feat: Allow uploading OpenAPI spec to register x402 resources (#97)#795
feat: Allow uploading OpenAPI spec to register x402 resources (#97)#795tarai-dl wants to merge 1 commit into
Conversation
Adds ability to register x402 resources from an OpenAPI specification with x-402 extensions, as an alternative to probing endpoints. - New API endpoint: POST /api/x402/registry/register-openapi Accepts an OpenAPI spec (JSON) with x-402 extensions and registers all matching endpoints as x402 resources. - New UI: OpenAPI Spec tab on the register page Users can paste or upload an OpenAPI spec file, preview detected endpoints, and register them in bulk. - Supports x-402 and x402 extension fields on operations - Extracts input/output schemas from OpenAPI parameters and requestBody - Docs: Example OpenAPI spec with x-402 extensions Implements Merit-Systems#97
|
Someone is attempting to deploy a commit to the Merit Systems Team on Vercel. A member of the Team first needs to authorize it. |
![vercel[bot]](https://avatars.githubusercontent.com/in/8329?s=60&v=4){kind=small}
| @@ -1,40 +1,64 @@ | |||
| import { Body, Heading } from '@/app/_components/layout/page-utils'; | |||
| import Link from 'next/link'; | |||
| 'use client'; | |||
There was a problem hiding this comment.
Page marked as 'use client' but removed metadata export, causing loss of SEO metadata (title and description) for the register page
| const op = operation as OpenApiOperation; | ||
| const x402Config = op['x-402'] ?? op['x402']; | ||
|
|
||
| if (!x402Config?.enabled && !x402Config?.paymentRequirements) continue; |
There was a problem hiding this comment.
| if (!x402Config?.enabled && !x402Config?.paymentRequirements) continue; | |
| if (!x402Config?.enabled) continue; |
Overly permissive condition for detecting x402 resources allows inclusion of endpoints with only paymentRequirements but without enabled: true
| if (method.startsWith('x-') || method === 'parameters') continue; | ||
| const operation = op as Record<string, unknown>; | ||
| const x402 = operation['x-402'] ?? operation['x402']; | ||
| if (x402) { |
There was a problem hiding this comment.
| if (x402) { | |
| const x402Config = x402 as Record<string, unknown> | undefined; | |
| if (x402Config?.enabled || x402Config?.paymentRequirements) { |
Form preview and registration handler have inconsistent filtering logic for x-402 endpoints, causing disabled endpoints to appear in preview but fail during registration
| const paymentOption = { | ||
| protocol: 'x402' as const, | ||
| scheme: 'exact' as const, | ||
| network: price.network ?? 'base', |
There was a problem hiding this comment.
x402-enabled endpoints can silently default to 0 payment when price amount is not specified
| network: price.network ?? 'base', | ||
| amount: String(price.amount ?? '0'), | ||
| maxAmountRequired: String(price.amount ?? '0'), | ||
| payTo: '', |
There was a problem hiding this comment.
The payTo field is hardcoded to empty string in OpenAPI x402 handler, preventing payment routing and ownership verification
| const fullUrl = serverUrl | ||
| ? `${serverUrl.replace(/\/$/, '')}${path}` | ||
| : path; |
There was a problem hiding this comment.
| const fullUrl = serverUrl | |
| ? `${serverUrl.replace(/\/$/, '')}${path}` | |
| : path; | |
| // Ensure path starts with / for correct URL construction | |
| const normalizedPath = path.startsWith('/') ? path : `/${path}`; | |
| const fullUrl = serverUrl | |
| ? `${serverUrl.replace(/\/$/, '')}${normalizedPath}` | |
| : normalizedPath; |
URL concatenation assumes paths always start with /, causing malformed URLs when a path lacks the leading slash
| 'Register x402 resources from an OpenAPI specification with x-402 extensions' | ||
| ) | ||
| .handler(({ body }) => | ||
| handleRegistryRegisterOpenApi(body.spec as string, body.baseUrl) |
There was a problem hiding this comment.
| handleRegistryRegisterOpenApi(body.spec as string, body.baseUrl) | |
| handleRegistryRegisterOpenApi(body.spec, body.baseUrl) |
Incorrect type cast loses type safety when passing body.spec to handler that accepts union type
| @@ -0,0 +1,270 @@ | |||
| import { jsonResponse } from '@/app/api/x402/_lib/utils'; | |||
| import { registerResource } from '@/lib/resources'; | |||
| import { convertOpenApiSchemaToV1 } from '@/lib/openapi-to-v1'; | |||
There was a problem hiding this comment.
| import { convertOpenApiSchemaToV1 } from '@/lib/openapi-to-v1'; |
Unused import convertOpenApiSchemaToV1 should be removed from registry-register-openapi.ts
1 participant
Summary
This PR implements the ability to register x402 resources from an OpenAPI specification with
x-402extensions, as an alternative to probing endpoints directly.Closes #97
Changes
New API Endpoint
/api/x402/registry/register-openapix-402extensionsbaseUrlparameter to override the spec's servers arrayNew UI Component
.json,.yaml,.ymlfilesOpenAPI Parsing
x-402orx402extension fieldsenabled,price.amount,price.network,price.assetfieldsHow to Use
Add
x-402extensions to your OpenAPI spec operations:{ "paths": { "/api/premium-data": { "post": { "x-402": { "enabled": true, "price": { "amount": "1000", "network": "base" } }, "requestBody": { ... }, "responses": { ... } } } } }See
docs/examples/openapi-x402-example.jsonfor a complete example.Test Plan
Relates to Algora bounty #97 ($100)