feat(spec): validate webhookEndpoint format on PATCH /config#496
feat(spec): validate webhookEndpoint format on PATCH /config#496jklein24 wants to merge 1 commit into
Conversation
Adds format:uri and pattern constraints to PlatformConfigUpdateRequest.webhookEndpoint so SDK clients and the bundler catch malformed URLs before they reach the server. The audit found the server currently accepts not-a-url, http://, localhost, and empty string. Server-side validation tracked separately. Refs AT-5334
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
✱ Stainless preview builds for gridThis PR will update the cli csharp go kotlin openapi php python ruby typescript Edit this comment to update them. They will appear in their respective SDK's changelogs. ✅ grid-cli studio · code · diff
✅ grid-go studio · code · diff
✅ grid-openapi studio · code · diff
✅ grid-ruby studio · code · diff
✅ grid-typescript studio · code · diff
✅ grid-kotlin studio · code · diff
✅ grid-python studio · code · diff
✅ grid-php studio · code · diff
⏳ These are partial results; builds are still running. This comment is auto-generated by GitHub Actions and is automatically kept up to date as you push. |
Greptile SummaryThis PR adds
Confidence Score: 4/5Safe to merge — changes are additive spec annotations with no breaking effect on existing valid requests. The source schema and both generated bundles are updated consistently. The constraints work as intended for common cases, but minLength:9 is loose enough to let obviously malformed values like https://x slip through, and format:uri may be treated as annotation-only by some validators, leaving whitespace-containing values unblocked on the client side. openapi/components/schemas/config/PlatformConfigUpdateRequest.yaml — the minLength value and format:uri reliability are worth a second look.
|
| Filename | Overview |
|---|---|
| openapi/components/schemas/config/PlatformConfigUpdateRequest.yaml | Adds format:uri, pattern, minLength, and description to webhookEndpoint — the source-of-truth change. Minor concern: minLength:9 is very permissive (allows https://x) and format:uri enforcement varies by validator. |
| openapi.yaml | Generated bundle updated consistently with the source schema change via make build; changes are correct and match the source. |
| mintlify/openapi.yaml | Mintlify bundle updated consistently with the source schema change; identical delta to openapi.yaml. |
Sequence Diagram
sequenceDiagram
participant Client as SDK / Client
participant Spec as OpenAPI Schema Validator
participant Server as Grid API Server
Client->>Spec: "PATCH /config {webhookEndpoint: "..."}"
alt Fails pattern (^https://) or minLength or format:uri
Spec-->>Client: Validation error (rejected client-side)
else Passes schema constraints
Spec->>Server: Request forwarded
Server-->>Client: 200 OK (or server-side error for localhost/private host)
end
Prompt To Fix All With AI
Fix the following 2 code review issues. Work through them one at a time, proposing concise fixes.
---
### Issue 1 of 2
openapi/components/schemas/config/PlatformConfigUpdateRequest.yaml:8-10
`minLength: 9` is derived from `len("https://") + 1 = 9`, which means `https://x` technically passes all three constraints (pattern, minLength, and loosely format:uri). The description already calls out that raw hostnames are rejected, but a value of `minLength: 11` would guarantee at least a minimal `host.tld` form. Consider either raising the value to match your shortest real-world endpoint or dropping it in favour of relying solely on `format: uri` + `pattern`.
```suggestion
format: uri
pattern: '^https://'
minLength: 11
```
### Issue 2 of 2
openapi/components/schemas/config/PlatformConfigUpdateRequest.yaml:8-9
`format: uri` enforcement is optional in JSON Schema Draft 2019-09 and later — validators are permitted to treat it as an annotation rather than a constraint. SDK generators that follow the spec loosely may skip it entirely, leaving `pattern: '^https://'` as the only reliably-enforced check. A string like `https://not a url` or `https:// spaces` would pass pattern + minLength but fail a strict URI parse. Adding `pattern: '^https://[^\s]+'` (or a stricter host regex) would give deterministic client-side rejection regardless of validator behaviour.
Reviews (1): Last reviewed commit: "feat(spec): validate webhookEndpoint for..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| format: uri | ||
| pattern: '^https://' | ||
| minLength: 9 |
There was a problem hiding this comment.
minLength: 9 is derived from len("https://") + 1 = 9, which means https://x technically passes all three constraints (pattern, minLength, and loosely format:uri). The description already calls out that raw hostnames are rejected, but a value of minLength: 11 would guarantee at least a minimal host.tld form. Consider either raising the value to match your shortest real-world endpoint or dropping it in favour of relying solely on format: uri + pattern.
| format: uri | |
| pattern: '^https://' | |
| minLength: 9 | |
| format: uri | |
| pattern: '^https://' | |
| minLength: 11 |
Prompt To Fix With AI
This is a comment left during a code review.
Path: openapi/components/schemas/config/PlatformConfigUpdateRequest.yaml
Line: 8-10
Comment:
`minLength: 9` is derived from `len("https://") + 1 = 9`, which means `https://x` technically passes all three constraints (pattern, minLength, and loosely format:uri). The description already calls out that raw hostnames are rejected, but a value of `minLength: 11` would guarantee at least a minimal `host.tld` form. Consider either raising the value to match your shortest real-world endpoint or dropping it in favour of relying solely on `format: uri` + `pattern`.
```suggestion
format: uri
pattern: '^https://'
minLength: 11
```
How can I resolve this? If you propose a fix, please make it concise.
| format: uri | ||
| pattern: '^https://' |
There was a problem hiding this comment.
format: uri enforcement is optional in JSON Schema Draft 2019-09 and later — validators are permitted to treat it as an annotation rather than a constraint. SDK generators that follow the spec loosely may skip it entirely, leaving pattern: '^https://' as the only reliably-enforced check. A string like https://not a url or https:// spaces would pass pattern + minLength but fail a strict URI parse. Adding pattern: '^https://[^\s]+' (or a stricter host regex) would give deterministic client-side rejection regardless of validator behaviour.
Prompt To Fix With AI
This is a comment left during a code review.
Path: openapi/components/schemas/config/PlatformConfigUpdateRequest.yaml
Line: 8-9
Comment:
`format: uri` enforcement is optional in JSON Schema Draft 2019-09 and later — validators are permitted to treat it as an annotation rather than a constraint. SDK generators that follow the spec loosely may skip it entirely, leaving `pattern: '^https://'` as the only reliably-enforced check. A string like `https://not a url` or `https:// spaces` would pass pattern + minLength but fail a strict URI parse. Adding `pattern: '^https://[^\s]+'` (or a stricter host regex) would give deterministic client-side rejection regardless of validator behaviour.
How can I resolve this? If you propose a fix, please make it concise.
|
Closing — the underlying defects (filed under epic AT-5324) are server-side runtime issues that need to be fixed in sparkcore, not here in the spec. These spec-level clarifications can be reopened as follow-ups once the server fixes land if still useful. |
1 participant
Summary
Tightens the OpenAPI schema for
webhookEndpointonPATCH /configso SDKclients and bundler-level validation reject obvious garbage URLs:
format: uripattern: ^https://minLength: 9Why
The error audit (parent epic AT-5324) found the server currently accepts
not-a-url,http://...,https://localhost:..., and empty string forwebhookEndpointwith HTTP 200. Spec-side tightening helps SDKs catch thisearly; the server-side validation fix is tracked in AT-5334.
Test plan
make buildcleanmake lintcleanmintlify/openapi.yamlandconfirm the description renders correctly in docs preview.
Refs AT-5334