$ show stoplightio/prism
Stoplight Prism is an open-source HTTP mock server and validation proxy driven by OpenAPI specifications (v2, v3, v3.1) and Postman Collections. It provides two primary CLI commands: `prism mock` to simulate an API from a schema definition, and `prism proxy` to validate requests and responses against a spec while forwarding traffic to a real upstream. The architecture is a monorepo with four packages (`core`, `http`, `http-server`, `cli`) that implement a functional pipeline: route matching, input validation (body, headers, query/path parameters, security), content negotiation, and response generation (static examples or dynamic faker-generated data). It also supports callback mocking, CORS handling, and RFC 7807 problem detail errors. The codebase is written in TypeScript with heavy use of fp-ts for composable error handling and dependency injection via reader monads. While the project is mature and well-tested (unit, integration, and a text-based harness test suite), its tight coupling to Stoplight internal packages and the steep learning curve of fp-ts reduce its overall reusability for external projects. It is not a data research repository.
The LLM identified 4 files worth highlighting for reuse:
Implements RFC-compliant content negotiation for HTTP responses: selects the best status code, media type, and example based on client preferences (Accept header, quality values, Prefer header). Uses `fp-ts` Option and Either to handle missing matches gracefully. The logic is isolated from response generation and could be extracted as a standalone content negotiation library for any API tool that needs to pick from a list of media types or examples.
A collection of serializers for OpenAPI 3 parameter styles (deepObject, delimited, form, label, matrix, simple). Each file is self-contained, takes a parameter value and configuration, and returns the serialized string. These are used for generating dynamic responses with correct encoding. The modular design allows any project needing OpenAPI-compliant parameter serialization to reuse them with minimal adaptation, and they demonstrate careful handling of edge cases like exploded vs. non-exploded arrays.
A set of handler modules for validating different security schemes (apiKey, basicAuth, bearer, digest, oauth2, openIdConnect). Each handler exports a well-defined function that inspects a request for the required credentials and returns a validation result. This plugin-like architecture makes it easy to add new authentication types and is reusable in any HTTP validation context (not just Prism). The code demonstrates clean separation of concerns and thorough handling of edge cases.
Implements the routing engine that matches incoming HTTP requests to the correct OpenAPI operation based on method, path (with path parameters), and server base URL. It handles disambiguation when multiple operations match (e.g., concrete vs. parameterized paths, colon-delimited parameters). The logic is self-contained, imports only external types and utilities, and could be extracted as a general OpenAPI router for other API tools or servers.