Devx 867 render body fix

[ShipilA]

https://commercetools.atlassian.net/browse/DEVX-867

[orca-security-eu]

Orca Security Scan Summary

Status	Check	Issues by priority
Failed	Infrastructure as Code	1   1   3   4	View in Orca
Passed	SAST	0   0   0   0	View in Orca
Passed	Secrets	0   0   0   0	View in Orca
Passed	Vulnerabilities	0   0   0   0	View in Orca

🛡️ The following IaC misconfigurations have been detected

	NAME	FILE
	Global Security Field Is Undefined	.../multipart-body.yaml	View in code
	Field 'securityScheme' On Components Is Undefined	.../multipart-body.yaml	View in code
	Response Code Missing (v3)	.../multipart-body.yaml	View in code
	No Global And Operation Security Defined	.../multipart-body.yaml	View in code
	Response on operations that should have a body has undefined schema	.../multipart-body.yaml	View in code
	Server URL Uses Undefined Variables	.../multipart-body.yaml	View in code
	Object Without Required Property	.../multipart-body.yaml	View in code
	Schema Has A Required Property Undefined	.../multipart-body.yaml	View in code
	Schema Has A Required Property Undefined	.../multipart-body.yaml	View in code

[Copilot]

🟡 Changes recommended

The current renderer and the new fixture emit content at the wrong indentation level (sibling of requestBody), producing invalid OpenAPI/YAML and potentially masking the intended multipart rendering fix.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR adds a regression test and fixtures for rendering multiple request body media types (JSON + multipart/form-data) into OpenAPI, and adjusts the OAS renderer to emit a single requestBody.content map rather than repeating content per body.

Changes:

• Add a RAML test API and an expected OpenAPI fixture covering application/json + multipart/form-data request bodies.
• Add a Kotlin test asserting the generated openapi.yaml matches the new fixture.
• Update OasResourceRenderer to render content at the requestBody level and render each body as a media-type entry.

File summaries

File	Description
languages/oas/src/test/resources/multipart-body-test.raml	New RAML input defining JSON and multipart request bodies for the same operation.
languages/oas/src/test/resources/fixtures/multipart-body.yaml	New expected OpenAPI output fixture for multipart + JSON request bodies.
languages/oas/src/test/kotlin/languages/oas/TestCodeGenerator.kt	New regression test validating the generated OpenAPI matches the multipart fixture.
languages/oas/src/main/kotlin/io/vrap/codegen/languages/oas/model/OasResourceRenderer.kt	Adjust requestBody rendering to emit content once and list media types beneath it.

Review details

Suppressed comments (2)

languages/oas/src/main/kotlin/io/vrap/codegen/languages/oas/model/OasResourceRenderer.kt:133

• With content: moved out of renderBody, the returned snippet should no longer include the extra leading indentation; otherwise the generated "*/*" entry is over-indented under requestBody.content.

            return """
                |  "*/*":
                |    schema:
                |      type: string
            """.trimMargin().keepAngleIndent()

languages/oas/src/main/kotlin/io/vrap/codegen/languages/oas/model/OasResourceRenderer.kt:138

• This body rendering is now inserted under requestBody.content; the content-type key and nested schema lines need to be de-dented by two spaces to keep valid OpenAPI/YAML structure (and to match how response bodies are rendered).

            |  ${body.contentType}:${if (body.type != null) """
            |    schema:
            |      <<${body.type.renderAnyType()}>>

• Files reviewed: 4/4 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[orca-security-eu]

Orca Security Scan Summary

Status	Check	Issues by priority
Failed	Infrastructure as Code	1   1   3   3	View in Orca
Passed	SAST	0   0   0   0	View in Orca
Passed	Secrets	0   0   0   0	View in Orca
Passed	Vulnerabilities	0   0   0   0	View in Orca

🛡️ The following IaC misconfigurations have been detected

	NAME	FILE
	Global Security Field Is Undefined	.../multipart-body.yaml	View in code
	Field 'securityScheme' On Components Is Undefined	.../multipart-body.yaml	View in code
	Response on operations that should have a body has undefined schema	.../multipart-body.yaml	View in code
	No Global And Operation Security Defined	.../multipart-body.yaml	View in code
	Response Code Missing (v3)	.../multipart-body.yaml	View in code
	Schema Has A Required Property Undefined	.../multipart-body.yaml	View in code
	Schema Has A Required Property Undefined	.../multipart-body.yaml	View in code
	Server URL Uses Undefined Variables	.../multipart-body.yaml	View in code

[Copilot]

🟢 Approval recommended

The change is localized, fixes a concrete OpenAPI structure issue, and is backed by an exact-match regression test and fixture.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0 new
• Review effort level: Lite