feat(policy): add set-status-code policy v0.1.0#167
Open
renuka-fernando wants to merge 4 commits intowso2:mainfrom
Open
feat(policy): add set-status-code policy v0.1.0#167renuka-fernando wants to merge 4 commits intowso2:mainfrom
renuka-fernando wants to merge 4 commits intowso2:mainfrom
Conversation
Add a new gateway policy that overwrites the upstream response status code before forwarding to the downstream client. - Implements ResponsePolicy.OnResponseBody using DownstreamResponseModifications.StatusCode - Accepts statusCode integer param (100–599); handles both int and float64 (JSON unmarshal) - Returns 500 config error on missing, invalid type, or out-of-range param - Includes policy-definition.yaml, tests, and docs (v0.1)
renuka-fernando
requested review from
Krishanx92,
malinthaprasan and
pubudu538
as code owners
Contributor
WalkthroughAdds a new "Set Status Code" policy with implementation, tests, policy definition, module files, and documentation; it validates a configured Changes
sequenceDiagram
participant Client as Client
participant Gateway as Gateway Policy Engine
participant Upstream as Upstream Service
Client->>Upstream: Request (via Gateway)
Upstream-->>Gateway: Response (status, headers, body)
Gateway->>Gateway: OnResponseBody — parse params, validate statusCode
alt statusCode valid
Gateway-->>Client: Forward response with replaced status code
else invalid or missing
Gateway-->>Client: Immediate 500 JSON error response
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 1 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (1 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@policies/set-status-code/go.mod`:
- Line 5: The go.mod in the set-status-code policy pins
github.com/wso2/api-platform/sdk/core to v0.2.9 while most other policy modules
use v0.2.4; update the dependency to align versions across policies or add a
clear justification comment in this module explaining why v0.2.9 is required
(e.g., list the API/ABI differences or functions on which this policy relies) so
reviewers/runtime maintainers understand the divergence; specifically edit the
require line for github.com/wso2/api-platform/sdk/core in set-status-code (and
verify host-rewrite) or add a DOCUMENTATION comment in this module referencing
the differing version and the reason.
In `@policies/set-status-code/policy-definition.yaml`:
- Around line 6-16: The policy schema currently allows unknown extra keys
because the top-level "parameters" schema is missing additionalProperties:
false; update the "parameters" object in policy-definition.yaml to add
additionalProperties: false so only the declared "statusCode" property is
permitted (retain the existing "statusCode" constraints and required array).
In `@policies/set-status-code/setstatuscode.go`:
- Around line 67-72: The float64 branch in the switch handling raw input in
setstatuscode.go currently truncates decimals (case float64 { statusCode =
int(v) }) which allows fractional inputs like 200.9; change the float64 case in
the function that parses the raw parameter so it first checks if math.Trunc(v)
== v and only then converts with int(v), otherwise return an error/validation
failure (consistent with existing error handling paths) so non-integer floats
are rejected; also add a unit test (e.g., in
TestSetStatusCodePolicy_OnResponseBody_Float64Param) that passes a fractional
float64 (like 200.9) and asserts the policy rejects it.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: b6f0b64c-6d5a-4944-bd86-4f4018e77145
⛔ Files ignored due to path filters (1)
policies/set-status-code/go.sumis excluded by!**/*.sum
📒 Files selected for processing (6)
docs/set-status-code/v0.1/docs/set-status-code.mddocs/set-status-code/v0.1/metadata.jsonpolicies/set-status-code/go.modpolicies/set-status-code/policy-definition.yamlpolicies/set-status-code/setstatuscode.gopolicies/set-status-code/setstatuscode_test.go
…ss multiple policies
The top-level `parameters` object in 17 policy-definition.yaml files was missing `additionalProperties: false`, allowing unknown extra keys to pass schema validation silently. Added the constraint to: - set-status-code, basic-auth, host-rewrite, cors - content-length-guardrail, regex-guardrail, json-schema-guardrail - model-round-robin, model-weighted-round-robin - pii-masking-regex, prompt-decorator, prompt-template - semantic-cache, semantic-prompt-guard, semantic-tool-filtering - aws-bedrock-guardrail, azure-content-safety-content-moderation
- Add fractional check in the float64 switch case: converts to int and verifies round-trip equality before accepting the value - Add TestSetStatusCodePolicy_OnResponseBody_Float64FractionalParam to assert that inputs like 200.9 are rejected with a 500 error
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
policies/content-length-guardrail/policy-definition.yaml (1)
109-111: Consider addingadditionalProperties: falsetosystemParametersfor consistency.Other policies (e.g.,
azure-content-safety-content-moderation) includeadditionalProperties: falseon theirsystemParametersobject. Here,systemParametershas emptyproperties: {}but noadditionalPropertiesconstraint, which would allow arbitrary keys to be passed.If this policy intentionally has no system parameters, adding the constraint would enforce that explicitly.
Suggested change
systemParameters: type: object + additionalProperties: false properties: {}🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@policies/content-length-guardrail/policy-definition.yaml` around lines 109 - 111, The systemParameters object currently defines properties: {} but lacks an explicit additionalProperties constraint; update the policy-definition.yaml by adding additionalProperties: false under the systemParameters schema to explicitly forbid any unknown keys (i.e., modify the systemParameters block so that the symbol systemParameters contains type: object, properties: {}, and additionalProperties: false) to match other policies like azure-content-safety-content-moderation.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@policies/content-length-guardrail/policy-definition.yaml`:
- Around line 109-111: The systemParameters object currently defines properties:
{} but lacks an explicit additionalProperties constraint; update the
policy-definition.yaml by adding additionalProperties: false under the
systemParameters schema to explicitly forbid any unknown keys (i.e., modify the
systemParameters block so that the symbol systemParameters contains type:
object, properties: {}, and additionalProperties: false) to match other policies
like azure-content-safety-content-moderation.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: cbe2b007-3968-4c71-89ab-5acdbc3ee7a2
📒 Files selected for processing (46)
policies/analytics-header-filter/go.modpolicies/aws-bedrock-guardrail/policy-definition.yamlpolicies/azure-content-safety-content-moderation/go.modpolicies/azure-content-safety-content-moderation/policy-definition.yamlpolicies/basic-auth/go.modpolicies/basic-auth/policy-definition.yamlpolicies/content-length-guardrail/go.modpolicies/content-length-guardrail/policy-definition.yamlpolicies/cors/go.modpolicies/cors/policy-definition.yamlpolicies/dynamic-endpoint/go.modpolicies/host-rewrite/policy-definition.yamlpolicies/json-schema-guardrail/policy-definition.yamlpolicies/json-xml-mediator/go.modpolicies/llm-cost/go.modpolicies/log-message/go.modpolicies/mcp-acl-list/go.modpolicies/mcp-auth/go.modpolicies/mcp-authz/go.modpolicies/mcp-rewrite/go.modpolicies/model-round-robin/go.modpolicies/model-round-robin/policy-definition.yamlpolicies/model-weighted-round-robin/go.modpolicies/model-weighted-round-robin/policy-definition.yamlpolicies/pii-masking-regex/go.modpolicies/pii-masking-regex/policy-definition.yamlpolicies/prompt-decorator/go.modpolicies/prompt-decorator/policy-definition.yamlpolicies/prompt-template/go.modpolicies/prompt-template/policy-definition.yamlpolicies/regex-guardrail/go.modpolicies/regex-guardrail/policy-definition.yamlpolicies/remove-headers/go.modpolicies/request-rewrite/go.modpolicies/respond/go.modpolicies/semantic-cache/policy-definition.yamlpolicies/semantic-prompt-guard/policy-definition.yamlpolicies/semantic-tool-filtering/policy-definition.yamlpolicies/sentence-count-guardrail/go.modpolicies/set-headers/go.modpolicies/set-status-code/policy-definition.yamlpolicies/set-status-code/setstatuscode.gopolicies/set-status-code/setstatuscode_test.gopolicies/subscription-validation/go.modpolicies/url-guardrail/go.modpolicies/word-count-guardrail/go.mod
✅ Files skipped from review due to trivial changes (34)
- policies/model-round-robin/go.mod
- policies/analytics-header-filter/go.mod
- policies/dynamic-endpoint/go.mod
- policies/url-guardrail/go.mod
- policies/log-message/go.mod
- policies/remove-headers/go.mod
- policies/llm-cost/go.mod
- policies/regex-guardrail/go.mod
- policies/subscription-validation/go.mod
- policies/pii-masking-regex/go.mod
- policies/azure-content-safety-content-moderation/go.mod
- policies/model-weighted-round-robin/go.mod
- policies/aws-bedrock-guardrail/policy-definition.yaml
- policies/request-rewrite/go.mod
- policies/mcp-rewrite/go.mod
- policies/mcp-acl-list/go.mod
- policies/respond/go.mod
- policies/cors/go.mod
- policies/sentence-count-guardrail/go.mod
- policies/semantic-cache/policy-definition.yaml
- policies/model-weighted-round-robin/policy-definition.yaml
- policies/mcp-auth/go.mod
- policies/mcp-authz/go.mod
- policies/prompt-template/go.mod
- policies/model-round-robin/policy-definition.yaml
- policies/basic-auth/go.mod
- policies/host-rewrite/policy-definition.yaml
- policies/word-count-guardrail/go.mod
- policies/set-headers/go.mod
- policies/prompt-decorator/go.mod
- policies/regex-guardrail/policy-definition.yaml
- policies/set-status-code/policy-definition.yaml
- policies/json-xml-mediator/go.mod
- policies/content-length-guardrail/go.mod
🚧 Files skipped from review as they are similar to previous changes (1)
- policies/set-status-code/setstatuscode.go
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Add a new
set-status-codegateway policy that overwrites the upstream response status code before forwarding to the downstream client. This is useful for normalising status codes across backends or masking upstream error codes from clients.Approach
ResponsePolicy.OnResponseBodyusingDownstreamResponseModifications.StatusCodefromsdk/corev1alpha2statusCodeinteger parameter (100–599); handles bothintandfloat64types to support JSON-unmarshalled paramspolicy-definition.yamlwith parameter schema (min: 100, max: 599)docs/set-status-code/v0.1/with metadata and usage guideRelated Issues
N/A
Checklist
Summary by CodeRabbit
New Features
Documentation
Chores