Fix AWS Scope API model validation and regions logic

This commit fixes the validation of the AWSScope type so that if you
provide invalid properties or miss some required properties it errors.

It renames the "all" field to "allRegions" which better describes what
the flag does.

api/openapi.yaml

@@ -749,6 +749,8 @@ components:
             id:
               type: string
               readOnly: true
+          required:
+            - name
 
     ScanConfigExists:
       type: object
@@ -775,7 +777,8 @@ components:
       properties:
         objectType:
           type: string
-        all:
+        allRegions:
+          description: Scan all regions, if set will override anything set in regions.
           type: boolean
         regions:
           type: array
@@ -795,44 +798,45 @@ components:
             $ref: '#/components/schemas/Tag'
       required:
         - objectType
+      additionalProperties: false
 
     AwsRegion:
       type: object
       description: AWS region
       properties:
-        id:
-          type: string
-          readOnly: true
         name:
           type: string
         vpcs:
           type: array
           items:
             $ref: '#/components/schemas/AwsVPC'
+      required:
+        - name
+      additionalProperties: false
 
     AwsVPC:
       type: object
       description: AWS VPC
       properties:
         id:
           type: string
-          readOnly: true
-        name:
-          type: string
         securityGroups:
           type: array
           items:
             $ref: '#/components/schemas/AwsSecurityGroup'
+      required:
+        - id
+      additionalProperties: false
 
     AwsSecurityGroup:
       type: object
       description: AWS security group
       properties:
         id:
           type: string
-          readOnly: true
-        name:
-          type: string
+      required:
+        - id
+      additionalProperties: false
 
     Tag:
       type: object
@@ -842,6 +846,10 @@ components:
           type: string
         value:
           type: string
+      required:
+        - key
+        - value
+      additionalProperties: false
 
     RuntimeScheduleScanConfigType:
       type: object

backend/pkg/backend/backend.go

@@ -86,11 +86,10 @@ func Run() {
 
 	_ = CreateBackend(dbHandler)
 
-	restServer, err := rest.CreateRESTServer(config.BackendRestPort)
+	restServer, err := rest.CreateRESTServer(config.BackendRestPort, dbHandler)
 	if err != nil {
 		log.Fatalf("Failed to create REST server: %v", err)
 	}
-	restServer.RegisterHandlers(dbHandler)
 	restServer.Start(errChan)
 	defer restServer.Stop()
 

backend/pkg/database/gorm/scan_config.go

@@ -95,8 +95,8 @@ func (s *ScanConfigsTableHandler) GetScanConfig(scanConfigID models.ScanConfigID
 
 func (s *ScanConfigsTableHandler) CreateScanConfig(scanConfig models.ScanConfig) (models.ScanConfig, error) {
 	// Check the user provided the name field
-	if scanConfig.Name == nil || *scanConfig.Name == "" {
-		return models.ScanConfig{}, fmt.Errorf("name is a required field")
+	if scanConfig.Name == "" {
+		return models.ScanConfig{}, fmt.Errorf("name can not be empty")
 	}
 
 	// Check the user didn't provide an Id
@@ -122,7 +122,7 @@ func (s *ScanConfigsTableHandler) CreateScanConfig(scanConfig models.ScanConfig)
 
 	// Check the existing DB entries to ensure that the name field is unique
 	var scanConfigs []ScanConfig
-	filter := fmt.Sprintf("name eq '%s'", *scanConfig.Name)
+	filter := fmt.Sprintf("name eq '%s'", scanConfig.Name)
 	err := ODataQuery(s.DB, "ScanConfig", &filter, nil, nil, nil, nil, true, &scanConfigs)
 	if err != nil {
 		return models.ScanConfig{}, err
@@ -135,7 +135,7 @@ func (s *ScanConfigsTableHandler) CreateScanConfig(scanConfig models.ScanConfig)
 			return models.ScanConfig{}, fmt.Errorf("failed to convert DB model to API model: %w", err)
 		}
 		return sc, &common.ConflictError{
-			Reason: fmt.Sprintf("Scan config exists with name=%s", *sc.Name),
+			Reason: fmt.Sprintf("Scan config exists with name=%s", sc.Name),
 		}
 	}
 

backend/pkg/rest/server.go

@@ -44,8 +44,8 @@ type Server struct {
 	echoServer *echo.Echo
 }
 
-func CreateRESTServer(port int) (*Server, error) {
-	e, err := createEchoServer()
+func CreateRESTServer(port int, dbHandler databaseTypes.Database) (*Server, error) {
+	e, err := createEchoServer(dbHandler)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create rest server: %v", err)
 	}
@@ -55,34 +55,36 @@ func CreateRESTServer(port int) (*Server, error) {
 	}, nil
 }
 
-func createEchoServer() (*echo.Echo, error) {
+func createEchoServer(dbHandler databaseTypes.Database) (*echo.Echo, error) {
 	swagger, err := server.GetSwagger()
 	if err != nil {
 		return nil, fmt.Errorf("failed to load swagger spec: %v", err)
 	}
-	// Clear out the servers array in the swagger spec, that skips validating
-	// that server names match.
-	swagger.Servers = nil
 
 	e := echo.New()
+
 	// Log all requests
 	e.Use(echomiddleware.Logger())
-	// Create a router group for baseURL
-	g := e.Group(BaseURL)
-	// Use oapi-codegen validation middleware to validate
-	// the base URL router group against the OpenAPI schema.
-	g.Use(middleware.OapiRequestValidator(swagger))
 
-	return e, nil
-}
+	// Recover any panics into a HTTP 500
+	e.Use(echomiddleware.Recover())
+
+	// Create a router group for API base URL
+	apiGroup := e.Group(BaseURL)
 
-func (s *Server) RegisterHandlers(dbHandler databaseTypes.Database) {
-	serverImpl := &ServerImpl{
+	// Use oapi-codegen validation middleware to validate
+	// the API group against the OpenAPI schema.
+	apiGroup.Use(middleware.OapiRequestValidator(swagger))
+
+	// Create backend API implementation for API group
+	apiImpl := &ServerImpl{
 		dbHandler: dbHandler,
 	}
 
-	// Register server above as the handler for the interface
-	server.RegisterHandlersWithBaseURL(s.echoServer, serverImpl, BaseURL)
+	// Register paths with the backend implementation
+	server.RegisterHandlers(apiGroup, apiImpl)
+
+	return e, nil
 }
 
 func (s *Server) Start(errChan chan struct{}) {