From 7fde5ecb830696d83b45d715dc1131b4d4de0eb5 Mon Sep 17 00:00:00 2001 From: Daniel Huckins Date: Wed, 15 Feb 2023 14:57:57 -0500 Subject: [PATCH] Validate response schema for integration tests (#19043) * add RequestResponseCallback to core/options Signed-off-by: Daniel Huckins * pass in router and apply function on requests Signed-off-by: Daniel Huckins * add callback Signed-off-by: Daniel Huckins * cleanup Signed-off-by: Daniel Huckins * Apply suggestions from code review Co-authored-by: Anton Averchenkov <84287187+averche@users.noreply.github.com> * Update vault/core.go * bad typo... Signed-off-by: Daniel Huckins * use pvt interface, can't downcast to child struct Signed-off-by: Daniel Huckins * finer grained errors Signed-off-by: Daniel Huckins * trim path for backend Signed-off-by: Daniel Huckins * remove entire mount point instead of just the first part of url Signed-off-by: Daniel Huckins * Update vault/testing.go Co-authored-by: Anton Averchenkov <84287187+averche@users.noreply.github.com> * add doc string Signed-off-by: Daniel Huckins * update docstring Signed-off-by: Daniel Huckins * reformat Signed-off-by: Daniel Huckins * added changelog --------- Signed-off-by: Daniel Huckins Co-authored-by: Anton Averchenkov <84287187+averche@users.noreply.github.com> --- changelog/19043.txt | 3 ++ .../testhelpers/schema/response_validation.go | 41 +++++++++++++++++++ vault/core.go | 4 ++ vault/request_handling.go | 4 ++ vault/testing.go | 7 ++++ 5 files changed, 59 insertions(+) create mode 100644 changelog/19043.txt diff --git a/changelog/19043.txt b/changelog/19043.txt new file mode 100644 index 000000000..20a1a77bb --- /dev/null +++ b/changelog/19043.txt @@ -0,0 +1,3 @@ +```release-note:improvement +openapi: added ability to validate response structures against openapi schema for test clusters +``` \ No newline at end of file diff --git a/sdk/helper/testhelpers/schema/response_validation.go b/sdk/helper/testhelpers/schema/response_validation.go index 2a2d6b3b5..1238c595e 100644 --- a/sdk/helper/testhelpers/schema/response_validation.go +++ b/sdk/helper/testhelpers/schema/response_validation.go @@ -4,6 +4,7 @@ import ( "encoding/json" "fmt" "net/http" + "strings" "testing" "github.com/hashicorp/vault/sdk/framework" @@ -126,3 +127,43 @@ func GetResponseSchema(t *testing.T, path *framework.Path, operation logical.Ope return &schemaResponses[0] } + +// ResponseValidatingCallback can be used in setting up a [vault.TestCluster] that validates every response against the +// openapi specifications +// +// [vault.TestCluster]: https://pkg.go.dev/github.com/hashicorp/vault/vault#TestCluster +func ResponseValidatingCallback(t *testing.T) func(logical.Backend, *logical.Request, *logical.Response) { + type PathRouter interface { + Route(string) *framework.Path + } + + return func(b logical.Backend, req *logical.Request, resp *logical.Response) { + t.Helper() + + if b == nil { + t.Fatalf("non-nil backend required") + } + backend, ok := b.(PathRouter) + if !ok { + t.Fatalf("could not cast %T to have `Route(string) *framework.Path`", b) + } + + // the full request path includes the backend + // but when passing to the backend, we have to trim the mount point + // `sys/mounts/secret` -> `mounts/secret` + // `auth/token/create` -> `create` + requestPath := strings.TrimPrefix(req.Path, req.MountPoint) + + route := backend.Route(requestPath) + if route == nil { + t.Fatalf("backend %T could not find a route for %s", b, req.Path) + } + + ValidateResponse( + t, + GetResponseSchema(t, route, req.Operation), + resp, + true, + ) + } +} diff --git a/vault/core.go b/vault/core.go index 50077d673..45940ae94 100644 --- a/vault/core.go +++ b/vault/core.go @@ -688,6 +688,10 @@ type Core struct { // contains absolute paths that we intend to forward (and template) when // we're on a secondary cluster. writeForwardedPaths *pathmanager.PathManager + + // if populated, the callback is called for every request + // for testing purposes + requestResponseCallback func(logical.Backend, *logical.Request, *logical.Response) } // c.stateLock needs to be held in read mode before calling this function. diff --git a/vault/request_handling.go b/vault/request_handling.go index ff041838d..164956950 100644 --- a/vault/request_handling.go +++ b/vault/request_handling.go @@ -675,6 +675,10 @@ func (c *Core) handleCancelableRequest(ctx context.Context, req *logical.Request resp, auth, err = c.handleRequest(ctx, req) } + if err == nil && c.requestResponseCallback != nil { + c.requestResponseCallback(c.router.MatchingBackend(ctx, req.Path), req, resp) + } + // If we saved the token in the request, we should return it in the response // data. if resp != nil && resp.Data != nil { diff --git a/vault/testing.go b/vault/testing.go index da3c72e33..da11ae30c 100644 --- a/vault/testing.go +++ b/vault/testing.go @@ -1186,6 +1186,9 @@ type TestClusterOptions struct { NoDefaultQuotas bool Plugins *TestPluginConfig + + // if populated, the callback is called for every request + RequestResponseCallback func(logical.Backend, *logical.Request, *logical.Response) } type TestPluginConfig struct { @@ -1936,6 +1939,10 @@ func (testCluster *TestCluster) newCore(t testing.T, idx int, coreConfig *CoreCo handler = opts.HandlerFunc.Handler(&props) } + if opts != nil && opts.RequestResponseCallback != nil { + c.requestResponseCallback = opts.RequestResponseCallback + } + // Set this in case the Seal was manually set before the core was // created if localConfig.Seal != nil {