fix(openapi): align buyer contract license metadata - #316
Conversation
📝 WalkthroughWalkthrough구매자 OpenAPI 문서에 Apache-2.0 라이선스, 테넌트 예제, conversion 삭제, PDF artifact, liveness 계약을 추가했습니다. Python 및 Java 계약 테스트가 해당 메타데이터와 경로 정의를 검증합니다. Changes구매자 OpenAPI 계약 검증
Estimated code review effort: 3 (Moderate) | ~20분 Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review @opencode-agent @cwl-noema-review Please independently review exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
HEAD_SHA="d5b2cdfcfe955efe6d26335eeefdc4e21952f87d"
BASE_SHA="f3cc09a9838f0f88c81a2ceae22138fab80a2edb"
REPO="ContextualWisdomLab/clearfolio"
echo '== Local commit availability and identity =='
git rev-parse HEAD
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$HEAD_SHA"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$BASE_SHA"
echo '== Exact changed paths and diff stat =='
git diff --name-status "$BASE_SHA" "$HEAD_SHA"
git diff --stat "$BASE_SHA" "$HEAD_SHA"
echo '== Complete requested-range diff =='
git diff --no-ext-diff --unified=80 "$BASE_SHA" "$HEAD_SHA" -- \
docs/deployment/clearfolio-buyer-connector.openapi.yaml \
scripts/test_buyer_openapi_license_contract.py
echo '== Root LICENSE authority (first 40 lines) =='
sed -n '1,40p' LICENSE
echo '== Current OpenAPI info/license block =='
awk '
/^info:[[:space:]]*$/ { in_info=1 }
in_info { print }
in_info && /^paths:[[:space:]]*$/ { exit }
' docs/deployment/clearfolio-buyer-connector.openapi.yaml
echo '== Contract test source =='
cat -n scripts/test_buyer_openapi_license_contract.py
echo '== GitHub PR head/base and current checks =='
gh pr view 316 --repo "$REPO" --json number,state,isDraft,mergeable,headRefOid,baseRefOid,reviewDecision,statusCheckRollup
gh api "repos/$REPO/commits/$HEAD_SHA/check-runs?per_page=100" \
--jq '.check_runs[] | [.name, .status, .conclusion, .details_url] | `@tsv`'
echo '== Live main and branch protection =='
gh api "repos/$REPO/git/ref/heads/main" --jq '.object.sha'
gh api "repos/$REPO/branches/main/protection" \
--jq '{required_pull_request_reviews, required_status_checks, enforce_admins}'Length of output: 27199 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== Locate Buyer-readiness workflow and test-discovery references =='
rg -n -C 4 --hidden \
-g '!**/.git/**' \
-e 'Buyer-readiness script tests' \
-e 'test_buyer_openapi_license_contract' \
-e 'unittest' \
-e 'scripts/test_.*\.py' \
.
echo '== GitHub job steps for the successful Buyer-readiness job =='
gh api 'repos/ContextualWisdomLab/clearfolio/actions/jobs/93340438963' \
--jq '{name, status, conclusion, head_sha, started_at, completed_at, steps: [.steps[] | {name, status, conclusion, number}]}'Length of output: 16149
The exact range contains only the stated two files. The current I could not verify branch-protection requirements because GitHub returned HTTP 403. The PR still reports
|
|
@coderabbitai review Fresh retry after the previous rate-limit window. Please review exact source head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/clearfolio"
head="d5b2cdfcfe955efe6d26335eeefdc4e21952f87d"
base="83ec6f7fe2b04bdcd28bf98ec350e41e55730a18"
echo "== Commit identities and ancestry =="
git show -s --format='%H%n%P%n%s' "$head"
git show -s --format='%H%n%P%n%s' "$base"
git merge-base --is-ancestor "$base" "$head" && echo "base_is_ancestor_of_head=true" || echo "base_is_ancestor_of_head=false"
git merge-base "$base" "$head"
echo "== Pull request state =="
gh pr view 316 --repo "$repo" \
--json number,state,isDraft,mergeable,headRefOid,baseRefOid,reviewDecision,statusCheckRollup
echo "== Live protected main ref =="
gh api "repos/$repo/git/ref/heads/main" --jq '.object.sha'
echo "== Effective changed paths and complete diff =="
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
git diff --no-ext-diff --unified=60 "$base" "$head" -- \
docs/deployment/clearfolio-buyer-connector.openapi.yaml \
scripts/test_buyer_openapi_license_contract.py
echo "== Root license authority =="
sed -n '1,35p' LICENSE
echo "== OpenAPI top-level metadata through paths marker =="
sed -n '1,100p' docs/deployment/clearfolio-buyer-connector.openapi.yaml
echo "== Contract test =="
cat -n scripts/test_buyer_openapi_license_contract.py
echo "== Contract-test discovery references =="
rg -n -C 3 --hidden -g '!**/.git/**' \
'test_buyer_openapi_license_contract|Buyer-readiness|unittest' \
.github scripts 2>/dev/null || true
echo "== Current check runs for requested head =="
gh api "repos/$repo/commits/$head/check-runs?per_page=100" \
--jq '.check_runs[] | [.name,.status,.conclusion] | `@tsv`'Length of output: 33684 🏁 Script executed: #!/bin/bash
set -euo pipefail
head="d5b2cdfcfe955efe6d26335eeefdc4e21952f87d"
merge_base="f3cc09a9838f0f88c81a2ceae22138fab80a2edb"
echo "== Source-only delta from merge base to requested head =="
git diff --name-status "$merge_base" "$head"
git diff --check "$merge_base" "$head"
git diff --no-ext-diff --unified=30 "$merge_base" "$head" -- \
docs/deployment/clearfolio-buyer-connector.openapi.yaml \
scripts/test_buyer_openapi_license_contract.py
echo "== Buyer-readiness workflow script-test step =="
sed -n '29,65p' .github/workflows/ci.yml
echo "== License test assertion locations =="
rg -n -C 2 \
'assert(In|NotIn|Equal|True)|OPENAPI_PATH|LICENSE_PATH' \
scripts/test_buyer_openapi_license_contract.pyLength of output: 6939
P2 — Bind the regression to Parse the OpenAPI document and assert these exact fields:
The source-only delta from merge base This review is advisory. It is not an approval.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/test_buyer_openapi_license_contract.py`:
- Around line 21-27: Update the OpenAPI assertions in the test method to parse
OPENAPI_PATH as YAML and directly assert document["info"]["license"]["name"]
equals "Apache-2.0" and document["info"]["license"]["url"] equals the Apache
license URL. Remove the whole-file substring checks, and add the YAML parser to
the test dependencies and execution environment if it is not already available.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 90793cee-0c6d-4365-b3c5-9f9b309d32eb
📒 Files selected for processing (2)
docs/deployment/clearfolio-buyer-connector.openapi.yamlscripts/test_buyer_openapi_license_contract.py
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@src/test/java/com/clearfolio/viewer/config/BuyerOpenApiRouteContractTest.java`:
- Line 39: Update BuyerOpenApiRouteContractTest’s deleteOperation parameter
assertions to inspect the parameters array directly and require a parameter with
name jobId, in path, and required true, rather than only asserting that
parameters is non-null.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 9707dd5c-0096-41fc-9998-f9983d24a4eb
📒 Files selected for processing (4)
docs/deployment/clearfolio-buyer-connector.openapi.yamlscripts/test_buyer_openapi_license_contract.pysrc/test/java/com/clearfolio/viewer/config/BuyerOpenApiLicenseContractTest.javasrc/test/java/com/clearfolio/viewer/config/BuyerOpenApiRouteContractTest.java
🚧 Files skipped from review as they are similar to previous changes (1)
- docs/deployment/clearfolio-buyer-connector.openapi.yaml
|
@opencode-agent Please independently review exact current head |
|
@cwl-noema-review Please independently review exact current head |
|
Queued @cwl-noema-review for PR #316 at head |
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/deployment/clearfolio-buyer-connector.openapi.yaml`:
- Around line 307-321: OpenAPI의 해당 응답 정의에서 206과 416에 Content-Range 헤더를 추가하세요.
206은 bytes start-end/total 형식, 416은 bytes */total 형식을 설명하도록 각각 스키마와 설명을 선언하고, 다른
응답 정의는 변경하지 마세요.
In
`@src/test/java/com/clearfolio/viewer/config/BuyerOpenApiRouteContractTest.java`:
- Around line 51-53: BuyerOpenApiRouteContractTest의 getOperation 검증을 컨테이너 타입
확인에서 실제 계약 값 검증으로 확장하세요. 해결된 parameters에서 docId path parameter와 선택적인 Range
header의 이름, 위치, 필수 여부를 확인하고, operation security가 artifactTokenQuery와
artifactTokenBearer 요구사항만 정확히 포함하는지 검증하세요.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 044fc74f-8f85-45f8-b6a6-0ddf9e84c968
📒 Files selected for processing (2)
docs/deployment/clearfolio-buyer-connector.openapi.yamlsrc/test/java/com/clearfolio/viewer/config/BuyerOpenApiRouteContractTest.java
|
Queued @cwl-noema-review for PR #316 at head |
|
@opencode-agent @cwl-noema-review Please independently review exact current head |
|
Queued @cwl-noema-review for PR #316 at head |
1 participant
Objective
Advance issue #315 with bounded buyer-facing OpenAPI contract integrity: repository licensing must agree with machine-readable licensing, examples must not imply demo production authority, protected routes must declare their real parameter/auth semantics, and signed artifact range responses must be consumable by generated clients.
Exact current state — 2026-08-10
71c1e3a9cd26bbd4d193811d8d35927a9af60fe2main:55d7ae8647208e301f282350f076eeddaba61d1131391571756: success31391573204: success31391571894: success31391571821: successEvery predecessor SHA, run, review, and PR-body statement is historical.
Test-first defects and fixes
License authority
A RED contract proved the buyer OpenAPI
info.licensecontradicted repository Apache-2.0 authority. The OpenAPI now declaresApache-2.0with the canonical Apache License 2.0 URL, and Java contract tests parse the actual YAML object rather than relying on whole-file substrings.Demo identity in machine-readable examples
The spec no longer hard-codes
buyer-demo/buyer-demo-operator; neutraltenant-example/operator-examplevalues avoid implying production demo authority. Issue #317 still owns the broader UI/service demo-authority gap.Protected delete route
The contract test resolves referenced parameters and requires
jobIdto bein: pathandrequired: truerather than accepting an arbitrary non-null parameter container.Signed artifact auth and range contract
A review finding identified that tests did not bind
/artifacts/{docId}.pdfto its actual authority and range semantics. Test-only head581f53172d7ba2f8b88086111f9661d8ca953e9btightened the contract to require:docIdpath parameterRangeheaderartifactTokenQueryandartifactTokenBearersecurity alternatives200,206,401,403,404,416Content-Rangemetadata for206and416Exact-head CI failed RED because the OpenAPI had no
headersmap for the range responses (500tests,1failure,0errors,0skipped). Final head71c1e3a9cd26bbd4d193811d8d35927a9af60fe2adds only the missing contract metadata:206:Content-Rangestring, documented asbytes start-end/total416:Content-Rangestring, documented asbytes */totalThe four exact-head CI/security/SAST/fuzz workflows are now green, and CodeRabbit marked the corresponding findings addressed.
Scope / non-completion boundary
Changed paths remain limited to:
docs/deployment/clearfolio-buyer-connector.openapi.yamlscripts/test_buyer_openapi_license_contract.pysrc/test/java/com/clearfolio/viewer/config/BuyerOpenApiLicenseContractTest.javasrc/test/java/com/clearfolio/viewer/config/BuyerOpenApiRouteContractTest.javaThis PR does not complete issue #315. The buyer OpenAPI remains a partial seed; complete route/DTO/error/schema parity, API version policy, breaking-change detection, generated standalone and naruon clients, version negotiation, and release-provenance binding remain open. PR #337 independently owns the unique
operationIdinvariant.Merge gate
Merge only if this unchanged final head continues to satisfy live repository protection, has zero valid unresolved findings, and receives the qualifying independent non-author approval with write access required by protected main. After integration, continue issue #315 rather than closing it.