[Experiment] Add OpenAPI request response validation

api/src/main/resources/custom_templates/typeInfoAnnotation.mustache

@@ -1,3 +1,18 @@
+{{!
+    Copyright 2021-Present Okta, Inc.
+
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+}}
 {{!
 Based on https://github.com/OpenAPITools/openapi-generator/blob/v6.6.0/modules/openapi-generator/src/main/resources/Java/typeInfoAnnotation.mustache
 - Add defaultImpl to deserialize to base type if discriminator is null or unknown

coverage/pom.xml

@@ -39,7 +39,8 @@
         </dependency>
         <dependency>
             <groupId>com.okta.sdk</groupId>
-            <artifactId>okta-sdk-examples-quickstart</artifactId>
+            <artifactId>okta-sdk-examples</artifactId>
+            <version>${project.version}</version>
             <scope>test</scope>
         </dependency>
         <dependency>

examples/pom.xml

@@ -14,8 +14,7 @@
   ~ See the License for the specific language governing permissions and
   ~ limitations under the License.
   -->
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
-
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
     <modelVersion>4.0.0</modelVersion>
 
     <parent>
@@ -26,9 +25,54 @@
 
     <artifactId>okta-sdk-examples</artifactId>
     <name>Okta Java SDK :: Examples</name>
-    <packaging>pom</packaging>
+    <description>A simple (non-web) application to demonstrate the example code in the Okta Java Quickstart</description>
+
+    <dependencies>
+        <dependency>
+            <groupId>com.okta.sdk</groupId>
+            <artifactId>okta-sdk-api</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>com.okta.sdk</groupId>
+            <artifactId>okta-sdk-impl</artifactId>
+            <scope>runtime</scope>
+        </dependency>
+        <dependency>
+            <groupId>ch.qos.logback</groupId>
+            <artifactId>logback-classic</artifactId>
+            <scope>runtime</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.testng</groupId>
+            <artifactId>testng</artifactId>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.codehaus.mojo</groupId>
+                <artifactId>exec-maven-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>copy to swagger</id>
+                        <configuration>
+                            <skip>true</skip>
+                        </configuration>
+                    </execution>
+                    <execution>
+                        <goals>
+                            <goal>java</goal>
+                        </goals>
+                    </execution>
+                </executions>
+                <configuration>
+                    <killAfter>-1</killAfter>
+                    <mainClass>quickstart.Quickstart</mainClass>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
 
-    <modules>
-        <module>quickstart</module>
-    </modules>
 </project>

examples/quickstart/src/main/java/quickstart/Quickstart.java → examples/src/main/java/quickstart/Quickstart.java

@@ -66,9 +66,9 @@ public static void main(String[] args) throws ApiException {
 
             // Create a group
             group = GroupBuilder.instance()
-                    .setName(groupName)
-                    .setDescription("Quickstart created Group")
-                    .buildAndCreate(groupApi);
+                .setName(groupName)
+                .setDescription("Quickstart created Group")
+                .buildAndCreate(groupApi);
 
             println("Group: '" + group.getId() + "' was last updated on: " + group.getLastUpdated());
 
@@ -128,4 +128,4 @@ private static void println(String message) {
         System.out.println(message);
         System.out.flush();
     }
-}
+}

examples/quickstart/src/main/resources/logback.xml → examples/src/main/resources/logback.xml

@@ -28,6 +28,6 @@
         <appender-ref ref="STDOUT"/>
     </root>
     <logger name="com.okta.sdk" level="INFO"/>
-    <!--<logger name="org.apache.hc.client5.http.wire" level="DEBUG"/>-->
+    <logger name="org.apache.hc.client5.http.wire" level="DEBUG"/>
 
 </configuration>

impl/pom.xml

@@ -88,6 +88,18 @@
             <optional>true</optional>
         </dependency>
 
+        <dependency>
+            <groupId>com.atlassian.oai</groupId>
+            <artifactId>swagger-request-validator-core</artifactId>
+            <version>2.40.0</version>
+            <exclusions>
+                <exclusion>
+                    <groupId>commons-logging</groupId>
+                    <artifactId>commons-logging</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+
         <!-- Test deps -->
         <dependency>
             <groupId>org.mockito</groupId>

impl/src/main/java/com/okta/sdk/impl/client/DefaultClientBuilder.java

@@ -44,6 +44,8 @@
 import com.okta.sdk.impl.oauth2.AccessTokenRetrieverServiceImpl;
 import com.okta.sdk.impl.oauth2.DPoPInterceptor;
 import com.okta.sdk.impl.oauth2.OAuth2ClientCredentials;
+import com.okta.sdk.impl.openapi.OpenApiRequestValidationInterceptor;
+import com.okta.sdk.impl.openapi.OpenApiResponseValidationInterceptor;
 import com.okta.sdk.impl.serializer.GroupProfileSerializer;
 import com.okta.sdk.impl.serializer.UserProfileSerializer;
 import com.okta.sdk.impl.util.ConfigUtil;
@@ -109,6 +111,9 @@ public class DefaultClientBuilder implements ClientBuilder {
     private static final String OKTA_CONFIG_CP  = "com/okta/sdk/config/";
     private static final String OKTA_YAML       = "okta.yaml";
     private static final String OKTA_PROPERTIES = "okta.properties";
+
+    private static final String API_SPEC_PATH = "./../src/swagger/api.yaml";
+
     private CacheManager cacheManager;
     private ClientCredentials clientCredentials;
     private boolean allowNonHttpsForTesting = false;
@@ -398,6 +403,10 @@ protected HttpClientBuilder createHttpClientBuilder(ClientConfiguration clientCo
         if (isOAuth2Flow() && !hasAccessToken()) {
             httpClientBuilder.addExecInterceptorLast("dpop", new DPoPInterceptor());
         }
+
+        httpClientBuilder.addRequestInterceptorLast(new OpenApiRequestValidationInterceptor(API_SPEC_PATH));
+        httpClientBuilder.addResponseInterceptorLast(new OpenApiResponseValidationInterceptor(API_SPEC_PATH));
+
         return httpClientBuilder;
     }
 

impl/src/main/java/com/okta/sdk/impl/openapi/OpenApiRequestValidationInterceptor.java

@@ -0,0 +1,68 @@
+/*
+ * Copyright 2024-Present Okta, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.okta.sdk.impl.openapi;
+
+import com.atlassian.oai.validator.OpenApiInteractionValidator;
+import com.atlassian.oai.validator.model.SimpleRequest;
+import com.atlassian.oai.validator.report.JsonValidationReportFormat;
+import com.atlassian.oai.validator.report.ValidationReport;
+import org.apache.commons.codec.Charsets;
+import org.apache.commons.io.IOUtils;
+import org.apache.hc.core5.http.ClassicHttpRequest;
+import org.apache.hc.core5.http.EntityDetails;
+import org.apache.hc.core5.http.HttpRequest;
+import org.apache.hc.core5.http.HttpRequestInterceptor;
+import org.apache.hc.core5.http.protocol.HttpContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.IOException;
+import java.util.Objects;
+
+public class OpenApiRequestValidationInterceptor implements HttpRequestInterceptor {
+
+    private static final Logger logger = LoggerFactory.getLogger(OpenApiRequestValidationInterceptor.class);
+
+    private final OpenApiInteractionValidator validator;
+
+    public OpenApiRequestValidationInterceptor(final String specPath) {
+        validator = OpenApiInteractionValidator
+            .createForSpecificationUrl(specPath)
+            .build();
+    }
+
+    @Override
+    public void process(HttpRequest httpRequest, EntityDetails entityDetails, HttpContext httpContext) throws IOException {
+
+        logger.debug("OpenApiValidationRequestInterceptor invoked");
+
+        ClassicHttpRequest classicHttpRequest = (ClassicHttpRequest) httpRequest;
+
+        SimpleRequest.Builder builder =
+            new SimpleRequest.Builder(classicHttpRequest.getMethod(), classicHttpRequest.getRequestUri(), false);
+
+        if (Objects.nonNull(classicHttpRequest.getEntity().getContent())) {
+            String jsonRequest = IOUtils.toString(classicHttpRequest.getEntity().getContent(), Charsets.UTF_8);
+            builder.withBody(jsonRequest);
+        }
+
+        final ValidationReport requestValidationReport = validator.validateRequest(builder.build());
+
+        if (requestValidationReport.hasErrors()) {
+            logger.error(JsonValidationReportFormat.getInstance().apply(requestValidationReport));
+        }
+    }
+}