alkhttp/tasks/adapters/review-001-input-schema-enforcement.md at 12b35e2c5f8bb16217d937296ca6df9135318843

Files

T

glm-5.3-flash 12b35e2c5f docs(tasks): decompose review 001 remediation Units 1-5 into taskgraph tasks

21 review-001 tasks across server/adapters/client/gateway/websocket/infra,
chunked from the 7-unit remediation plan in
docs/reviews/001-initial-implementation-review.md.

- Scope split by mechanism, not one-per-finding: 15 tasks in generation 1
  (parallelizable), 6 sequenced after their file-sharing precursors
- Deliberately deferred until dependent fixes land: projection/doc
  fidelity partial (Unit 6 beyond dependency hygiene), coverage backfills
  (COV-01..07 via in-task acceptance for forward.rs), and per-finding
  minors (OAI-06/07, HY-02/04/06/10/11, CON-08)
- Cross-crate WS-12 (alkcall demux 4 GiB discard alloc) noted for filing
  in alkcall, not here

taskgraph: validate clean, no cycles, 6 generations

2026-08-29 07:10:15 +00:00

2.8 KiB

Raw Blame History

id, name, status, depends_on, scope, risk, impact, level, tags

name

status

depends_on

scope

risk

impact

level

Description

Review 001 findings OAI-02 + OAI-03 + OAI-07 + OAI-09 — the request a forwarder sends must match the contract /schema advertises:

OAI-02 (forward.rs:60-72): no input-schema enforcement — every input key that isn't a path placeholder (and isn't literally "body") becomes an upstream query parameter regardless of the registered input_schema. Peer input like "debug": "true" or "impersonate_id": "…" reaches the upstream. ADR-066's "input schema validation before send" is implemented nowhere. Fix: enforce input_schema at call time — reject undeclared keys (or document pass-through as an explicit, per-adapter choice).
OAI-03 (openapi_spec.rs:35-40): in: header parameters are silently sent as query parameters (in_ is a dead field). Upstream auth/trace headers never arrive, and header-designated values land in upstream access logs instead. Honor in: header; fix in: cookie (reject with a clear unsupported error).
OAI-07: the magic "body" key collides with a spec parameter actually named body — the declared parameter is silently diverted. Namespace the body input or reject the collision loudly.
OAI-09 (from_jsonschema.rs:36-51): malformed method/ path_template/base_url validate only at first invoke; and the module doc says "Internal by default" while the adapter passes the caller's spec through verbatim (from_openapi hardcodes Visibility::Internal). Validate at construction; align the doc or default the visibility.

Acceptance Criteria

Undeclared input keys are rejected (or the pass-through is explicit config, tested) — peer input cannot add upstream query params (test)
in: header parameters send as headers; in: cookie errors clearly at import (tests)
body-named parameter collision handled loudly (test)
from_jsonschema validates method/path_template/base_url at construction; Internal-by-default matches from_openapi or the doc is corrected
cargo test and cargo clippy --all-targets -- -D warnings pass

References

docs/reviews/001-initial-implementation-review.md (Part E, OAI-02, OAI-03, OAI-07, OAI-09)
docs/architecture/decisions/066-from-jsonschema-as-http-adapter.md

Notes

Agent fills during implementation. Depends on ref-resolution only for shared fixtures/types in openapi_spec.rs; start after it lands to avoid churn. OAI-06 (silent feature degradation) is deliberately deferred — revisit after this task.

Summary

Filled on completion.

2.8 KiB Raw Blame History