Skip to content

chore: align openapi-viewer with the shared service conventions - #62

Merged
BatLeDev merged 10 commits into
masterfrom
chore-align-service
Nov 9, 2026
Merged

BatLeDev merged 10 commits into
masterfrom
chore-align-service

Conversation

@BatLeDev

@BatLeDev BatLeDev commented Nov 9, 2026 •

Copy link
Copy Markdown
Member

Align openapi-viewer with the other data-fair services, and fix the UI issues found while validating it.

  • Dev environment on @data-fair/lib-dev: ports in .env (the HMR port 7200 collided with metrics), zellij panes without nvm/npm wrappers, nodemon, canonical compose blocks (nginx 1.29.4 with the shared template, simple-directory, mongo 8.0.17 with healthchecks), .mjs config files, /api/ping for readiness, no dependency discovery in vite
  • Dependencies: lib-express 2 / lib-node 3 (only the logger changed, unused here), frame 0.19, json-schema-ref-parser 16, js-yaml 5; lib-types-builder unpinned from 1.10.1 now that lib-utils 1.14.2 handles the OpenAPI 3.1 meta-schema (fix(utils): keep a property named $ref in makeLocalDefs lib#67); no high vulnerability left
  • Tooling: CI reads .nvmrc, Playwright keeps traces on failure, .gitignore template, typed router declarations, README header and sponsors like the other services
  • Fixes:
    • bash / yaml highlighting was broken in the dev server: vite-plugin-node-polyfills prepended its shim without a semicolon to Prism's minified components; the plugin is replaced by an explicit Buffer global, which also drops the crypto-browserify / elliptic chain
    • null in a parameter enum (data-fair's collapse and sampling) crashed the operation form
  • Perf: large response bodies no longer freeze the page (Prism output is no longer sanitized again, plain text past 100 kB)

Why: keep the service on the shared conventions so that it runs and is operated like the others, standalone or embedded in the data-fair stack.

Heads-up:

  • moving the dev mongo from 4.2 to 8 needs the dev volume reset (docker compose down -v)
  • vite reports that json-schema-ref-parser 16's HTTP resolver imports node:* modules, externalized in the browser; only internal refs are resolved, the production build was checked

Same header and sponsors block as the other data-fair services; Dawizz is no
longer listed as a sponsor.
- @data-fair/lib-express 2 and lib-node 3: the breaking change is the pino logger,
  which this service does not use (only session, errorHandler, site and SPA middlewares)
- @data-fair/lib-types-builder stays pinned at 1.10.1: later versions crash on the OpenAPI 3.1
  meta-schema (makeLocalDefs reads its $ref property as a reference)
- @data-fair/frame 0.19, @apidevtools/json-schema-ref-parser 16
- js-yaml 5: no default export any more, imported as a namespace
- lockfile refresh (minor and patch updates, npm audit fix: no high vulnerability left)
- dev environment tooling for the next commit: @data-fair/lib-dev, nodemon, dotenv
- engines.node >=24.22.1, like .nvmrc and the Docker image
Used as the readiness URL of the api pane in the dev environment, and usable as a
container healthcheck. The service has no dependency to check, so it answers ok.
- dev/dev.json: ports in .env (no more hard-coded 5600 / 8081 / 3000, nor the HMR port 7200
  shared with metrics), readiness URLs (api /api/ping, ui), dev page URL
- .zellij.kdl: panes run their command directly (no nvm/npm wrappers), status pane with
  df-status --start-deps, api with nodemon after df-dev wait-deps, vite under df-mem-cap
- api/nodemon.json replaces node --watch
- docker-compose: canonical nginx 1.29.4, simple-directory (healthcheck, shared dev secrets)
  and mongo 8.0.17 (healthcheck, 0.25 GB cache) blocks; no fake "dev" profile
- dev nginx template with the shared head instead of a full nginx.conf
- api config files in .mjs; the development one reads .env, the example docs URL follows
  the dev env's host and port; the unused test config and its branch in config.ts are removed
- vite: ports from .env with strictPort, no server block for vite preview
- scripts: dev-zellij through df-dev, stop-dev-deps on every profile, dev-* scripts removed
- playwright reads .env for its baseURL; the /dev page links follow the page's origin (and the
  recursive example link had a typo)
- .gitignore on the shared template (.env, dev/logs, agent working files)
- CONTRIBUTING: install with npx --no df-dev setup, standalone vs integrated mode

Moving from mongo 4.2 to 8 needs the dev volume reset (docker compose down -v).
- CI reads the node version from .nvmrc instead of any 24.x
- CI no longer prints the logs of a "data-fair" compose service that does not exist here
  (the quality job never starts the compose)
- playwright: trace and screenshot kept on failure, 30 s test timeout; the html reporter
  stays locally, the snapshot review reads it
- vite: typed router declarations in dts/typed-router.d.ts like the other UIs
A dependency discovered while browsing reloaded the page (three times on a first visit),
which breaks cold e2e runs. Only the commonjs dependencies are pre-bundled now: vjsf's,
debug, prismjs and its components, statuses. Validated on an empty ui/node_modules/.vite:
the e2e suite passes and vite logs no reload.
vite-plugin-node-polyfills prepends its globals shim to every pre-bundled dependency without a
trailing semicolon. prism-bash.min.js and prism-yaml.min.js start with an IIFE, which then
became an argument of the process polyfill call, so these languages never registered in dev
("Prism component for language bash was not found"). The production build was not affected.

The plugin was added for json-schema-ref-parser, whose version 16 only needs the Buffer
global (process is guarded, path is no longer imported): the plugin is replaced by the
buffer package assigned to globalThis.Buffer next to the dereference call. This also drops
the node-stdlib-browser / crypto-browserify / elliptic chain from the UI dependencies.
data-fair documents its collapse and sampling parameters with enum: [null, ...]. vjsf
renders that enum as a select whose null item crashes (Cannot read properties of null
(reading 'header')), and every re-render of the form then fails. null means "no value",
which an empty optional field already expresses: it is removed from the field schema
(and from items.enum), without mutating the documentation.
Measured on a 1000 lines /lines response (307 kB of JSON, 1.4 MB of highlighted HTML): Prism
64 ms, DOMPurify 378 ms, DOM insertion 536 ms; about 4 s for 5000 lines.

- Prism output is inserted as is: Prism escapes the code it highlights, so sanitizing it
  again was pure cost
- past 100 kB the code is shown as plain text, without the DOM of every token
- an unknown language shows the code as text instead of inserting it as HTML (a "<div>" in a
  response body disappeared)
- the copy button shows whenever there is code, not only when highlighting produced a tag
- v-safe-html no longer sanitizes and rewrites the element on every update of its parent
  when its value did not change
lib-utils 1.14.2 keeps a property named $ref in makeLocalDefs (data-fair/lib#67), so
lib-types-builder no longer crashes on the OpenAPI 3.1 meta-schema: ^1.14.6 with
lib-utils ^1.14.2 instead of the exact 1.10.1 pin. build-types and check-types pass with
the published versions.
@BatLeDev
BatLeDev merged commit 7391766 into master Nov 9, 2026
4 checks passed
@BatLeDev
BatLeDev deleted the chore-align-service branch November 9, 2026 13:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant