Support for multipart/form-data in the request body

packages/http-server/src/__tests__/body-params-validation.spec.ts

@@ -718,6 +718,70 @@ describe('body params validation', () => {
           tags: [],
           security: [],
         },
+        {
+          id: '?http-operation-id?',
+          method: 'post',
+          path: '/multipart-form-data-body-required',
+          responses: [
+            {
+              id: faker.random.word(),
+              code: '200',
+              headers: [],
+              contents: [
+                {
+                  id: faker.random.word(),
+                  mediaType: 'application/json',
+                  schema: {
+                    type: 'object',
+                    properties: {
+                      type: {
+                        type: 'string',
+                      },
+                    },
+                  },
+                  examples: [
+                    {
+                      id: faker.random.word(),
+                      key: 'test',
+                      value: { type: 'foo' },
+                    },
+                  ],
+                  encodings: [],
+                },
+              ],
+            },
+          ],
+          servers: [],
+          request: {
+            body: {
+              id: faker.random.word(),
+              required: true,
+              contents: [
+                {
+                  id: faker.random.word(),
+                  mediaType: 'multipart/form-data',
+                  schema: {
+                    type: 'object',
+                    properties: {
+                      status: {
+                        type: 'string'
+                      },
+                    },
+                    $schema: 'http://json-schema.org/draft-07/schema#',
+                  },
+                  examples: [],
+                  encodings: [],
+                },
+              ],
+            },
+            headers: [],
+            query: [],
+            cookie: [],
+            path: [],
+          },
+          tags: [],
+          security: [],
+        },
       ]);
     });
 
@@ -796,5 +860,20 @@ describe('body params validation', () => {
         expect(response.status).toBe(200);
       });
     });
+
+    describe('valid multipart form data parameter provided', () => {
+      test('returns 422', async () => {
+        const response = await makeRequest('/multipart-form-data-body-required', {
+          method: 'POST',
+          body: new URLSearchParams({
+            status: 'new',
+          }).toString(),
+          headers: { 'content-type': 'multipart/form-data' },
+        });
+
+        expect(response.status).toBe(200);
+        await expect(response.json()).resolves.toMatchObject({ type: 'foo' });
+      });
+    });
   });
 });

packages/http/src/mocker/index.ts

@@ -140,8 +140,7 @@ function parseBodyIfUrlEncoded(request: IHttpRequest, resource: IHttpOperation)
   const mediaType = caseless(request.headers || {}).get('content-type');
   if (!mediaType) return request;
 
-  if (!is(mediaType, ['application/x-www-form-urlencoded'])) return request;
-
+  if (!is(mediaType, ['application/x-www-form-urlencoded', 'multipart/form-data'])) return request;
   const specs = pipe(
     O.fromNullable(resource.request),
     O.chainNullableK(request => request.body),

packages/http/src/validator/validators/body.ts

@@ -150,7 +150,7 @@ export const validate: validateFn<unknown, IMediaTypeContent> = (target, specs,
       ({ contentResult: { content, mediaType: mt }, schema }) =>
         pipe(
           mt,
-          O.fromPredicate(mediaType => !!typeIs(mediaType, ['application/x-www-form-urlencoded'])),
+          O.fromPredicate(mediaType => !!typeIs(mediaType, ['application/x-www-form-urlencoded', 'multipart/form-data'])),
           O.fold(
             () => pipe(
               validateAgainstSchema(target, schema, false, prefix, bundle),

test-harness/specs/validate-body-params/multipart-allow-empty-value-2.oas2.txt

@@ -0,0 +1,28 @@
+====test====
+If I have an operation with a parameter with the allowEmptyValue set to false to false
+and I send a request with a correcly encoded parameter but with an empty key
+I should get a 422 error
+====spec====
+swagger: '2.0'
+paths:
+  /path:
+    post:
+      consumes:
+        - multipart/form-data
+      responses:
+        200:
+          schema:
+            type: string
+      parameters:
+        - in: formData
+          type: string
+          name: id
+          allowEmptyValue: false
+====server====
+mock -p 4010 ${document}
+====command====
+curl -i -X POST http://localhost:4010/path -H "Content-Type: multipart/form-data" --data "id"
+====expect====
+HTTP/1.1 422 Unprocessable Entity
+
+{"type":"https://stoplight.io/prism/errors#UNPROCESSABLE_ENTITY","title":"Invalid request","status":422,"detail":"Your request is not valid and no HTTP validation response was found in the spec, so Prism is generating this error for you.","validation":[{"location":["body","id"],"severity":"Error","code":"minLength","message":"Request body property id must NOT have fewer than 1 characters"}]}

test-harness/specs/validate-body-params/multipart-allow-empty-value.oas2.txt

@@ -0,0 +1,30 @@
+====test====
+If I have an operation with a parameter with the allowEmptyValue set to false to false
+and I send a request with a correcly encoded parameter and with the parameter empty
+I should get a 200 response
+====spec====
+swagger: '2.0'
+paths:
+  /path:
+    post:
+      produces:
+        - text/plain
+      consumes:
+        - multipart/form-data
+      responses:
+        200:
+          schema:
+            type: string
+      parameters:
+        - in: formData
+          type: string
+          name: id
+          allowEmptyValue: true
+====server====
+mock -p 4010 ${document}
+====command====
+curl -i -X POST http://localhost:4010/path -H "Content-Type: multipart/form-data" --data "id"
+====expect====
+HTTP/1.1 200 OK
+
+string

test-harness/specs/validate-body-params/multipart-form-byte-format-fail.oas2.txt

@@ -0,0 +1,27 @@
+====test====
+Set expected format of request body parameter to base64.
+Test if it fails when not base64.
+====spec====
+swagger: '2.0'
+paths:
+  /path:
+    post:
+      consumes:
+        - multipart/form-data
+      responses:
+        200:
+          schema:
+            type: string
+      parameters:
+        - in: formData
+          type: string
+          format: byte
+          name: id
+====server====
+mock -p 4010 ${document}
+====command====
+curl -i -X POST http://localhost:4010/path -H "Content-Type: multipart/form-data" --data-urlencode "id=%"
+====expect====
+HTTP/1.1 422 Unprocessable Entity
+
+{"type":"https://stoplight.io/prism/errors#UNPROCESSABLE_ENTITY","title":"Invalid request","status":422,"detail":"Your request is not valid and no HTTP validation response was found in the spec, so Prism is generating this error for you.","validation":[{"location":["body","id"],"severity":"Error","code":"pattern","message":"Request body property id must match pattern \"^[\\w\\d+\\/=]*$\""},{"location":["body","id"],"severity":"Error","code":"format","message":"Request body property id must match format \"byte\""}]}

test-harness/specs/validate-body-params/multipart-form-byte-format-ok.oas2.txt

@@ -0,0 +1,31 @@
+====test====
+Set expected format of request body parameter to base64.
+Test if it's OK when passed base64.
+====spec====
+swagger: '2.0'
+paths:
+  /path:
+    post:
+      produces:
+        - text/plain
+      consumes:
+        - multipart/form-data
+      responses:
+        200:
+          schema:
+            type: string
+            example: abc
+      parameters:
+        - in: formData
+          type: string
+          format: byte
+          name: id
+====server====
+mock -p 4010 ${document}
+====command====
+curl -i -X POST http://localhost:4010/path -H "Content-Type: multipart/form-data" --data-urlencode "id=cmFuZG9tc3R1ZmY="
+====expect====
+HTTP/1.1 200 OK
+content-type: text/plain
+
+abc

test-harness/specs/validate-body-params/multipart-form-data-allow-reserved-fail.oas3.txt

@@ -0,0 +1,34 @@
+====test====
+Send reserved characters in body and expect to fail validation.
+====spec====
+openapi: '3.0.1'
+paths:
+  /path:
+    post:
+      responses:
+        200:
+          content:
+            text/plain:
+              example: ok
+      requestBody:
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                reserved:
+                  type: string
+            encoding:
+              reserved:
+                contentType: text/plain
+                allowReserved: false
+                style: form
+====server====
+mock -p 4010 ${document}
+====command====
+curl -i -X POST http://localhost:4010/path -H "Content-Type: multipart/form-data" --data "reserved=:/?#[]@!$&'()*+,;"
+====expect====
+HTTP/1.1 422 Unprocessable Entity
+content-type: application/problem+json
+
+{"type":"https://stoplight.io/prism/errors#UNPROCESSABLE_ENTITY","title":"Invalid request","status":422,"detail":"Your request is not valid and no HTTP validation response was found in the spec, so Prism is generating this error for you.","validation":[{"location":["body","reserved"],"severity":"Error","message":"Reserved characters used in request body"}]}

test-harness/specs/validate-body-params/multipart-form-data-allow-reserved-ok.oas3.txt

@@ -0,0 +1,34 @@
+====test====
+Send reserved characters in body and expect to pass validation.
+====spec====
+openapi: '3.0.1'
+paths:
+  /path:
+    post:
+      responses:
+        200:
+          content:
+            text/plain:
+              example: ok
+      requestBody:
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                reserved:
+                  type: string
+            encoding:
+              reserved:
+                contentType: text/plain
+                allowReserved: true
+                style: form
+====server====
+mock -p 4010 ${document}
+====command====
+curl -i -X POST http://localhost:4010/path -H "Content-Type: multipart/form-data" --data "reserved=:/?#[]@!$&'()*+,;"
+====expect====
+HTTP/1.1 200 OK
+content-type: text/plain
+
+ok

test-harness/specs/validate-body-params/multipart-form-data-invalid-request.oas2.txt

@@ -0,0 +1,37 @@
+====test====
+Given form data expected in request body
+but invalid data sent then return 422
+====spec====
+swagger: '2.0'
+paths:
+  /path:
+    post:
+      consumes:
+        - multipart/form-data
+      responses:
+        200:
+          schema:
+            type: string
+      parameters:
+        - in: formData
+          type: integer
+          name: id
+          required: true
+          minimum: 100
+          exclusiveMinimum: true
+        - in: formData
+          type: string
+          name: status
+          required: true
+          enum:
+            - open
+            - close
+====server====
+mock -p 4010 ${document}
+====command====
+curl -i -X POST http://localhost:4010/path -H "Content-Type: multipart/form-data" --data "id=100&status=open"
+====expect====
+HTTP/1.1 422 Unprocessable Entity
+content-type: application/problem+json
+
+{"type":"https://stoplight.io/prism/errors#UNPROCESSABLE_ENTITY","title":"Invalid request","status":422,"detail":"Your request is not valid and no HTTP validation response was found in the spec, so Prism is generating this error for you.","validation":[{"location":["body","id"],"severity":"Error","code":"exclusiveMinimum","message":"Request body property id must be > 100"}]}

test-harness/specs/validate-body-params/multipart-form-data-invalid-request.oas3.txt

@@ -0,0 +1,40 @@
+====test====
+Test sending form data with a missing property and invalid string.
+Expect to get validation errors in return.
+====spec====
+openapi: '3.0.1'
+paths:
+  /path:
+    post:
+      responses:
+        200:
+          content:
+            text/plain:
+              example: ok
+      requestBody:
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                id:
+                  type: integer
+                  minimum: 100
+                  exclusiveMinimum: true
+                status:
+                  type: string
+                  enum:
+                    - open
+                    - close
+              required:
+                - id
+                - status
+====server====
+mock -p 4010 ${document}
+====command====
+curl -i -X POST http://localhost:4010/path -H "Content-Type: multipart/form-data" --data "id=100&status=open"
+====expect====
+HTTP/1.1 422 Unprocessable Entity
+content-type: application/problem+json
+
+{"type":"https://stoplight.io/prism/errors#UNPROCESSABLE_ENTITY","title":"Invalid request","status":422,"detail":"Your request is not valid and no HTTP validation response was found in the spec, so Prism is generating this error for you.","validation":[{"location":["body","id"],"severity":"Error","code":"exclusiveMinimum","message":"Request body property id must be > 100"}]}