Repository navigation
Fix/upstream bugs - #1158
Closed
sroucheray wants to merge 16 commits into
Closed
Fix/upstream bugs#1158sroucheray wants to merge 16 commits into
sroucheray wants to merge 16 commits into
Conversation
setTheme read the misspelled `theme.navAccenttextColor` whenever `navAccentTextColor` was set, so a custom value always resolved to undefined (for both the dark and the light theme).
The storage listener called `this.receiveStorage`, which does not exist, so it threw a TypeError on every storage event instead of relaying the OAuth data to the parent window.
The api-key security scheme was pushed with an `apiKeyId` field while the lookup just above matches on `securitySchemeId`. The entry was therefore never found again and every api-key attribute change pushed a duplicate scheme.
The relative refreshUrl branch concatenated the server URL with the tokenUrl (copy/paste of the tokenUrl branch), so when the server URL ends with a slash the refresh URL silently became the token endpoint.
The element itself was passed as `targetOrigin`, which browsers reject with a SyntaxError. Starting a new OAuth flow while a previous single-use message listener was still active therefore threw before the authorization window was opened. The fake message is sent to the current window and carries no data, so '*' is safe.
…tions ProcessSpec takes (attrApiKey, attrApiKeyLocation, attrApiKeyValue, serverUrl) before (matchPaths, matchType, removeEndpointsWithBadgeLabelAs), but the viewer passed the match-* attributes directly after sortEndpointsBy, so they landed in the api-key parameters and the match parameters kept their defaults.
generateExample takes 8 parameters but the call passed 9: the extra `true`
shifted 'text' into includeGeneratedExample and put `true` in outputType. The
generated sample of an object-typed parameter was thus returned as an object
instead of JSON text, and `data-example="${example.exampleVal}"` rendered
"[object Object]" which the "Fill Example" button then wrote into the input.
Two heading renderers (read-mode endpoint descriptions and the info description headings in the nav bar) still used the pre-v5 `heading(text, level, raw)` signature. marked 18 passes a single token object, so `level` and `raw` were undefined and headings rendered as `<hundefined ... id="...--undefined">`. Align them with the renderers already updated in focused-endpoint-template and overview-template.
`typeof null === 'object'`, so a valid `example: null` (or a null entry in an examples map) reached `ex.value` / `obj.value` and threw a TypeError, breaking the rendering of the whole endpoint.
…onse `exportparts` takes `inner:outer`; the entries read `tab-coontent:tab-content` (typo), so no inner part matched and the documented `tab-content` part was never re-exported to the rapi-doc host.
- downloadResource/viewResource/onApiKeyChange are called with an event
argument they do not accept
- unsafeHTML() takes a single argument; the `{ USE_PROFILES }` options (a
DOMPurify leftover) were silently ignored since sanitizeHTML already runs
- endpoint ordering by method compared indices as strings (via toString +
localeCompare); compare them numerically
No behavior change.
…eme tokens The viewer built its theme object with the misspelled key `navAccenttextColor`, so setTheme never saw the configured nav-accent-text-color.
jsonSchemaViewerTemplate only takes `isMini`; the three extra arguments were leftovers of the former endpoint template signature.
…<base> tag When the host page has an HTML <base> tag, a bare `#section` link in a markdown description resolves against the base URL, so clicking it navigates away from the page instead of jumping to the section. Markdown in-page anchors are now rendered as absolute URLs of the current page (with an `anchor-link` class). The fix is applied to the global marked instance and to the custom renderers (headings in the nav bar, read mode, focused mode), which replace the global renderer when passed per call. Covered by unit tests and by a browser test on a page with a <base> tag.
The icon click passed a div as event target, so searchVal became undefined and the component search crashed on undefined.toLowerCase(). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…pec is loading resolvedSpec is a placeholder without securitySchemes during loadSpec, so attributeChangedCallback threw on securitySchemes.find. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Collaborator
|
Thanks for the contribution I will hold onto this PR once v11 is released. Once thats done i will see what can be cherry picked. In case you spot any conflicts in your PR after v11 please feel free to resolve them as it will help me merge the changes faster |
mrin9
approved these changes
Oct 11, 2026
Collaborator
|
Thank you for the detailed fixes and test cases, Stéphane! We have cherry-picked and integrated the 12 relevant bug fixes into our upcoming feature/theme (v11) branch: OAuth fixes (storage listener, refreshUrl resolution, and postMessage targetOrigin) Closing this PR as these fixes are now incorporated in feature/theme." |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A batch of small, independent bug fixes found while embedding RapiDoc in a host application (Angular wrapper, OAuth flows, themed UI). Each fix is its own commit, so they can be reviewed or cherry-picked one by one.
Fixes
Crashes
↩icon next to "Filter" passed the icon<div>as the event target, sosearchValbecameundefinedand the component search threwCannot read properties of undefined (reading 'toLowerCase').onSearchChangenow reads the input (also injson-schema-viewer).api-key-name,api-key-locationorapi-key-valuewhile the spec is loading threwCannot read properties of undefined (reading 'find'), becauseresolvedSpecis only a placeholder withoutsecuritySchemesat that point. The update is now skipped until the spec is resolved.standardizeExampleno longer throws on anullexample.OAuth
oauth-receiverrelays storage events withrelayAuthParams.refreshUrlis resolved against the server URL.postMessagegets a valid target origin.Markdown
marked18 heading renderer signature.#anchorlinks stay on the current page (a<base>tag is added), instead of navigating away.Other
nav-accent-text-coloris honored by the theme (the token was misspelled injson-schema-viewer).rapidoc-miniregisters the api-key scheme undersecuritySchemeId.json-schema-viewerpassesProcessSpecarguments in the right positions.tab-contentpart is exported fromapi-requestandapi-response.Cleanups (no behavior change)
generateExample,json-schema-viewertemplate).Tests
Unit tests were added or extended for the markdown and schema utilities (
tests/unit/markdown-utils.test.js,tests/unit/schema-utils.test.js).The search and api-key fixes were checked by hand against an embedding host app; they have no automated test.