feat: add user token OpenAPI contract#35
Conversation
|
Warning Review limit reached
More reviews will be available in 50 minutes and 22 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThis PR introduces a new User Token Management API contract to the Apollo OpenAPI specification. Three new endpoints expose the current token's identity, permission scope, callable capabilities, and a whoami alias. The contract is validated via a new unittest module that verifies endpoint presence, operationIds, schema references, and detailed property constraints. ChangesUser Token Management API
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
apollo-openapi.yaml (1)
6931-7061: ⚡ Quick winConsider documenting which fields are required in the
OpenUserTokenCurrentCapabilityschema.The schema defines approximately 30 properties but lacks a
requiredarray. While this makes all fields optional by default, it's unclear whether this is intentional or an oversight. Key fields likeauthType,userId,tokenIdappear semantically required for a token capability response.For API contract clarity, consider adding a
requiredarray if certain fields will always be present, similar to other schemas in this spec that define required fields.💡 Example required fields specification
OpenUserTokenCurrentCapability: type: object description: 当前用户访问Token身份、权限范围和可调用OpenAPI能力 + required: + - authType + - userId + - tokenId properties: authType: type: string🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apollo-openapi.yaml` around lines 6931 - 7061, The OpenUserTokenCurrentCapability schema lacks a "required" array making all ~30 properties optional; add a required array listing fields that must always be returned (e.g. authType, userId, tokenId, tokenName, tokenPrefix, expires) or adjust to the actual contract; update the OpenUserTokenCurrentCapability schema's properties block to include a "required" array with those field names and ensure any downstream validation/serialization code (token creation/response logic) returns those fields accordingly.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@apollo-openapi.yaml`:
- Around line 6931-7061: The OpenUserTokenCurrentCapability schema lacks a
"required" array making all ~30 properties optional; add a required array
listing fields that must always be returned (e.g. authType, userId, tokenId,
tokenName, tokenPrefix, expires) or adjust to the actual contract; update the
OpenUserTokenCurrentCapability schema's properties block to include a "required"
array with those field names and ensure any downstream validation/serialization
code (token creation/response logic) returns those fields accordingly.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 8dd952c3-a078-42bf-8c1f-00ba1a0b5830
📒 Files selected for processing (2)
apollo-openapi.yamltests/test_user_token_contract.py
nobodyiam
left a comment
nobodyiam
left a comment
There was a problem hiding this comment.
Reviewed current head a1b8387. The new User Token Management paths and response model match the referenced Apollo implementation shape, generate the expected UserTokenManagementApi, and the required-fields follow-up has been addressed. I also verified the local contract tests, generation check, and generated project compile successfully.
Non-blocking follow-up: OpenUserTokenOpenApiAction currently leaves its catalog fields optional in the schema, so generated clients treat fields like id, method, path, requiredOperations, grantedOperations, operationMatch, resourceScope, and description as nullable. Since this endpoint is intended to expose a machine-readable action catalog, it would be clearer to mark those nested action fields as required in a later cleanup.
No blocking findings from my side.
2 participants
What's changed
Related Apollo change
This contract is needed by apolloconfig/apollo#5632 so Apollo Portal can implement the generated UserTokenManagementApi interface instead of hand-written OpenAPI mappings.
Tests
Summary by CodeRabbit
Release Notes
whoamialias endpoint for quick token identification