7digital API Rules

# 7digital Spectral Ruleset
# Generated for api-evangelist/7digital — enforces the conventions observed
# across the 7digital classic API (v1.2) and the modern MassiveMusic Streaming
# Platform API.

extends:
  - spectral:oas

rules:
  # ── INFO / METADATA ─────────────────────────────────────────────────────
  info-title-prefix:
    description: API title must begin with "7digital" (the provider brand).
    severity: error
    given: $.info.title
    then:
      function: pattern
      functionOptions:
        match: "^7digital"

  info-description-required:
    description: API info MUST include a non-trivial description (>= 60 chars).
    severity: error
    given: $.info
    then:
      field: description
      function: length
      functionOptions:
        min: 60

  info-version-required:
    description: API info MUST include a version.
    severity: error
    given: $.info
    then:
      field: version
      function: truthy

  info-contact-required:
    description: API info SHOULD declare a contact (Client Success).
    severity: warn
    given: $.info
    then:
      field: contact
      function: truthy

  info-license-required:
    description: API info SHOULD declare a license (commercial agreement).
    severity: warn
    given: $.info
    then:
      field: license
      function: truthy

  # ── OPENAPI VERSION + SERVERS ──────────────────────────────────────────
  openapi-version-pinned:
    description: OpenAPI must be 3.0.x.
    severity: error
    given: $.openapi
    then:
      function: pattern
      functionOptions:
        match: "^3\\.0\\."

  servers-required:
    description: At least one server MUST be defined.
    severity: error
    given: $
    then:
      field: servers
      function: schema
      functionOptions:
        schema:
          type: array
          minItems: 1

  servers-https-only:
    description: Server URLs MUST use https (TLS).
    severity: error
    given: $.servers[*].url
    then:
      function: pattern
      functionOptions:
        match: "^https://"

  servers-7digital-host:
    description: Production servers SHOULD live under api.7digital.com.
    severity: info
    given: $.servers[*].url
    then:
      function: pattern
      functionOptions:
        match: "api\\.7digital\\.com"

  # ── PATHS ──────────────────────────────────────────────────────────────
  path-no-trailing-slash:
    description: Paths MUST NOT end with a trailing slash.
    severity: error
    given: $.paths.*~
    then:
      function: pattern
      functionOptions:
        notMatch: "/$"

  path-camel-case-segments:
    description: Path segments use camelCase (e.g. `unlimitedStreaming`) per the existing 7digital convention.
    severity: warn
    given: $.paths.*~
    then:
      function: pattern
      functionOptions:
        match: "^(/[a-zA-Z][a-zA-Z0-9-]*(\\{[a-zA-Z][a-zA-Z0-9]*\\})?)+$"

  # ── OPERATIONS ─────────────────────────────────────────────────────────
  operation-id-required:
    description: Every operation MUST declare an operationId.
    severity: error
    given: $.paths.*[get,post,put,patch,delete]
    then:
      field: operationId
      function: truthy

  operation-id-camel-case:
    description: operationId MUST be camelCase.
    severity: error
    given: $.paths.*[get,post,put,patch,delete].operationId
    then:
      function: pattern
      functionOptions:
        match: "^[a-z][a-zA-Z0-9]*$"

  operation-id-verb-prefix:
    description: operationId SHOULD start with a known verb prefix.
    severity: warn
    given: $.paths.*[get,post,put,patch,delete].operationId
    then:
      function: pattern
      functionOptions:
        match: "^(get|list|find|search|browse|create|update|delete|remove|add|apply|complete|signup|authenticate|stream|download|transfer|report|post|put|deliver|select|register|resolve|match|credit|authorize|authorise)[A-Z]"

  operation-summary-required:
    description: Every operation MUST declare a summary.
    severity: error
    given: $.paths.*[get,post,put,patch,delete]
    then:
      field: summary
      function: truthy

  operation-summary-prefix:
    description: Operation summaries MUST begin with "7digital ".
    severity: error
    given: $.paths.*[get,post,put,patch,delete].summary
    then:
      function: pattern
      functionOptions:
        match: "^7digital "

  operation-description-required:
    description: Every operation MUST declare a description.
    severity: warn
    given: $.paths.*[get,post,put,patch,delete]
    then:
      field: description
      function: truthy

  operation-tags-required:
    description: Every operation MUST be tagged.
    severity: error
    given: $.paths.*[get,post,put,patch,delete]
    then:
      field: tags
      function: schema
      functionOptions:
        schema:
          type: array
          minItems: 1

  operation-microcks-extension:
    description: Operations SHOULD declare x-microcks-operation for mock-server compatibility.
    severity: info
    given: $.paths.*[get,post,put,patch,delete]
    then:
      field: x-microcks-operation
      function: truthy

  # ── TAGS ───────────────────────────────────────────────────────────────
  global-tags-defined:
    description: Global tags array SHOULD be defined with descriptions.
    severity: warn
    given: $
    then:
      field: tags
      function: schema
      functionOptions:
        schema:
          type: array
          minItems: 1

  tag-description-required:
    description: Each global tag MUST have a description.
    severity: warn
    given: $.tags[*]
    then:
      field: description
      function: truthy

  tag-title-case:
    description: Global tag names use Title Case (e.g. "Interactive Radio").
    severity: info
    given: $.tags[*].name
    then:
      function: pattern
      functionOptions:
        match: "^[A-Z][A-Za-z0-9]*( [A-Z][A-Za-z0-9]*)*$"

  # ── PARAMETERS ─────────────────────────────────────────────────────────
  parameter-description-required:
    description: Each parameter MUST have a description.
    severity: warn
    given: $..parameters[*]
    then:
      field: description
      function: truthy

  parameter-schema-required:
    description: Each parameter MUST have a schema.type.
    severity: error
    given: $..parameters[*]
    then:
      field: schema
      function: truthy

  parameter-camel-case:
    description: Parameter names use camelCase (e.g. `pageSize`, `releaseId`).
    severity: warn
    given: $..parameters[*].name
    then:
      function: pattern
      functionOptions:
        match: "^[a-z][a-zA-Z0-9]*$"

  # ── REQUEST BODIES ─────────────────────────────────────────────────────
  request-body-content-type:
    description: Request bodies SHOULD use application/json or application/x-www-form-urlencoded (OAuth signing).
    severity: warn
    given: $.paths.*[post,put,patch,delete].requestBody.content
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          anyOf:
            - required: ["application/json"]
            - required: ["application/x-www-form-urlencoded"]

  # ── RESPONSES ──────────────────────────────────────────────────────────
  response-success-required:
    description: Each operation MUST declare at least one 2xx response.
    severity: error
    given: $.paths.*[get,post,put,patch,delete].responses
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          anyOf:
            - required: ["200"]
            - required: ["201"]
            - required: ["202"]
            - required: ["204"]

  response-description-required:
    description: Every response MUST have a description.
    severity: warn
    given: $.paths.*[get,post,put,patch,delete].responses.*
    then:
      field: description
      function: truthy

  response-error-401:
    description: Operations SHOULD declare a 401 response (authentication failure).
    severity: info
    given: $.paths.*[get,post,put,patch,delete].responses
    then:
      field: "401"
      function: truthy

  # ── SCHEMAS ────────────────────────────────────────────────────────────
  schema-property-camel-case:
    description: Schema properties use camelCase (e.g. `releaseId`, `previewUrl`).
    severity: warn
    given: $.components.schemas..properties.*~
    then:
      function: pattern
      functionOptions:
        match: "^[a-z][a-zA-Z0-9]*$"

  schema-type-required:
    description: Schemas MUST declare a type or composition keyword.
    severity: warn
    given: $.components.schemas.*
    then:
      function: schema
      functionOptions:
        schema:
          type: object
          anyOf:
            - required: ["type"]
            - required: ["allOf"]
            - required: ["oneOf"]
            - required: ["anyOf"]
            - required: ["$ref"]

  # ── SECURITY ───────────────────────────────────────────────────────────
  global-security-required:
    description: A global security requirement MUST be defined (OAuth 1.0).
    severity: error
    given: $
    then:
      field: security
      function: truthy

  oauth-security-scheme-defined:
    description: Security schemes MUST include an OAuth 1.0 scheme.
    severity: error
    given: $.components.securitySchemes
    then:
      field: oauth1
      function: truthy

  # ── HTTP METHOD CONVENTIONS ────────────────────────────────────────────
  no-get-request-body:
    description: GET operations MUST NOT declare a request body.
    severity: error
    given: $.paths.*.get
    then:
      field: requestBody
      function: falsy

  post-put-patch-request-body:
    description: POST, PUT, and PATCH operations SHOULD declare a request body.
    severity: warn
    given: $.paths.*[post,put,patch]
    then:
      field: requestBody
      function: truthy

  delete-no-request-body:
    description: DELETE operations MUST NOT declare a request body.
    severity: warn
    given: $.paths.*.delete
    then:
      field: requestBody
      function: falsy