glm-5.3-flash
12b35e2c5f
21 review-001 tasks across server/adapters/client/gateway/websocket/infra, chunked from the 7-unit remediation plan in docs/reviews/001-initial-implementation-review.md. - Scope split by mechanism, not one-per-finding: 15 tasks in generation 1 (parallelizable), 6 sequenced after their file-sharing precursors - Deliberately deferred until dependent fixes land: projection/doc fidelity partial (Unit 6 beyond dependency hygiene), coverage backfills (COV-01..07 via in-task acceptance for forward.rs), and per-finding minors (OAI-06/07, HY-02/04/06/10/11, CON-08) - Cross-crate WS-12 (alkcall demux 4 GiB discard alloc) noted for filing in alkcall, not here taskgraph: validate clean, no cycles, 6 generations
63 lines
2.8 KiB
Markdown
63 lines
2.8 KiB
Markdown
---
|
|
id: review-001-input-schema-enforcement
|
|
name: Send exactly what the input schema advertises (OAI-02, OAI-03, OAI-07, OAI-09)
|
|
status: pending
|
|
depends_on: [review-001-openapi-import-integrity]
|
|
scope: narrow
|
|
risk: medium
|
|
impact: component
|
|
level: implementation
|
|
tags: [adapters, review-001, from-openapi, from-jsonschema]
|
|
---
|
|
|
|
## Description
|
|
|
|
Review 001 findings OAI-02 + OAI-03 + OAI-07 + OAI-09 — the request a
|
|
forwarder sends must match the contract `/schema` advertises:
|
|
|
|
- **OAI-02** (`forward.rs:60-72`): no input-schema enforcement — every
|
|
input key that isn't a path placeholder (and isn't literally `"body"`)
|
|
becomes an upstream query parameter regardless of the registered
|
|
`input_schema`. Peer input like `"debug": "true"` or
|
|
`"impersonate_id": "…"` reaches the upstream. ADR-066's
|
|
"input schema validation before send" is implemented nowhere. Fix:
|
|
enforce `input_schema` at call time — reject undeclared keys (or
|
|
document pass-through as an explicit, per-adapter choice).
|
|
- **OAI-03** (`openapi_spec.rs:35-40`): `in: header` parameters are
|
|
silently sent as query parameters (`in_` is a dead field). Upstream
|
|
auth/trace headers never arrive, and header-designated values land in
|
|
upstream *access logs* instead. Honor `in: header`; fix `in: cookie`
|
|
(reject with a clear unsupported error).
|
|
- **OAI-07**: the magic `"body"` key collides with a spec parameter
|
|
actually named `body` — the declared parameter is silently diverted.
|
|
Namespace the body input or reject the collision loudly.
|
|
- **OAI-09** (`from_jsonschema.rs:36-51`): malformed `method`/
|
|
`path_template`/`base_url` validate only at first invoke; and the
|
|
module doc says "`Internal` by default" while the adapter passes the
|
|
caller's spec through verbatim (`from_openapi` hardcodes
|
|
`Visibility::Internal`). Validate at construction; align the doc or
|
|
default the visibility.
|
|
|
|
## Acceptance Criteria
|
|
|
|
- [ ] Undeclared input keys are rejected (or the pass-through is explicit config, tested) — peer input cannot add upstream query params (test)
|
|
- [ ] `in: header` parameters send as headers; `in: cookie` errors clearly at import (tests)
|
|
- [ ] `body`-named parameter collision handled loudly (test)
|
|
- [ ] `from_jsonschema` validates method/path_template/base_url at construction; `Internal`-by-default matches `from_openapi` or the doc is corrected
|
|
- [ ] `cargo test` and `cargo clippy --all-targets -- -D warnings` pass
|
|
|
|
## References
|
|
|
|
- docs/reviews/001-initial-implementation-review.md (Part E, OAI-02, OAI-03, OAI-07, OAI-09)
|
|
- docs/architecture/decisions/066-from-jsonschema-as-http-adapter.md
|
|
|
|
## Notes
|
|
|
|
> Agent fills during implementation. Depends on ref-resolution only
|
|
> for shared fixtures/types in `openapi_spec.rs`; start after it lands
|
|
> to avoid churn. OAI-06 (silent feature degradation) is deliberately
|
|
> deferred — revisit after this task.
|
|
|
|
## Summary
|
|
|
|
> Filled on completion. |