vl-convert-server 2.0.0-rc2

HTTP server for converting Vega-Lite and Vega specifications to static images
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105

mod common;

use common::*;

#[tokio::test]
async fn test_public_docs_available() {
    let server = &*DEFAULT_SERVER;
    let resp = server
        .client
        .get(format!("{}/api-doc/openapi.json", server.base_url))
        .send()
        .await
        .unwrap();
    assert_eq!(resp.status(), 200);
    let body: serde_json::Value = resp.json().await.unwrap();
    assert!(
        body["openapi"].is_string(),
        "expected openapi version field"
    );
    assert!(body["paths"].is_object(), "expected paths object");

    let resp = server
        .client
        .get(format!("{}/docs/", server.base_url))
        .send()
        .await
        .unwrap();
    assert_eq!(resp.status(), 200);
    let ct = resp
        .headers()
        .get("content-type")
        .and_then(|v| v.to_str().ok())
        .unwrap_or("");
    assert!(
        ct.contains("text/html"),
        "expected HTML content type for swagger UI, got: {ct}"
    );
}

#[tokio::test]
async fn test_main_openapi_excludes_admin_paths() {
    // The main `/api-doc/openapi.json` must NOT leak any /admin/* path.
    // Admin is a separate surface with its own spec at `/admin/api-doc/openapi.json`.
    let server = &*DEFAULT_SERVER;
    let resp = server
        .client
        .get(format!("{}/api-doc/openapi.json", server.base_url))
        .send()
        .await
        .unwrap();
    assert_eq!(resp.status(), 200);
    let body: serde_json::Value = resp.json().await.unwrap();
    let paths = body["paths"].as_object().expect("paths must be an object");
    let admin_paths: Vec<&String> = paths.keys().filter(|k| k.starts_with("/admin")).collect();
    assert!(
        admin_paths.is_empty(),
        "main /api-doc/openapi.json leaked admin paths: {admin_paths:?}"
    );
}

#[tokio::test]
async fn test_admin_openapi_includes_admin_paths() {
    // The admin spec at `/admin/api-doc/openapi.json` must include every
    // admin endpoint. Spawns a server with an admin listener so the spec is
    // reachable.
    let server = start_admin_config_server(
        vl_convert_rs::converter::VlcConfig::default(),
        default_serve_config(),
    );
    let client = reqwest::Client::new();
    let resp = client
        .get(format!(
            "{}/admin/api-doc/openapi.json",
            server.admin_base_url
        ))
        .send()
        .await
        .unwrap();
    assert_eq!(resp.status(), 200);
    let body: serde_json::Value = resp.json().await.unwrap();
    let paths = body["paths"].as_object().expect("paths must be an object");

    // Expected admin paths should appear; method counts are grouped under
    // one path object by utoipa-axum.
    let expected = [
        "/admin/budget",
        "/admin/config",
        "/admin/config/fonts/directories",
        "/admin/diagnostics/workers",
    ];
    for path in expected {
        assert!(
            paths.contains_key(path),
            "admin spec missing expected path {path}; got keys: {:?}",
            paths.keys().collect::<Vec<_>>()
        );
    }

    // Negative: admin spec should NOT include main-surface paths.
    let has_vegalite = paths.keys().any(|k| k.starts_with("/vegalite"));
    assert!(
        !has_vegalite,
        "admin spec leaked /vegalite/* paths — should only contain /admin/*"
    );
}