Merge pull request #32147 from backstage/sennyeya/auditor-openapi

.changeset/major-mangos-shine.md

@@ -0,0 +1,5 @@
+---
+'@backstage/backend-openapi-utils': patch
+---
+
+Internal update to use native feature from our request validation library for handling base path determination.

packages/backend-openapi-utils/src/stub.ts

@@ -31,13 +31,6 @@ import { middleware as OpenApiValidator } from 'express-openapi-validator';
 import { OPENAPI_SPEC_ROUTE } from './constants';
 import { isErrorResult, merge } from 'openapi-merge';
 
-type PropertyOverrideRequest = Request & {
-  [key: symbol]: string;
-};
-
-const baseUrlSymbol = Symbol();
-const originalUrlSymbol = Symbol();
-
 function validatorErrorTransformer(): ErrorRequestHandler {
   return (error: Error, _: Request, _2: Response, next: NextFunction) => {
     next(new InputError(error.message));
@@ -75,30 +68,6 @@ function createRouterWithValidation(
   const router = PromiseRouter();
   router.use(options?.middleware || getDefaultRouterMiddleware());
 
-  /**
-   * Middleware to setup the routing for OpenApiValidator. OpenApiValidator expects `req.originalUrl`
-   *    and `req.baseUrl` to be the full path. We adjust them here to basically be nothing and then
-   *    revive the old values in the last function in this method. We could instead update `req.path`
-   *    but that might affect the routing and I'd rather not.
-   *
-   * TODO: I opened https://github.com/cdimascio/express-openapi-validator/issues/843
-   *    to track this on the middleware side, but there was a similar ticket, https://github.com/cdimascio/express-openapi-validator/issues/113
-   *    that has had minimal activity. If that changes, update this to use a new option on their side.
-   */
-  router.use((req: Request, _, next) => {
-    /**
-     * Express typings are weird. They don't recognize PropertyOverrideRequest as a valid
-     *  Request child and try to overload as PathParams. Just cast it here, since we know
-     *  what we're doing.
-     */
-    const customRequest = req as PropertyOverrideRequest;
-    customRequest[baseUrlSymbol] = customRequest.baseUrl;
-    customRequest.baseUrl = '';
-    customRequest[originalUrlSymbol] = customRequest.originalUrl;
-    customRequest.originalUrl = customRequest.url;
-    next();
-  });
-
   // TODO: Handle errors by converting from OpenApiValidator errors to known @backstage/errors errors.
   router.use(
     OpenApiValidator({
@@ -106,6 +75,7 @@ function createRouterWithValidation(
         coerceTypes: false,
         allowUnknownQueryParameters: false,
       },
+      useRequestUrl: true,
       ignoreUndocumented: true,
       validateResponses: false,
       ...options?.validatorOptions,
@@ -113,19 +83,6 @@ function createRouterWithValidation(
     }),
   );
 
-  /**
-   * Revert `req.baseUrl` and `req.originalUrl` changes. This ensures that any further usage
-   *    of these variables will be unchanged.
-   */
-  router.use((req: Request, _, next) => {
-    const customRequest = req as PropertyOverrideRequest;
-    customRequest.baseUrl = customRequest[baseUrlSymbol];
-    customRequest.originalUrl = customRequest[originalUrlSymbol];
-    delete customRequest[baseUrlSymbol];
-    delete customRequest[originalUrlSymbol];
-    next();
-  });
-
   // Any errors from the middleware get through here.
   router.use(validatorErrorTransformer());