Address PR review feedback on JSON/YAML request body support

- Preserve the inner Bytes extractor status code (e.g. 413) on body-read
  failures instead of forcing 400, and make ConfigBody's rejection type a
  consistent (StatusCode, Json<ErrorResponse>) tuple across all branches.
- Move raw serde parse errors out of ErrorResponse.message into
  ErrorDetail::technical_details, per the project error convention.
- Reject YAML anchor/alias expansion ('billion laughs') before deserializing.
- Move ConfigBody and helpers out of error.rs into a dedicated
  src/api/shared/extractor.rs module; re-export from shared.
- Keep push_source_data (a data-proxy endpoint) on axum::Json to avoid
  silent YAML->JSON coercion.
- README: list all five accepted YAML content types.
- CLAUDE.md: document ConfigBody usage and the data-plane exception.
- Tests: fix TOCTOU port race (bind port 0 once), narrow the module
  docstring, and add coverage for application/x-yaml and text/vnd.yaml,
  the missing-Content-Type JSON default, malformed JSON, anchor/alias
  rejection, source/reaction YAML wiring, plus is_yaml_content_type and
  anchor-scanner unit tests.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: danielgerlag

CLAUDE.md

@@ -59,6 +59,7 @@ This repository contains only the server wrapper functionality:
    - `v1/` - API version 1 handlers, routes, and OpenAPI spec
    - `v1/plugin_handlers.rs` - Plugin management API endpoints
    - `shared/` - Common handlers, error types, and response types shared across versions
+   - `shared/extractor.rs` - `ConfigBody<T>` request-body extractor (JSON/YAML content negotiation). New handlers that accept a config request body should use `ConfigBody<T>` rather than `axum::Json<T>` so JSON and YAML are accepted interchangeably. Data-plane proxy endpoints (e.g. `push_source_data`) stay on `axum::Json` to avoid silent YAML→JSON coercion.
    - `version.rs` - API version constants and utilities
    - `models/` - Data Transfer Objects (DTOs)
    - `mappings/` - DTO to domain model conversions

README.md

@@ -1662,8 +1662,8 @@ The server exposes a REST API at `http://localhost:8080` (default). For complete
 Every endpoint that accepts a request body accepts **both JSON and YAML** payloads
 interchangeably. The format is selected from the request's `Content-Type` header:
 send `application/json` (the default) for JSON, or one of `application/yaml`,
-`application/x-yaml`, or `text/yaml` for YAML. When no `Content-Type` is provided,
-the body is parsed as JSON.
+`application/x-yaml`, `text/yaml`, `text/x-yaml`, or `text/vnd.yaml` for YAML.
+When no `Content-Type` is provided, the body is parsed as JSON.
 
 ```bash
 # Create a query using a YAML body

src/api/joins_tests.rs

@@ -20,7 +20,7 @@ mod api_query_joins_tests {
     use crate::api::shared::handlers::*;
     use crate::persistence::ConfigPersistence;
     use async_trait::async_trait;
-    use crate::api::shared::error::ConfigBody;
+    use crate::api::shared::extractor::ConfigBody;
     use axum::Extension;
     use drasi_lib::{
         channels::{

src/api/shared/error.rs

@@ -29,95 +29,12 @@
 //! - **Layer 3 (drasi-lib):** Returns `DrasiError` which is converted to
 //!   `ErrorResponse` via `From<DrasiError>` with proper status code mapping.
 
-use axum::async_trait;
-use axum::body::Bytes;
-use axum::extract::FromRequest;
-use axum::http::header::CONTENT_TYPE;
 use axum::http::StatusCode;
 use axum::response::IntoResponse;
 use drasi_lib::DrasiError;
-use serde::{de::DeserializeOwned, Serialize};
+use serde::Serialize;
 use utoipa::ToSchema;
 
-/// A request-body extractor that accepts both JSON and YAML payloads.
-///
-/// The body format is selected from the request's `Content-Type` header:
-/// YAML media types (`application/yaml`, `application/x-yaml`, `text/yaml`,
-/// `text/x-yaml`, `text/vnd.yaml`) are parsed with `serde_yaml`; everything
-/// else (including a missing `Content-Type`) defaults to JSON. This lets every
-/// HTTP route on the API accept JSON and YAML interchangeably.
-///
-/// On failure it returns a structured `ErrorResponse` with the serde error
-/// details included (HTTP 400 via the `INVALID_REQUEST` code).
-#[derive(Debug, Clone, Copy, Default)]
-pub struct ConfigBody<T>(pub T);
-
-/// Returns `true` when the supplied `Content-Type` value denotes a YAML media type.
-fn is_yaml_content_type(content_type: &str) -> bool {
-    // Ignore any parameters (e.g. "; charset=utf-8") and surrounding whitespace.
-    let essence = content_type
-        .split(';')
-        .next()
-        .unwrap_or("")
-        .trim()
-        .to_ascii_lowercase();
-    matches!(
-        essence.as_str(),
-        "application/yaml"
-            | "application/x-yaml"
-            | "text/yaml"
-            | "text/x-yaml"
-            | "text/vnd.yaml"
-    )
-}
-
-#[async_trait]
-impl<T, S> FromRequest<S> for ConfigBody<T>
-where
-    T: DeserializeOwned,
-    S: Send + Sync,
-{
-    type Rejection = ErrorResponse;
-
-    async fn from_request(
-        req: axum::http::Request<axum::body::Body>,
-        state: &S,
-    ) -> Result<Self, Self::Rejection> {
-        let is_yaml = req
-            .headers()
-            .get(CONTENT_TYPE)
-            .and_then(|value| value.to_str().ok())
-            .map(is_yaml_content_type)
-            .unwrap_or(false);
-
-        let bytes = Bytes::from_request(req, state).await.map_err(|rejection| {
-            log::debug!("Failed to read request body: {}", rejection.body_text());
-            ErrorResponse::new(
-                error_codes::INVALID_REQUEST,
-                "Failed to read request body".to_string(),
-            )
-        })?;
-
-        if is_yaml {
-            serde_yaml::from_slice(&bytes).map(ConfigBody).map_err(|e| {
-                log::debug!("YAML extraction failed: {e}");
-                ErrorResponse::new(
-                    error_codes::INVALID_REQUEST,
-                    format!("Failed to parse YAML request body: {e}"),
-                )
-            })
-        } else {
-            serde_json::from_slice(&bytes).map(ConfigBody).map_err(|e| {
-                log::debug!("JSON extraction failed: {e}");
-                ErrorResponse::new(
-                    error_codes::INVALID_REQUEST,
-                    format!("Failed to parse JSON request body: {e}"),
-                )
-            })
-        }
-    }
-}
-
 /// Error codes for API responses
 pub mod error_codes {
     pub const SOURCE_CREATE_FAILED: &str = "SOURCE_CREATE_FAILED";