feat: openapi.yaml に securitySchemes と security を追加#33
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughOpenAPI 仕様に認証スキーム（EmailVerifiedSession、NewShowcaseAuth、CsrfTokenHeader）を導入し、メール検証・顧客・請求書・決済セッション API の統一リファクタリングを実施。エンドポイントパス（/customer → /customers 等）やリクエスト/レスポンススキーマを整理し、サーバコード生成型・ハンドラインタフェース・ラッピング実装を対応更新。 ChangesAPI セキュリティと仕様統一
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (2)
openapi.yaml (2)
16-18: ⚡ Quick win
operation.descriptionを足して Spectral warning を消してください。この 4 operations は
summaryだけなので、今の lint 警告が残ります。短いdescriptionを入れておくと、CI と生成ドキュメントの見通しが良くなります。Also applies to: 42-45, 133-140, 227-234
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@openapi.yaml` around lines 16 - 18, The Spectral warnings are caused by POST operations that only have a summary; add a short operation.description for each flagged POST (e.g., the operation with summary "isct メールアドレスの確認メールを送信" and the three other POST operations flagged by the linter) so each operation object contains both summary and description; update each operation block to include an operation.description string (one or two concise sentences) describing the endpoint behavior to satisfy the linter and improve generated docs.
206-210: ⚡ Quick win空の PATCH と未知キーを spec 上で許してしまっています。
今の定義だと
requestBody自体が optional で、PatchCustomerRequestも全フィールド optional /additionalProperties未指定なので、body なし・{}・typo キー付きの更新が全部 valid になります。部分更新でも最低 1 項目は要求し、未知キーは弾いた方が契約として安全です。差分案
patch: summary: Customer を更新 tags: - Customer operationId: patchCustomer requestBody: + required: true content: application/json: schema: $ref: '`#/components/schemas/PatchCustomerRequest`' @@ PatchCustomerRequest: description: Customer 更新リクエスト (すべてのフィールドはオプショナル) type: object + additionalProperties: false + minProperties: 1 properties: email: type: string description: EmailAlso applies to: 541-553
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@openapi.yaml` around lines 206 - 210, requestBody is currently optional and PatchCustomerRequest allows empty bodies and unknown keys; make the body required and tighten the schema by adding requestBody.required: true and in components.schemas.PatchCustomerRequest set additionalProperties: false and minProperties: 1 (keep individual fields optional to allow partial updates), and apply the same changes to the other PATCH schemas mentioned (e.g., the other Patch* schemas at the noted range) so an empty object and unknown/typo keys are rejected by the spec.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@openapi.yaml`:
- Around line 16-18: The Spectral warnings are caused by POST operations that
only have a summary; add a short operation.description for each flagged POST
(e.g., the operation with summary "isct メールアドレスの確認メールを送信" and the three other
POST operations flagged by the linter) so each operation object contains both
summary and description; update each operation block to include an
operation.description string (one or two concise sentences) describing the
endpoint behavior to satisfy the linter and improve generated docs.
- Around line 206-210: requestBody is currently optional and
PatchCustomerRequest allows empty bodies and unknown keys; make the body
required and tighten the schema by adding requestBody.required: true and in
components.schemas.PatchCustomerRequest set additionalProperties: false and
minProperties: 1 (keep individual fields optional to allow partial updates), and
apply the same changes to the other PATCH schemas mentioned (e.g., the other
Patch* schemas at the noted range) so an empty object and unknown/typo keys are
rejected by the spec.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 6ffeb3ea-a9ae-4183-8d7b-271787cde57b
📒 Files selected for processing (2)
openapi.yamlserver/gen.go
1 participant
Close #11
Summary by CodeRabbit