Gemfile (1)

119-122: Group and pin testing/documentation gems for stability.

• Keep rswag-specs in :development,:test; serve rswag-api/ui in :development.
• Pin rspec-rails to the series compatible with Rails 7.2 (8.x) and rswag to stable 2.16 to avoid the 3.0.0.pre.

Based on learnings

Apply within this block:

-group :test do
+group :test do
   gem "capybara"
   gem "selenium-webdriver"
   gem "mocha"
   gem "vcr"
   gem "webmock"
   gem "climate_control"
   gem "simplecov", require: false
-  gem "rspec-rails"
-  gem "rswag-api"
-  gem "rswag-specs"
-  gem "rswag-ui"
+  gem "rspec-rails", "~> 8.0"
+  gem "rswag-specs", "~> 2.16"
 end

And add rswag-ui/api to the development group:

 group :development do
   gem "hotwire-livereload"
   gem "letter_opener"
   gem "ruby-lsp-rails"
   gem "web-console"
   gem "faker"
   gem "benchmark-ips"
   gem "stackprof"
   gem "derailed_benchmarks"
   gem "foreman"
+  gem "rswag-ui",   "~> 2.16"
+  gem "rswag-api",  "~> 2.16"
 end

If you intentionally want to serve Swagger UI in production, we can revisit the grouping and mount path.

spec/requests/api/v1/chats_spec.rb (3)

125-134: Use OAS3 request_body instead of parameter in: :body.

For OpenAPI 3, prefer request_body with content to avoid Swagger 2.0 remnants and improve schema fidelity.

Example for “Create chat”:

-      parameter name: :chat_params, in: :body, required: true, schema: {
-        type: :object,
-        properties: {
-          title: { type: :string, example: 'Monthly budget review' },
-          message: { type: :string, description: 'Initial message in the chat' },
-          model: { type: :string, description: 'Optional OpenAI model identifier' }
-        },
-        required: %w[title message]
-      }
+      request_body do
+        required true
+        content 'application/json' do
+          schema type: :object,
+                 properties: {
+                   title: { type: :string, example: 'Monthly budget review' },
+                   message: { type: :string, description: 'Initial message in the chat' },
+                   model: { type: :string, description: 'Optional OpenAI model identifier' }
+                 },
+                 required: %w[title message]
+        end
+      end

Repeat similarly for the PATCH body and the message create body.

If your spec/swagger_helper.rb is set to Swagger 2.0, keep current style; otherwise, this change aligns with OAS3. Please confirm your openapi version in swagger_helper.

Also applies to: 201-207, 268-276

---

326-334: Avoid allow_any_instance_of; stub closer to the seam.

allow_any_instance_of(AssistantMessage) is broad and can hide regressions. Prefer stubbing the collaborator invoked by the retry action (e.g., service object) or create the minimal valid record.

If there’s a specific validator or service, stub that class/method instead of the model instance. I can draft an example if you share the retry implementation.

---

84-101: Minor rswag polish.

• security [ { bearerAuth: [] } ] is good; you can omit explicit Authorization header parameter if you set a global swagger_helper securitySchemes and use a request helper to inject the header. Optional only.
• produces/consumes are accepted; with OAS3 content they become redundant. Keep or remove consistently.

Also applies to: 118-134, 260-276, 316-325

spec/rails_helper.rb (2)

39-41: Fixture path config: verify key.

Typical RSpec config uses config.fixture_path = Rails.root.join('spec/fixtures'). If fixture_paths is intentional to support multiple dirs, keep; otherwise switch to singular.

-config.fixture_paths = [
-  Rails.root.join('spec/fixtures')
-]
+config.fixture_path = Rails.root.join('spec/fixtures')

---

66-67: Consider enabling type inference.

config.infer_spec_type_from_file_location! reduces the need for type: :request annotations. Optional.

docs/api/openapi.yaml (3)

220-225: Remove redundant Authorization parameter.

When using the bearerAuth security scheme (line 218), the Authorization header is automatically documented and should not be explicitly listed as a parameter. This redundancy appears in multiple endpoints.

Apply this pattern to remove the redundant parameter:

       security:
       - bearerAuth: []
-      parameters:
-      - name: Authorization
-        in: header
-        required: true
-        schema:
-          type: string
-        description: Bearer token with read scope
       responses:

This same issue occurs at:

• Lines 246-251 (POST /api/v1/chats)
• Lines 286-291 (/api/v1/chats/{id})
• Lines 366-371 (POST messages)
• Lines 419-424 (POST retry)

---

323-323: Remove empty parameters array.

An empty parameters: [] array is redundant and can be omitted.

       security:
       - bearerAuth: []
-      parameters: []
       responses:

Same issue at line 384.

---

51-55: Consider adding maxItems constraint to error details array.

The static analysis tool suggests adding a maximum number of items to arrays. While not critical, adding maxItems can help document API behavior and prevent potential issues with excessively large error details arrays.

If there's a practical limit on error details, consider:

           oneOf:
           - type: array
             items:
               type: string
+            maxItems: 100
           - type: object

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: CR
PR: we-promise/sure#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-20T08:37:48.022Z
Learning: Applies to test/**/*_test.rb : Use VCR for external API tests.

Learnt from: CR
PR: we-promise/sure#0
File: .cursor/rules/testing.mdc:0-0
Timestamp: 2025-09-23T22:22:48.511Z
Learning: Applies to test/**/*_test.rb : For tests needing many records, use Rails helpers to construct data and inline the creation in the test