Documentation
¶
Overview ¶
Package openapi loads an OpenAPI document and flattens it into the list of operations Spoofy needs.
Nothing downstream touches the raw document. Keeping $ref resolution, parameter inheritance, and 3.0-versus-3.1 differences in one package stops that complexity leaking into request generation.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Operation ¶
type Operation struct {
// ID is the operationId when the spec provides one, otherwise a synthesised
// stable identifier. Used for logging and metrics labels.
ID string
// Method is the uppercase HTTP method.
Method string
// Path is the templated path as written in the spec, e.g.
// "/orders/{orderId}". Metrics label on this, never the concrete URL, or
// Prometheus cardinality grows without bound.
Path string
// Summary is the spec's human description, shown in dry-run output.
Summary string
// Params is the merged parameter set: path-item-level parameters plus
// operation-level ones, with operation-level winning on conflict.
Params []*openapi3.Parameter
// RequestBody is nil for operations that take no body.
RequestBody *openapi3.RequestBody
// Deprecated mirrors the spec flag.
Deprecated bool
}
Operation is one callable endpoint: a method, a templated path, and everything needed to build a request for it.
type Selector ¶
type Selector interface {
MethodAllowed(method string) bool
PathAllowed(templatedPath string) bool
}
Selector decides which operations a run should exercise.
type Spec ¶
Spec is a flattened OpenAPI document.
func FromDocument ¶
FromDocument flattens an already-parsed document, so tests can build one in memory without touching the filesystem.
func Load ¶
Load reads an OpenAPI document from a file path or an http(s) URL.
External $ref resolution stays off. kin-openapi would otherwise follow references out of the document, which on a spec you did not write means local file reads (`$ref: "/etc/passwd"`) and SSRF against metadata endpoints. Specs are often fetched from a running service, so they are untrusted input.