$this->withoutRequestValidation(); does not validate Response

[Marre-86]

Tried it many times, and very much sure that indeed it doesn't.

Don't really know, which proofs to attach.

Just please take another look and check it out.

[luisdalmolin]

@Marre-86 Can you post some example into how you are using this? Some code blocks, which versions you are running, etc.

[joelclermont]

I've been trying out this library and I've run into the same issue. I have a test that asserts a 400 response when an unsupported language is provided in the header. Because it's an invalid request, I need to add withoutRequestValidation but I'd like it to still validate the response conforms to the spec.

Here's a very simple test case:

    public function testIndexRequiresLanguage(): void
    {
        $user = User::factory()->create();
        $hub = Hub::factory()->for($user->tenant)->create();

        $response = $this
            ->withoutRequestValidation()
            ->prepareRequestFor($user, $hub)
            ->withHeader('accept-language', 'invalid-language')
            ->getJson(route('tenant-configs.index'));

        $response->assertBadRequest();
    }

If I remove 400 from the list of possible responses in the spec, I still have a passing test. I would expect this to fail.

I believe the issue is found here: https://github.com/kirschbaum-development/laravel-openapi-validator/blob/main/src/ValidatesOpenApiSpec.php#L98

When request validation is skipped, $address will be set to null, which then makes it skip response validation.

[joelclermont]

If it's helpful, here's a workaround we're using for now. We basically create our own extension of the trait which adds some custom behavior if request validation is being skipped. With this approach, we're still getting response validation.

<?php

 declare(strict_types=1);



 namespace Tests\Concerns;

 use League\OpenAPIValidation\PSR7\OperationAddress;
 use League\OpenAPIValidation\PSR7\PathFinder;
 use Symfony\Component\HttpFoundation\Request as SymfonyRequest;
 use Tests\Exceptions\OpenAPIRequestValidationFailure;

 trait ValidatesOpenApiSpec
 {
     use \Kirschbaum\OpenApiValidator\ValidatesOpenApiSpec { validateRequest as parentValidateRequest; }

     protected function validateRequest(SymfonyRequest $request): OperationAddress
     {
         if (!$this->skipRequestValidation) {
             return $this->parentValidateRequest($request);
         }

         $schema = $this->getOpenApiValidatorBuilder()->getRequestValidator()->getSchema();
         $authenticatedRequest = $this->getAuthenticatedRequest($request);
         $request = $this->getPsr7Factory()->createRequest($authenticatedRequest);

         $pathFinder = new PathFinder($schema, (string) $request->getUri(), $request->getMethod());
         $found = $pathFinder->search();
         if (empty($found) || count($found) > 1) {
             OpenAPIRequestValidationFailure::fromRequest($request);
         }

         return $found[0];
     }
 }