
Research
/Security News
Weaponizing Discord for Command and Control Across npm, PyPI, and RubyGems.org
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
@stoplight/http-spec
Advanced tools
HTTP Spec is yet another, hopefully more pragmatic, attempt to standardise OpenAPI v2, OpenAPI v3, Postman Collections and other HTTP-related specification under a single AST to rule them all (at least in Stoplight).
There have been a lot of other attempts to have a universal specification such as API Elements, API Flow and they all failed for a number of reasons. Some of those have been discussed here.
Stoplight needs a way to interact with these documents in a standardized way, and relying on some dying intermediate format does not make that much sense. It's better to accept the sad state of the industry and work on a minimal superset format that can encompass the majority of the use cases.
This repository contains exclusively converters functions that take OpenAPI v2, OpenAPI v3.x, or Postman Collection documents and transforms them into the http-spec interface.
You can explore the whole structure by looking at the IHttpService definition and checking out its descendants. You'll probably notice that it resembles a lot the current OpenAPI 3.x specification, and that's on purpose. OpenAPI 3.0 has first support and we gracefully upgrade/downgrade the other specification formats to it.
If you would like to add support for another API description format, like RAML, follow these steps:
src/
directoryIHttpService
IHttpOperation
from your own inputwithContext
?If a given fragment of a document needs to be represented as a standalone node, and as such an id is needed, you should wrap a converter with withContext
.
withContext
ensures parentId
will be set properly to all descendant converters - it's important to call this.generateId
first, though.
Example:
import { isPlainObject } from '@stoplight/json';
import type { Optional } from '@stoplight/types';
import { withContext } from './context';
import { isNonNullable } from './guards';
import type { ArrayCallbackParameters, TranslateFunction } from './types';
type Item = {
id: string;
value: number;
};
type Object = {
id: string;
name: string;
items: Item[];
};
export const translateItem = withContext<
TranslateFunction<
// Oas2TranslateFunction & Oas3TranslateFunction are available too
Record<string, unknown>, // type of the entire doc, should be skipped whe Oas{2,3} TranslateFunction is used
ArrayCallbackParameters<[object: unknown]>, // fn parameters, ArrayCallbackParameters is a shorthand
Optional<Item> // fn return type
>
>(function (object, index) {
if (!isPlainObject(object)) return;
const id = this.generateId(`my-item-${index}`); // can also be any of src/generators.ts like this.generateId.httpQuery({ keyOrName: 'whatever' })
return {
id,
value: index,
};
});
export const translateObject = withContext<
TranslateFunction<Record<string, unknown>, [object: unknown], Optional<Object>>
>(function (object) {
if (!isPlainObject(object)) return;
const id = this.generateId('my_id'); // can also be any of src/generators.ts like this.generateId.httpQuery({ keyOrName: 'whatever' })
return {
id,
name: 'some-name',
items: Array.isArray(object.items) ? object.items.map(translateItem, this).filter(isNonNullable) : [],
};
});
src/merge.ts
contains a utility that reduces the list of IHttpOperation
's into a minimal set. This tool particularly handy if you have a recorded list of request/response pairs, and you want to infer a specification out of it.
The strategy is the following:
anyOf
.FAQs
## What is it?
The npm package @stoplight/http-spec receives a total of 124,857 weekly downloads. As such, @stoplight/http-spec popularity was classified as popular.
We found that @stoplight/http-spec demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
Security News
Socket now integrates with Bun 1.3’s Security Scanner API to block risky packages at install time and enforce your organization’s policies in local dev and CI.
Research
The Socket Threat Research Team is tracking weekly intrusions into the npm registry that follow a repeatable adversarial playbook used by North Korean state-sponsored actors.