fix: restore consumer token response schema#31
Merged
Conversation
|
Linter diff in the way? Review this PR in Change Stack to focus on meaningful changes and expand context only when needed. Warning Review limit reached
More reviews will be available in 8 minutes and 2 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (18)
📝 WalkthroughWalkthroughThis PR bumps Apollo OpenAPI from version 0.3.6 to 0.3.7 and introduces ChangesOpenAPI specification, core schema, and version updates
Java client SDK
Python SDK
Spring Boot 2 server
Rust SDK
TypeScript SDK
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Suggested reviewers
Poem
✨ Finishing Touches🧪 Generate unit tests (beta)
|
There was a problem hiding this comment.
Pull request overview
Restores the /openapi/v1/consumer-tokens/by-appId endpoint to return a token-specific schema (OpenConsumerTokenDTO) instead of reusing the broader consumer-info schema, and regenerates/bump-pins all published artifacts to version 0.3.7 across the OpenAPI spec, server stubs, and SDKs.
Changes:
- Introduce
OpenConsumerTokenDTOschema and update/openapi/v1/consumer-tokens/by-appIdresponse type to use it. - Regenerate TypeScript, Python, Java client, Spring Boot server, and Rust artifacts to include the new model and updated endpoint types.
- Bump package/spec versions and generator metadata from
0.3.6→0.3.7.
Reviewed changes
Copilot reviewed 54 out of 54 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
typescript/src/models/OpenConsumerTokenDTO.ts |
Adds TS model for the token-specific response payload. |
typescript/src/models/index.ts |
Exports the new TS model from the models barrel. |
typescript/src/apis/PortalManagementApi.ts |
Updates TS client method return type to OpenConsumerTokenDTO. |
typescript/README.md |
Bumps TS package version references to 0.3.7. |
typescript/package.json |
Bumps TS package version to 0.3.7. |
typescript/.openapi-generator/FILES |
Registers the newly generated TS model file. |
tests/test_user_management_contract.py |
Updates contract assertions to require OpenConsumerTokenDTO and validates key fields. |
spring-boot2/src/main/resources/openapi.yaml |
Bumps spec version and switches endpoint schema ref to OpenConsumerTokenDTO; adds schema definition. |
spring-boot2/src/main/java/com/apollo/openapi/server/model/OpenConsumerTokenDTO.java |
Adds Spring server model for OpenConsumerTokenDTO (with token redaction in toString). |
spring-boot2/src/main/java/com/apollo/openapi/server/config/SpringDocConfiguration.java |
Bumps published OpenAPI version string to 0.3.7. |
spring-boot2/src/main/java/com/apollo/openapi/server/api/PortalManagementApiDelegate.java |
Updates delegate signature and example payload to token DTO shape. |
spring-boot2/src/main/java/com/apollo/openapi/server/api/PortalManagementApiController.java |
Updates controller imports/types to include token DTO. |
spring-boot2/src/main/java/com/apollo/openapi/server/api/PortalManagementApi.java |
Updates API interface response schema/type to token DTO. |
spring-boot2/pom.xml |
Bumps Spring server artifact version to 0.3.7. |
spring-boot2/.openapi-generator/FILES |
Registers the newly generated Spring server model file. |
rust/src/models/open_consumer_token_dto.rs |
Adds Rust model for token DTO. |
rust/src/models/mod.rs |
Exposes token DTO from Rust models module. |
rust/src/apis/configuration.rs |
Bumps Rust client user-agent/version metadata to 0.3.7. |
rust/README.md |
Bumps Rust package/API version metadata and lists the new model. |
rust/docs/OpenConsumerTokenDto.md |
Adds Rust model documentation for token DTO. |
rust/Cargo.toml |
Bumps Rust crate version to 0.3.7. |
rust/.openapi-generator/FILES |
Registers new Rust model + docs. |
python/test/test_models/test_open_consumer_token_dto.py |
Adds generated Python model test stub for token DTO. |
python/setup.py |
Bumps Python package version to 0.3.7. |
python/README.md |
Bumps Python package/API version metadata and lists the new model. |
python/docs/models/OpenConsumerTokenDTO.md |
Adds Python model documentation for token DTO. |
python/docs/apis/tags/PortalManagementApi.md |
Updates Python API docs to show token endpoint returning OpenConsumerTokenDTO. |
python/apollo_openapi/paths/openapi_v1_consumer_tokens_by_app_id/get.pyi |
Updates typed stub to use OpenConsumerTokenDTO for 200 response. |
python/apollo_openapi/paths/openapi_v1_consumer_tokens_by_app_id/get.py |
Updates runtime path definition to use OpenConsumerTokenDTO for 200 response. |
python/apollo_openapi/models/__init__.py |
Exposes token DTO model from Python models package. |
python/apollo_openapi/model/open_consumer_token_dto.pyi |
Adds Python type stub for token DTO. |
python/apollo_openapi/model/open_consumer_token_dto.py |
Adds Python model implementation for token DTO. |
python/apollo_openapi/configuration.py |
Bumps Python debug report metadata to 0.3.7. |
python/apollo_openapi/api_client.py |
Bumps Python user-agent to 0.3.7. |
python/apollo_openapi/__init__.py |
Bumps Python package __version__ to 0.3.7. |
python/.openapi-generator/FILES |
Registers new Python model + docs + test stub. |
java-client/src/test/java/org/openapitools/client/model/OpenConsumerTokenDTOTest.java |
Adds generated Java client model test stub for token DTO. |
java-client/src/test/java/org/openapitools/client/api/PortalManagementApiTest.java |
Updates Java client API test to expect OpenConsumerTokenDTO. |
java-client/src/main/java/org/openapitools/client/model/OpenConsumerTokenDTO.java |
Adds Java client model for token DTO (with JSON validation + token redaction in toString). |
java-client/src/main/java/org/openapitools/client/JSON.java |
Registers the new Java model type adapter factory. |
java-client/src/main/java/org/openapitools/client/Configuration.java |
Bumps Java client VERSION constant to 0.3.7. |
java-client/src/main/java/org/openapitools/client/ApiClient.java |
Bumps Java user-agent to 0.3.7. |
java-client/src/main/java/org/openapitools/client/api/PortalManagementApi.java |
Updates Java client endpoint return types to OpenConsumerTokenDTO. |
java-client/README.md |
Bumps Java client documentation version references and lists the new model. |
java-client/pom.xml |
Bumps Java client artifact version to 0.3.7. |
java-client/docs/PortalManagementApi.md |
Updates Java client API docs to show token endpoint returning OpenConsumerTokenDTO. |
java-client/docs/OpenConsumerTokenDTO.md |
Adds Java client model documentation for token DTO. |
java-client/build.sbt |
Bumps Java client SBT version to 0.3.7. |
java-client/build.gradle |
Bumps Java client Gradle version to 0.3.7. |
java-client/api/openapi.yaml |
Bumps Java-client bundled spec version and switches endpoint schema ref to token DTO; adds schema. |
java-client/.openapi-generator/FILES |
Registers new Java client model + docs + test stub. |
generate.sh |
Bumps generator packageVersion/npmVersion/artifactVersion/user_agent inputs to 0.3.7. |
CHANGELOG.md |
Adds a “Fixed” entry describing restoring token endpoint schema. |
apollo-openapi.yaml |
Bumps core spec version to 0.3.7, switches endpoint response schema ref, and adds OpenConsumerTokenDTO to components. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+6
to
+10
| import com.fasterxml.jackson.annotation.JsonCreator; | ||
| import java.time.OffsetDateTime; | ||
| import org.springframework.format.annotation.DateTimeFormat; | ||
| import org.openapitools.jackson.nullable.JsonNullable; | ||
| import java.time.OffsetDateTime; |
Member
Author
There was a problem hiding this comment.
Fixed in 78739ea. The generated Spring Boot model now has a single java.time.OffsetDateTime import; python -m unittest discover tests and git diff --check both pass.
Comment on lines
8
to
20
| ## [Unreleased] | ||
|
|
||
| ### Changed | ||
|
|
||
| - Rename Portal user management contracts from `Portal User Management` to `User Management`. | ||
|
|
||
| ### Fixed | ||
|
|
||
| - Restore `/openapi/v1/consumer-tokens/by-appId` to a token-specific response schema. | ||
|
|
||
| ### Added | ||
|
|
||
| - Add Consumer Token support notes to user management contracts, including `ManageUsers`-guarded user lookup and mutation operations. |
Member
Author
There was a problem hiding this comment.
Keeping this entry under [Unreleased] is intentional for the PR stage. The OpenAPI spec and generated SDK artifacts are bumped to 0.3.7 so the release artifacts have the right version, while the changelog still tracks unreleased PR contents until the release is cut. The release prep can move these entries into a 0.3.7 section/release notes.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (5)
java-client/src/test/java/org/openapitools/client/model/OpenConsumerTokenDTOTest.java (1)
35-126: ⚡ Quick winGenerated tests are currently no-op
All added
@Testmethods contain TODOs only, so they don’t validateOpenConsumerTokenDTObehavior and won’t catch regressions in the new token contract. Please add at least one assertion-based roundtrip test covering token, expiry, rate-limit, and audit fields.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@java-client/src/test/java/org/openapitools/client/model/OpenConsumerTokenDTOTest.java` around lines 35 - 126, Replace the no-op tests in OpenConsumerTokenDTOTest with an assertion-based roundtrip test that constructs an OpenConsumerTokenDTO instance (set fields token, expires, rateLimit, consumerId, id, deleted, deletedAt, dataChangeCreatedBy, dataChangeCreatedTime, dataChangeLastModifiedBy, dataChangeLastModifiedTime), serializes and deserializes it (or copies via getters/setters) and asserts equality/field-by-field matches for token, expires, rateLimit and the audit fields; update the testOpenConsumerTokenDTO() method to perform this full-coverage assertion sequence and remove the TODOs in the individual property test methods (or implement similar assertions there) so the test verifies the DTO's roundtrip integrity and catches regressions.spring-boot2/src/main/java/com/apollo/openapi/server/model/OpenConsumerTokenDTO.java (2)
7-10: ⚡ Quick winRemove duplicate import.
OffsetDateTimeis imported twice (lines 7 and 10).🧹 Proposed fix
import com.fasterxml.jackson.annotation.JsonProperty; import com.fasterxml.jackson.annotation.JsonCreator; import java.time.OffsetDateTime; import org.springframework.format.annotation.DateTimeFormat; import org.openapitools.jackson.nullable.JsonNullable; -import java.time.OffsetDateTime; import javax.validation.Valid;🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@spring-boot2/src/main/java/com/apollo/openapi/server/model/OpenConsumerTokenDTO.java` around lines 7 - 10, The import list in OpenConsumerTokenDTO includes a duplicate import of OffsetDateTime; remove the redundant OffsetDateTime import so only one import java.time.OffsetDateTime; remains, leaving the other imports (org.springframework.format.annotation.DateTimeFormat and org.openapitools.jackson.nullable.JsonNullable) intact and ensuring the class compiles without duplicate imports.
30-30: ⚡ Quick winUse uppercase 'L' suffix for long literals.
The lowercase 'l' can be confused with the digit '1'. Use
0Linstead of0lfor clarity.📝 Proposed fix
- private Long deletedAt = 0l; + private Long deletedAt = 0L;🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@spring-boot2/src/main/java/com/apollo/openapi/server/model/OpenConsumerTokenDTO.java` at line 30, Replace the lowercase long literal used to initialize the field deletedAt in class OpenConsumerTokenDTO: change the initializer for the field symbol deletedAt from 0l to 0L to avoid confusion with the digit '1' and follow Java convention for long literals.rust/src/models/open_consumer_token_dto.rs (1)
50-66: ⚡ Quick winRedundant constructor with
Defaultderive.The struct derives
Defaulton line 13, which automatically provides adefault()method that initializes allOptionfields toNone. The manualnew()implementation duplicates this behavior.♻️ Proposed fix: Remove the redundant constructor
Since
Defaultis derived, users can callOpenConsumerTokenDto::default()or use the struct update syntax. Thenew()method can be removed:-impl OpenConsumerTokenDto { - pub fn new() -> OpenConsumerTokenDto { - OpenConsumerTokenDto { - id: None, - deleted: None, - deleted_at: None, - consumer_id: None, - token: None, - rate_limit: None, - expires: None, - data_change_created_by: None, - data_change_created_time: None, - data_change_last_modified_by: None, - data_change_last_modified_time: None, - } - } -}Alternatively, if the
new()pattern is preferred by the generator, remove theDefaultderive from line 13.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@rust/src/models/open_consumer_token_dto.rs` around lines 50 - 66, The impl OpenConsumerTokenDto::new() duplicates behavior already provided by the derived Default for OpenConsumerTokenDto; remove the manual new() constructor to avoid redundancy and rely on OpenConsumerTokenDto::default() (or keep new() and instead remove the Default derive if you prefer the explicit constructor pattern). Update any call sites to use OpenConsumerTokenDto::default() if you remove new().python/test/test_models/test_open_consumer_token_dto.py (1)
18-20: 🏗️ Heavy liftConsider adding test methods for the new DTO.
The test class is currently a stub with no test methods. While this is standard OpenAPI generator output, adding tests for serialization, deserialization, and field validation would improve coverage for the new
OpenConsumerTokenDTOmodel.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@python/test/test_models/test_open_consumer_token_dto.py` around lines 18 - 20, Add concrete unit tests to replace the stub TestOpenConsumerTokenDTO class by implementing tests that cover serialization, deserialization, and basic field validation for the OpenConsumerTokenDTO model: create test methods named test_serialization_to_dict, test_deserialization_from_dict, and test_field_validation that construct an OpenConsumerTokenDTO with representative values, assert that .to_dict() (or equivalent) produces expected keys/values, recreate the model from that dict and assert equality, and verify required/optional fields behave as expected (e.g., missing required fields raise or default correctly) using the OpenConsumerTokenDTO class referenced in the test file.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@python/docs/apis/tags/PortalManagementApi.md`:
- Line 3094: The response-schema table row for the operation
get_consumer_token_by_app_id (OpenConsumerTokenDTO) is malformed with fewer
pipe-separated cells than the table header; update the table row in
PortalManagementApi.md for get_consumer_token_by_app_id so it has the same
number of columns as the header (add the missing cell(s) such as response type,
status code or description as appropriate) and ensure each cell is separated by
"|" to restore proper Markdown table rendering.
In `@python/docs/models/OpenConsumerTokenDTO.md`:
- Line 13: The documentation line for the OpenConsumerTokenDTO field deletedAt
has a formatting issue ("0value must be a 64 bit integer"); update the deletedAt
description in OpenConsumerTokenDTO so it reads with proper punctuation and
spacing (e.g., "if omitted the server will use the default value of 0; value
must be a 64 bit integer" or "if omitted the server will use the default value
of 0. Value must be a 64-bit integer") ensuring the field name deletedAt and the
DTO OpenConsumerTokenDTO remain unchanged.
In `@spring-boot2/src/main/resources/openapi.yaml`:
- Around line 8858-8860: The OpenAPI schema for the property named "token"
currently declares it as type: string but must allow explicit nulls; update the
"token" property definition in openapi.yaml to include nullable: true (i.e., set
token: { type: string, nullable: true }) so generated SDKs match the service
behavior when the token is redacted/serialized as null; ensure you update the
same "token" schema instance referenced by any components/schemas that define
this field.
---
Nitpick comments:
In
`@java-client/src/test/java/org/openapitools/client/model/OpenConsumerTokenDTOTest.java`:
- Around line 35-126: Replace the no-op tests in OpenConsumerTokenDTOTest with
an assertion-based roundtrip test that constructs an OpenConsumerTokenDTO
instance (set fields token, expires, rateLimit, consumerId, id, deleted,
deletedAt, dataChangeCreatedBy, dataChangeCreatedTime, dataChangeLastModifiedBy,
dataChangeLastModifiedTime), serializes and deserializes it (or copies via
getters/setters) and asserts equality/field-by-field matches for token, expires,
rateLimit and the audit fields; update the testOpenConsumerTokenDTO() method to
perform this full-coverage assertion sequence and remove the TODOs in the
individual property test methods (or implement similar assertions there) so the
test verifies the DTO's roundtrip integrity and catches regressions.
In `@python/test/test_models/test_open_consumer_token_dto.py`:
- Around line 18-20: Add concrete unit tests to replace the stub
TestOpenConsumerTokenDTO class by implementing tests that cover serialization,
deserialization, and basic field validation for the OpenConsumerTokenDTO model:
create test methods named test_serialization_to_dict,
test_deserialization_from_dict, and test_field_validation that construct an
OpenConsumerTokenDTO with representative values, assert that .to_dict() (or
equivalent) produces expected keys/values, recreate the model from that dict and
assert equality, and verify required/optional fields behave as expected (e.g.,
missing required fields raise or default correctly) using the
OpenConsumerTokenDTO class referenced in the test file.
In `@rust/src/models/open_consumer_token_dto.rs`:
- Around line 50-66: The impl OpenConsumerTokenDto::new() duplicates behavior
already provided by the derived Default for OpenConsumerTokenDto; remove the
manual new() constructor to avoid redundancy and rely on
OpenConsumerTokenDto::default() (or keep new() and instead remove the Default
derive if you prefer the explicit constructor pattern). Update any call sites to
use OpenConsumerTokenDto::default() if you remove new().
In
`@spring-boot2/src/main/java/com/apollo/openapi/server/model/OpenConsumerTokenDTO.java`:
- Around line 7-10: The import list in OpenConsumerTokenDTO includes a duplicate
import of OffsetDateTime; remove the redundant OffsetDateTime import so only one
import java.time.OffsetDateTime; remains, leaving the other imports
(org.springframework.format.annotation.DateTimeFormat and
org.openapitools.jackson.nullable.JsonNullable) intact and ensuring the class
compiles without duplicate imports.
- Line 30: Replace the lowercase long literal used to initialize the field
deletedAt in class OpenConsumerTokenDTO: change the initializer for the field
symbol deletedAt from 0l to 0L to avoid confusion with the digit '1' and follow
Java convention for long literals.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: e9157ee6-4949-413f-b5a3-4ea3e6f03313
📒 Files selected for processing (54)
CHANGELOG.mdapollo-openapi.yamlgenerate.shjava-client/.openapi-generator/FILESjava-client/README.mdjava-client/api/openapi.yamljava-client/build.gradlejava-client/build.sbtjava-client/docs/OpenConsumerTokenDTO.mdjava-client/docs/PortalManagementApi.mdjava-client/pom.xmljava-client/src/main/java/org/openapitools/client/ApiClient.javajava-client/src/main/java/org/openapitools/client/Configuration.javajava-client/src/main/java/org/openapitools/client/JSON.javajava-client/src/main/java/org/openapitools/client/api/PortalManagementApi.javajava-client/src/main/java/org/openapitools/client/model/OpenConsumerTokenDTO.javajava-client/src/test/java/org/openapitools/client/api/PortalManagementApiTest.javajava-client/src/test/java/org/openapitools/client/model/OpenConsumerTokenDTOTest.javapython/.openapi-generator/FILESpython/README.mdpython/apollo_openapi/__init__.pypython/apollo_openapi/api_client.pypython/apollo_openapi/configuration.pypython/apollo_openapi/model/open_consumer_token_dto.pypython/apollo_openapi/model/open_consumer_token_dto.pyipython/apollo_openapi/models/__init__.pypython/apollo_openapi/paths/openapi_v1_consumer_tokens_by_app_id/get.pypython/apollo_openapi/paths/openapi_v1_consumer_tokens_by_app_id/get.pyipython/docs/apis/tags/PortalManagementApi.mdpython/docs/models/OpenConsumerTokenDTO.mdpython/setup.pypython/test/test_models/test_open_consumer_token_dto.pyrust/.openapi-generator/FILESrust/Cargo.tomlrust/README.mdrust/docs/OpenConsumerTokenDto.mdrust/src/apis/configuration.rsrust/src/models/mod.rsrust/src/models/open_consumer_token_dto.rsspring-boot2/.openapi-generator/FILESspring-boot2/pom.xmlspring-boot2/src/main/java/com/apollo/openapi/server/api/PortalManagementApi.javaspring-boot2/src/main/java/com/apollo/openapi/server/api/PortalManagementApiController.javaspring-boot2/src/main/java/com/apollo/openapi/server/api/PortalManagementApiDelegate.javaspring-boot2/src/main/java/com/apollo/openapi/server/config/SpringDocConfiguration.javaspring-boot2/src/main/java/com/apollo/openapi/server/model/OpenConsumerTokenDTO.javaspring-boot2/src/main/resources/openapi.yamltests/test_user_management_contract.pytypescript/.openapi-generator/FILEStypescript/README.mdtypescript/package.jsontypescript/src/apis/PortalManagementApi.tstypescript/src/models/OpenConsumerTokenDTO.tstypescript/src/models/index.ts
There was a problem hiding this comment.
Actionable comments posted: 5
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (3)
apollo-openapi.yaml (1)
6864-6871:⚠️ Potential issue | 🟠 Major | 🏗️ Heavy liftEnforce
rateLimitEnabled/rateLimitdependency in schema, not only description.Line 6870 documents “must be > 0 when enabled”, but current schema still permits
rateLimitEnabled: truewithrateLimit: 0. This weakens request-contract validation across generated SDK/server validators.💡 Suggested OpenAPI constraint shape
OpenConsumerCreateRequestDTO: type: object required: - appId - name - orgId - ownerName + oneOf: + - properties: + rateLimitEnabled: + enum: [false] + - required: + - rateLimit + properties: + rateLimitEnabled: + enum: [true] + rateLimit: + type: integer + minimum: 1 properties: appId: type: string @@ rateLimit: type: integer description: 限流QPS，rateLimitEnabled 为 true 时必须大于 0；未开启限流时 0 表示不限流 minimum: 0🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apollo-openapi.yaml` around lines 6864 - 6871, The schema currently allows rateLimitEnabled: true with rateLimit: 0; update the OpenAPI schema for the object containing rateLimitEnabled and rateLimit to enforce the dependency by adding a conditional (use oneOf or if/then) such that when rateLimitEnabled is true the schema requires rateLimit and constrains it to minimum: 1, and when rateLimitEnabled is false (or absent) rateLimit can be 0 (or >=0); target the properties named rateLimitEnabled and rateLimit and add the conditional blocks (e.g., an if: {properties:{rateLimitEnabled:{const:true}}} then: {required:["rateLimit"], properties:{rateLimit:{minimum:1}}} else: {properties:{rateLimit:{minimum:0}}}) to ensure validation matches the documented rule.java-client/src/main/java/org/openapitools/client/model/OpenConsumerCreateRequestDTO.java (1)
90-104:⚠️ Potential issue | 🟠 MajorFix unsound
@javax.annotation.Nonnullon DTO getters when a public no-arg constructor allows nulls
OpenConsumerCreateRequestDTOhas a public no-arg constructor, and required String fields (appId,name,orgId,ownerName) are not initialized; the@javax.annotation.Nonnullgetters can therefore returnnullwhen called on a directly-instantiated object (e.g.,getAppIdat lines 103-106; alsogetName166-169,getOrgId187-190,getOwnerName229-232). Either make construction impossible without required fields (or remove/limit the no-arg constructor) or mark these getters@Nullableand enforce requiredness via validation when building/deserializing the request.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@java-client/src/main/java/org/openapitools/client/model/OpenConsumerCreateRequestDTO.java` around lines 90 - 104, OpenConsumerCreateRequestDTO currently exposes a public no-arg constructor while its required String getters (getAppId, getName, getOrgId, getOwnerName) are annotated `@javax.annotation.Nonnull` which is unsound because those fields can remain null; either remove or restrict the public no-arg constructor (make it private/protected or provide a builder/constructor that requires appId/name/orgId/ownerName) so instances cannot be created with null required fields, or alternatively change those getters to `@Nullable` and add runtime validation (e.g., in a validate() method or in the builder/deserializer) to enforce presence; update the class accordingly and keep annotations consistent with the new construction/validation approach.spring-boot2/src/main/resources/openapi.yaml (1)
6456-6460:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winRefresh the
OpenConsumerInfoDTO.tokendescription after this endpoint split.After Line 6460 switches
/openapi/v1/consumer-tokens/by-appIdtoOpenConsumerTokenDTO, thetokenfield docs inOpenConsumerInfoDTOat Lines 8756-8758 still say it is returned for “按应用查询详情”. That wording is now stale and will flow into generated docs/SDK docs.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@spring-boot2/src/main/resources/openapi.yaml` around lines 6456 - 6460, Update the OpenConsumerInfoDTO.token description to remove the stale phrase "按应用查询详情" and reflect the current behavior after the endpoint split where /openapi/v1/consumer-tokens/by-appId now returns OpenConsumerTokenDTO; specifically edit the token field description in the OpenConsumerInfoDTO schema (symbol: OpenConsumerInfoDTO.token) to either a neutral description of the token value or to state the correct endpoint(s) that return it, and ensure consistency with OpenConsumerTokenDTO's documentation.
♻️ Duplicate comments (1)
python/docs/apis/tags/PortalManagementApi.md (1)
3084-3084:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winFix malformed DTO table row and unresolved model links
Line 3084 is missing one table cell for the 5-column header and still uses
{{complexTypePrefix}}, which leaves broken links in rendered docs.Suggested fix
-[**OpenConsumerInfoDTO**]({{complexTypePrefix}}OpenConsumerInfoDTO.md) | [**OpenConsumerInfoDTO**]({{complexTypePrefix}}OpenConsumerInfoDTO.md) | [**OpenConsumerInfoDTO**]({{complexTypePrefix}}OpenConsumerInfoDTO.md) | | +[**OpenConsumerInfoDTO**](../../models/OpenConsumerInfoDTO.md) | [**OpenConsumerInfoDTO**](../../models/OpenConsumerInfoDTO.md) | [**OpenConsumerInfoDTO**](../../models/OpenConsumerInfoDTO.md) | | |🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@python/docs/apis/tags/PortalManagementApi.md` at line 3084, The Markdown table row for OpenConsumerInfoDTO in PortalManagementApi.md is malformed (it has only four cells for a five-column header) and uses the unresolved token {{complexTypePrefix}}; update the row for OpenConsumerInfoDTO to include the missing fifth cell (e.g., an appropriate description or placeholder) and replace the `{{complexTypePrefix}}OpenConsumerInfoDTO.md` links with the correct relative/absolute link target (or plain filename) so the three link cells point to a valid OpenConsumerInfoDTO doc; locate the row containing OpenConsumerInfoDTO to make these edits.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@java-client/api/openapi.yaml`:
- Around line 8434-8435: The OpenAPI schema currently allows rateLimit to be 0
or omitted even when rateLimitEnabled is true; update
java-client/api/openapi.yaml to make rateLimit required and >0 when
rateLimitEnabled is true by adding a conditional schema (use an if: {
properties: { rateLimitEnabled: { const: true } } } then: { required:
["rateLimit"], properties: { rateLimit: { minimum: 1 } } }) or alternatively
model the two branches with oneOf (enabled branch requires rateLimit with
minimum 1, disabled branch allows rateLimit = 0 or omitted); this will produce
generated Spring DTOs with the necessary `@NotNull/`@Min(1) constraints.
In `@python/docs/models/OpenConsumerCreateRequestDTO.md`:
- Around line 11-14: The table rows for the fields ownerName, appId, name, and
orgId are malformed because the 5-column Markdown table is missing the Notes
column; update each row in OpenConsumerCreateRequestDTO.md to include a Notes
entry such as "[required]" so each row has five columns (e.g., ensure the lines
defining **ownerName**, **appId**, **name**, **orgId** each end with a Notes
cell like `[required]`) to restore correct table rendering.
In `@rust/docs/OpenConsumerCreateRequestDto.md`:
- Around line 7-13: The markdown table rows for required fields app_id, name,
org_id, and owner_name are missing the Notes column and break the 4-column
format; update the table entries for these identifiers (app_id, name, org_id,
owner_name) to include an explicit Notes value such as "[required]" so every row
has four columns (Field | Type | Description | Notes) and the table remains
consistent.
In
`@spring-boot2/src/main/java/com/apollo/openapi/server/model/OpenConsumerCreateRequestDTO.java`:
- Around line 227-233: The current validation on OpenConsumerCreateRequestDTO
only applies `@Min`(0) to the rateLimit field, allowing rateLimit=0 when
rateLimitEnabled is true; add conditional validation so that if the boolean
field rateLimitEnabled is true then rateLimit must be > 0. Implement this by
adding either a class-level custom constraint (or an `@AssertTrue` validator
method) on OpenConsumerCreateRequestDTO that checks rateLimitEnabled and
rateLimit and returns false when rateLimitEnabled==true and rateLimit<=0, and
update the validation message accordingly to reflect the invariant.
In `@spring-boot2/src/main/resources/openapi.yaml`:
- Around line 8710-8717: The schema currently allows rateLimit: 0 even when
rateLimitEnabled is true; update the OpenAPI schema for the object containing
rateLimit and rateLimitEnabled to explicitly encode the invariant (e.g., use
oneOf with two variants: one where rateLimitEnabled: true and rateLimit has
minimum: 1, and another where rateLimitEnabled: false and rateLimit has minimum:
0) so generated SDKs cannot accept {rateLimitEnabled: true, rateLimit: 0};
target the schema that defines the properties rateLimitEnabled and rateLimit and
add the oneOf constraint referencing those property sets.
---
Outside diff comments:
In `@apollo-openapi.yaml`:
- Around line 6864-6871: The schema currently allows rateLimitEnabled: true with
rateLimit: 0; update the OpenAPI schema for the object containing
rateLimitEnabled and rateLimit to enforce the dependency by adding a conditional
(use oneOf or if/then) such that when rateLimitEnabled is true the schema
requires rateLimit and constrains it to minimum: 1, and when rateLimitEnabled is
false (or absent) rateLimit can be 0 (or >=0); target the properties named
rateLimitEnabled and rateLimit and add the conditional blocks (e.g., an if:
{properties:{rateLimitEnabled:{const:true}}} then: {required:["rateLimit"],
properties:{rateLimit:{minimum:1}}} else: {properties:{rateLimit:{minimum:0}}})
to ensure validation matches the documented rule.
In
`@java-client/src/main/java/org/openapitools/client/model/OpenConsumerCreateRequestDTO.java`:
- Around line 90-104: OpenConsumerCreateRequestDTO currently exposes a public
no-arg constructor while its required String getters (getAppId, getName,
getOrgId, getOwnerName) are annotated `@javax.annotation.Nonnull` which is unsound
because those fields can remain null; either remove or restrict the public
no-arg constructor (make it private/protected or provide a builder/constructor
that requires appId/name/orgId/ownerName) so instances cannot be created with
null required fields, or alternatively change those getters to `@Nullable` and add
runtime validation (e.g., in a validate() method or in the builder/deserializer)
to enforce presence; update the class accordingly and keep annotations
consistent with the new construction/validation approach.
In `@spring-boot2/src/main/resources/openapi.yaml`:
- Around line 6456-6460: Update the OpenConsumerInfoDTO.token description to
remove the stale phrase "按应用查询详情" and reflect the current behavior after the
endpoint split where /openapi/v1/consumer-tokens/by-appId now returns
OpenConsumerTokenDTO; specifically edit the token field description in the
OpenConsumerInfoDTO schema (symbol: OpenConsumerInfoDTO.token) to either a
neutral description of the token value or to state the correct endpoint(s) that
return it, and ensure consistency with OpenConsumerTokenDTO's documentation.
---
Duplicate comments:
In `@python/docs/apis/tags/PortalManagementApi.md`:
- Line 3084: The Markdown table row for OpenConsumerInfoDTO in
PortalManagementApi.md is malformed (it has only four cells for a five-column
header) and uses the unresolved token {{complexTypePrefix}}; update the row for
OpenConsumerInfoDTO to include the missing fifth cell (e.g., an appropriate
description or placeholder) and replace the
`{{complexTypePrefix}}OpenConsumerInfoDTO.md` links with the correct
relative/absolute link target (or plain filename) so the three link cells point
to a valid OpenConsumerInfoDTO doc; locate the row containing
OpenConsumerInfoDTO to make these edits.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 278231f6-8a1c-465c-9777-367843733fc9
📒 Files selected for processing (44)
apollo-openapi.yamljava-client/.openapi-generator/FILESjava-client/README.mdjava-client/api/openapi.yamljava-client/docs/OpenConsumerCreateRequestDTO.mdjava-client/docs/OpenConsumerSummaryDTO.mdjava-client/docs/PortalManagementApi.mdjava-client/src/main/java/org/openapitools/client/JSON.javajava-client/src/main/java/org/openapitools/client/api/PortalManagementApi.javajava-client/src/main/java/org/openapitools/client/model/OpenConsumerCreateRequestDTO.javajava-client/src/main/java/org/openapitools/client/model/OpenConsumerSummaryDTO.javajava-client/src/test/java/org/openapitools/client/api/PortalManagementApiTest.javapython/.openapi-generator/FILESpython/README.mdpython/apollo_openapi/model/open_consumer_create_request_dto.pypython/apollo_openapi/model/open_consumer_create_request_dto.pyipython/apollo_openapi/model/open_consumer_summary_dto.pypython/apollo_openapi/model/open_consumer_summary_dto.pyipython/apollo_openapi/models/__init__.pypython/apollo_openapi/paths/openapi_v1_consumers/get.pypython/apollo_openapi/paths/openapi_v1_consumers/get.pyipython/docs/apis/tags/PortalManagementApi.mdpython/docs/models/OpenConsumerCreateRequestDTO.mdrust/.openapi-generator/FILESrust/Cargo.tomlrust/README.mdrust/docs/OpenConsumerCreateRequestDto.mdrust/docs/OpenConsumerSummaryDto.mdrust/src/models/mod.rsrust/src/models/open_consumer_create_request_dto.rsrust/src/models/open_consumer_summary_dto.rsspring-boot2/.openapi-generator/FILESspring-boot2/src/main/java/com/apollo/openapi/server/api/PortalManagementApi.javaspring-boot2/src/main/java/com/apollo/openapi/server/api/PortalManagementApiController.javaspring-boot2/src/main/java/com/apollo/openapi/server/api/PortalManagementApiDelegate.javaspring-boot2/src/main/java/com/apollo/openapi/server/model/OpenConsumerCreateRequestDTO.javaspring-boot2/src/main/java/com/apollo/openapi/server/model/OpenConsumerSummaryDTO.javaspring-boot2/src/main/resources/openapi.yamltests/test_user_management_contract.pytypescript/.openapi-generator/FILEStypescript/src/apis/PortalManagementApi.tstypescript/src/models/OpenConsumerCreateRequestDTO.tstypescript/src/models/OpenConsumerSummaryDTO.tstypescript/src/models/index.ts
💤 Files with no reviewable changes (21)
- rust/docs/OpenConsumerSummaryDto.md
- typescript/.openapi-generator/FILES
- python/apollo_openapi/models/init.py
- java-client/docs/OpenConsumerSummaryDTO.md
- rust/src/models/open_consumer_summary_dto.rs
- spring-boot2/src/main/java/com/apollo/openapi/server/model/OpenConsumerSummaryDTO.java
- rust/src/models/mod.rs
- java-client/src/main/java/org/openapitools/client/JSON.java
- python/.openapi-generator/FILES
- typescript/src/models/OpenConsumerSummaryDTO.ts
- typescript/src/models/index.ts
- python/apollo_openapi/model/open_consumer_summary_dto.py
- java-client/README.md
- rust/.openapi-generator/FILES
- spring-boot2/src/main/java/com/apollo/openapi/server/api/PortalManagementApiController.java
- java-client/src/main/java/org/openapitools/client/model/OpenConsumerSummaryDTO.java
- spring-boot2/.openapi-generator/FILES
- java-client/.openapi-generator/FILES
- python/apollo_openapi/model/open_consumer_summary_dto.pyi
- rust/README.md
- python/README.md
🚧 Files skipped from review as they are similar to previous changes (1)
- tests/test_user_management_contract.py
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 90d81724b8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| type: array | ||
| items: | ||
| $ref: '#/components/schemas/OpenConsumerSummaryDTO' | ||
| $ref: '#/components/schemas/OpenConsumerInfoDTO' |
There was a problem hiding this comment.
Because this is still published as patch release 0.3.7, switching /openapi/v1/consumers from OpenConsumerSummaryDTO to OpenConsumerInfoDTO also deletes the public OpenConsumerSummaryDTO model and changes the generated getConsumerList return types across SDKs; clients upgrading from 0.3.6 that import that model or implement the generated server delegate will break even though the endpoint behavior did not need to change to restore the token-specific response. Keep the summary schema for the list response, or make this a larger breaking-version change.
Useful? React with 👍 / 👎.
Member
Author
There was a problem hiding this comment.
This contract simplification is intentional for this release workflow. Apollo OpenAPI currently has no external consumers, and the paired Apollo portal/UI change is allowed to make breaking contract changes while both repositories move together. The list endpoint still does not expose token values; it reuses OpenConsumerInfoDTO for non-secret consumer metadata to reduce the redundant create/info/summary DTO surface, while token retrieval remains isolated behind OpenConsumerTokenDTO.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Tests
Summary by CodeRabbit
New Features
Bug Fixes
Changes