DMP-5272 API Validation /transcriptions/{transcription_id}/document POST Input Hardening

src/integrationTest/java/uk/gov/hmcts/darts/cases/controller/CaseControllerAdminGetCaseByIdIntTest.java

@@ -134,8 +134,8 @@ void adminGetCaseById_WithCaseOpenAndReportingRestrictions() throws Exception {
         String actualResponse = mvcResult.getResponse().getContentAsString();
         String expectedResponse = getContentsFromFile(
             "tests/cases/CaseControllerAdminGetCaseByIdTest/testCaseOpen/expectedResponse.json");
-        expectedResponse = expectedResponse.replace("<CREATED_AT>", courtCase.getCreatedDateTime().format(DateTimeFormatter.ISO_DATE_TIME));
-        expectedResponse = expectedResponse.replace("<LAST_MODIFIED_AT>", courtCase.getLastModifiedDateTime().format(DateTimeFormatter.ISO_DATE_TIME));
+        expectedResponse = expectedResponse.replace("<CREATED_AT>", formatAsUtc(courtCase.getCreatedDateTime()));
+        expectedResponse = expectedResponse.replace("<LAST_MODIFIED_AT>", formatAsUtc(courtCase.getLastModifiedDateTime()));
         JSONAssert.assertEquals(expectedResponse, actualResponse, JSONCompareMode.NON_EXTENSIBLE);
 
     }
@@ -176,8 +176,8 @@ void adminGetCaseById_WithCaseClosedAndReportingRestrictions() throws Exception
         String actualResponse = mvcResult.getResponse().getContentAsString();
         String expectedResponse = getContentsFromFile(
             "tests/cases/CaseControllerAdminGetCaseByIdTest/testCaseClosed/expectedResponse.json");
-        expectedResponse = expectedResponse.replace("<CREATED_AT>", courtCase.getCreatedDateTime().format(DateTimeFormatter.ISO_DATE_TIME));
-        expectedResponse = expectedResponse.replace("<LAST_MODIFIED_AT>", courtCase.getLastModifiedDateTime().format(DateTimeFormatter.ISO_DATE_TIME));
+        expectedResponse = expectedResponse.replace("<CREATED_AT>", formatAsUtc(courtCase.getCreatedDateTime()));
+        expectedResponse = expectedResponse.replace("<LAST_MODIFIED_AT>", formatAsUtc(courtCase.getLastModifiedDateTime()));
         JSONAssert.assertEquals(expectedResponse, actualResponse, JSONCompareMode.NON_EXTENSIBLE);
 
     }
@@ -213,8 +213,8 @@ void adminGetCaseById_IsAnonymised() throws Exception {
         String expectedResponse = getContentsFromFile(
             "tests/cases/CaseControllerAdminGetCaseByIdTest/testIsAnonymised/expectedResponse.json");
         expectedResponse = expectedResponse
-            .replace("<CREATED_AT>", courtCase.getCreatedDateTime().format(DateTimeFormatter.ISO_DATE_TIME))
-            .replace("<LAST_MODIFIED_AT>", courtCase.getLastModifiedDateTime().format(DateTimeFormatter.ISO_DATE_TIME))
+            .replace("<CREATED_AT>", formatAsUtc(courtCase.getCreatedDateTime()))
+            .replace("<LAST_MODIFIED_AT>", formatAsUtc(courtCase.getLastModifiedDateTime()))
             .replace("<DATA_ANONYMISED_BY>", String.valueOf(anonymisedBy.getId()));
         JSONAssert.assertEquals(expectedResponse, actualResponse, JSONCompareMode.NON_EXTENSIBLE);
     }
@@ -248,8 +248,8 @@ void adminGetCaseById_IsDeleted() throws Exception {
         String expectedResponse = getContentsFromFile(
             "tests/cases/CaseControllerAdminGetCaseByIdTest/expectedResponse_isDeleted.json");
         expectedResponse = expectedResponse
-            .replace("<CREATED_AT>", courtCase.getCreatedDateTime().format(DateTimeFormatter.ISO_DATE_TIME))
-            .replace("<LAST_MODIFIED_AT>", courtCase.getLastModifiedDateTime().format(DateTimeFormatter.ISO_DATE_TIME))
+            .replace("<CREATED_AT>", formatAsUtc(courtCase.getCreatedDateTime()))
+            .replace("<LAST_MODIFIED_AT>", formatAsUtc(courtCase.getLastModifiedDateTime()))
             .replace("<CASE_DELETED_BY>", String.valueOf(deletedBy.getId()));
         JSONAssert.assertEquals(expectedResponse, actualResponse, JSONCompareMode.NON_EXTENSIBLE);
     }
@@ -299,8 +299,8 @@ void adminGetCaseById_WithRetentionAndAdditionalCaseDetails() throws Exception {
         String expectedResponse = getContentsFromFile(
             "tests/cases/CaseControllerAdminGetCaseByIdTest/expectedResponse_withRetentionAndAdditionalCaseDetails.json");
         expectedResponse = expectedResponse
-            .replace("<CREATED_AT>", courtCase.getCreatedDateTime().format(DateTimeFormatter.ISO_DATE_TIME))
-            .replace("<LAST_MODIFIED_AT>", courtCase.getLastModifiedDateTime().format(DateTimeFormatter.ISO_DATE_TIME));
+            .replace("<CREATED_AT>", formatAsUtc(courtCase.getCreatedDateTime()))
+            .replace("<LAST_MODIFIED_AT>", formatAsUtc(courtCase.getLastModifiedDateTime()));
         JSONAssert.assertEquals(expectedResponse, actualResponse, JSONCompareMode.NON_EXTENSIBLE);
     }
 
@@ -328,4 +328,8 @@ private List<EventEntity> createEventsWithDifferentTimestamps(List<OffsetDateTim
                 return event;
             }).toList();
     }
+
+    private static String formatAsUtc(OffsetDateTime dateTime) {
+        return dateTime.withOffsetSameInstant(UTC).format(DateTimeFormatter.ISO_DATE_TIME);
+    }
 }

src/main/resources/openapi/transcriptions.yaml

@@ -456,17 +456,21 @@ paths:
           schema:
             type: integer
             format: int64
+            description: Transcription ID. Validated by the application for min and max range.
       requestBody:
+        required: true
         content:
           multipart/form-data:
             schema:
               required:
                 - transcript
               type: object
+              additionalProperties: false
               properties:
                 transcript:
                   type: string
                   format: binary
+                  description: Transcript file. Validated by the application for file extension, content type, and maximum size.
       responses:
         '200':
           description: OK

src/test/java/uk/gov/hmcts/darts/openapi/TranscriptionOpenApiContractTest.java

@@ -4,7 +4,9 @@
 import com.atlassian.oai.validator.model.Request;
 import com.atlassian.oai.validator.model.SimpleRequest;
 import com.atlassian.oai.validator.report.ValidationReport;
+import org.junit.jupiter.api.Nested;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.TestInstance;
 import uk.gov.hmcts.darts.util.ValidationConstants;
 
 import static org.junit.jupiter.api.Assertions.assertTrue;
@@ -59,4 +61,78 @@ void openApi_ShouldReturnNoError_WhenValidTranscriptionIdUsed() {
 
         assertTrue(report.getMessages().isEmpty(), "Expected no validation errors for a valid transcription_id");
     }
+
+    @Nested
+    @TestInstance(TestInstance.Lifecycle.PER_CLASS)
+    class TranscriptionsTranscriptionIdDocumentPost {
+
+        @Test
+        void openApi_ShouldReturnNoError_WhenValidTranscriptionIdUsed() {
+            String boundary = "test-boundary";
+            Request request = SimpleRequest.Builder
+                .post("/transcriptions/1/document")
+                .withContentType("multipart/form-data; boundary=" + boundary)
+                .withBody(multipartTranscriptBody(boundary))
+                .build();
+
+            ValidationReport report = VALIDATOR.validateRequest(request);
+
+            assertTrue(report.getMessages().isEmpty(), "Expected no validation errors for a valid transcript upload request");
+        }
+
+        @Test
+        void openApi_ShouldReturnError_WhenTranscriptionIdIsNotNumeric() {
+            Request request = SimpleRequest.Builder
+                .get("/transcriptions/not-a-number/document")
+                .build();
+
+            ValidationReport report = VALIDATOR.validateRequest(request);
+
+            assertHasMessageContaining(report, "Instance type (string) does not match any allowed primitive type");
+        }
+
+        @Test
+        void openApi_ShouldReturnError_WhenUnsupportedContentTypeUsed() {
+            Request request = SimpleRequest.Builder
+                .post("/transcriptions/1/document")
+                .withContentType("application/json")
+                .withBody("{\"transcript\":\"Transcript content\"}")
+                .build();
+
+            ValidationReport report = VALIDATOR.validateRequest(request);
+
+            assertHasMessageContaining(report, "does not match any allowed types");
+        }
+
+        @Test
+        void openApi_ShouldReturnError_WhenRequestBodyIsMissing() {
+            Request request = SimpleRequest.Builder
+                .post("/transcriptions/1/document")
+                .withContentType("multipart/form-data")
+                .build();
+
+            ValidationReport report = VALIDATOR.validateRequest(request);
+
+            assertHasMessageContaining(report, "A request body is required but none found");
+        }
+
+        private String multipartTranscriptBody(String boundary) {
+            return String.join("\r\n",
+                               "--" + boundary,
+                               "Content-Disposition: form-data; name=\"transcript\"; filename=\"transcript.txt\"",
+                               "Content-Type: text/plain",
+                               "",
+                               "Transcript content",
+                               "--" + boundary + "--",
+                               "");
+        }
+    }
+
+    private void assertHasMessageContaining(ValidationReport report, String expectedSubstring) {
+        assertTrue(
+            report.getMessages().stream()
+                .anyMatch(message -> message.getMessage().contains(expectedSubstring)),
+            () -> "Expected validation message containing '%s' but got %s".formatted(expectedSubstring, report.getMessages())
+        );
+    }
 }