fix(cmd-api-server): OpenAPI spec validation missing from plugin REST endpoints

[petermetz]

Describe the bug

Right now the constraints we define for request/response objects are not checked when a request comes in. (except for the api-server's built in endpoints).

To Reproduce

Send an invalid request to some plugin endpoint that is invalid in a certain way and watch how it crashes the plugin resulting in internal server error vs. bad request.

Expected behavior

Fail with bad request even before the plugin's back-end code is reached if a request is sent that does not comply with the open api specs defined for that endpoint.

Logs/Stack traces

N/A

Screenshots

N/A

Cloud provider or hardware configuration:

N/A

Operating system name, version, build:

N/A

Hyperledger Cactus release version or commit (git rev-parse --short HEAD):

main @ today

Hyperledger Cactus Plugins/Connectors Used

All of them.

Additional context

The mechanics of this are very simple and there's also a working example in the code of the api-server.ts file, but what needs to be given some more thought prior to jumping in is how to do this within the confines of the plugin architecture.
More specifically one of the questions that needs answering prior to actual work is who should be responsible for registering the validation middleware? Is it the api-server when hooking up the plugin's web services or should we delegate this entirely to the plugin instance itself?

My recommendation is below (but this could turn out to be a bad idea so be ready for the need to do some refactoring once we see how it plays out)

The interface of the web service plugins should be extended with a getOpenApiSpecs() method that returns an OpenAPI v3 spec document (see the openapi-types package)
Then the api-server calls up this method when it's installing the web services of the plugin, obtains the open api specs and creates a validator instance from it, hooks that middleware in to the api-server's express JS object.

cc: @takeutak @sfuji822 @hartm @jonathan-m-hamilton @AzaharaC @jordigiam @kikoncuo @jagpreetsinghsasan @arnab-roy @TonyRowntree

[TonyRowntree]

hey @petermetz is this done?

[elenaizaguirre]

@petermetz, can I work with this?

[petermetz]

hey @petermetz is this done?

@TonyRowntree Not yet, no.

[petermetz]

@petermetz, can I work with this?

@elenaizaguirre Yup! Feel free to pick it up!