Parse only OpenAPI documents and resolve only internal refs - #1291

Summary

The OpenAPI import handed whatever it decoded to swagger-parser with its default options. Pasted text that is not a document (one user pasted curl commands) became a plain string, which swagger-parser reads as a path or URL. $refs that point outside the document were followed too. A spec should only be read from the content or the URL the user gives us, and the URL goes through assertSafeOutboundUrl first.

Changes

• parseSpec() rejects anything that does not decode to an object, with a clear message.
• swagger-parser gets resolve: { external: false, file: false, http: false } in all three calls, so it resolves only $refs inside the document.
• Specs split over several files with relative $refs no longer resolve them. Those need to be bundled into one file first.

Same behaviour on Cloud and self-hosted.

Type

• Bug fix
• New feature
• Documentation
• Refactoring
• Performance improvement
• Other (describe below)

Testing

• Added/updated unit tests
• Tested manually (describe steps below)
• No tests needed (explain why)

In packages/backend:

• npx jest src/connectors/parsers/openapi.parser.spec.ts: 35 passed. Without the parser change, the two new tests for non-documents and external $refs fail.
• npx jest src/connectors: 80 suites, 1596 passed, 11 skipped.
• npx tsc --noEmit -p tsconfig.json and npx eslint on the changed files: no errors.

Checklist

• My code follows the existing code style
• I have tested my changes locally
• I have updated documentation (if applicable)
• All existing tests pass (npm test) (connector suites locally, full suite in CI)
• This PR has a descriptive title

Related Issues

Found in the Cloud logs during the daily check.