Support query string parameters in CrudApiPlugin actions

Split action URLs into path and query parts at the '?' delimiter. Query
parameters are matched individually and order-independently via
HttpUtility.ParseQueryString; values may be literal (exact match) or {param}
placeholders. A parameter can be declared multiple times in the action URL
(e.g. ?id={id1}&id={id2}) to capture repeated query parameters, bound
positionally for use in the action's JSONPath query.

Author: garrytrinder

DevProxy.Plugins/Mocking/CrudApiPlugin.cs

@@ -19,6 +19,7 @@
 using System.Security.Claims;
 using System.Text.Json.Serialization;
 using System.Text.RegularExpressions;
+using System.Web;
 using Titanium.Web.Proxy.EventArguments;
 using Titanium.Web.Proxy.Http;
 using Titanium.Web.Proxy.Models;
@@ -246,6 +247,7 @@ private async Task SetupOpenIdConnectConfigurationAsync()
         });
 
         var requestUrlWithoutQuery = request.RequestUri.GetLeftPart(UriPartial.Path);
+        var requestQuery = request.RequestUri.Query;
         var parameters = new Dictionary<string, string>();
         var action = Configuration.Actions.FirstOrDefault(action =>
         {
@@ -256,33 +258,94 @@ private async Task SetupOpenIdConnectConfigurationAsync()
 
             var absoluteActionUrl = (Configuration.BaseUrl + action.Url).Replace("//", "/", 8);
 
-            if (absoluteActionUrl == requestUrlWithoutQuery)
+            // split action URL into path and query parts
+            string actionPath;
+            string? actionQuery = null;
+            var queryIndex = absoluteActionUrl.IndexOf('?', StringComparison.OrdinalIgnoreCase);
+            if (queryIndex >= 0)
             {
-                return true;
+                actionPath = absoluteActionUrl[..queryIndex];
+                actionQuery = absoluteActionUrl[queryIndex..];
+            }
+            else
+            {
+                actionPath = absoluteActionUrl;
             }
 
-            // check if the action contains parameters
-            // if it doesn't, it's not a match for the current request for sure
-            if (!absoluteActionUrl.Contains('{', StringComparison.OrdinalIgnoreCase))
+            // match the path part
+            var pathMatched = false;
+            if (actionPath == requestUrlWithoutQuery)
             {
-                return false;
+                pathMatched = true;
+            }
+            else if (actionPath.Contains('{', StringComparison.OrdinalIgnoreCase))
+            {
+                var pathRegex = Regex.Replace(Regex.Escape(actionPath).Replace("\\{", "{", StringComparison.OrdinalIgnoreCase), "({[^}]+})", parameterMatchEvaluator);
+                var pathMatch = Regex.Match(requestUrlWithoutQuery, pathRegex);
+                if (pathMatch.Success)
+                {
+                    pathMatched = true;
+                    foreach (var groupName in pathMatch.Groups.Keys)
+                    {
+                        if (groupName == "0")
+                        {
+                            continue;
+                        }
+                        parameters[groupName] = Uri.UnescapeDataString(pathMatch.Groups[groupName].Value);
+                    }
+                }
             }
 
-            // convert parameters into named regex groups
-            var urlRegex = Regex.Replace(Regex.Escape(absoluteActionUrl).Replace("\\{", "{", StringComparison.OrdinalIgnoreCase), "({[^}]+})", parameterMatchEvaluator);
-            var match = Regex.Match(requestUrlWithoutQuery, urlRegex);
-            if (!match.Success)
+            if (!pathMatched)
             {
                 return false;
             }
 
-            foreach (var groupName in match.Groups.Keys)
+            // if the action has no query string definition, it's a match
+            if (string.IsNullOrEmpty(actionQuery))
+            {
+                return true;
+            }
+
+            // match query string parameters individually (order-independent)
+            var actionQueryParams = HttpUtility.ParseQueryString(actionQuery.TrimStart('?'));
+            var requestQueryParams = HttpUtility.ParseQueryString(requestQuery.TrimStart('?'));
+
+            foreach (string? key in actionQueryParams.AllKeys)
             {
-                if (groupName == "0")
+                if (key is null)
                 {
                     continue;
                 }
-                parameters.Add(groupName, Uri.UnescapeDataString(match.Groups[groupName].Value));
+
+                // a key can be declared multiple times in the action (e.g. ?id={id1}&id={id2})
+                // and supplied multiple times in the request (e.g. ?id=1&id=2); pair them by position
+                var actionValues = actionQueryParams.GetValues(key) ?? [];
+                var requestValues = requestQueryParams.GetValues(key);
+
+                if (requestValues is null)
+                {
+                    return false;
+                }
+
+                for (var i = 0; i < actionValues.Length; i++)
+                {
+                    // check if the declared value is a parameter pattern like {param}
+                    var paramMatch = Regex.Match(actionValues[i], "^{([^}]+)}$");
+                    if (paramMatch.Success)
+                    {
+                        // bind the i-th declared placeholder to the i-th supplied value
+                        if (i < requestValues.Length)
+                        {
+                            var paramName = paramMatch.Groups[1].Value.Replace('-', '_');
+                            parameters[paramName] = requestValues[i] ?? string.Empty;
+                        }
+                    }
+                    else if (!requestValues.Contains(actionValues[i], StringComparer.Ordinal))
+                    {
+                        return false;
+                    }
+                }
             }
             return true;
         });
@@ -541,8 +604,8 @@ private void GetOne(SessionEventArgs e, CrudApiAction action, IDictionary<string
     {
         try
         {
-            var item = _data?.SelectToken(ReplaceParams(action.Query, parameters));
-            if (item is null)
+            if (!TryReplaceParams(action.Query, parameters, out var query) ||
+                _data?.SelectToken(query) is not JToken item)
             {
                 SendNotFoundResponse(e);
                 Logger.LogRequest($"404 {action.Url}", MessageType.Mocked, new LoggingContext(e));
@@ -563,7 +626,15 @@ private void GetMany(SessionEventArgs e, CrudApiAction action, IDictionary<strin
     {
         try
         {
-            var items = (_data?.SelectTokens(ReplaceParams(action.Query, parameters))) ?? [];
+            // an action may reference more indexed values than were supplied
+            // (e.g. {id2} with a single id); treat that as no matches
+            if (!TryReplaceParams(action.Query, parameters, out var query))
+            {
+                SendJsonResponse("[]", HttpStatusCode.OK, e);
+                Logger.LogRequest($"200 {action.Url}", MessageType.Mocked, new LoggingContext(e));
+                return;
+            }
+            var items = _data?.SelectTokens(query) ?? [];
             SendJsonResponse(JsonConvert.SerializeObject(items, Formatting.Indented), HttpStatusCode.OK, e);
             Logger.LogRequest($"200 {action.Url}", MessageType.Mocked, new LoggingContext(e));
         }
@@ -594,8 +665,8 @@ private void Merge(SessionEventArgs e, CrudApiAction action, IDictionary<string,
     {
         try
         {
-            var item = _data?.SelectToken(ReplaceParams(action.Query, parameters));
-            if (item is null)
+            if (!TryReplaceParams(action.Query, parameters, out var query) ||
+                _data?.SelectToken(query) is not JToken item)
             {
                 SendNotFoundResponse(e);
                 Logger.LogRequest($"404 {action.Url}", MessageType.Mocked, new LoggingContext(e));
@@ -617,8 +688,8 @@ private void Update(SessionEventArgs e, CrudApiAction action, IDictionary<string
     {
         try
         {
-            var item = _data?.SelectToken(ReplaceParams(action.Query, parameters));
-            if (item is null)
+            if (!TryReplaceParams(action.Query, parameters, out var query) ||
+                _data?.SelectToken(query) is not JToken item)
             {
                 SendNotFoundResponse(e);
                 Logger.LogRequest($"404 {action.Url}", MessageType.Mocked, new LoggingContext(e));
@@ -640,8 +711,8 @@ private void Delete(SessionEventArgs e, CrudApiAction action, IDictionary<string
     {
         try
         {
-            var item = _data?.SelectToken(ReplaceParams(action.Query, parameters));
-            if (item is null)
+            if (!TryReplaceParams(action.Query, parameters, out var query) ||
+                _data?.SelectToken(query) is not JToken item)
             {
                 SendNotFoundResponse(e);
                 Logger.LogRequest($"404 {action.Url}", MessageType.Mocked, new LoggingContext(e));
@@ -676,17 +747,19 @@ private static bool HasPermission(string permission, string permissionString)
         return permissions.Contains(permission, StringComparer.OrdinalIgnoreCase);
     }
 
-    private static string ReplaceParams(string query, IDictionary<string, string> parameters)
+    private static bool TryReplaceParams(string query, IDictionary<string, string> parameters, out string result)
     {
-        var result = Regex.Replace(query, "{([^}]+)}", new MatchEvaluator(m =>
+        result = Regex.Replace(query, "{([^}]+)}", new MatchEvaluator(m =>
         {
             return $"{{{m.Groups[1].Value.Replace('-', '_')}}}";
         }));
         foreach (var param in parameters)
         {
             result = result.Replace($"{{{param.Key}}}", param.Value, StringComparison.OrdinalIgnoreCase);
         }
-        return result;
+        // report unresolved placeholders (e.g. an action referencing {id2} when only one
+        // value was supplied) so callers can treat it as no match instead of failing
+        return !Regex.IsMatch(result, "{[^}]+}");
     }
 
     protected override void Dispose(bool disposing)