, "5", true) require.NoError(t, err) assert.EqualValues(t, 5, actual()) err = binder.setFieldValue(fld, defVal, "", true) require.NoError(t, err) assert.EqualValues(t, expectedDef, actual()) err = binder.setFieldValue(fld, defVal, "yada", true) require.Error(t, err) } func TestParamBinding(t testing.T) { actual := new(SomeOperationParams) val := reflect.ValueOf(actual).Elem() pName := "Name" fld := val.FieldByName(pName) binder := &untypedParamBinder{ parameter: spec.QueryParam(pName).Typed(typeString, "").WithDefault("some-name"), Name: pName, } err := binder.setFieldValue(fld, "some-name", "the name value", true) require.NoError(t, err) assert.Equal(t, "the name value", actual.Name) err = binder.setFieldValue(fld, "some-name", "", true) require.NoError(t, err) assert.Equal(t, "some-name", actual.Name) IntParamTest(t, "ID", val, 1, 1, func() interface{} { return actual.ID }) IntParamTest(t, "ID", val, nil, 0, func() interface{} { return actual.ID }) IntParamTest(t, "Age", val, 1, 1, func() interface{} { return actual.Age }) IntParamTest(t, "Age", val, nil, 0, func() interface{} { return actual.Age }) IntParamTest(t, "Visits", val, 1, 1, func() interface{} { return actual.Visits }) IntParamTest(t, "Visits", val, nil, 0, func() interface{} { return actual.Visits }) IntParamTest(t, "Count", val, 1, 1, func() interface{} { return actual.Count }) IntParamTest(t, "Count", val, nil, 0, func() interface{} { return actual.Count }) IntParamTest(t, "Seq", val, 1, 1, func() interface{} { return actual.Seq }) IntParamTest(t, "Seq", val, nil, 0, func() interface{} { return actual.Seq }) IntParamTest(t, "UID", val, uint64(1), 1, func() interface{} { return actual.UID }) IntParamTest(t, "UID", val, uint64(0), 0, func() interface{} { return actual.UID }) IntParamTest(t, "UAge", val, uint(1), 1, func() interface{} { return actual.UAge }) IntParamTest(t, "UAge", val, nil, 0, func() interface{} { return actual.UAge }) IntParamTest(t, "UVisits", val, uint32(1), 1, func() interface{} { return actual.UVisits }) IntParamTest(t, "UVisits", val, nil, 0, func() interface{} { return actual.UVisits }) IntParamTest(t, "UCount", val, uint16(1), 1, func() interface{} { return actual.UCount }) IntParamTest(t, "UCount", val, nil, 0, func() interface{} { return actual.UCount }) IntParamTest(t, "USeq", val, uint8(1), 1, func() interface{} { return actual.USeq }) IntParamTest(t, "USeq", val, nil, 0, func() interface{} { return actual.USeq }) FloatParamTest(t, "score", "Score", "float", val, 1.0, 1, func() interface{} { return actual.Score }) FloatParamTest(t, "score", "Score", "float", val, nil, 0, func() interface{} { return actual.Score }) FloatParamTest(t, "rate", "Rate", "double", val, 1.0, 1, func() interface{} { return actual.Rate }) FloatParamTest(t, "rate", "Rate", "double", val, nil, 0, func() interface{} { return actual.Rate }) pName = "Confirmed" confirmedField := val.FieldByName(pName) binder = &untypedParamBinder{ parameter: spec.QueryParam(pName).Typed("boolean", "").WithDefault(true), Name: pName, } for _, tv := range evaluatesAsTrue { err = binder.setFieldValue(confirmedField, true, tv, true) require.NoError(t, err) assert.True(t, actual.Confirmed) } err = binder.setFieldValue(confirmedField, true, "", true) require.NoError(t, err) assert.True(t, actual.Confirmed) err = binder.setFieldValue(confirmedField, true, "0", true) require.NoError(t, err) assert.False(t, actual.Confirmed) pName = "Timestamp" timeField := val.FieldByName(pName) dt := strfmt.DateTime(time.Date(2014, 3, 19, 2, 9, 0, 0, time.UTC)) binder = &untypedParamBinder{ parameter: spec.QueryParam(pName).Typed(typeString, "date-time").WithDefault(dt), Name: pName, } exp := strfmt.DateTime(time.Date(2014, 5, 14, 2, 9, 0, 0, time.UTC)) err = binder.setFieldValue(timeField, dt, exp.String(), true) require.NoError(t, err) assert.Equal(t, exp, actual.Timestamp) err = binder.setFieldValue(timeField, dt, "", true) require.NoError(t, err) assert.Equal(t, dt, actual.Timestamp) err = binder.setFieldValue(timeField, dt, "yada", true) require.Error(t, err) ddt := strfmt.Date(time.Date(2014, 3, 19, 0, 0, 0, 0, time.UTC)) pName = "Birthdate" dateField := val.FieldByName(pName) binder = &untypedParamBinder{ parameter: spec.QueryParam(pName).Typed(typeString, "date").WithDefault(ddt), Name: pName, } expd := strfmt.Date(time.Date(2014, 5, 14, 0, 0, 0, 0, time.UTC)) err = binder.setFieldValue(dateField, ddt, expd.String(), true) require.NoError(t, err) assert.Equal(t, expd, actual.Birthdate) err = binder.setFieldValue(dateField, ddt, "", true) require.NoError(t, err) assert.Equal(t, ddt, actual.Birthdate) err = binder.setFieldValue(dateField, ddt, "yada", true) require.Error(t, err) dt = strfmt.DateTime(time.Date(2014, 3, 19, 2, 9, 0, 0, time.UTC)) fdt := &dt pName = "LastFailure" ftimeField := val.FieldByName(pName) binder = &untypedParamBinder{ parameter: spec.QueryParam(pName).Typed(typeString, "date").WithDefault(fdt), Name: pName, } exp = strfmt.DateTime(time.Date(2014, 5, 14, 2, 9, 0, 0, time.UTC)) fexp := &exp err = binder.setFieldValue(ftimeField, fdt, fexp.String(), true) require.NoError(t, err) assert.Equal(t, fexp, actual.LastFailure) err = binder.setFieldValue(ftimeField, fdt, "", true) require.NoError(t, err) assert.Equal(t, fdt, actual.LastFailure) err = binder.setFieldValue(ftimeField, fdt, "", true) require.NoError(t, err) assert.Equal(t, fdt, actual.LastFailure) actual.LastFailure = nil err = binder.setFieldValue(ftimeField, fdt, "yada", true) require.Error(t, err) assert.Nil(t, actual.LastFailure) pName = "Unsupported" unsupportedField := val.FieldByName(pName) binder = &untypedParamBinder{ parameter: spec.QueryParam(pName).Typed(typeString, ""), Name: pName, } err = binder.setFieldValue(unsupportedField, nil, "", true) require.Error(t, err) } func TestSliceConversion(t *testing.T) { actual := new(SomeOperationParams) val := reflect.ValueOf(actual).Elem() // prefsField := val.FieldByName("Prefs") // cData := "yada,2,3" // _, _, err := readFormattedSliceFieldValue("Prefs", prefsField, cData, "csv", nil) // require.Error(t, err) sliced := []string{"some", typeString, "values"} seps := map[string]string{"ssv": " ", "tsv": "\t", "pipes": "\|", "csv": ",", "": ","} tagsField := val.FieldByName("Tags") for k, sep := range seps { binder := &untypedParamBinder{ Name: "Tags", parameter: spec.QueryParam("tags").CollectionOf(stringItems, k), } actual.Tags = nil cData := strings.Join(sliced, sep) tags, _, err := binder.readFormattedSliceFieldValue(cData, tagsField) require.NoError(t, err) assert.Equal(t, sliced, tags) cData = strings.Join(sliced, " "+sep+" ") tags, _, err = binder.readFormattedSliceFieldValue(cData, tagsField) require.NoError(t, err) assert.Equal(t, sliced, tags) tags, _, err = binder.readFormattedSliceFieldValue("", tagsField) require.NoError(t, err) assert.Empty(t, tags) } assert.Nil(t, swag.SplitByFormat("yada", "multi")) assert.Nil(t, swag.SplitByFormat("", "")) categoriesField := val.FieldByName("Categories") binder := &untypedParamBinder{ Name: "Categories", parameter: spec.QueryParam("categories").CollectionOf(stringItems, "csv"), } cData := strings.Join(sliced, ",") categories, custom, err := binder.readFormattedSliceFieldValue(cData, categoriesField) require.NoError(t, err) assert.EqualValues(t, sliced, actual.Categories) assert.True(t, custom) assert.Empty(t, categories) categories, custom, err = binder.readFormattedSliceFieldValue("", categoriesField) require.Error(t, err) assert.True(t, custom) assert.Empty(t, categories) }	10.17 KB	2025-05-25 12:27
📄 swaggerui.go package middleware import ( "bytes" "fmt" "html/template" "net/http" "path" ) // SwaggerUIOpts configures the SwaggerUI middleware type SwaggerUIOpts struct { // BasePath for the API, defaults to: / BasePath string // Path combines with BasePath to construct the path to the UI, defaults to: "docs". Path string // SpecURL is the URL of the spec document. // // Defaults to: /swagger.json SpecURL string // Title for the documentation site, default to: API documentation Title string // Template specifies a custom template to serve the UI Template string // OAuthCallbackURL the url called after OAuth2 login OAuthCallbackURL string // The three components needed to embed swagger-ui // SwaggerURL points to the js that generates the SwaggerUI site. // // Defaults to: https://unpkg.com/swagger-ui-dist/swagger-ui-bundle.js SwaggerURL string SwaggerPresetURL string SwaggerStylesURL string Favicon32 string Favicon16 string } // EnsureDefaults in case some options are missing func (r SwaggerUIOpts) EnsureDefaults() { r.ensureDefaults() if r.Template == "" { r.Template = swaggeruiTemplate } } func (r SwaggerUIOpts) EnsureDefaultsOauth2() { r.ensureDefaults() if r.Template == "" { r.Template = swaggerOAuthTemplate } } func (r SwaggerUIOpts) ensureDefaults() { common := toCommonUIOptions(r) common.EnsureDefaults() fromCommonToAnyOptions(common, r) // swaggerui-specifics if r.OAuthCallbackURL == "" { r.OAuthCallbackURL = path.Join(r.BasePath, r.Path, "oauth2-callback") } if r.SwaggerURL == "" { r.SwaggerURL = swaggerLatest } if r.SwaggerPresetURL == "" { r.SwaggerPresetURL = swaggerPresetLatest } if r.SwaggerStylesURL == "" { r.SwaggerStylesURL = swaggerStylesLatest } if r.Favicon16 == "" { r.Favicon16 = swaggerFavicon16Latest } if r.Favicon32 == "" { r.Favicon32 = swaggerFavicon32Latest } } // SwaggerUI creates a middleware to serve a documentation site for a swagger spec. // // This allows for altering the spec before starting the http listener. func SwaggerUI(opts SwaggerUIOpts, next http.Handler) http.Handler { opts.EnsureDefaults() pth := path.Join(opts.BasePath, opts.Path) tmpl := template.Must(template.New("swaggerui").Parse(opts.Template)) assets := bytes.NewBuffer(nil) if err := tmpl.Execute(assets, opts); err != nil { panic(fmt.Errorf("cannot execute template: %w", err)) } return serveUI(pth, assets.Bytes(), next) } const ( swaggerLatest = "https://unpkg.com/swagger-ui-dist/swagger-ui-bundle.js" swaggerPresetLatest = "https://unpkg.com/swagger-ui-dist/swagger-ui-standalone-preset.js" swaggerStylesLatest = "https://unpkg.com/swagger-ui-dist/swagger-ui.css" swaggerFavicon32Latest = "https://unpkg.com/swagger-ui-dist/favicon-32x32.png" swaggerFavicon16Latest = "https://unpkg.com/swagger-ui-dist/favicon-16x16.png" swaggeruiTemplate = ` <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>{{ .Title }}</title> <link rel="stylesheet" type="text/css" href="{{ .SwaggerStylesURL }}" > <link rel="icon" type="image/png" href="{{ .Favicon32 }}" sizes="32x32" /> <link rel="icon" type="image/png" href="{{ .Favicon16 }}" sizes="16x16" /> <style> html { box-sizing: border-box; overflow: -moz-scrollbars-vertical; overflow-y: scroll; } , :before, :after { box-sizing: inherit; } body { margin:0; background: #fafafa; } </style> </head> <body> <div id="swagger-ui"></div> <script src="{{ .SwaggerURL }}"> </script> <script src="{{ .SwaggerPresetURL }}"> </script> <script> window.onload = function() { // Begin Swagger UI call region const ui = SwaggerUIBundle({ url: '{{ .SpecURL }}', dom_id: '#swagger-ui', deepLinking: true, presets: [ SwaggerUIBundle.presets.apis, SwaggerUIStandalonePreset ], plugins: [ SwaggerUIBundle.plugins.DownloadUrl ], layout: "StandaloneLayout", oauth2RedirectUrl: '{{ .OAuthCallbackURL }}' }) // End Swagger UI call region window.ui = ui } </script> </body> </html> ` )	4.18 KB	2025-05-25 12:27
📄 swaggerui_oauth2.go package middleware import ( "bytes" "fmt" "net/http" "text/template" ) func SwaggerUIOAuth2Callback(opts SwaggerUIOpts, next http.Handler) http.Handler { opts.EnsureDefaultsOauth2() pth := opts.OAuthCallbackURL tmpl := template.Must(template.New("swaggeroauth").Parse(opts.Template)) assets := bytes.NewBuffer(nil) if err := tmpl.Execute(assets, opts); err != nil { panic(fmt.Errorf("cannot execute template: %w", err)) } return serveUI(pth, assets.Bytes(), next) } const ( swaggerOAuthTemplate = ` <!DOCTYPE html> <html lang="en"> <head> <title>{{ .Title }}</title> </head> <body> <script> 'use strict'; function run () { var oauth2 = window.opener.swaggerUIRedirectOauth2; var sentState = oauth2.state; var redirectUrl = oauth2.redirectUrl; var isValid, qp, arr; if (/code\|token\|error/.test(window.location.hash)) { qp = window.location.hash.substring(1).replace('?', '&'); } else { qp = location.search.substring(1); } arr = qp.split("&"); arr.forEach(function (v,i,_arr) { _arr[i] = '"' + v.replace('=', '":"') + '"';}); qp = qp ? JSON.parse('{' + arr.join() + '}', function (key, value) { return key === "" ? value : decodeURIComponent(value); } ) : {}; isValid = qp.state === sentState; if (( oauth2.auth.schema.get("flow") === "accessCode" \|\| oauth2.auth.schema.get("flow") === "authorizationCode" \|\| oauth2.auth.schema.get("flow") === "authorization_code" ) && !oauth2.auth.code) { if (!isValid) { oauth2.errCb({ authId: oauth2.auth.name, source: "auth", level: "warning", message: "Authorization may be unsafe, passed state was changed in server. The passed state wasn't returned from auth server." }); } if (qp.code) { delete oauth2.state; oauth2.auth.code = qp.code; oauth2.callback({auth: oauth2.auth, redirectUrl: redirectUrl}); } else { let oauthErrorMsg; if (qp.error) { oauthErrorMsg = "["+qp.error+"]: " + (qp.error_description ? qp.error_description+ ". " : "no accessCode received from the server. ") + (qp.error_uri ? "More info: "+qp.error_uri : ""); } oauth2.errCb({ authId: oauth2.auth.name, source: "auth", level: "error", message: oauthErrorMsg \|\| "[Authorization failed]: no accessCode received from the server." }); } } else { oauth2.callback({auth: oauth2.auth, token: qp, isValid: isValid, redirectUrl: redirectUrl}); } window.close(); } if (document.readyState !== 'loading') { run(); } else { document.addEventListener('DOMContentLoaded', function () { run(); }); } </script> </body> </html> ` )	3.14 KB	2025-05-25 12:27
📄 swaggerui_oauth2_test.go package middleware import ( "context" "fmt" "net/http" "net/http/httptest" "testing" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) func TestSwaggerUIOAuth2CallbackMiddleware(t testing.T) { t.Run("with defaults", func(t testing.T) { doc := SwaggerUIOAuth2Callback(SwaggerUIOpts{}, nil) req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, "/docs/oauth2-callback", nil) require.NoError(t, err) recorder := httptest.NewRecorder() doc.ServeHTTP(recorder, req) require.Equal(t, http.StatusOK, recorder.Code) assert.Equal(t, "text/html; charset=utf-8", recorder.Header().Get(contentTypeHeader)) var o SwaggerUIOpts o.EnsureDefaultsOauth2() htmlResponse := recorder.Body.String() assert.Contains(t, htmlResponse, fmt.Sprintf("<title>%s</title>", o.Title)) assert.Contains(t, htmlResponse, `oauth2.auth.schema.get("flow") === "accessCode"`) }) t.Run("edge cases", func(t testing.T) { t.Run("with custom template that fails to execute", func(t testing.T) { assert.Panics(t, func() { SwaggerUIOAuth2Callback(SwaggerUIOpts{ Template: `<!DOCTYPE html> <html> spec-url='{{ .Unknown }}' </html> `, }, nil) }) }) }) }	1.2 KB	2025-05-25 12:27
📄 swaggerui_test.go package middleware import ( "context" "fmt" "net/http" "net/http/httptest" "strings" "testing" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) func TestSwaggerUIMiddleware(t testing.T) { var o SwaggerUIOpts o.EnsureDefaults() swui := SwaggerUI(o, nil) t.Run("with defaults ", func(t testing.T) { req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, "/docs", nil) require.NoError(t, err) recorder := httptest.NewRecorder() swui.ServeHTTP(recorder, req) assert.Equal(t, http.StatusOK, recorder.Code) assert.Equal(t, "text/html; charset=utf-8", recorder.Header().Get(contentTypeHeader)) assert.Contains(t, recorder.Body.String(), fmt.Sprintf("<title>%s</title>", o.Title)) assert.Contains(t, recorder.Body.String(), fmt.Sprintf(`url: '%s',`, strings.ReplaceAll(o.SpecURL, `/`, `\/`))) assert.Contains(t, recorder.Body.String(), swaggerLatest) assert.Contains(t, recorder.Body.String(), swaggerPresetLatest) assert.Contains(t, recorder.Body.String(), swaggerStylesLatest) assert.Contains(t, recorder.Body.String(), swaggerFavicon16Latest) assert.Contains(t, recorder.Body.String(), swaggerFavicon32Latest) }) t.Run("with path with a trailing / (issue #238)", func(t testing.T) { req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, "/docs/", nil) require.NoError(t, err) recorder := httptest.NewRecorder() swui.ServeHTTP(recorder, req) assert.Equal(t, http.StatusOK, recorder.Code) }) t.Run("should yield not found", func(t testing.T) { req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, "/nowhere", nil) require.NoError(t, err) recorder := httptest.NewRecorder() swui.ServeHTTP(recorder, req) assert.Equal(t, http.StatusNotFound, recorder.Code) }) t.Run("edge cases", func(t testing.T) { t.Run("with custom template that fails to execute", func(t testing.T) { assert.Panics(t, func() { SwaggerUI(SwaggerUIOpts{ Template: `<!DOCTYPE html> <html> spec-url='{{ .Unknown }}' </html> `, }, nil) }) }) }) }	2.06 KB	2025-05-25 12:27
📄 ui_options.go package middleware import ( "bytes" "encoding/gob" "fmt" "net/http" "path" "strings" ) const ( // constants that are common to all UI-serving middlewares defaultDocsPath = "docs" defaultDocsURL = "/swagger.json" defaultDocsTitle = "API Documentation" ) // uiOptions defines common options for UI serving middlewares. type uiOptions struct { // BasePath for the UI, defaults to: / BasePath string // Path combines with BasePath to construct the path to the UI, defaults to: "docs". Path string // SpecURL is the URL of the spec document. // // Defaults to: /swagger.json SpecURL string // Title for the documentation site, default to: API documentation Title string // Template specifies a custom template to serve the UI Template string } // toCommonUIOptions converts any UI option type to retain the common options. // // This uses gob encoding/decoding to convert common fields from one struct to another. func toCommonUIOptions(opts interface{}) uiOptions { var buf bytes.Buffer enc := gob.NewEncoder(&buf) dec := gob.NewDecoder(&buf) var o uiOptions err := enc.Encode(opts) if err != nil { panic(err) } err = dec.Decode(&o) if err != nil { panic(err) } return o } func fromCommonToAnyOptions[T any](source uiOptions, target T) { var buf bytes.Buffer enc := gob.NewEncoder(&buf) dec := gob.NewDecoder(&buf) err := enc.Encode(source) if err != nil { panic(err) } err = dec.Decode(target) if err != nil { panic(err) } } // UIOption can be applied to UI serving middleware, such as Context.APIHandler or // Context.APIHandlerSwaggerUI to alter the defaut behavior. type UIOption func(uiOptions) func uiOptionsWithDefaults(opts []UIOption) uiOptions { var o uiOptions for _, apply := range opts { apply(&o) } return o } // WithUIBasePath sets the base path from where to serve the UI assets. // // By default, Context middleware sets this value to the API base path. func WithUIBasePath(base string) UIOption { return func(o uiOptions) { if !strings.HasPrefix(base, "/") { base = "/" + base } o.BasePath = base } } // WithUIPath sets the path from where to serve the UI assets (i.e. /{basepath}/{path}. func WithUIPath(pth string) UIOption { return func(o uiOptions) { o.Path = pth } } // WithUISpecURL sets the path from where to serve swagger spec document. // // This may be specified as a full URL or a path. // // By default, this is "/swagger.json" func WithUISpecURL(specURL string) UIOption { return func(o uiOptions) { o.SpecURL = specURL } } // WithUITitle sets the title of the UI. // // By default, Context middleware sets this value to the title found in the API spec. func WithUITitle(title string) UIOption { return func(o uiOptions) { o.Title = title } } // WithTemplate allows to set a custom template for the UI. // // UI middleware will panic if the template does not parse or execute properly. func WithTemplate(tpl string) UIOption { return func(o uiOptions) { o.Template = tpl } } // EnsureDefaults in case some options are missing func (r uiOptions) EnsureDefaults() { if r.BasePath == "" { r.BasePath = "/" } if r.Path == "" { r.Path = defaultDocsPath } if r.SpecURL == "" { r.SpecURL = defaultDocsURL } if r.Title == "" { r.Title = defaultDocsTitle } } // serveUI creates a middleware that serves a templated asset as text/html. func serveUI(pth string, assets []byte, next http.Handler) http.Handler { return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) { if path.Clean(r.URL.Path) == pth { rw.Header().Set(contentTypeHeader, "text/html; charset=utf-8") rw.WriteHeader(http.StatusOK) _, _ = rw.Write(assets) return } if next != nil { next.ServeHTTP(rw, r) return } rw.Header().Set(contentTypeHeader, "text/plain") rw.WriteHeader(http.StatusNotFound) _, _ = rw.Write([]byte(fmt.Sprintf("%q not found", pth))) }) }	3.83 KB	2025-05-25 12:27
📄 ui_options_test.go package middleware import ( "testing" "github.com/stretchr/testify/require" ) func TestConvertOptions(t testing.T) { t.Run("from any UI options to uiOptions", func(t testing.T) { t.Run("from RedocOpts", func(t testing.T) { in := RedocOpts{ BasePath: "a", Path: "b", SpecURL: "c", Template: "d", Title: "e", RedocURL: "f", } out := toCommonUIOptions(in) require.Equal(t, "a", out.BasePath) require.Equal(t, "b", out.Path) require.Equal(t, "c", out.SpecURL) require.Equal(t, "d", out.Template) require.Equal(t, "e", out.Title) }) t.Run("from RapiDocOpts", func(t testing.T) { in := RapiDocOpts{ BasePath: "a", Path: "b", SpecURL: "c", Template: "d", Title: "e", RapiDocURL: "f", } out := toCommonUIOptions(in) require.Equal(t, "a", out.BasePath) require.Equal(t, "b", out.Path) require.Equal(t, "c", out.SpecURL) require.Equal(t, "d", out.Template) require.Equal(t, "e", out.Title) }) t.Run("from SwaggerUIOpts", func(t testing.T) { in := SwaggerUIOpts{ BasePath: "a", Path: "b", SpecURL: "c", Template: "d", Title: "e", SwaggerURL: "f", } out := toCommonUIOptions(in) require.Equal(t, "a", out.BasePath) require.Equal(t, "b", out.Path) require.Equal(t, "c", out.SpecURL) require.Equal(t, "d", out.Template) require.Equal(t, "e", out.Title) }) }) t.Run("from uiOptions to any UI options", func(t testing.T) { in := uiOptions{ BasePath: "a", Path: "b", SpecURL: "c", Template: "d", Title: "e", } t.Run("to RedocOpts", func(t testing.T) { var out RedocOpts fromCommonToAnyOptions(in, &out) require.Equal(t, "a", out.BasePath) require.Equal(t, "b", out.Path) require.Equal(t, "c", out.SpecURL) require.Equal(t, "d", out.Template) require.Equal(t, "e", out.Title) }) t.Run("to RapiDocOpts", func(t testing.T) { var out RapiDocOpts fromCommonToAnyOptions(in, &out) require.Equal(t, "a", out.BasePath) require.Equal(t, "b", out.Path) require.Equal(t, "c", out.SpecURL) require.Equal(t, "d", out.Template) require.Equal(t, "e", out.Title) }) t.Run("to SwaggerUIOpts", func(t *testing.T) { var out SwaggerUIOpts fromCommonToAnyOptions(in, &out) require.Equal(t, "a", out.BasePath) require.Equal(t, "b", out.Path) require.Equal(t, "c", out.SpecURL) require.Equal(t, "d", out.Template) require.Equal(t, "e", out.Title) }) }) }	2.48 KB	2025-05-25 12:27
📁 untyped	-	2025-05-25 12:27
📄 untyped_request_test.go // Copyright 2015 go-swagger maintainers // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package middleware import ( "bytes" "context" "encoding/base64" "encoding/json" "io" "mime/multipart" "net/http" "net/url" "strings" "testing" "time" "github.com/go-openapi/runtime" "github.com/go-openapi/strfmt" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) func TestUntypedFormPost(t testing.T) { params := parametersForFormUpload() binder := NewUntypedRequestBinder(params, nil, strfmt.Default) req, err := http.NewRequestWithContext(context.Background(), http.MethodPost, testURL, bytes.NewBufferString(`name=the-name&age=32`)) require.NoError(t, err) req.Header.Set("Content-Type", "application/x-www-form-urlencoded") data := make(map[string]interface{}) require.NoError(t, binder.Bind(req, nil, runtime.JSONConsumer(), &data)) assert.Equal(t, "the-name", data["name"]) assert.EqualValues(t, 32, data["age"]) req, err = http.NewRequestWithContext(context.Background(), http.MethodPost, testURL, bytes.NewBufferString(`name=%3&age=32`)) require.NoError(t, err) req.Header.Set("Content-Type", "application/x-www-form-urlencoded") data = make(map[string]interface{}) require.Error(t, binder.Bind(req, nil, runtime.JSONConsumer(), &data)) } func TestUntypedFileUpload(t testing.T) { binder := paramsForFileUpload() body := bytes.NewBuffer(nil) writer := multipart.NewWriter(body) part, err := writer.CreateFormFile("file", "plain-jane.txt") require.NoError(t, err) _, err = part.Write([]byte("the file contents")) require.NoError(t, err) require.NoError(t, writer.WriteField("name", "the-name")) require.NoError(t, writer.Close()) req, err := http.NewRequestWithContext(context.Background(), http.MethodPost, testURL, body) require.NoError(t, err) req.Header.Set("Content-Type", writer.FormDataContentType()) data := make(map[string]interface{}) require.NoError(t, binder.Bind(req, nil, runtime.JSONConsumer(), &data)) assert.Equal(t, "the-name", data["name"]) assert.NotNil(t, data["file"]) assert.IsType(t, runtime.File{}, data["file"]) file := data["file"].(runtime.File) require.NotNil(t, file.Header) assert.Equal(t, "plain-jane.txt", file.Header.Filename) bb, err := io.ReadAll(file.Data) require.NoError(t, err) assert.Equal(t, []byte("the file contents"), bb) req, err = http.NewRequestWithContext(context.Background(), http.MethodPost, testURL, body) require.NoError(t, err) req.Header.Set("Content-Type", "application/json") data = make(map[string]interface{}) require.Error(t, binder.Bind(req, nil, runtime.JSONConsumer(), &data)) req, err = http.NewRequestWithContext(context.Background(), http.MethodPost, testURL, body) require.NoError(t, err) req.Header.Set("Content-Type", "application(") data = make(map[string]interface{}) require.Error(t, binder.Bind(req, nil, runtime.JSONConsumer(), &data)) body = bytes.NewBuffer(nil) writer = multipart.NewWriter(body) part, err = writer.CreateFormFile("bad-name", "plain-jane.txt") require.NoError(t, err) _, err = part.Write([]byte("the file contents")) require.NoError(t, err) require.NoError(t, writer.WriteField("name", "the-name")) require.NoError(t, writer.Close()) req, err = http.NewRequestWithContext(context.Background(), http.MethodPost, testURL, body) require.NoError(t, err) req.Header.Set("Content-Type", writer.FormDataContentType()) data = make(map[string]interface{}) require.Error(t, binder.Bind(req, nil, runtime.JSONConsumer(), &data)) req, err = http.NewRequestWithContext(context.Background(), http.MethodPost, testURL, body) require.NoError(t, err) req.Header.Set("Content-Type", writer.FormDataContentType()) _, err = req.MultipartReader() require.NoError(t, err) data = make(map[string]interface{}) require.Error(t, binder.Bind(req, nil, runtime.JSONConsumer(), &data)) writer = multipart.NewWriter(body) require.NoError(t, writer.WriteField("name", "the-name")) require.NoError(t, writer.Close()) req, err = http.NewRequestWithContext(context.Background(), http.MethodPost, testURL, body) require.NoError(t, err) req.Header.Set("Content-Type", writer.FormDataContentType()) data = make(map[string]interface{}) require.Error(t, binder.Bind(req, nil, runtime.JSONConsumer(), &data)) } func TestUntypedOptionalFileUpload(t testing.T) { binder := paramsForOptionalFileUpload() body := bytes.NewBuffer(nil) writer := multipart.NewWriter(body) require.NoError(t, writer.WriteField("name", "the-name")) require.NoError(t, writer.Close()) req, err := http.NewRequestWithContext(context.Background(), http.MethodPost, testURL, body) require.NoError(t, err) req.Header.Set("Content-Type", writer.FormDataContentType()) data := make(map[string]interface{}) require.NoError(t, binder.Bind(req, nil, runtime.JSONConsumer(), &data)) assert.Equal(t, "the-name", data["name"]) writer = multipart.NewWriter(body) part, err := writer.CreateFormFile("file", "plain-jane.txt") require.NoError(t, err) _, err = part.Write([]byte("the file contents")) require.NoError(t, err) require.NoError(t, writer.WriteField("name", "the-name")) require.NoError(t, writer.Close()) req, err = http.NewRequestWithContext(context.Background(), http.MethodPost, testURL, body) require.NoError(t, err) req.Header.Set("Content-Type", writer.FormDataContentType()) require.NoError(t, writer.Close()) data = make(map[string]interface{}) require.NoError(t, binder.Bind(req, nil, runtime.JSONConsumer(), &data)) assert.Equal(t, "the-name", data["name"]) assert.NotNil(t, data["file"]) assert.IsType(t, runtime.File{}, data["file"]) file := data["file"].(runtime.File) assert.NotNil(t, file.Header) assert.Equal(t, "plain-jane.txt", file.Header.Filename) } func TestUntypedBindingTypesForValid(t testing.T) { op2 := parametersForAllTypes("") binder := NewUntypedRequestBinder(op2, nil, strfmt.Default) confirmed := true name := "thomas" friend := map[string]interface{}{"name": "toby", "age": json.Number("32")} id, age, score, factor := int64(7575), int32(348), float32(5.309), float64(37.403) requestID := 19394858 tags := []string{"one", "two", "three"} dt1 := time.Date(2014, 8, 9, 0, 0, 0, 0, time.UTC) planned := strfmt.Date(dt1) dt2 := time.Date(2014, 10, 12, 8, 5, 5, 0, time.UTC) delivered := strfmt.DateTime(dt2) picture := base64.URLEncoding.EncodeToString([]byte("hello")) uri, err := url.Parse("http://localhost:8002/hello/7575") require.NoError(t, err) qs := uri.Query() qs.Add("name", name) qs.Add("confirmed", "true") qs.Add("age", "348") qs.Add("score", "5.309") qs.Add("factor", "37.403") qs.Add("tags", strings.Join(tags, ",")) qs.Add("planned", planned.String()) qs.Add("delivered", delivered.String()) qs.Add("picture", picture) req, err := http.NewRequestWithContext(context.Background(), http.MethodPost, uri.String()+"?"+qs.Encode(), bytes.NewBufferString(`{"name":"toby","age":32}`)) require.NoError(t, err) req.Header.Set("Content-Type", "application/json") req.Header.Set("X-Request-Id", "19394858") data := make(map[string]interface{}) err = binder.Bind(req, RouteParams([]RouteParam{{"id", "7575"}}), runtime.JSONConsumer(), &data) require.NoError(t, err) assert.Equal(t, id, data["id"]) assert.Equal(t, name, data["name"]) assert.Equal(t, friend, data["friend"]) assert.EqualValues(t, requestID, data["X-Request-Id"]) assert.Equal(t, tags, data["tags"]) assert.Equal(t, planned, data["planned"]) assert.Equal(t, delivered, data["delivered"]) assert.Equal(t, confirmed, data["confirmed"]) assert.Equal(t, age, data["age"]) assert.InDelta(t, factor, data["factor"], 1e-6) assert.InDelta(t, score, data["score"], 1e-6) pb, err := base64.URLEncoding.DecodeString(picture) require.NoError(t, err) assert.EqualValues(t, pb, data["picture"].(strfmt.Base64)) }	8.16 KB	2025-05-25 12:27
📄 validation.go // Copyright 2015 go-swagger maintainers // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package middleware import ( "mime" "net/http" "strings" "github.com/go-openapi/errors" "github.com/go-openapi/swag" "github.com/go-openapi/runtime" ) type validation struct { context Context result []error request http.Request route MatchedRoute bound map[string]interface{} } // ContentType validates the content type of a request func validateContentType(allowed []string, actual string) error { if len(allowed) == 0 { return nil } mt, _, err := mime.ParseMediaType(actual) if err != nil { return errors.InvalidContentType(actual, allowed) } if swag.ContainsStringsCI(allowed, mt) { return nil } if swag.ContainsStringsCI(allowed, "/") { return nil } parts := strings.Split(actual, "/") if len(parts) == 2 && swag.ContainsStringsCI(allowed, parts[0]+"/") { return nil } return errors.InvalidContentType(actual, allowed) } func validateRequest(ctx Context, request http.Request, route MatchedRoute) validation { validate := &validation{ context: ctx, request: request, route: route, bound: make(map[string]interface{}), } validate.debugLogf("validating request %s %s", request.Method, request.URL.EscapedPath()) validate.contentType() if len(validate.result) == 0 { validate.responseFormat() } if len(validate.result) == 0 { validate.parameters() } return validate } func (v validation) debugLogf(format string, args ...any) { v.context.debugLogf(format, args...) } func (v validation) parameters() { v.debugLogf("validating request parameters for %s %s", v.request.Method, v.request.URL.EscapedPath()) if result := v.route.Binder.Bind(v.request, v.route.Params, v.route.Consumer, v.bound); result != nil { if result.Error() == "validation failure list" { for _, e := range result.(errors.Validation).Value.([]interface{}) { v.result = append(v.result, e.(error)) } return } v.result = append(v.result, result) } } func (v validation) contentType() { if len(v.result) == 0 && runtime.HasBody(v.request) { v.debugLogf("validating body content type for %s %s", v.request.Method, v.request.URL.EscapedPath()) ct, _, req, err := v.context.ContentType(v.request) if err != nil { v.result = append(v.result, err) } else { v.request = req } if len(v.result) == 0 { v.debugLogf("validating content type for %q against [%s]", ct, strings.Join(v.route.Consumes, ", ")) if err := validateContentType(v.route.Consumes, ct); err != nil { v.result = append(v.result, err) } } if ct != "" && v.route.Consumer == nil { cons, ok := v.route.Consumers[ct] if !ok { v.result = append(v.result, errors.New(500, "no consumer registered for %s", ct)) } else { v.route.Consumer = cons } } } } func (v *validation) responseFormat() { // if the route provides values for Produces and no format could be identify then return an error. // if the route does not specify values for Produces then treat request as valid since the API designer // choose not to specify the format for responses. if str, rCtx := v.context.ResponseFormat(v.request, v.route.Produces); str == "" && len(v.route.Produces) > 0 { v.request = rCtx v.result = append(v.result, errors.InvalidResponseFormat(v.request.Header.Get(runtime.HeaderAccept), v.route.Produces)) } }	3.81 KB	2025-05-25 12:27
📄 validation_test.go // Copyright 2015 go-swagger maintainers // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package middleware import ( "bytes" stdcontext "context" "net/http" "net/http/httptest" "strings" "testing" "github.com/go-openapi/errors" "github.com/go-openapi/runtime" "github.com/go-openapi/runtime/internal/testing/petstore" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) func newTestValidation(ctx Context, next http.Handler) http.Handler { return http.HandlerFunc(func(rw http.ResponseWriter, r http.Request) { matched, rCtx, _ := ctx.RouteInfo(r) if rCtx != nil { r = rCtx } if matched == nil { ctx.NotFound(rw, r) return } _, r, result := ctx.BindAndValidate(r, matched) if result != nil { ctx.Respond(rw, r, matched.Produces, matched, result) return } next.ServeHTTP(rw, r) }) } func TestContentTypeValidation(t testing.T) { spec, api := petstore.NewAPI(t) context := NewContext(spec, api, nil) context.router = DefaultRouter(spec, context.api) mw := newTestValidation(context, http.HandlerFunc(terminator)) recorder := httptest.NewRecorder() request, _ := http.NewRequestWithContext(stdcontext.Background(), http.MethodGet, "/api/pets", nil) request.Header.Add("Accept", "/") mw.ServeHTTP(recorder, request) assert.Equal(t, http.StatusOK, recorder.Code) recorder = httptest.NewRecorder() request, _ = http.NewRequestWithContext(stdcontext.Background(), http.MethodPost, "/api/pets", nil) request.Header.Add("content-type", "application(") request.Header.Add("Accept", "application/json") request.ContentLength = 1 mw.ServeHTTP(recorder, request) assert.Equal(t, http.StatusBadRequest, recorder.Code) assert.Equal(t, "application/json", recorder.Header().Get("content-type")) recorder = httptest.NewRecorder() request, _ = http.NewRequestWithContext(stdcontext.Background(), http.MethodPost, "/api/pets", nil) request.Header.Add("Accept", "application/json") request.Header.Add("content-type", "text/html") request.ContentLength = 1 mw.ServeHTTP(recorder, request) assert.Equal(t, http.StatusUnsupportedMediaType, recorder.Code) assert.Equal(t, "application/json", recorder.Header().Get("content-type")) recorder = httptest.NewRecorder() request, _ = http.NewRequestWithContext(stdcontext.Background(), http.MethodPost, "/api/pets", strings.NewReader(`{"name":"dog"}`)) request.Header.Add("Accept", "application/json") request.Header.Add("content-type", "text/html") request.TransferEncoding = []string{"chunked"} mw.ServeHTTP(recorder, request) assert.Equal(t, http.StatusUnsupportedMediaType, recorder.Code) assert.Equal(t, "application/json", recorder.Header().Get("content-type")) recorder = httptest.NewRecorder() request, _ = http.NewRequestWithContext(stdcontext.Background(), http.MethodPost, "/api/pets", nil) request.Header.Add("Accept", "application/json+special") request.Header.Add("content-type", "text/html") mw.ServeHTTP(recorder, request) assert.Equal(t, 406, recorder.Code) assert.Equal(t, "application/json", recorder.Header().Get("content-type")) // client sends data with unsupported mime recorder = httptest.NewRecorder() request, _ = http.NewRequestWithContext(stdcontext.Background(), http.MethodPost, "/api/pets", nil) request.Header.Add("Accept", "application/json") // this content type is served by default by the API request.Header.Add("content-type", "application/json+special") request.ContentLength = 1 mw.ServeHTTP(recorder, request) assert.Equal(t, 415, recorder.Code) // Unsupported media type assert.Equal(t, "application/json", recorder.Header().Get("content-type")) // client sends a body of data with no mime: breaks recorder = httptest.NewRecorder() request, _ = http.NewRequestWithContext(stdcontext.Background(), http.MethodPost, "/api/pets", nil) request.Header.Add("Accept", "application/json") request.ContentLength = 1 mw.ServeHTTP(recorder, request) assert.Equal(t, 415, recorder.Code) assert.Equal(t, "application/json", recorder.Header().Get("content-type")) } func TestResponseFormatValidation(t testing.T) { spec, api := petstore.NewAPI(t) context := NewContext(spec, api, nil) context.router = DefaultRouter(spec, context.api) mw := newTestValidation(context, http.HandlerFunc(terminator)) recorder := httptest.NewRecorder() request, _ := http.NewRequestWithContext(stdcontext.Background(), http.MethodPost, "/api/pets", bytes.NewBufferString(`name: Dog`)) request.Header.Set(runtime.HeaderContentType, "application/x-yaml") request.Header.Set(runtime.HeaderAccept, "application/x-yaml") mw.ServeHTTP(recorder, request) assert.Equal(t, 200, recorder.Code, recorder.Body.String()) recorder = httptest.NewRecorder() request, _ = http.NewRequestWithContext(stdcontext.Background(), http.MethodPost, "/api/pets", bytes.NewBufferString(`name: Dog`)) request.Header.Set(runtime.HeaderContentType, "application/x-yaml") request.Header.Set(runtime.HeaderAccept, "application/sml") mw.ServeHTTP(recorder, request) assert.Equal(t, http.StatusNotAcceptable, recorder.Code) } func TestValidateContentType(t testing.T) { data := []struct { hdr string allowed []string err errors.Validation }{ {"application/json", []string{"application/json"}, nil}, {"application/json", []string{"application/x-yaml", "text/html"}, errors.InvalidContentType("application/json", []string{"application/x-yaml", "text/html"})}, {"text/html; charset=utf-8", []string{"text/html"}, nil}, {"text/html;charset=utf-8", []string{"text/html"}, nil}, {"", []string{"application/json"}, errors.InvalidContentType("", []string{"application/json"})}, {"text/html; charset=utf-8", []string{"application/json"}, errors.InvalidContentType("text/html; charset=utf-8", []string{"application/json"})}, {"application(", []string{"application/json"}, errors.InvalidContentType("application(", []string{"application/json"})}, {"application/json;char", []string{"application/json"}, errors.InvalidContentType("application/json;char", []string{"application/json"})}, {"application/octet-stream", []string{"image/jpeg", "application/"}, nil}, {"image/png", []string{"/", "application/json"}, nil}, } for _, v := range data { err := validateContentType(v.allowed, v.hdr) if v.err == nil { require.NoError(t, err, "input: %q", v.hdr) } else { require.Error(t, err, "input: %q", v.hdr) assert.IsType(t, &errors.Validation{}, err, "input: %q", v.hdr) require.EqualErrorf(t, err, v.err.Error(), "input: %q", v.hdr) assert.EqualValues(t, http.StatusUnsupportedMediaType, err.(errors.Validation).Code()) } } }	7.01 KB	2025-05-25 12:27

Edit File:

Terminal