Merge pull request #106 from unifysell/feature/validate-query-param-integer-range

Missing validation for integer range on query params

Author: mbuhot

lib/open_api_spex/cast/integer.ex

@@ -9,8 +9,8 @@ defmodule OpenApiSpex.Cast.Integer do
     end
   end
 
-  def cast(%{value: value}) when is_number(value) do
-    {:ok, round(value)}
+  def cast(%{value: value} = ctx) when is_number(value) do
+    cast(%{ctx | value: round(value)})
   end
 
   def cast(%{value: value} = ctx) when is_binary(value) do

test/operation2_test.exs

@@ -148,6 +148,27 @@ defmodule OpenApiSpex.Operation2Test do
       assert error.name == :name
     end
 
+    test "validate invalid value for integer range" do
+      parameter =
+        Operation.parameter(
+          :age,
+          :query,
+          %Schema{type: :integer, minimum: 1, maximum: 99},
+          "Filter by user age",
+          required: true
+        )
+
+      operation = %{OperationFixtures.user_index() | parameters: [parameter]}
+
+      assert {:error, [error]} = do_index_cast(%{"age" => 100}, operation: operation)
+      assert %Error{} = error
+      assert error.reason == :maximum
+
+      assert {:error, [error]} = do_index_cast(%{"age" => 0}, operation: operation)
+      assert %Error{} = error
+      assert error.reason == :minimum
+    end
+
     defp do_index_cast(query_params, opts \\ []) do
       conn =
         :get