fix(openapi): validate response serialization when falsy

Author: anafalcao

aws_lambda_powertools/event_handler/middlewares/openapi_validation.py

@@ -136,67 +136,47 @@ def handler(self, app: EventHandlerInstance, next_middleware: NextMiddleware) ->
             return self._handle_response(route=route, response=response)
 
     def _handle_response(self, *, route: Route, response: Response):
-        # Process the response body if it exists
-        if response.body:
-            # Validate and serialize the response, if it's JSON
-            if response.is_json():
+        # Check if we have a return type defined
+        if route.dependant.return_param:
+            try:
+                # Validate all responses, including None
                 response.body = self._serialize_response(
                     field=route.dependant.return_param,
                     response_content=response.body,
                 )
+            except RequestValidationError as e:
+                logger.error(f"Response validation failed: {str(e)}")
+                response.status_code = 422
+                response.body = {"detail": e.errors()}
 
         return response
 
     def _serialize_response(
         self,
         *,
-        field: ModelField | None = None,
+        field: Any = None,
         response_content: Any,
         include: IncEx | None = None,
         exclude: IncEx | None = None,
-        by_alias: bool = True,
+        by_alias: bool = False,
         exclude_unset: bool = False,
         exclude_defaults: bool = False,
         exclude_none: bool = False,
     ) -> Any:
-        """
-        Serialize the response content according to the field type.
-        """
         if field:
             errors: list[dict[str, Any]] = []
-            # MAINTENANCE: remove this when we drop pydantic v1
-            if not hasattr(field, "serializable"):
-                response_content = self._prepare_response_content(
-                    response_content,
-                    exclude_unset=exclude_unset,
-                    exclude_defaults=exclude_defaults,
-                    exclude_none=exclude_none,
-                )
-
             value = _validate_field(field=field, value=response_content, loc=("response",), existing_errors=errors)
             if errors:
                 raise RequestValidationError(errors=_normalize_errors(errors), body=response_content)
 
-            if hasattr(field, "serialize"):
-                return field.serialize(
-                    value,
-                    include=include,
-                    exclude=exclude,
-                    by_alias=by_alias,
-                    exclude_unset=exclude_unset,
-                    exclude_defaults=exclude_defaults,
-                    exclude_none=exclude_none,
-                )
-
-            return jsonable_encoder(
+            return field.serialize(
                 value,
                 include=include,
                 exclude=exclude,
                 by_alias=by_alias,
                 exclude_unset=exclude_unset,
                 exclude_defaults=exclude_defaults,
                 exclude_none=exclude_none,
-                custom_serializer=self._validation_serializer,
             )
         else:
             # Just serialize the response content returned from the handler

tests/functional/event_handler/_pydantic/test_openapi_validation_middleware.py

@@ -1128,3 +1128,47 @@ def handler(user_id: int = 123):
     # THEN the handler should be invoked and return 200
     result = app(minimal_event, {})
     assert result["statusCode"] == 200
+
+
+def test_validate_optional_return_types(gw_event):
+    # GIVEN an APIGatewayRestResolver with validation enabled
+    app = APIGatewayRestResolver(enable_validation=True)
+
+    class Model(BaseModel):
+        name: str
+        age: int
+
+    # AND handlers defined with different Optional return types
+    @app.get("/none_not_allowed")
+    def handler_none_not_allowed() -> Model:
+        return None  # type: ignore
+
+    @app.get("/none_allowed")
+    def handler_none_allowed() -> Optional[Model]:
+        return None
+
+    @app.get("/valid_optional")
+    def handler_valid_optional() -> Optional[Model]:
+        return Model(name="John", age=30)
+
+    # WHEN returning None for a non-Optional type
+    gw_event["path"] = "/none_not_allowed"
+    result = app(gw_event, {})
+    # THEN it should return a validation error
+    assert result["statusCode"] == 422
+    body = json.loads(result["body"])
+    assert "model_attributes_type" in body["detail"][0]["type"]
+
+    # WHEN returning None for an Optional type
+    gw_event["path"] = "/none_allowed"
+    result = app(gw_event, {})
+    # THEN it should succeed
+    assert result["statusCode"] == 200
+    assert result["body"] == "null"
+
+    # WHEN returning a valid model for an Optional type
+    gw_event["path"] = "/valid_optional"
+    result = app(gw_event, {})
+    # THEN it should succeed and return the serialized model
+    assert result["statusCode"] == 200
+    assert json.loads(result["body"]) == {"name": "John", "age": 30}