documentationUrl: https://spec.openlint.org/
functions:
- baloise-validate-tracing
functionsDir: ./functions
rules:
  openapi-path-require-tracing-header:
    description: MUST use b3 or w3c tracing [233a].
    message: Header X-B3-Traceid, X-B3-Spanid or traceparent (w3c) missing
    severity: info
    given: $.paths.*
    then:
      function: baloise-validate-tracing
    documentationUrl: https://apicommons.org/rules/#openapi-path-require-tracing-header
  openapi-request-support-baggage:
    description: Operations should accept a baggage request header (W3C Baggage / OpenTelemetry) so application-defined context
      propagates across services.
    message: Operation should accept a `baggage` request header.
    given: $.paths[*][get,post,put,patch,delete]
    severity: info
    then:
      field: parameters
      function: schema
      functionOptions:
        schema:
          type: array
          contains:
            type: object
            required:
            - name
            - in
            properties:
              name:
                const: baggage
              in:
                const: header
    documentationUrl: https://apicommons.org/rules/#openapi-request-support-baggage
  openapi-request-support-correlation-id:
    description: Operations should accept a correlation / request ID request header (e.g. Correlation-Id or X-Request-Id)
      so a caller-supplied id can be traced end to end.
    message: Operation should accept a `Correlation-Id` request header.
    given: $.paths[*][get,post,put,patch,delete]
    severity: info
    then:
      field: parameters
      function: schema
      functionOptions:
        schema:
          type: array
          contains:
            type: object
            required:
            - name
            - in
            properties:
              name:
                pattern: ^([Xx]-)?([Cc]orrelation|[Rr]equest)-[Ii][Dd]$
              in:
                const: header
    documentationUrl: https://apicommons.org/rules/#openapi-request-support-correlation-id
  openapi-request-support-tracestate:
    description: Operations should accept a tracestate request header (W3C Trace Context) so vendor-specific trace state propagates
      alongside traceparent.
    message: Operation should accept a `tracestate` request header.
    given: $.paths[*][get,post,put,patch,delete]
    severity: info
    then:
      field: parameters
      function: schema
      functionOptions:
        schema:
          type: array
          contains:
            type: object
            required:
            - name
            - in
            properties:
              name:
                const: tracestate
              in:
                const: header
    documentationUrl: https://apicommons.org/rules/#openapi-request-support-tracestate
  openapi-response-return-correlation-id:
    description: Responses should return a correlation / request ID header (e.g. Request-Id or X-Correlation-Id) so callers
      can correlate a response with their request and with server-side logs.
    message: Responses should return a correlation / request ID header.
    given: $..responses.*
    severity: info
    then:
      field: headers
      function: schema
      functionOptions:
        schema:
          type: object
          anyOf:
          - required:
            - Request-Id
          - required:
            - X-Request-Id
          - required:
            - X-Request-ID
          - required:
            - Correlation-Id
          - required:
            - X-Correlation-Id
          - required:
            - X-Correlation-ID
    documentationUrl: https://apicommons.org/rules/#openapi-response-return-correlation-id
  openapi-schema-requestid-property-must-be-string:
    description: requestId MUST use a data type of 'string'.
    message: requestId MUST use a data type of 'string'.
    severity: info
    given: $..[?(@property === "requestId")].type
    then:
      function: pattern
      functionOptions:
        match: ^string$
    formats:
    - oas3
    documentationUrl: https://apicommons.org/rules/#openapi-schema-requestid-property-must-be-string
  asyncapi-component-asyncapi-message-require-correlation-id:
    description: Messages should define a correlationId so events can be traced across services.
    message: Message should define a correlationId.
    given: $.components.messages[*]
    severity: info
    then:
      field: correlationId
      function: truthy
    documentationUrl: https://apicommons.org/rules/#asyncapi-component-asyncapi-message-require-correlation-id