feat(apisix): validate upstreams and credentials

[bzp2010]

Description

Perform server-side validation of upstreams and credentials. In previous implementations, these were skipped; now they are no longer skipped.

Checklist

• I have explained the need for this PR and the problem it solves
• I have explained the changes or the new features added to this PR
• I have added tests corresponding to this change
• I have updated the documentation to reflect this change
• I have verified that this change is backward compatible

Summary by CodeRabbit

• New Features

  • APISIX validation now supports upstream events and consumer credential configurations.
  • Consumer credentials are associated with their parent consumers during validation.
  • Validation errors identify the affected resource type and ID.

• Bug Fixes

  • Improved handling of invalid upstream node weights and incomplete consumer credential configurations.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: d7c59636-b925-49e3-aa68-67bb0eed4c48

📥 Commits

Reviewing files that changed from the base of the PR and between ada9404 and aca9c3f.

📒 Files selected for processing (2)

• rust/crates/adc-backend-apisix/src/validator.rs
• rust/crates/adc-backend-apisix/tests/e2e_validate.rs

Included review availability: 4 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

---

📝 Walkthrough

Walkthrough

The APISIX validator now serializes validation resources as JSON, includes upstreams, and maps consumer credentials to parent-derived IDs. Tests cover valid and invalid upstream and credential configurations.

Changes

APISIX validation

Layer / File(s)	Summary
Validation payload construction rust/crates/adc-backend-apisix/src/validator.rs	Consumer payloads use JSON values. Upstreams are indexed by event resource ID. Consumer credentials require a parent and use <parent>/credentials/<credential> IDs. Consumer groups and internal stream services remain excluded.
End-to-end validation coverage rust/crates/adc-backend-apisix/tests/e2e_validate.rs	Ignored APISIX 3.17+ tests cover valid and invalid named upstreams and consumer credentials. Invalid-resource errors identify the corresponding resource and event.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to aca9c

The new validation payload paths include upstreams and consumer credentials with matching resource identifiers, with no actionable merge risk identified.

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Security Check	❌ Error	Category 1 — CRITICAL: Sensitive Data Exposure in Logs & Responses. rust/crates/adc-backend-apisix/src/validator.rs:209-216 now converts each ConsumerCredential into plugins and serializes it in…	Keep the complete credential payload on the HTTPS request to APISIX so validation can inspect it, but prevent it from entering logs. Add a sensitive-request path or redaction hook to HttpClient and redact credential/plugin secret values, …

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding APISIX validation for upstreams and credentials.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
E2e Test Quality Review	✅ Passed	PASS. The added tests are real E2E tests. They call Validator::validate, which sends requests to APISIX's /apisix/admin/configs/validate endpoint through the live HTTP client. CI runs the ignored …

Full details: Security Check

Explanation

Category 1 — CRITICAL: Sensitive Data Exposure in Logs & Responses. rust/crates/adc-backend-apisix/src/validator.rs:209-216 now converts each ConsumerCredential into plugins and serializes it into the validation request. rust/crates/adc-backend-apisix/src/transformer.rs:581-593 places the credential config into that plugin map, and the plugin map accepts arbitrary JSON values. The base revision skipped credentials, so this exposure is introduced by the pull request. The shared client records the complete request body at rust/crates/adc-backend-core/src/client.rs:168-190 when debug tracing is enabled. The CLI formatter prints that body without redaction at rust/crates/adc-cli/src/logging/http_debug.rs:92-108. Therefore API keys and other credential values can appear in --verbose 2 output. No issues found in Category 2 (no database persistence changes), Category 3 (no mutating endpoint or permission change), Category 4 (the new credential path requires a parent ID), Category 5 (no TLS configuration change), Category 6 (no shared-resource mutation), or Category 7 (the changed code does not introduce a connection using an unresolved secret reference).

Resolution

Keep the complete credential payload on the HTTPS request to APISIX so validation can inspect it, but prevent it from entering logs. Add a sensitive-request path or redaction hook to HttpClient and redact credential/plugin secret values, or disable request-body capture for /apisix/admin/configs/validate. Apply the protection before request_body is recorded and add a test with a sentinel credential value that verifies verbose tracing does not emit the value.

• Fix all pre-merge checks with AI

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch bzp/feat-apisix-validate-upstreams-credentials

---

_{Comment @coderabbitai help to get the list of available commands.}