private-api-config.yaml

plugin: openapi
specFile: ./private-api.yaml

pickFirstIfNoneMatch: false

validation:
  request: true

system:
  stores:
    questions:
      preloadFile: data/questions.json

resources:
  ### 'insufficient-questions' journey ###
  - method: POST
    path: /session
    requestBody:
      jsonPath: $.client_id
      value: "insufficient-questions"
    response:
      statusCode: 201
      template: true
      content: |
        {
          "session_id": "insufficient-questions",
          "state": "sT@t3",
          "redirect_uri": "http://example.net"
        }

  - method: POST
    path: /fetchquestions
    requestHeaders:
      session-id: insufficient-questions
    response:
      statusCode: 400
      content: |
        {
          "redirect_uri": "http://example.net",
          "oauth_error": {
            "error_description": "Invalid request",
            "error": "invalid_request"
          }
        }

  ### 'question-500' journey ###
  - method: GET
    path: /question
    requestHeaders:
      session-id: question-500
    response:
      statusCode: 500
      template: true
      content: Server Error

  ### 'answer-500' journey ###
  - method: POST
    path: /answer
    requestHeaders:
      session-id: answer-500
    response:
      statusCode: 500
      template: true
      content: Server Error

  ### 'authorization-error' journey ###
  - method: POST
    path: /session
    requestBody:
      jsonPath: $.client_id
      value: "authorization-error"
    response:
      statusCode: 201
      template: true
      content: |
        {
          "session_id": "authorization-error",
          "state": "sT@t3",
          "redirect_uri": "http://example.net"
        }

  - method: GET
    path: /question
    requestHeaders:
      session-id: "authorization-error"
    response:
      statusCode: 204

  - method: GET
    path: /authorization
    requestHeaders:
      session-id: "authorization-error"
    response:
      statusCode: 500
      content: |
        {
          "redirect_uri": "http://example.net",
          "oauth_error": {
            "error_description": "gateway",
            "error": "server_error"
          }
        }

  ### 'session-400' journey ###
  - method: POST
    path: /session
    requestBody:
      jsonPath: $.client_id
      value: "session-400"
    response:
      statusCode: 400
      template: true
      content: |
        {}

  ### 'session-500' journey ###
  - method: POST
    path: /session
    requestBody:
      jsonPath: $.client_id
      value: "session-500"
    response:
      statusCode: 500
      template: true
      content: |
        {}
  - method: POST
    path: /session
    requestBody:
      jsonPath: $.client_id
      value: "abandon"
    response:
      statusCode: 201
      template: true
      content: |
        {
          "session_id": "abandon",
          "state": "sT@t3",
          "redirect_uri": "http://example.net"
        }
  - method: POST
    path: /answer
    requestHeaders:
      session-id: "abandon"
    response:
      scriptFile: scripts/post-answer.groovy

  # Default journey that will get questions from the question store matching the initial client_id value as long as that
  # value starts with "questions-"
  - method: POST
    path: /session
    # Capture the client_id value here so we can use it in the response
    capture:
      journey:
        jsonPath: $.client_id
        store: request
    requestBody:
      jsonPath: $.client_id
      value: "questions-.+" # match anything starting with "questions-"
      operator: Matches
    response:
      statusCode: 201
      template: true
      # Set the session id to a unique value based on the client_id. The random element means that we can run tests
      # multiple times without clashes in the stores.
      content: |
        {
          "session_id": "${stores.request.journey}-SEPARATOR-${random.uuid()}",
          "state": "sT@t3",
          "redirect_uri": "http://example.net"
        }

  - method: POST
    path: /fetchquestions
    requestHeaders:
      session-id:
        value: "questions-.+-SEPARATOR-.+" # Match our session_id pattern
        operator: Matches
    response:
      statusCode: 200

  - method: GET
    path: /question
    requestHeaders:
      session-id:
        value: "questions-.+-SEPARATOR-.+" # Match our session_id pattern
        operator: Matches
    response:
      scriptFile: scripts/get-question.groovy

  - method: POST
    path: /answer
    requestHeaders:
      session-id:
        value: "questions-.+-SEPARATOR-.+" # Match our session_id pattern
        operator: Matches
    response:
      scriptFile: scripts/post-answer.groovy

  - method: GET
    path: /authorization
    requestHeaders:
      session-id:
        value: "questions-.+-SEPARATOR-.+" # Match our session_id pattern
        operator: Matches
    steps:
      # short-circuit when it's the 'abandon' journey
      - type: script
        lang: groovy
        code: |
          if (context.request.headers['session-id'] ==~ /questions-abandon.+/) {
            def deniedResponse = [
              redirect_uri: "http://example.net",
              oauth_error: [ error_description: "access-denied", error: "access_denied" ]
            ]
            def serializer = new groovy.json.JsonOutput()
            respond().withStatusCode(500).withContent(serializer.toJson(deniedResponse))
          }
    response:
      template: true
      statusCode: 200
      content: |
        {
          "authorizationCode": {
            "value":"auth-code-${random.uuid()}"
          },
          "state":"sT@t3",
          "redirect_uri":"http://example.net"
        }