mirror of
https://github.com/azaion/satellite-provider.git
synced 2026-06-21 10:21:14 +00:00
Oleksandr Bezdieniezhnykh
34ee1e0b83
AZ-808: FluentValidation for POST /api/satellite/request - RegionRequestValidator: id non-empty, lat/lon/sizeMeters/zoomLevel ranges - RequestRegionRequest: [JsonRequired] on every property, no implicit defaults - Wired via .WithValidation<RequestRegionRequest>() in MapPost chain - Unit + integration tests + curl probe script - New contract: contracts/api/region-request.md v1.0.0 AZ-811: FluentValidation + envelope filter for GET /api/satellite/tiles/latlon - GetTileByLatLonQuery: nullable record (double?/int?) so the minimal-API binder never short-circuits with BadHttpRequestException before filters - GetTileByLatLonQueryValidator: Cascade(Stop) + NotNull + InclusiveBetween per param; missing surfaces as `\`<name>\` is required.` - RejectUnknownQueryParamsEndpointFilter: reusable IEndpointFilter that rejects any query key outside the allowed set with errors[<key>] map; catches legacy `?Latitude=` typos and hostile probes (`?debug=1&admin=1`) - Handler: [AsParameters] GetTileByLatLonQuery + .Value deref post-validator - Unit (validator + filter) + integration tests + curl probe script - New contract: contracts/api/tile-latlon.md v1.0.0 Shared hygiene - Promote AssertErrorsContainsMention from per-test-file private helpers to ProblemDetailsAssertions (closes batch-1 Low-severity DRY warning) - Sync Swagger param descriptions, README, blackbox/security/perf scripts, uuidv5 doc with the new lat/lon/zoom query-param names Docs - system-flows.md F1/F2 reference the new contracts + validation layers - modules/api_program.md adds Api/Validators + Api/DTOs sections - _autodev_state.md: batch 2 of 4 complete; next batch = AZ-809 All smoke tests green (mode=smoke, exit 0). AZ-808 + AZ-811 transitioned to In Testing on Jira. Co-authored-by: Cursor <cursoragent@cursor.com>
63 lines
2.6 KiB
Bash
Executable File
63 lines
2.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# Manual end-to-end probe for GET /api/satellite/tiles/latlon strict validation
|
|
# (AZ-811). Each failure call should return HTTP 400 with an
|
|
# `application/problem+json` body. The happy path should return HTTP 200.
|
|
#
|
|
# Two enforcement layers:
|
|
# 1. RejectUnknownQueryParamsEndpointFilter — rejects any query key outside
|
|
# {lat, lon, zoom}.
|
|
# 2. WithValidation<GetTileByLatLonQuery> — range-checks lat, lon, zoom.
|
|
#
|
|
# Usage:
|
|
# API_URL=https://localhost:8080 JWT="<bearer-token>" ./scripts/probe_latlon_validation.sh
|
|
|
|
API_URL="${API_URL:-https://localhost:8080}"
|
|
JWT="${JWT:-}"
|
|
PATH_LATLON="${API_URL%/}/api/satellite/tiles/latlon"
|
|
|
|
if [[ -z "${JWT}" ]]; then
|
|
echo "ERROR: set JWT env var to a bearer token. Mint one via:"
|
|
echo " dotnet run --project SatelliteProvider.IntegrationTests -- --mint-only"
|
|
exit 2
|
|
fi
|
|
|
|
curl_args=(-sS -k -H "Authorization: Bearer ${JWT}" -X GET)
|
|
|
|
probe() {
|
|
local label="$1"
|
|
local query="$2"
|
|
local expected_status="$3"
|
|
|
|
echo "----- ${label} (expecting HTTP ${expected_status}) -----"
|
|
local response
|
|
response=$(curl "${curl_args[@]}" "${PATH_LATLON}?${query}" -w "\nHTTP_STATUS=%{http_code}\n")
|
|
echo "${response}"
|
|
local actual_status
|
|
actual_status=$(echo "${response}" | tail -n 1 | sed 's/HTTP_STATUS=//')
|
|
if [[ "${actual_status}" != "${expected_status}" ]]; then
|
|
echo "FAIL: expected HTTP ${expected_status}, got ${actual_status}"
|
|
return 1
|
|
fi
|
|
echo "OK: HTTP ${expected_status}"
|
|
echo
|
|
}
|
|
|
|
probe "happy-path" "lat=47.461747&lon=37.647063&zoom=18" 200
|
|
# Validator rules — NotNull (missing required) + InclusiveBetween (range)
|
|
probe "missing-lat" "lon=37.647063&zoom=18" 400
|
|
probe "missing-lon" "lat=47.461747&zoom=18" 400
|
|
probe "missing-zoom" "lat=47.461747&lon=37.647063" 400
|
|
probe "lat-out-of-range" "lat=91&lon=37.647063&zoom=18" 400
|
|
probe "lon-out-of-range" "lat=47.461747&lon=181&zoom=18" 400
|
|
probe "zoom-out-of-range" "lat=47.461747&lon=37.647063&zoom=30" 400
|
|
# Envelope rule: unknown query params (legacy pre-AZ-811 wire names + hostile probes)
|
|
probe "legacy-param-names" "Latitude=47.461747&Longitude=37.647063&ZoomLevel=18" 400
|
|
probe "hostile-debug-admin" "lat=47.461747&lon=37.647063&zoom=18&debug=1&admin=true" 400
|
|
probe "typo-zooom" "lat=47.461747&lon=37.647063&zooom=18" 400
|
|
# Type mismatch (model binder)
|
|
probe "lat-type-mismatch" "lat=fifty&lon=37.647063&zoom=18" 400
|
|
|
|
echo "All probes passed."
|