fix: warn on incompatible response

[j-zimnowoda]

This pull request introduces improved error handling for response validation in the application. The main change is the addition of a custom handler for response validation errors, which logs warnings when a response does not conform to the defined schema, instead of returning HTTP 500 error.

Warning example:

2026-07-23T09:23:57.027Z otomi:api:v1:settings getSettings(obj,obj)
Response body fails validation:  InternalServerError [Internal Server Error]: /response/obj/provider/type must be equal to one of the allowed values: disabled, /response/obj/provider must have required property 'linode', /response/obj/provider must match exactly one schema in oneOf
    at ResponseValidator._validate (/app/node_modules/express-openapi-validator/dist/middlewares/openapi.response.validator.js:153:19)
    at /app/node_modules/express-openapi-validator/dist/middlewares/openapi.response.validator.js:43:33
    at ServerResponse.json_hook (/app/node_modules/express-openapi-validator/dist/framework/modded.express.mung.js:35:24)
    at getSettings (/app/dist/src/api/v1/settings.js:19:9) {
  status: 500,
  path: '/v1/settings?ids=obj&ids=obj',
  headers: undefined,
  errors: [
    {
      path: '/response/obj/provider/type',
      message: 'must be equal to one of the allowed values: disabled',
      errorCode: 'enum.openapi.validation'
    },
    {
      path: '/response/obj/provider/linode',
      message: "must have required property 'linode'",
      errorCode: 'required.openapi.validation'
    },
    {
      path: '/response/obj/provider',
      message: 'must match exactly one schema in oneOf',
      errorCode: 'oneOf.openapi.validation'
    }
  ]
} GET

[Copilot]

Pull request overview

Adds a response-validation error hook to the Express OpenAPI validator setup so the service logs a warning when outgoing responses don’t match the OpenAPI schema (“incompatible response”).

Changes:

• Introduces validateResponseError middleware helper to warn on response validation failures.
• Wires validateResponseError into OpenApiValidator.middleware({ validateResponses: { onError } }).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/middleware/error.ts	Adds a response-validation onError handler that logs a warning.
src/app.ts	Registers the new onError handler under validateResponses.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

src/middleware/error.ts:13

• Avoid importing InternalServerError from the package’s internal dist/... path and typing the callback error that narrowly. Internal subpath imports can break with package export maps / version changes, and a too-specific parameter type can make the onError callback fail TypeScript assignment if the library passes a different error shape. Prefer a stable/public type (or unknown) and drop the deep import; also consider logging URL for easier diagnostics.

import { debug, error, warn } from 'console'
import { Request, Response } from 'express'
import { InternalServerError } from 'express-openapi-validator/dist/openapi.validator'
import { HttpError, OtomiError } from 'src/error'
import { OpenApiRequest } from 'src/otomi-models'
import { cleanEnv } from 'src/validators'
import { cleanSession } from './session'

const env = cleanEnv({})

export function validateResponseError(err: InternalServerError, body: any, req: Request): void {
  warn(`Response body fails validation: `, err, req.method)
  return

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

src/middleware/error.ts:13

• validateResponseError has a redundant return, uses any types (loses type-safety), and the warning log only includes the HTTP method (no URL/path), which makes it hard to identify which endpoint produced the invalid response. Consider typing inputs as unknown, removing the redundant return, and including req.originalUrl (or req.path) in the log output.

export function validateResponseError(err: any, _body: any, req: Request): void {
  warn(`Response body fails validation: `, err, req.method)
  return