[rust-salvo] Add Rust server generator targeting the Salvo web framework

[AuroraMaster]

What this PR does

Adds a new rust-salvo server generator that mirrors the rust-axum baseline (security, schema composition, parameter / wire format coverage) but targets the Salvo web framework.

Closes #23771.

Highlights

• Handlers use #[salvo::oapi::endpoint] plus the typed extractors from salvo::oapi::extract (JsonBody<T>, PathParam<T>, QueryParam<T, REQUIRED>, HeaderParam<T, REQUIRED>, FormBody<T>).
• Models derive salvo::oapi::ToSchema so they flow through the extractors and surface in the generated OpenAPI doc.
• Routes use the modern {name} path syntax (Salvo >= 0.76), driven by a salvoRoutes bundle populated in postProcessSupportingFileData.
• Auth middleware (ApiKeyAuth / BasicAuth / BearerAuth) is scaffolded from the spec's securitySchemes when enableAuthMiddleware=true. CORS and request validation are gated by enableCorsMiddleware / enableRequestValidation.
• Cargo deps pinned to current stable: salvo 0.93, validator 0.20, base64 0.22.

Validation

• RustSalvoServerCodegenTest: 7/7 pass.
• Generated petstore (bin/configs/manual/rust-salvo-petstore.yaml) and all three test specs compile with cargo check cleanly on Salvo 0.93 (0 errors, 0 warnings).
• docs/generators/rust-salvo.md auto-exported via bin/utils/export_generator.sh; declared feature set matches rust-axum (allOf / anyOf / oneOf, JSON, ApiKey + Basic + Bearer).
• Forbiddenapis check passes locally on modules/openapi-generator.

cc Rust technical committee: @frol @farcaller @richardwhiuk @paladinzh @jacob-pro @dsteeley

PR checklist

• Read the contribution guidelines.
• Pull Request title clearly describes the work and the description provides validation details.
• ./mvnw clean package, ./bin/generate-samples.sh ./bin/configs/manual/rust-salvo-petstore.yaml, and ./bin/utils/export_generator.sh rust-salvo all run cleanly; generated artifacts are committed.
• Filed against master.
• References the tracking issue ([REQ] [rust-salvo] New server generator targeting the Salvo web framework #23771).

---

Summary by cubic

Adds a new rust-salvo server generator targeting Salvo 0.93 with near-parity to rust-axum. It scaffolds per-tag handlers, models, routes, and optional auth/CORS/validation, plus docs, tests, and a petstore sample that builds cleanly.

• New Features

  • Generates handlers (grouped by tag), models, routes, and optional middleware for Salvo 0.93.
  • Uses #[salvo::oapi::endpoint] with typed extractors: JsonBody<T>, PathParam<T>, QueryParam<T, REQUIRED>, HeaderParam<T, REQUIRED>, FormBody<T>.
  • Models derive salvo::oapi::ToSchema; fields add #[serde(rename = "...")] to preserve wire names.
  • Modern route paths keep {name} syntax; auth attached per operation via route .hoop(...).
  • Endpoint security emits one entry per scheme (OR semantics) and preserves OAuth2 scopes; Basic and Bearer split into separate middleware types/factories with case-insensitive Authorization parsing.
  • Flags: enableAuthMiddleware, enableCorsMiddleware, enableRequestValidation, enableResponseValidation; supports JSON, ApiKey/Basic/Bearer auth, and allOf/anyOf/oneOf.
  • Registered in SPI; docs added (docs/generators/rust-salvo.md); tests cover basic/auth/validation; petstore sample passes cargo check; CI adds a dedicated rust-salvo build job.

• Dependencies

  • salvo 0.93 (features: oapi, cors, jwt-auth, serve-static).
  • validator 0.20 (with request validation), base64 0.22, tokio 1, async-trait, chrono, serde, serde_json, tracing, tracing-subscriber.
  • Optional uuid 1 when UUIDs are used.

^{Written for commit e488d1f. Summary will update on new commits.}

[cubic-dev-ai]

6 issues found across 34 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="modules/openapi-generator/src/main/resources/rust-salvo/handlers.mustache">

<violation number="1" location="modules/openapi-generator/src/main/resources/rust-salvo/handlers.mustache:30">
P2: Multiple auth schemes are collapsed into one security requirement, so alternative auth methods become combined (AND) instead of remaining alternatives (OR).</violation>
</file>

<file name="modules/openapi-generator/src/test/resources/3_0/rust/rust-salvo-auth-test.yaml">

<violation number="1" location="modules/openapi-generator/src/test/resources/3_0/rust/rust-salvo-auth-test.yaml:64">
P2: Auth fixture omits BasicAuth, so the rust-salvo middleware test never exercises the basic-auth path it expects.</violation>
</file>

<file name="modules/openapi-generator/src/main/resources/rust-salvo/lib.mustache">

<violation number="1" location="modules/openapi-generator/src/main/resources/rust-salvo/lib.mustache:48">
P1: Auth is installed as a global service hoop, so it runs on every request and can block public operations because the generated middleware is not operation-aware.</violation>
</file>

<file name="samples/server/petstore/rust-salvo/output/petstore/src/models.rs">

<violation number="1" location="samples/server/petstore/rust-salvo/output/petstore/src/models.rs:72">
P1: Missing serde rename attributes cause JSON wire names to drift from OpenAPI camelCase to Rust snake_case, breaking API contract interoperability. For example, `pet_id` serializes as `pet_id` instead of `petId`, `ship_date` instead of `shipDate`, and `photo_urls` instead of `photoUrls`. The codegen templates should emit `#[serde(rename = "...")]` (or a struct-level `#[serde(rename_all = "camelCase")]` if all fields follow that convention) to preserve the original OpenAPI field names.</violation>
</file>

<file name="modules/openapi-generator/src/main/resources/rust-salvo/middleware.mustache">

<violation number="1" location="modules/openapi-generator/src/main/resources/rust-salvo/middleware.mustache:78">
P2: Authentication scheme parsing is case-sensitive, so valid Basic/Bearer `Authorization` headers with different casing will be rejected.</violation>
</file>

<file name="samples/server/petstore/rust-salvo/output/petstore/README.md">

<violation number="1" location="samples/server/petstore/rust-salvo/output/petstore/README.md:65">
P3: The generated README leaves the API endpoints section empty instead of listing the server routes.</violation>
</file>

_{Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.}

[wing328]

please add the new sample folder to the workflow: https://github.com/OpenAPITools/openapi-generator/blob/master/.github/workflows/samples-rust-server.yaml so that CI will test it moving forward

[cubic-dev-ai]

1 issue found across 20 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="samples/server/petstore/rust-salvo/output/petstore/src/handlers/pet.rs">

<violation number="1" location="samples/server/petstore/rust-salvo/output/petstore/src/handlers/pet.rs:27">
P1: OAuth2 scope requirements are dropped in generated Salvo endpoint annotations, using empty scope arrays instead of the scopes defined in the source OpenAPI spec.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[wing328]

Thanks for the PR but your commit (as shown in the Commits tab) is not linked to your Github account, which means this PR won't count as your contribution in https://github.com/OpenAPITools/openapi-generator/graphs/contributors.

Let me know if you need help fixing it.

Ref: https://github.com/OpenAPITools/openapi-generator/wiki/FAQ#how-can-i-update-commits-that-are-not-linked-to-my-github-account

[AuroraMaster]

Thanks for flagging this — rebased the branch to attribute all commits to my GitHub noreply email (45430047+AuroraMaster@users.noreply.github.com). The Commits tab should now show them linked to my account. Also wired the new samples/server/petstore/rust-salvo/ into samples-rust-server.yaml (separate build-salvo job since it ships as a single crate rather than the output/* layout used by rust-server/rust-axum).

[wing328]

i think we need to add the new folder here as well