Skip to content

feat(api): expose OpenAPI 3.1 document at /openapi.json - #10

Open
lgalabru wants to merge 1 commit into
mainfrom
feat/openapi-json
Open

feat(api): expose OpenAPI 3.1 document at /openapi.json#10
lgalabru wants to merge 1 commit into
mainfrom
feat/openapi-json

Conversation

@lgalabru

@lgalabru lgalabru commented Aug 2, 2026

Copy link
Copy Markdown
Member

Serves an OpenAPI 3.1 description of the whole surface at GET /openapi.json — the discovery document a pay gateway can gate against (ludovic's ask, scarce-studio channel).

How

  • Assembled, not hand-maintained: components come from the published schemars registry (studio_types::schemas) — the same derives that generate schemas/*.json — so the OpenAPI contract cannot drift from the wire types. One mechanical transform: each schema's $defs hoist into #/components/schemas (deduplicated, refs rewritten) so the document is plain-pointer resolvable.
  • Registry grows rfq-record, quote-record, field-error (response + 422 contracts), now also served at /api/v1/schemas/{name} and checked in under schemas/.
  • servers comes from the configured public_url, so the served doc is addressable as deployed. Root security: [] (buyers never authenticate); create_quote overrides with the studio bearer scheme.

Drift guards (tests/openapi_api.rs)

  • every documented operation is actually routed (no bare fallback / 405)
  • everything GET /api/v1 advertises is documented
  • every $ref resolves; the full registry is embedded

Verified

  • just ci: fmt + clippy clean, 154 tests pass (149 baseline + 5 new)
  • live smoke: ran scarced, curled /openapi.json; document validates spec-clean under redocly lint (remaining warnings are deliberate: ops endpoints with no 4xx, standalone gate-policy component)

Assembled from the published schemars registry (studio_types::schemas),
so the OpenAPI contract cannot drift from the wire types: components are
the registry schemas with $defs hoisted into #/components/schemas and
refs rewritten. Registry grows rfq-record, quote-record and field-error
(response and 422 contracts, now also served at /api/v1/schemas/{name}).

Drift guards in tests/openapi_api.rs: every documented operation is
routed (no bare-fallback/405), every endpoint advertised by GET /api/v1
is documented, every $ref resolves, registry fully embedded. Document
validates clean under redocly lint (spec-valid, root security declared,
license stamped).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant