ガバナンスルールセットに対する API 仕様の検証

#%Validation Profile 1.0
profile: HTTPS enforcement
description: This ruleset helps ensure the use of HTTPS across URLs in API
  definitions, both in the base server URL and in any callbacks optionally
  defined.
violation:
  - use-https-for-callbacks
  - use-https-for-scheme-protocol
  - use-https-for-urls
tags:
  - security
validations:
  use-https-for-callbacks:
    message: "{{apiContract.expression}} must use https as it is a callback url"
    targetClass: apiContract.Callback
    propertyConstraints:
      apiContract.expression:
        pattern: ^https://
    examples:
      valid: |
        openapi: "3.0.0"
        info:
          title: example API
          version: "1.0.0"
        paths:
          /subscribe:
            post:
              responses:
                '201':
                  description: Webhook created
              callbacks:
                myEvent:
                  'https://{$request.body#/callbackUrl}'
      invalid: |
        openapi: "3.0.0"
        info:
          title: example API
          version: "1.0.0"
        paths:
          /subscribe:
            post:
              responses:
                '201':
                  description: Webhook created
              callbacks:
                myEvent:
                  'http://{$request.body#/callbackUrl}'
  use-https-for-scheme-protocol:
    message: Only use https protocol scheme
    targetClass: apiContract.WebAPI
    not:
      propertyConstraints:
        apiContract.scheme:
          containsSome:
            - HTTP
            - http
    examples:
      valid: |
        #%RAML 1.0
        protocols:
          - HTTPS
      invalid: |
        #%RAML 1.0
        protocols:
          - HTTP
  use-https-for-urls:
    message: "{{core.urlTemplate}} should use https"
    targetClass: apiContract.Server
    propertyConstraints:
      core.urlTemplate:
        pattern: ^https://
    examples:
      valid: |
        openapi: "3.0.0"
        servers:
          - url: "https://mySecureEndpoint"
            description: "My endpoint that uses HTTPS"
      invalid: |
        openapi: "3.0.0"
        servers:
          - url: "http://myNotSoSecureEndpoint"
            description: "My endpoint that uses HTTP"