Disable openapi response path validation

[christiangoerdes]

Summary by CodeRabbit

• Bug Fixes

  • Response validation no longer incorrectly reports a missing-path error when validating responses for requests whose path isn't defined in the OpenAPI spec.

• Tests

  • Added tests to cover response validation behavior for undefined request paths and adjusted existing response tests.

• Refactor

  • Internal validation logic streamlined for clarity and maintainability.

[christiangoerdes]

/ok-to-test

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 87ad86b7-93a4-4b9a-b525-6ec507d96618

📥 Commits

Reviewing files that changed from the base of the PR and between c725c73 and 933eea8.

📒 Files selected for processing (1)

• core/src/test/java/com/predic8/membrane/core/openapi/validators/ResponseTest.java

🚧 Files skipped from review as they are similar to previous changes (1)

• core/src/test/java/com/predic8/membrane/core/openapi/validators/ResponseTest.java

---

📝 Walkthrough

Walkthrough

Changed OpenAPI response validation so path mismatches no longer produce 404 errors when validating responses (only when validating requests). Introduced static imports and updated tests to use statusCode(...); added a test asserting responses on unknown request paths produce no validation errors.

Changes

Cohort / File(s)	Summary
Validator Logic core/src/main/java/com/predic8/membrane/core/openapi/OpenAPIValidator.java	Adjusted validateMessage(...) to return a 404 ValidationErrors.error(...) only when res == null (request validation); when res != null (response validation) return empty ValidationErrors. Added static imports for fromRequest and error.
Response Validation Tests core/src/test/java/com/predic8/membrane/core/openapi/validators/ResponseTest.java	Replaced fully-qualified builders with statically imported statusCode(...) usages, removed a debug print, added responsePathMismatchDoesNotFailValidation asserting zero errors for responses when request path doesn't match spec, and normalized EOF newline.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 Paths may wander far and wide, yet responses hop along,
Request checks still bark a 404, but responses sing their song.
Static imports nip and tuck the code with gentle art,
Tests applaud the calmer flow—validation plays its part. 🥕

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 10.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'Disable openapi response path validation' directly and specifically describes the main behavioral change: disabling path validation for OpenAPI response validation.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch disable-response-path-validation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (2)

core/src/main/java/com/predic8/membrane/core/openapi/OpenAPIValidator.java (1)

98-99: Add a debug breadcrumb when skipping response path mismatch validation.

This path now succeeds silently; a debug log would help diagnose spec/routing drift in production.

Suggested minimal change

         // Do not validate the path for response
+        log.debug("Skipping response path validation because no OpenAPI path matched request path '{}'.", req.getPath());
         return new ValidationErrors();

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@core/src/main/java/com/predic8/membrane/core/openapi/OpenAPIValidator.java`
around lines 98 - 99, Add a debug breadcrumb in OpenAPIValidator immediately
before the early return that skips response path mismatch validation: log a
concise debug message (e.g., using the class logger instance such as
logger.debug or LOG.debug) indicating that response path validation was skipped
and include available context like the request path, operation identifier or
response status (use the local variables available in the method surrounding the
return) to help diagnose spec/routing drift, then perform the existing return
new ValidationErrors().

core/src/test/java/com/predic8/membrane/core/openapi/validators/ResponseTest.java (1)

117-121: Consider adding the inverse regression test for request validation.

A paired test asserting request validation still returns a PATH/404 on unmatched paths would lock in the asymmetric behavior.

Companion test sketch

+    `@Test`
+    public void requestPathMismatchStillFailsValidation() {
+        ValidationErrors errors = validator.validate(Request.get().path("/does-not-exist"));
+        assertEquals(1, errors.size());
+        assertEquals(PATH, errors.get(0).getContext().getValidatedEntityType());
+        assertEquals(404, errors.get(0).getContext().getStatusCode());
+    }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@core/src/test/java/com/predic8/membrane/core/openapi/validators/ResponseTest.java`
around lines 117 - 121, Add a companion test in ResponseTest that verifies
request validation fails for unmatched paths: add a method (e.g.,
requestPathMismatchReturnsPath404) which calls
validator.validateRequest(Request.get().path("/does-not-exist"), /* suitable
request object */) and assert that the returned ValidationErrors indicate a
path-mismatch (non-zero size and/or contains the PATH/404 error code/message).
Use the same Request.get().path(...) and validator.validateRequest(...) symbols
to locate where to add the test so the asymmetric behavior is locked in.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@core/src/main/java/com/predic8/membrane/core/openapi/OpenAPIValidator.java`:
- Around line 98-99: Add a debug breadcrumb in OpenAPIValidator immediately
before the early return that skips response path mismatch validation: log a
concise debug message (e.g., using the class logger instance such as
logger.debug or LOG.debug) indicating that response path validation was skipped
and include available context like the request path, operation identifier or
response status (use the local variables available in the method surrounding the
return) to help diagnose spec/routing drift, then perform the existing return
new ValidationErrors().

In
`@core/src/test/java/com/predic8/membrane/core/openapi/validators/ResponseTest.java`:
- Around line 117-121: Add a companion test in ResponseTest that verifies
request validation fails for unmatched paths: add a method (e.g.,
requestPathMismatchReturnsPath404) which calls
validator.validateRequest(Request.get().path("/does-not-exist"), /* suitable
request object */) and assert that the returned ValidationErrors indicate a
path-mismatch (non-zero size and/or contains the PATH/404 error code/message).
Use the same Request.get().path(...) and validator.validateRequest(...) symbols
to locate where to add the test so the asymmetric behavior is locked in.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 06ff8471-8469-4f77-aa9c-f8cdb224e87d

📥 Commits

Reviewing files that changed from the base of the PR and between 005aa54 and c725c73.

📒 Files selected for processing (2)

• core/src/main/java/com/predic8/membrane/core/openapi/OpenAPIValidator.java
• core/src/test/java/com/predic8/membrane/core/openapi/validators/ResponseTest.java

[membrane-ci-server]

This pull request needs "/ok-to-test" from an authorized committer.