RFC #1706 Phase 1: OpenAPI spec from workspace-server schedules handler #1707

Merged

hongming merged 3 commits from rfc-1706-openapi-phase1-schedules into main 2026-05-23 07:37:01 +00:00

Conversation 9 Commits 3 Files Changed 6

+1029 -24

3 Commits

Author	SHA1	Message	Date
hongming	f86e151c02	Fix golangci-lint unused failure — export OpenAPI response types ... CI / Platform (Go) flagged `internal/handlers/schedules.go:19:6: type errorResponse is unused (unused)` because golangci-lint's `unused` checker doesn't recognise swaggo's `@Success {object} errorResponse` annotations as references — the types are only used in comments from Go's perspective. Fix: export all OpenAPI request/response types. Exported names are skipped by the unused-checker (package consumers may exist outside the package, even if absent inside it). Renamed: - errorResponse → ErrorResponse - statusResponse → StatusResponse - createScheduleResponse → CreateScheduleResponse - runNowResponse → RunNowResponse - historyEntry → HistoryEntry - scheduleResponse → ScheduleResponse - createScheduleRequest → CreateScheduleRequest - updateScheduleRequest → UpdateScheduleRequest - scheduleHealthResponse → ScheduleHealthResponse (test ref updated) Regenerated docs/openapi/swagger.{yaml,json} with new type names. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-23 00:14:16 -07:00
hongming	f01636cd76	Address CR2 review: add OrgSlugAuth + OrgIdAuth securityDefinitions ... CR2 (5-axis review) flagged: the original PR mentioned X-Molecule-Org-Slug and X-Molecule-Org-Id only in the BearerAuth @description prose. Generated SDK clients (per RFC #1706 Phases 3-6) wouldn't actually send those headers, so any client built from the spec would 401/403 against prod. Fix: - Add OrgSlugAuth + OrgIdAuth as formal apikey securityDefinitions in cmd/server/main.go - Bind every annotated endpoint with `@Security BearerAuth && OrgSlugAuth` (AND semantics — generated clients send both headers, not OR) - Regenerate docs/openapi/swagger.{yaml,json} Verified: swagger.yaml security blocks now show - BearerAuth: [] OrgSlugAuth: [] (single requirement object with both schemes = AND in OpenAPI 2.0). No backend behavior change. Handler tests pass. Refs: PR #1707, RFC #1706, CR2 review comment. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-22 23:51:54 -07:00
hongming	665cec1991	RFC #1706 Phase 1: OpenAPI spec from workspace-server schedules handler ... Adds swaggo-annotated comments to schedules.go (List/Create/Update/Delete/ RunNow/History), pulls request/response shapes up to package scope so swaggo can reference them, and wires `make openapi-spec` + `make openapi-spec-check` (CI gate). Generated workspace-server/docs/openapi/swagger.{yaml,json} from real handler signatures — first OpenAPI artifact in the repo. No backend behavior changes. Handler tests pass. Refs: #1706 (proposed kill-list for 4 hand-written HTTP wrappers across canvas / molecule-mcp-server / molecule-cli / molecule-sdk-python). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-22 23:37:04 -07:00