glm-5.3-flash
12b35e2c5f
21 review-001 tasks across server/adapters/client/gateway/websocket/infra, chunked from the 7-unit remediation plan in docs/reviews/001-initial-implementation-review.md. - Scope split by mechanism, not one-per-finding: 15 tasks in generation 1 (parallelizable), 6 sequenced after their file-sharing precursors - Deliberately deferred until dependent fixes land: projection/doc fidelity partial (Unit 6 beyond dependency hygiene), coverage backfills (COV-01..07 via in-task acceptance for forward.rs), and per-finding minors (OAI-06/07, HY-02/04/06/10/11, CON-08) - Cross-crate WS-12 (alkcall demux 4 GiB discard alloc) noted for filing in alkcall, not here taskgraph: validate clean, no cycles, 6 generations
56 lines
2.3 KiB
Markdown
56 lines
2.3 KiB
Markdown
---
|
|
id: review-001-openapi-import-integrity
|
|
name: Resolve parameter/requestBody $refs; detect import collisions (OAI-04, OAI-05)
|
|
status: pending
|
|
depends_on: [review-001-ref-cycle-guard]
|
|
scope: narrow
|
|
risk: medium
|
|
impact: component
|
|
level: implementation
|
|
tags: [adapters, review-001, from-openapi]
|
|
---
|
|
|
|
## Description
|
|
|
|
Review 001 findings OAI-04 + OAI-05 — import produces ops that misbehave
|
|
silently at call time:
|
|
|
|
- **OAI-04** (`openapi_spec.rs:236-262`): parameter entries of the form
|
|
`{"$ref": "#/components/parameters/Id"}` (extremely common in real
|
|
specs) have no `name`, are silently skipped, and never reach
|
|
`resolve_refs_recursive`; same for `requestBody: {"$ref": …}`. Only
|
|
`components/schemas` is indexed (`:162-174`). Result: the op registers
|
|
with `{id}` in the template but `id` absent from the schema; at call
|
|
time the placeholder is substituted with the literal `{owner}` text and
|
|
percent-encoded (`%7Bowner%7D`) — a well-formed request to a nonsense
|
|
path, with credentials attached. No error at import or call time.
|
|
Fix: index `components/parameters` + `requestBodies`, resolve the ref
|
|
forms, and fail loudly on unresolved path placeholders (import and/or
|
|
call time).
|
|
- **OAI-05** (`from_openapi.rs:51-65,160`): generated operation IDs
|
|
collide by construction (`/x/{id}/y` and `/x/y` both → `get_x_y`);
|
|
the registry silently replaces, so one op shadows another and
|
|
`/search` under-reports. Detect duplicates within the import batch and
|
|
fail loudly (or deterministically disambiguate + warn — pick one and
|
|
document).
|
|
|
|
## Acceptance Criteria
|
|
|
|
- [ ] `{"$ref": "#/components/parameters/…"}` params and `requestBody` refs resolve into the op's schema (test)
|
|
- [ ] Unresolved path placeholders fail loudly (import-time, or call-time with a loud error — tested, not silently `%7Bowner%7D`)
|
|
- [ ] Duplicate operation IDs in one import batch are detected and rejected (or deterministically disambiguated + warned — tested)
|
|
- [ ] `cargo test` and `cargo clippy --all-targets -- -D warnings` pass
|
|
|
|
## References
|
|
|
|
- docs/reviews/001-initial-implementation-review.md (Part E, OAI-04, OAI-05)
|
|
|
|
## Notes
|
|
|
|
> Agent fills during implementation. Follows the cycle-guard task so
|
|
> the resolver is already hardened when the new ref kinds are wired
|
|
> through it.
|
|
|
|
## Summary
|
|
|
|
> Filled on completion. |