From b80f231029ee31a784ec7b7c77b756cbd6692872 Mon Sep 17 00:00:00 2001
From: Blair Currey <12960453+BlairCurrey@users.noreply.github.com>
Date: Tue, 17 Oct 2023 09:21:53 -0400
Subject: [PATCH] fix(openapi): remove additional properties (#331)

* fix(openapi): remove additional properties

* refactor: add unevaluatedProperties

* chore(open-payments): add changeset

* fix: additional properties on list incoming payment

* fix(openapi): create middleware test

* fix: update changeset description
---
 .changeset/lovely-feet-dance.md         |  5 +++
 openapi/resource-server.yaml            |  2 +-
 packages/openapi/src/middleware.test.ts | 42 ++++++++++++++++++++++++-
 3 files changed, 47 insertions(+), 2 deletions(-)
 create mode 100644 .changeset/lovely-feet-dance.md

diff --git a/.changeset/lovely-feet-dance.md b/.changeset/lovely-feet-dance.md
new file mode 100644
index 00000000..df53d265
--- /dev/null
+++ b/.changeset/lovely-feet-dance.md
@@ -0,0 +1,5 @@
+---
+'@interledger/open-payments': patch
+---
+
+moves additionalProperties: false from incoming-payment type to GET /incoming-payments response
diff --git a/openapi/resource-server.yaml b/openapi/resource-server.yaml
index ac42d585..55edbfa9 100644
--- a/openapi/resource-server.yaml
+++ b/openapi/resource-server.yaml
@@ -197,6 +197,7 @@ paths:
                     type: array
                     items:
                       $ref: '#/components/schemas/incoming-payment'
+                      additionalProperties: false
               examples:
                 forward pagination:
                   value:
@@ -904,7 +905,6 @@ components:
           expiresAt: '2022-04-12T23:20:50.52Z'
           createdAt: '2022-03-12T23:20:50.52Z'
           updatedAt: '2022-03-12T23:20:50.52Z'
-      additionalProperties: false
       properties:
         id:
           type: string
diff --git a/packages/openapi/src/middleware.test.ts b/packages/openapi/src/middleware.test.ts
index cefaec06..d2f93f22 100644
--- a/packages/openapi/src/middleware.test.ts
+++ b/packages/openapi/src/middleware.test.ts
@@ -177,6 +177,40 @@ describe('OpenAPI Validator', (): void => {
       expect(next).toHaveBeenCalled()
     })
 
+    test('returns 500 with additional properties', async (): Promise<void> => {
+      const ctx = createContext(
+        {
+          headers: { Accept: 'application/json' }
+        },
+        {}
+      )
+      addTestSignatureHeaders(ctx)
+      ctx.request.query = { 'wallet-address': WALLET_ADDRESS }
+
+      const next = jest.fn().mockImplementation(() => {
+        ctx.response.body = {
+          pagination: { hasNextPage: false, hasPreviousPage: false },
+          result: [
+            {
+              id: uuid(),
+              walletAddress: WALLET_ADDRESS,
+              completed: false,
+              receivedAmount: { value: '0', assetCode: 'USD', assetScale: 2 },
+              createdAt: '2022-03-12T23:20:50.52Z',
+              updatedAt: '2022-04-01T10:24:36.11Z',
+              additionalProp: 'disallowed'
+            }
+          ]
+        }
+      })
+      await expect(validateListMiddleware(ctx, next)).rejects.toMatchObject({
+        status: 500,
+        message:
+          'response.result.0 must NOT have additional properties: additionalProp'
+      })
+      expect(next).toHaveBeenCalled()
+    })
+
     const body = {
       id: `https://${accountId}/incoming-payments/${uuid()}`,
       walletAddress: 'https://openpayments.guide/alice',
@@ -185,13 +219,19 @@ describe('OpenAPI Validator', (): void => {
         assetCode: 'USD',
         assetScale: 2
       },
+      methods: [
+        {
+          type: 'ilp',
+          ilpAddress: 'g.ilp.iwuyge987y.98y08y',
+          sharedSecret: '1c7eaXa4rd2fFOBl1iydvCT1tV5TbM3RW1WLCafu_JA'
+        }
+      ],
       createdAt: '2022-03-12T23:20:50.52Z',
       updatedAt: '2022-04-01T10:24:36.11Z'
     }
     test.each`
       status | body                                                                    | message                                                           | description
       ${202} | ${{}}                                                                   | ${'An unknown status code was used and no default was provided.'} | ${'status code'}
-      ${201} | ${{ ...body, invalid: 'field' }}                                        | ${'response must NOT have additional properties: invalid'}        | ${'body with additional property'}
       ${201} | ${{ ...body, receivedAmount: { ...body.receivedAmount, value: '-1' } }} | ${'response.receivedAmount.value must match format "uint64"'}     | ${'body with invalid type'}
     `(
       'returns 500 on invalid response $description',