Merge pull request #116 from sevenval/develop

Release 2021-06-23

CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+##  [20210623](https://hub.docker.com/r/sevenvaltechnologies/flatrunner/tags)
+
+### Added
+
+- The [`validate-request-security` request option](/reference/actions/request.md#options)
+
+### Fixed
+
+- [`set-env`](/reference/actions/set-env.md) now does not produce unnecessary quotes for numeric values
+- Problem in the [`split()` function](/reference/functions/split.md), if called with a string containing an ampersand
+- Send `Vary: Origin` response headers for non-preflight requests if [CORS](/reference/OpenAPI/cors.md) is enabled but `Origin` was not sent
+
+
 ## [20210107](https://hub.docker.com/r/sevenvaltechnologies/flatrunner/tags)
 
 ### Added

README.md

@@ -1,14 +1,16 @@
 # FLAT
 
-![Couper](https://couper.io/assets/images/couper-logo.svg)
-
 _FLAT_ - the "Frontend Layer API Toolkit" by [Sevenval](https://www.sevenval.com/) is designed
-for easy decoupling frontend from backend in modern web applications. It is the
-preview version of _Couper_. See [couper.io](https://couper.io/) for more
-details.
+for easy decoupling frontend from backend in modern web applications.
+
+This documentation helps building maintainable JSON-based web APIs on
+top of FLAT.
 
-This documentation helps building maintainable JSON-based web APIs
-on top of FLAT.
+FLAT is the preview version of
+[_Couper_](https://github.com/avenga/couper) –
+[Avenga's](https://www.avenga.com) lightweight API gateway designed
+to support developers in building and operating API-driven Web
+projects. See [couper.io](https://couper.io/) for more details.
 
 ## [Tutorial](tutorial/README.md)
 
@@ -17,7 +19,7 @@ This is the best place to start.
 
 ## [Cookbook](cookbook/README.md)
 
-Browse the recipes in [Couper's Cookbook](cookbook/README.md) to learn
+Browse the recipes in [FLAT's Cookbook](cookbook/README.md) to learn
 how to accomplish common API development tasks with FLAT. Developers will find plenty of examples here.
 
 ## [Reference](reference/README.md)

reference/OpenAPI/upstream.md

@@ -14,6 +14,7 @@ The configuration takes place in the [`request` action](/reference/actions/reque
 
 * `definition` - The path to the swagger definition file (type: `string`)
 * `validate-request` - Whether to validate the request (valid values: `true`, `false`, "report-only", default: `false`)
+* `validate-request-security` - Whether to validate the request security requirements according to `security` in the swagger definition (valid values: `true`, `false`, "report-only", default: `false`)
 * `validate-response` - Whether to validate the response (valid values: `true`, `false`, "report-only", default: `false`)
 
 ### Error Handling
@@ -34,6 +35,22 @@ The configuration takes place in the [`request` action](/reference/actions/reque
 }
 ```
 
+If `validate-request-security` is `true` and the request does not fullfill the security requirements, the request _will not be sent_. The response will be an [error document](validation.md#system-error-document) with status `401 Unauthorized`.
+
+```json
+{
+  "error": {
+    "message": "Upstream Request Security Validation Failed",
+    "error": 3207,
+    "status": 401,
+    "requestID": "W@W8DrjPEMPxyqu4zAL4PAAAABg",
+    "info": [
+       "Header Security (HeaderAuth): Missing header My-Header"
+     ]
+  }
+}
+```
+
 If `validate-response` detects that the response body violates the schema, the response will be replaced by a system error.
 
 ```json

reference/actions/request.md

@@ -315,6 +315,7 @@ The `options` property sets the request options. Its value must be a JSON object
 * `disable-connection-reuse` - Whether to disable the reuse of HTTP connections (type: `boolean`, default: `false`)
 * `mock-response` - Whether to [mock the response](/reference/OpenAPI/upstream.md#mocking) (type: `boolean`, default: `false`)
 * `validate-request` - Whether to validate the request (valid values: `true`, `false`, "report-only", default: `false`)
+* `validate-request-security` - Whether to validate the request security requirements according to `security` in the swagger definition (valid values: `true`, `false`, "report-only", default: `false`)
 * `validate-response` - Whether to validate the response (valid values: `true`, `false`, "report-only", default: `false`)
 * `definition` - The path to the swagger definition file (type: `string`)
 * `exit-on-error` - if `true`, abort normal processing of the flow in case of validation errors. If configured, the [error flow](/reference/OpenAPI/routing.md#error-flow) is run. Otherwise a standard error message is substituted as a response to the request (type: `boolean`, default `false`)

reference/flow.md

@@ -79,6 +79,22 @@ If the result of that expression is `false`, the block will be skipped and the c
 
 The block associated with the first matching conditional expression will be executed – or if all  expressions were evaluated to `false`, the `else` block will be executed.
 
+### `if` attribute
+
+The `if` attribute allows for conditional execution of a single action:
+
+```xml
+<flow>
+  …
+  <error if="$upstream/my_request/status != 200">
+  {
+    …
+  }
+  </error>
+  …
+</flow>
+```
+
 ### `return`
 
 `return` quits the current [sub flow](actions/sub-flow.md) and returns to its parent flow.

reference/functions/README.md

@@ -6,24 +6,24 @@
 * [`base64-decode()`](base64-decode.md)
 * [`base64-encode()`](base64-encode.md)
 * [`capitalize-first()`](capitalize-first.md)
-* [`concat()` ↗](https://developer.mozilla.org/en/XPath/Functions/concat)
-* [`contains()` ↗](https://developer.mozilla.org/en/XPath/Functions/contains)
+* [`concat()` ↗](https://developer.mozilla.org/en-US/docs/web/XPath/Functions/concat)
+* [`contains()` ↗](https://developer.mozilla.org/en-US/docs/web/XPath/Functions/contains)
 * [`ends-with()`](ends-with.md)
 * [`join()`](join.md)
 * [`matches()`](matches.md)
 * [`md5()`](md5.md)
-* [`normalize-space()` ↗](https://developer.mozilla.org/en/XPath/Functions/normalize-space)
+* [`normalize-space()` ↗](https://developer.mozilla.org/en-US/docs/web/XPath/Functions/normalize-space)
 * [`replace()`](replace.md)
 * [`split()`](split.md)
-* [`starts-with()` ↗](https://developer.mozilla.org/en/XPath/Functions/starts-with)
-* [`string()` ↗](https://developer.mozilla.org/en/XPath/Functions/string)
-* [`string-length()` ↗](https://developer.mozilla.org/en/XPath/Functions/string-length)
-* [`substring()` ↗](https://developer.mozilla.org/en/XPath/Functions/substring)
-* [`substring-after()` ↗](https://developer.mozilla.org/en/XPath/Functions/substring-after)
-* [`substring-before()` ↗](https://developer.mozilla.org/en/XPath/Functions/substring-before)
+* [`starts-with()` ↗](https://developer.mozilla.org/en-US/docs/web/XPath/Functions/starts-with)
+* [`string()` ↗](https://developer.mozilla.org/en-US/docs/web/XPath/Functions/string)
+* [`string-length()` ↗](https://developer.mozilla.org/en-US/docs/web/XPath/Functions/string-length)
+* [`substring()` ↗](https://developer.mozilla.org/en-US/docs/web/XPath/Functions/substring)
+* [`substring-after()` ↗](https://developer.mozilla.org/en-US/docs/web/XPath/Functions/substring-after)
+* [`substring-before()` ↗](https://developer.mozilla.org/en-US/docs/web/XPath/Functions/substring-before)
 * [`tolower()`](tolower.md)
 * [`toupper()`](toupper.md)
-* [`translate()` ↗](https://developer.mozilla.org/en/XPath/Functions/translate)
+* [`translate()` ↗](https://developer.mozilla.org/en-US/docs/web/XPath/Functions/translate)
 * [`trim()`](trim.md)
 * [`urldecode()`, `url-decode()`](urldecode.md)
 * [`urlencode()`, `url-encode()`](urlencode.md)
@@ -47,17 +47,17 @@
 
 ## Boolean Functions
 
-* [`boolean()` ↗](https://developer.mozilla.org/en/XPath/Functions/boolean)
-* [`false()` ↗](https://developer.mozilla.org/en/XPath/Functions/false)
-* [`not()` ↗](https://developer.mozilla.org/en/XPath/Functions/not)
-* [`true()` ↗](https://developer.mozilla.org/en/XPath/Functions/true)
+* [`boolean()` ↗](https://developer.mozilla.org/en-US/docs/web/XPath/Functions/boolean)
+* [`false()` ↗](https://developer.mozilla.org/en-US/docs/web/XPath/Functions/false)
+* [`not()` ↗](https://developer.mozilla.org/en-US/docs/web/XPath/Functions/not)
+* [`true()` ↗](https://developer.mozilla.org/en-US/docs/web/XPath/Functions/true)
 
 ## Math Functions
-* [`ceiling()` ↗](https://developer.mozilla.org/en/XPath/Functions/ceiling)
-* [`floor()` ↗](https://developer.mozilla.org/en/XPath/Functions/floor)
-* [`number()` ↗](https://developer.mozilla.org/en/XPath/Functions/number)
-* [`round()` ↗](https://developer.mozilla.org/en/XPath/Functions/round)
-* [`sum()` ↗](https://developer.mozilla.org/en/XPath/Functions/sum)
+* [`ceiling()` ↗](https://developer.mozilla.org/en-US/docs/web/XPath/Functions/ceiling)
+* [`floor()` ↗](https://developer.mozilla.org/en-US/docs/web/XPath/Functions/floor)
+* [`number()` ↗](https://developer.mozilla.org/en-US/docs/web/XPath/Functions/number)
+* [`round()` ↗](https://developer.mozilla.org/en-US/docs/web/XPath/Functions/round)
+* [`sum()` ↗](https://developer.mozilla.org/en-US/docs/web/XPath/Functions/sum)
 
 ## Date Functions
 
@@ -76,23 +76,23 @@
 
 * [`body()`](body.md)
 * [`content()`](content.md)
-* [`count()` ↗](https://developer.mozilla.org/en/XPath/Functions/count)
+* [`count()` ↗](https://developer.mozilla.org/en-US/docs/web/XPath/Functions/count)
 * [`file-exists()`](file-exists.md)
 * [`fit-document()`](fit-document.md)
 * [`fit-log()`](fit-log.md)
 * [`fit-serialize()`](fit-serialize.md)
 * [`get-log()`](get-log.md)
 * [`has-class()`](has-class.md)
 * [`html-parse()`](html-parse.md)
-* [`id()` ↗](https://developer.mozilla.org/en/XPath/Functions/id)
+* [`id()` ↗](https://developer.mozilla.org/en-US/docs/web/XPath/Functions/id)
 * [`ldap-lookup()`](ldap-lookup.md)
 * [`ldap-query()`](ldap-query.md)
-* [`lang()` ↗](https://developer.mozilla.org/en/XPath/Functions/lang)
-* [`last()` ↗](https://developer.mozilla.org/en/XPath/Functions/last)
-* [`local-name()` ↗](https://developer.mozilla.org/en/XPath/Functions/local-name)
+* [`lang()` ↗](https://developer.mozilla.org/en-US/docs/web/XPath/Functions/lang)
+* [`last()` ↗](https://developer.mozilla.org/en-US/docs/web/XPath/Functions/last)
+* [`local-name()` ↗](https://developer.mozilla.org/en-US/docs/web/XPath/Functions/local-name)
 * [`lookup()`](lookup.md)
-* [`name()` ↗](https://developer.mozilla.org/en/XPath/Functions/name)
-* [`namespace-uri()` ↗](https://developer.mozilla.org/en/XPath/Functions/namespace-uri)
-* [`position()` ↗](https://developer.mozilla.org/en/XPath/Functions/position)
+* [`name()` ↗](https://developer.mozilla.org/en-US/docs/web/XPath/Functions/name)
+* [`namespace-uri()` ↗](https://developer.mozilla.org/en-US/docs/web/XPath/Functions/namespace-uri)
+* [`position()` ↗](https://developer.mozilla.org/en-US/docs/web/XPath/Functions/position)
 * [`uuid3()` and `uuid4()`](uuid.md)
 * [`xml-parse()`](xml-parse.md)