Serialize in request validation and authorize object when toJSON() matches to the format

[pilerou]

Is your feature request related to a problem? Please describe.
I would like to do 2 things :

• serialize String data to Object when I receive it from request
• deserialize object when i want to return the response and validate my response

I have two kinds of objects in my mind :

• Date objects
• Mongodb ObjectID

Describe the solution you'd like
It could be great to allow developers to add some adapters that could be considered by express-openapi-validator on request and on response.
For example, i could declare in my openapi components section :

  components: 
    schemas: 
      ObjectId:
        type: "string"
        pattern: "^[0-9a-fA-F]{24}$"
      Date:
        type: "string"
        format: "date"
      DateTime:
        type: "string"
        format: "date-time"

then i could configure my OpenAPIValidator with those adapters :

OpenApiValidator({
  apiSpec: './test/resources/openapi.yaml',
  validateRequests: true, // (default)
  validateResponses: true, // false by default
  formatAdapters : {
     '#/components/schemas/ObjectId' : {
        serialize : o => new ObjectID(o)
        deserialize : o => o.toJSON()
    },
    '#/components/schemas/Date' : {
        serialize : o => new Date(o)
        deserialize : o => o.toISOString().slice(0,10);
    },
    '#/components/schemas/DateTime' : {
        serialize : o => new Date(o)
        deserialize : o => o.toISOString();
    } 
  }
})

Describe alternatives you've considered
I already tried to hack the formats.js by adding new formats and a "validate" description
I also used in the past (2014-2015), a library, "tdegrunt/jsonschema" ,in which I added a hook to do this.
I manage to do this but I need to parse twice the JSON body : once with jsonschema then once with express-openapi-validator.

Additional context
I saw some issues related to this issue even if they are not explained the same way. I think this solution would be adaptable :

• Date is not validated correctly as type: string, format: date-time #246

[cdimascio]

Thanks @pilerou, this is a nice idea. Would you mind posting the code you wrote to “hack it”? Thanks

[pilerou]

Actually I didn't manage to make it work.

• I can hack deserialization with JSON.parse(JSON.stringify(object)) .
  It's good for converting Date object to date-time json schema. It won't solve the case of a date json schema
• I didn't manage to serialize json to objects. I don't know where to do it in the module and I think it's related to AJV usage. I don't know very much how to change something in it.

If you give me some clues, I'm OK to try to implement this feature.

[pilerou]

Hi @cdimascio
I had time to work on it this sunday (and I just make it work with your last version 4.5.0).

First, I défine my components (in JSON or in YAML)

{
  "components" : {
    "schemas" : {
      "ObjectId" : {
        "type": "string",
        "pattern": "^[0-9a-fA-F]{24}$"
      },
      "Date" : {
        "type": "string",
        "format": "date"
      },
      "dateTime" : {
        "type": "string",
        "format": "date-time"
      }
    }
  }
}

Then I just have to configure the way AJV has to coerce it at OpenApiValidator middleware creation.

    app.use(OpenApiValidator.middleware({
      apiSpec: schema.openAPIJson,
      validateRequests: true,
      validateResponses: true,
      coerceComponents: {
        'ObjectId': {
          serialize: (o) => new ObjectID(o),
          deserialize: (o) => o.toString(),
        },
        'Date': {
          serialize: (o) => new Date(o),
          deserialize: (o) => o.toISOString().slice(0, 10),
        },
        'DateTime': {
          serialize: (o) => new Date(o),
          deserialize: (o) => o.toISOString(),
        },
      },
    }));

To do this, I had to change openapi.validator.js and framework/ajv/index.js in order to manage the new parameter coerceComponents.
I add the patch : coherceComponents.txt

openapi.validator.js

I add coerceComponents attribute to be copied in base options.

      baseOptions() {
        const { coerceTypes, unknownFormats, validateFormats, coerceComponents } = this.options;
        return {
            nullable: true,
            coerceTypes,
            coerceComponents,
            useDefaults: true,
            removeAdditional: false,
            unknownFormats,
            format: validateFormats,
            formats: this.options.formats.reduce((acc, f) => {
                acc[f.name] = {
                    type: f.type,
                    validate: f.validate,
                };
                return acc;
            }, {}),
        };
    }

framework/ajv/index.js

First, I add a coerceComponent attribute to each component schema I described at middleware initialization.
Note that the order of the property coerceComponent is important. It has to be the last one on request and the first one on response because :

• Other validation format checks must be done before the serialization to object on request
• the deserialization from object to primitive type must be done before checking other rules on response.

            if(options.coerceComponents && options.coerceComponents[id]) {
                if (request) {
                    // On resquest, we must coerce at the end
                    schema.coerceComponent = options.coerceComponents[id];
                }
                else {
                    // On response, we must coerce before validate
                    openApiSpec.components.schemas[id] = {
                        ...{coerceComponent : options.coerceComponents[id]},
                        schema
                    }
                }
            }
            ajv.addSchema(openApiSpec.components.schemas[id], `#/components/schemas/${id}`);

Then, I add a keyword mecanism to AJV on each schema with attribute coerceComponent.
On request I serialize string to object by calling serialize function.

      if (request) {
        if(options.coerceComponents) {
            ajv.addKeyword('coerceComponent', {
                modifying: true,
                compile: sch => {
                    if (sch) {
                        return function validate(data, path, obj, propName) {
                            obj[propName] = sch.serialize(data);
                            return true;
                        }
                    }
                    return () => true;
                }
            });
        }

On response, I deserialize object to string.

        // response
        if(options.coerceComponents) {
            ajv.addKeyword('coerceComponent', {
                modifying: true,
                compile: sch => {
                    if (sch) {
                        return function validate(data, path, obj, propName) {
                            obj[propName] = sch.deserialize(data);
                            return true;
                        }
                    }
                    return () => true;
                }
            });
        }

[pilerou]

I forgot to tell you that it only work on body validation.
Actually, on url parameter it doesn't work as this module makes his own url decoding in order to retrieve parameters names and values.
Even if I change the value of a parameter, Express is doing his job after and override the req.params object.

I think you already looked but i ask anyway : there's no way to make express decode url before analyzing url parameters and make the schema validation ?

[pilerou]

In my pull request, I tested it.
It also worked for request parameters.

[cdimascio]

i'll have a look. thanks for this work!