Petstore API from its OpenAPI spec

Build the Swagger Petstore API in this empty folder and deploy it to Volcano.

The spec is https://petstore3.swagger.io/api/v3/openapi.json. I will import that same spec into Insomnia and point it at your URL, so match its paths, parameters, JSON shapes and status codes exactly, under the spec's /api/v3 prefix.

- Implement the pet operations: POST /pet, PUT /pet, GET /pet/findByStatus, GET /pet/findByTags, GET /pet/{petId}, POST /pet/{petId} (name and status as query parameters) and DELETE /pet/{petId}. Leave out uploadImage, store and user. JSON only.
- Store pets in a Postgres table on Volcano. Pet ids are integers the database assigns. Seed five or six pets with a mix of statuses, so the first GET returns rows.
- Serve it from one public Volcano Function in HTTP mode, with http_auth_mode none, so GET requests work with no Authorization header.
- Reads are public. POST, PUT and DELETE need "Authorization: Bearer <access token>" from a Volcano email and password sign-in; without a valid token answer 401.
- Writes need a registered email-and-password user, never an anonymous session: answer 401 to an anonymous session's token, and make the write policies refuse it too.
- A pet belongs to the user who created it. Only that user can update or delete it: answer 403 when the pet exists but belongs to someone else. Enforce this with row-level security, so the database refuses another user's change even if the function code is wrong. Run writes as the signed-in user, never with a full-access connection. Seeded pets belong to no one.
- Refuse bad input with 400 or 422 before touching the database: name at most 100 characters, at most 10 photoUrls and 10 tags, status one of available, pending, sold. Allow at most 100 pets per user, enforced in the database.

Create a new Volcano project named petstore-api, deploy to production and give me the base URL to put in Insomnia (ending in /api/v3), plus the exact sign-in request that returns a token. Before you finish, test the live API: GET /pet/findByStatus?status=available with no header returns seeded pets; POST /pet with no token gets 401; sign up two throwaway users; user A creates a pet; user B can't update or delete it (and it is unchanged afterwards); user A can.

# volcano/volcano-config.yaml
version: 1
functions:
  - name: petstore
    visibility: public
    invocation_mode: http
    http_auth_mode: none

CREATE TABLE IF NOT EXISTS pets (
    id BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
    name TEXT NOT NULL CHECK (char_length(name) BETWEEN 1 AND 100),
    category JSONB,
    photo_urls JSONB NOT NULL DEFAULT '[]'::jsonb,
    tags JSONB NOT NULL DEFAULT '[]'::jsonb,
    status TEXT CHECK (status IS NULL OR status IN ('available', 'pending', 'sold')),
    owner_id UUID DEFAULT auth.uid(),
    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);
ALTER TABLE pets ENABLE ROW LEVEL SECURITY;
GRANT SELECT ON pets TO anon;
GRANT SELECT, INSERT, UPDATE, DELETE ON pets TO authenticated;
DROP POLICY IF EXISTS pets_select_all ON pets;
CREATE POLICY pets_select_all ON pets FOR SELECT USING (true);
DROP POLICY IF EXISTS pets_insert_own ON pets;
CREATE POLICY pets_insert_own ON pets FOR INSERT
  WITH CHECK (auth.role() = 'authenticated' AND owner_id = auth.uid());
DROP POLICY IF EXISTS pets_update_own ON pets;
CREATE POLICY pets_update_own ON pets FOR UPDATE
  USING (auth.role() = 'authenticated' AND owner_id = auth.uid())
  WITH CHECK (auth.role() = 'authenticated' AND owner_id = auth.uid());
DROP POLICY IF EXISTS pets_delete_own ON pets;
CREATE POLICY pets_delete_own ON pets FOR DELETE
  USING (auth.role() = 'authenticated' AND owner_id = auth.uid());

const res = await fetch(`${API_URL}/auth/user`, { headers: { Authorization: `Bearer ${token}` } });
if (!res.ok) return unauthorized();
// The token is valid, so its claims can be read. An anonymous session's role is "anonymous".
const { role } = JSON.parse(Buffer.from(token.split(".")[1], "base64url").toString());
if (role !== "authenticated") return unauthorized();

await fetch(`${API_URL}/databases/app/query/update`, {
  method: "POST",
  headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
  body: JSON.stringify({ table: "pets", values, filters: [{ column: "id", operator: "eq", value: id }] }),
});

const url = new URL(process.env.DATABASE_READ_URL);
url.searchParams.set("application_name", "volcano_user_access"); // anon role, RLS on
const pool = new Pool({ connectionString: url.toString() });

volcano init javascript
volcano projects create petstore-api
volcano use petstore-api
volcano cloud databases create app --region us-east-1 --pg-version 16
volcano cloud databases get app --show-connection-string   # volcano_full_access -> volcano_user_access, then DATABASE_READ_URL
volcano cloud deploy --env-file volcano/cloud.env --with-migrations -d app
volcano cloud functions get petstore   # base URL: invoke_url + api/v3