The test proved `RefParser` inlines nested `$ref`s, using `createWorkflow` as
the vehicle because `workflowCreate.yml` referenced `node.yml`. Once create
became a decorator route its schema is generated from Zod and holds no refs, so
the assertion passed without exercising anything.
It now uses `createDestination`, whose body is a `oneOf` over three files that
themselves reference more, and walks the resolved schema for any leftover
`$ref` instead of checking one hand-picked property.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
`workflowSettings.yml` set `additionalProperties: false` and typed every value,
so express-openapi-validator rejected an unknown setting, an out-of-enum value
or a wrongly typed one. The DTO used an untyped record, which accepted all
three.
Ports the 17 documented settings, including `binaryMode` and
`credentialResolverId` — both are listed in the old spec, so a request carrying
them is accepted and then stripped by the controller rather than rejected.
The generated fragments now match the old schema field for field.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
`GET /discover?includeSchemas=true` returned no `requestSchema` for any
`@PublicApiController` route, because `buildDecoratorEndpoints` never set the
field. Only the express-openapi-validator routes got one, from the hand-written
spec.
Three endpoints are affected today: `POST /roles`, `POST /role-mapping-rules`
and `PUT /workflows/{id}/tags`.
The schema now comes from the route's own `@Body` DTO, converted through the
same generator that writes the committed spec fragments, so the two agree
without reading a file at request time.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
`executions.test.ts` now registers its own `InstanceSettings` mock before
`setupTestServer`, so the shared helper no longer needs to patch the already
constructed instance. Leaves the helper identical to master.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
`WorkflowRequest.Update` and `WorkflowRequest.Delete` lost their last callers
when update and delete moved to the controller. `Get` stays, still used by
archive and unarchive.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The hand-written specs set `additionalProperties: false` on both request
bodies, so express-openapi-validator rejected an unrecognised key with a 400.
`Z.class` strips instead, which silently accepted a client's typo.
`Z.class` now takes an optional `{ strict: true }`, applied to the two workflow
write DTOs. The generated fragments emit `additionalProperties: false` again.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
`WorkflowService.update` re-fetches with only the `tags` and `activeVersion`
relations, so `shared` came back undefined and the response mapper threw on
`workflow.shared.map(...)`. The catch block turned that into a 400, failing
every `PUT /workflows/{id}` call.
Re-fetch through `findWorkflowForUser` for the response, as `getWorkflow` does.
This adds `shared` to the update response, which the legacy handler omitted.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
