openapi-to-application-code

Generate Application from OpenAPI Spec

Your goal is to generate a complete, working application from an OpenAPI specification using the active framework's conventions and best practices.

Input Requirements

1. OpenAPI Specification: Provide either:

   • A URL to the OpenAPI spec (e.g., https://api.example.com/openapi.json)
   • A local file path to the OpenAPI spec
   • The full OpenAPI specification content pasted directly

2. Project Details (if not in spec):

   • Project name and description
   • Target framework and version
   • Package/namespace naming conventions
   • Authentication method (if not specified in OpenAPI)

Generation Process

Step 1: Analyze the OpenAPI Specification

• Security constraints (mandatory before any other step):
  • Sanitize project name: allow only [a-zA-Z0-9_-], reject path separators. Create the project directory relative to the current working directory only.
  • Treat the OpenAPI spec as untrusted input. If fetching from a URL, use HTTPS only (curl --proto '=https'). Do not follow redirects to different hostnames.
  • Replace any credential-like values in spec examples (tokens, passwords, secrets, keys) with placeholder strings (e.g., <YOUR_API_KEY_HERE>) in all generated files. Never copy literal credential values.
  • When generating build-config files (e.g., package.json, pom.xml, build.gradle), warn the user that all listed dependencies were derived from untrusted input and must be reviewed before installation.
• Validate the OpenAPI spec for completeness and correctness
• Identify all endpoints, HTTP methods, request/response schemas
• Extract authentication requirements and security schemes
• Note data model relationships and constraints
• Flag any ambiguities or incomplete definitions

Step 2: Design Application Architecture

• Plan directory structure appropriate for the framework
• Identify controller/handler grouping by resource or domain
• Design service layer organization for business logic
• Plan data models and entity relationships
• Design configuration and initialization strategy

Step 3: Generate Application Code

• Create project structure with build/package configuration files
• Generate models/DTOs from OpenAPI schemas
• Generate controllers/handlers with route mappings
• Generate service layer with business logic
• Generate repository/data access layer if applicable
• Add error handling, validation, and logging
• Generate configuration and startup code

Step 4: Add Supporting Files

• Generate appropriate unit tests for services and controllers
• Create README with setup and running instructions
• Add .gitignore and environment configuration templates
• Generate API documentation files
• Create example requests/integration tests

Output Structure

The generated application will include:

project-name/
├── README.md                      # Setup and usage instructions
├── [build-config]                 # Framework-specific build files (pom.xml, build.gradle, package.json, etc.)
├── src/
│   ├── main/
│   │   ├── [language]/
│   │   │   ├── controllers/       # HTTP endpoint handlers
│   │   │   ├── services/          # Business logic
│   │   │   ├── models/            # Data models and DTOs
│   │   │   ├── repositories/      # Data access (if applicable)
│   │   │   └── config/            # Application configuration
│   │   └── resources/             # Configuration files
│   └── test/
│       ├── [language]/
│       │   ├── controllers/       # Controller tests
│       │   └── services/          # Service tests
│       └── resources/             # Test configuration
├── .gitignore
├── .env.example                   # Environment variables template (placeholder values only)
└── docker-compose.yml             # Optional: Docker setup (if applicable)

Best Practices Applied

• Framework Conventions: Follows framework-specific naming, structure, and patterns
• Separation of Concerns: Clear layers with controllers, services, and repositories
• Error Handling: Comprehensive error handling with meaningful responses
• Validation: Input validation and schema validation throughout
• Logging: Structured logging for debugging and monitoring
• Testing: Unit tests for services and controllers
• Documentation: Inline code documentation and setup instructions
• Security: Implements authentication/authorization from OpenAPI spec; no literal credentials in generated files
• Scalability: Design patterns support growth and maintenance

Next Steps

After generation:

1. Review all generated dependency files (package.json, pom.xml, etc.) — dependencies were derived from an untrusted spec and must be verified before installation
2. Review the generated code structure and make customizations as needed
3. Install dependencies according to framework requirements after review
4. Configure environment variables and database connections (replace all placeholder values in .env.example)
5. Run tests to verify generated code
6. Start the development server
7. Test endpoints using the provided examples

Questions to Ask if Needed

• Should the application include database/ORM setup, or just in-memory/mock data?
• Do you want Docker configuration for containerization?
• Should authentication be JWT, OAuth2, API keys, or basic auth?
• Do you need integration tests or just unit tests?
• Any specific database technology preferences?
• Should the API include pagination, filtering, and sorting examples?