fix: correct SCIM Swagger try it out URLs (#24779)

coderd/coderdtest/swaggerparser.go

@@ -147,11 +147,33 @@ func parseSwaggerComment(commentGroup *ast.CommentGroup) SwaggerComment {
 	return c
 }
 
-func isExperimentalEndpoint(route string) bool {
-	return strings.HasPrefix(route, "/workspaceagents/me/experimental/")
+// SwaggerOption configures VerifySwaggerDefinitions.
+type SwaggerOption func(*swaggerOptions)
+
+type swaggerOptions struct {
+	routePrefix string
 }
 
-func VerifySwaggerDefinitions(t *testing.T, router chi.Router, swaggerComments []SwaggerComment) {
+// WithSwaggerRoutePrefix prepends the given prefix to every route walked from
+// the chi router. Use this when calling VerifySwaggerDefinitions with a
+// subrouter (for example api.APIHandler at /api/v2) so that routes line up
+// with the absolute paths used in @Router annotations.
+func WithSwaggerRoutePrefix(prefix string) SwaggerOption {
+	return func(o *swaggerOptions) {
+		o.routePrefix = prefix
+	}
+}
+
+func isExperimentalEndpoint(route string) bool {
+	return strings.HasPrefix(route, "/api/v2/workspaceagents/me/experimental/")
+}
+
+func VerifySwaggerDefinitions(t *testing.T, router chi.Router, swaggerComments []SwaggerComment, opts ...SwaggerOption) {
+	cfg := swaggerOptions{}
+	for _, opt := range opts {
+		opt(&cfg)
+	}
+
 	assertUniqueRoutes(t, swaggerComments)
 	assertSingleAnnotations(t, swaggerComments)
 
@@ -161,6 +183,18 @@ func VerifySwaggerDefinitions(t *testing.T, router chi.Router, swaggerComments [
 			route = route[:len(route)-1]
 		}
 
+		// chi.Walk yields routes relative to the router that
+		// VerifySwaggerDefinitions was called with. Prepend the configured
+		// mount prefix so routes match the absolute paths used in @Router
+		// annotations.
+		if cfg.routePrefix != "" {
+			if route == "/" {
+				route = cfg.routePrefix + "/"
+			} else {
+				route = cfg.routePrefix + route
+			}
+		}
+
 		t.Run(method+" "+route, func(t *testing.T) {
 			t.Parallel()
 
@@ -313,14 +347,14 @@ func assertSecurityDefined(t *testing.T, comment SwaggerComment) {
 		"CoderProvisionerKey",
 	}
 
-	if comment.router == "/updatecheck" ||
-		comment.router == "/buildinfo" ||
-		comment.router == "/" ||
-		comment.router == "/auth/scopes" ||
-		comment.router == "/users/login" ||
-		comment.router == "/users/otp/request" ||
-		comment.router == "/users/otp/change-password" ||
-		comment.router == "/init-script/{os}/{arch}" {
+	if comment.router == "/api/v2/updatecheck" ||
+		comment.router == "/api/v2/buildinfo" ||
+		comment.router == "/api/v2/" ||
+		comment.router == "/api/v2/auth/scopes" ||
+		comment.router == "/api/v2/users/login" ||
+		comment.router == "/api/v2/users/otp/request" ||
+		comment.router == "/api/v2/users/otp/change-password" ||
+		comment.router == "/api/v2/init-script/{os}/{arch}" {
 		return // endpoints do not require authorization
 	}
 	assert.Containsf(t, authorizedSecurityTags, comment.security, "@Security must be either of these options: %v", authorizedSecurityTags)
@@ -365,14 +399,14 @@ func assertProduce(t *testing.T, comment SwaggerComment) {
 		assert.True(t, comment.produce != "", "Route must have @Produce annotation as it responds with a model structure")
 		assert.Contains(t, allowedProduceTypes, comment.produce, "@Produce value is limited to specific types: %s", strings.Join(allowedProduceTypes, ","))
 	} else {
-		if (comment.router == "/workspaceagents/me/app-health" && comment.method == "post") ||
-			(comment.router == "/workspaceagents/me/startup" && comment.method == "post") ||
-			(comment.router == "/workspaceagents/me/startup/logs" && comment.method == "patch") ||
-			(comment.router == "/licenses/{id}" && comment.method == "delete") ||
-			(comment.router == "/debug/coordinator" && comment.method == "get") ||
-			(comment.router == "/debug/tailnet" && comment.method == "get") ||
-			(comment.router == "/workspaces/{workspace}/acl" && comment.method == "patch") ||
-			(comment.router == "/init-script/{os}/{arch}" && comment.method == "get") {
+		if (comment.router == "/api/v2/workspaceagents/me/app-health" && comment.method == "post") ||
+			(comment.router == "/api/v2/workspaceagents/me/startup" && comment.method == "post") ||
+			(comment.router == "/api/v2/workspaceagents/me/startup/logs" && comment.method == "patch") ||
+			(comment.router == "/api/v2/licenses/{id}" && comment.method == "delete") ||
+			(comment.router == "/api/v2/debug/coordinator" && comment.method == "get") ||
+			(comment.router == "/api/v2/debug/tailnet" && comment.method == "get") ||
+			(comment.router == "/api/v2/workspaces/{workspace}/acl" && comment.method == "patch") ||
+			(comment.router == "/api/v2/init-script/{os}/{arch}" && comment.method == "get") {
 			return // Exception: HTTP 200 is returned without response entity
 		}