.spectral.yaml

formats:
  - oas2
  - oas3
  - json-schema-loose
extends:
  - 'spectral:oas'
rules:
  operation-short-summary:
    description: 'Operation summary should be short and sweet, no full stops, and less than 20 characters'
    recommended: true
    type: style
    given: '$.paths.*[?( @property === ''get'' || @property === ''put'' || @property === ''post'' || @property === ''delete'' || @property === ''options'' || @property === ''head'' || @property === ''patch'' || @property === ''trace'' )]'
    then:
      - field: summary
        function: pattern
        functionOptions:
          notMatch: \.
      - field: summary
        function: length
        functionOptions:
          max: 20
  schema-names-pascal-case:
    description: Schema names MUST be written in PascalCase
    message: '{{property}} is not PascalCase: {{error}}'
    recommended: true
    type: style
    given: $.components.schemas.*~
    then:
      function: pattern
      functionOptions:
        match: '^[A-Z][a-zA-Z0-9]*$'
  operationIds-kebab-case:
    description: Operation IDs MUST be written in kebab-case
    message: '{{property}} is not kebab-case: {{error}}'
    recommended: true
    type: style
    given: '$.paths.*[?( @property === ''get'' || @property === ''put'' || @property === ''post'' || @property === ''delete'' || @property === ''options'' || @property === ''head'' || @property === ''patch'' || @property === ''trace'' )]'
    then:
      field: operationId
      function: pattern
      functionOptions:
        match: '^([a-z0-9-]+)$'
  parameter-description:
    description: Parameters must have a description.
    recommended: true
    given: $..properties.*
    then:
      field: description
      function: truthy
  paths-kebab-case:
    description: Should paths be kebab-case.
    message: '{{property}} is not kebab-case: {{error}}'
    severity: warn
    recommended: true
    given: '$.paths[*]~'
    then:
      function: pattern
      functionOptions:
        match: '^(/[a-z0-9-{}]+)+$'
  no-x-headers:
    description: Please do not use headers with X-
    message: 'Headers cannot start with X-, so please find a new name for {{property}}. More: https://tools.ietf.org/html/rfc6648'
    recommended: true
    type: style
    given: '$..parameters.[?(@.in === ''header'')].name'
    then:
      function: pattern
      functionOptions:
        notMatch: ^(x|X)-
  oas2-hosts-https-only:
    description: ALL requests MUST go through `https` protocol only
    recommended: true
    severity: error
    formats:
      - oas2
    type: style
    message: Schemes MUST be https and no other value is allowed.
    given: $.schemes
    then:
      function: schema
      functionOptions:
        schema:
          type: array
          items:
            type: string
            enum:
              - https
          maxItems: 1
  request-GET-no-body:
    description: A `GET` request MUST NOT accept a `body` parameter
    severity: error
    recommended: true
    given: $.paths..get.parameters..in
    then:
      function: pattern
      functionOptions:
        notMatch: /^body$/
  headers-hyphenated-pascal-case:
    description: All `HTTP` headers MUST use `Hyphenated-Pascal-Case` notation
    severity: error
    given: '$..parameters[?(@.in == ''header'')].name'
    message: '''HTTP'' headers MUST follow ''Hyphenated-Pascal-Case'' notation'
    recommended: true
    type: style
    then:
      function: pattern
      functionOptions:
        match: '/^([A-Z][a-z0-9]-)*([A-Z][a-z0-9])+/'
  oas3-hosts-https-only:
    description: ALL requests MUST go through `https` protocol only
    formats:
      - oas3
    recommended: true
    severity: error
    message: Servers MUST be https and no other protocol is allowed.
    given: $.servers..url
    then:
      function: pattern
      functionOptions:
        match: '/^https:/'
  oas3-request-support-xml:
    description: Every request SHOULD support `application/xml` media type
    formats:
      - oas3
    recommended: true
    severity: warn
    message: '{{description}}: {{error}}'
    given: '$.paths.[*].requestBody.content[?(@property.indexOf(''xml'') === -1)]^'
    then:
      function: falsy
  fhir-type-pascal-case:
    description: FHIR "types" must be PascalCase
    message: '{{property}} is not PascalCase: {{error}}'
    severity: warn
    recommended: true
    format: oas2
    given: '$.paths[*]~'
    then:
      function: pattern
      functionOptions:
        match: '^(\/)?[A-Z][a-zA-Z0-9]*(\/)?'
  fhir-use-ssl:
    description: FHIR preffers SSL for servers
    message: '{{property}} does not contain https'
    severity: warn
    recommended: true
    format: oas2
    given: $.schemes
    then:
      function: schema
      functionOptions:
        schema:
          type: array
          contains:
            const: https
  fhir-consume-mime-types:
    description: FHIR mime-type must be application/fhir+(xml|json|turtle) or application/x-www-form-urlencoded for `search` endpoints
    severity: error
    recommended: true
    format: oas2
    given: $..consumes.*
    then:
      function: schema
      functionOptions:
        schema:
          type: string
          enum:
            - application/fhir+xml
            - application/fhir+json
            - application/fhir+turtle
            - application/x-www-form-urlencoded
  fhir-produces-mime-types:
    description: FHIR mime-type must be application/fhir+(xml|json|turtle)
    severity: error
    recommended: true
    format: oas2
    given: $..produces.*
    then:
      function: schema
      functionOptions:
        schema:
          type: string
          enum:
            - application/fhir+xml
            - application/fhir+json
            - application/fhir+turtle
  fhir-spec-v4:
    description: FHIR v4.0 is the prefered version
    severity: warn
    recommended: true
    format: oas2
    given: $..headers.Accept
    then:
      function: pattern
      functionOptions:
        match: ^.*; fhirVersion=4
  paths-camelCase:
    description: All YAML/JSON paths MUST follow camelCase
    severity: warn
    recommended: true
    message: '{{property}} is not camelCase: {{error}}'
    given: '$.paths[*]~'
    then:
      function: pattern
      functionOptions:
        match: '^/([a-z][a-zA-Z0-9]+)?(/[a-z][a-zA-Z0-9]+|/{[a-z][a-zA-Z0-9]+})*$'
  definitions-camelCase-alphanumeric:
    description: All YAML/JSON definitions MUST follow fields-camelCase and be ASCII alphanumeric characters or `_` or `$`.
    severity: error
    recommended: true
    message: '{{property}} MUST follow camelCase and be ASCII alphanumeric characters or `_` or `$`.'
    given: '$.definitions[*]~'
    then:
      function: pattern
      functionOptions:
        match: '/^[a-z$_]{1}[A-Z09$_]*/'
  properties-camelCase-alphanumeric:
    description: All JSON Schema properties MUST follow fields-camelCase and be ASCII alphanumeric characters or `_` or `$`.
    severity: error
    recommended: true
    message: '{{property}} MUST follow camelCase and be ASCII alphanumeric characters or `_` or `$`.'
    given: '$.definitions..properties[*]~'
    then:
      function: pattern
      functionOptions:
        match: '/^[a-z$_]{1}[A-Z09$_]*/'
  request-GET-noaccept-body:
    description: A 'GET' request MUST NOT accept a 'body` parameter
    severity: error
    given: $.paths..get.parameters..in
    then:
      function: pattern
      functionOptions:
        notMatch: /^body$/
  uri-template-cannot-dash:
    description: 'The ''URI'' template (RFC 6570 - https://tools.ietf.org/html/rfc6570) cannot contain a ''-'' character'
    severity: error
    recommended: true
    message: '{{property}}: {{description}}'
    given: '$.paths[*]~'
    then:
      function: pattern
      functionOptions:
        notMatch: /-/
  headers-no-x-headers:
    description: 'All ''HTTP'' headers SHOULD NOT include ''X-'' headers (https://tools.ietf.org/html/rfc6648).'
    severity: warn
    given: '$..parameters[?(@.in == ''header'')].name'
    message: HTTP headers SHOULD NOT include 'X-' prefix.
    recommended: true
    type: style
    then:
      function: pattern
      functionOptions:
        notMatch: /^(x|X)-/
  headers-all-hyphenated-pascal-case:
    description: All `HTTP` headers MUST use `Hyphenated-Pascal-Case` notation
    severity: error
    given: '$..parameters[?(@.in == ''header'')].name'
    message: '''HTTP'' headers MUST follow ''Hyphenated-Pascal-Case'' notation'
    recommended: true
    type: style
    then:
      function: pattern
      functionOptions:
        match: '/^([A-Z][a-z0-9]-)*([A-Z][a-z0-9])+/'
  oas2-protocol-https-only:
    description: ALL requests MUST go through `https` protocol only
    formats:
      - oas2
    recommended: true
    severity: error
    type: style
    message: Schemes MUST be https and no other value is allowed.
    given: $
    then:
      field: schemes
      function: schema
      functionOptions:
        schema:
          type: array
          items:
            type: string
            enum:
              - https
          maxItems: 1
  oas2-request-support-json:
    description: Every request SHOULD support `application/json` media type
    formats:
      - oas2
    severity: warn
    message: '{{description}}: {{error}}'
    recommended: true
    given: $..consumes
    then:
      function: schema
      functionOptions:
        schema:
          type: array
          contains:
            type: string
            enum:
              - application/json
  oas2-example-exists-in-parameters:
    description: All models MUST have a valid example.
    severity: error
    recommended: true
    formats:
      - oas2
    message: '{{ property }} MUST have a valid example.'
    given: '$..parameters..[?(@.in == ''body'' && (@.example || @.schema.$ref))]'
    then:
      function: truthy
  oas3-request-support-application/json:
    description: Every request MUST support `application/json` media type
    formats:
      - oas3
    recommended: true
    severity: error
    message: '{{description}}: {{error}}'
    given: '$.paths.[*].requestBody.content[?(@property.indexOf(''json'') === -1)]^'
    then:
      function: falsy
  oas3-valid-example-in-parameters:
    description: Examples must be valid against their defined schema.
    message: '{{error}}'
    recommended: true
    formats:
      - oas3
    severity: 0
    type: validation
    given: '$..parameters..[?(@.in == ''body'')]..[?(@property !== ''properties'' && @.example && ( @.type || @.format || @.$ref ))]'
    then:
      function: schemaPath
      functionOptions:
        field: example
        schemaPath: $
  oas3-valid-example-in-definitions:
    description: Examples must be valid against their defined schema.
    message: '{{error}}'
    recommended: true
    formats:
      - oas3
    severity: 0
    type: validation
    given: '$..definitions..[?(@property !== ''properties'' && @.example && (@.type || @.format || @.$ref))]'
    then:
      function: schemaPath
      functionOptions:
        field: example
        schemaPath: $
  oas3-protocol-https-only:
    description: ALL requests MUST go through `https` protocol only
    formats:
      - oas3
    recommended: true
    severity: error
    message: Servers MUST be https and no other protocol is allowed.
    given: $.servers..url
    then:
      function: pattern
      functionOptions:
        match: '/^https:/'
  oas3-response-success-hal:
    description: All success responses MUST be of media type `application/hal+json`
    severity: error
    given: '$.paths..responses[?( @property >= 200 && @property < 300 && @property != 204)].content[*]~'
    recommended: true
    formats:
      - oas3
    message: 'Response documents MUST be of application/json media type: {{error}}'
    then:
      function: enumeration
      functionOptions:
        values:
          - application/json
  operation-singular-tag: hint
  tag-description: hint
  operation-default-response: info
  openapi-tags-alphabetical: hint
  oas3-server-not-example.com: warn
  oas3-parameter-description: error
  oas2-parameter-description: error
  oas2-host-not-example: warn
  info-license: info
  license-url: info
  contact-properties: info
  valid-foo-value: 'off'