fix: Reject string-to-number coercion in type validation

JSON Schema 'type' refers to the JSON value's intrinsic kind, not whether
its lexical form is parseable to another type. DefaultValidator was parsing
numeric-looking strings as integers/numbers, which broke oneOf branches
mixing string and number (both matched) and silently accepted strings for
plain {"type": "number"} fields.

Validator is now strict; parameter values (always strings on the wire) are
coerced to the schema's primitive type in RequestPreparationFilter before
validation runs.

Author: thced

src/main/java/com/retailsvc/http/internal/RequestPreparationFilter.java

@@ -11,6 +11,10 @@
 import com.retailsvc.http.spec.Parameter;
 import com.retailsvc.http.spec.RequestBody;
 import com.retailsvc.http.spec.Spec;
+import com.retailsvc.http.spec.schema.BooleanSchema;
+import com.retailsvc.http.spec.schema.IntegerSchema;
+import com.retailsvc.http.spec.schema.NumberSchema;
+import com.retailsvc.http.spec.schema.Schema;
 import com.retailsvc.http.validate.ValidationError;
 import com.retailsvc.http.validate.Validator;
 import com.sun.net.httpserver.Filter;
@@ -124,10 +128,48 @@ private void validateParameters(
         }
         continue;
       }
-      validator.validate(value, p.schema(), pointer);
+      validator.validate(coerceParameterValue(value, p.schema(), pointer), p.schema(), pointer);
     }
   }
 
+  /**
+   * Converts a raw parameter string into a typed value matching the schema's primitive kind, so the
+   * validator (which is faithful to JSON Schema {@code type} semantics) sees the value the spec
+   * describes rather than its string serialization. Strings that fail to parse are passed through
+   * unchanged so the validator surfaces a {@code type} error with the original input.
+   */
+  private static Object coerceParameterValue(String raw, Schema schema, String pointer) {
+    return switch (schema) {
+      case IntegerSchema _ -> {
+        try {
+          yield Long.parseLong(raw);
+        } catch (NumberFormatException _) {
+          throw new ValidationException(
+              new ValidationError(pointer, "type", "expected integer", raw));
+        }
+      }
+      case NumberSchema _ -> {
+        try {
+          yield Double.parseDouble(raw);
+        } catch (NumberFormatException _) {
+          throw new ValidationException(
+              new ValidationError(pointer, "type", "expected number", raw));
+        }
+      }
+      case BooleanSchema _ -> {
+        if ("true".equals(raw)) {
+          yield Boolean.TRUE;
+        }
+        if ("false".equals(raw)) {
+          yield Boolean.FALSE;
+        }
+        throw new ValidationException(
+            new ValidationError(pointer, "type", "expected boolean", raw));
+      }
+      default -> raw;
+    };
+  }
+
   private Object validateAndParseBody(HttpExchange exchange, Operation op, byte[] body) {
     Optional<RequestBody> rb = op.requestBody();
     if (rb.isEmpty()) {

src/main/java/com/retailsvc/http/validate/DefaultValidator.java

@@ -347,22 +347,11 @@ private static boolean isHextet(String hextet) {
   }
 
   private void validateInteger(Object value, IntegerSchema s, String pointer) {
-    long n;
-    switch (value) {
-      case Number num -> n = num.longValue();
-      case String str -> {
-        try {
-          n = Long.parseLong(str);
-        } catch (NumberFormatException _) {
-          fail(pointer, "type", "expected integer", value);
-          return;
-        }
-      }
-      case null, default -> {
-        fail(pointer, "type", "expected integer", value);
-        return;
-      }
+    if (!(value instanceof Number num)) {
+      fail(pointer, "type", "expected integer", value);
+      return;
     }
+    long n = num.longValue();
 
     if (s.minimum() != null && n < s.minimum()) {
       fail(pointer, "minimum", "integer below minimum " + s.minimum(), n);
@@ -385,22 +374,11 @@ private void validateInteger(Object value, IntegerSchema s, String pointer) {
   }
 
   private void validateNumber(Object value, NumberSchema s, String pointer) {
-    double n;
-    switch (value) {
-      case Number num -> n = num.doubleValue();
-      case String str -> {
-        try {
-          n = Double.parseDouble(str);
-        } catch (NumberFormatException _) {
-          fail(pointer, "type", "expected number", value);
-          return;
-        }
-      }
-      case null, default -> {
-        fail(pointer, "type", "expected number", value);
-        return;
-      }
+    if (!(value instanceof Number num)) {
+      fail(pointer, "type", "expected number", value);
+      return;
     }
+    double n = num.doubleValue();
 
     if (s.minimum() != null && n < s.minimum().doubleValue()) {
       fail(pointer, "minimum", "number below minimum " + s.minimum(), n);

src/test/java/com/retailsvc/http/internal/RequestPreparationFilterTest.java

@@ -15,6 +15,8 @@
 import com.retailsvc.http.spec.PathTemplate;
 import com.retailsvc.http.spec.Server;
 import com.retailsvc.http.spec.Spec;
+import com.retailsvc.http.spec.schema.IntegerSchema;
+import com.retailsvc.http.spec.schema.NumberSchema;
 import com.retailsvc.http.spec.schema.StringSchema;
 import com.retailsvc.http.spec.schema.TypeName;
 import com.retailsvc.http.validate.DefaultValidator;
@@ -151,4 +153,61 @@ void invalidQueryParamThrowsValidation() {
         .extracting(t -> ((ValidationException) t).error().pointer())
         .isEqualTo("/query/q");
   }
+
+  @Test
+  void integerQueryParamIsCoercedFromStringBeforeValidation() throws Exception {
+    var intSchema = new IntegerSchema(Set.of(TypeName.INTEGER), 1L, 100L, null, null, null, null);
+    var op =
+        new Operation(
+            "a",
+            HttpMethod.GET,
+            PathTemplate.compile("/x"),
+            Optional.empty(),
+            List.of(new Parameter("n", Parameter.Location.QUERY, true, intSchema)),
+            Map.of());
+    Spec spec = specWith(op);
+    Filter f = newFilter(spec);
+
+    HttpExchange ex = exchange("GET", "/x?n=42", new byte[0]);
+    f.doFilter(ex, Mockito.mock(Filter.Chain.class));
+  }
+
+  @Test
+  void integerQueryParamRejectsNonNumericString() {
+    var intSchema = new IntegerSchema(Set.of(TypeName.INTEGER), null, null, null, null, null, null);
+    var op =
+        new Operation(
+            "a",
+            HttpMethod.GET,
+            PathTemplate.compile("/x"),
+            Optional.empty(),
+            List.of(new Parameter("n", Parameter.Location.QUERY, true, intSchema)),
+            Map.of());
+    Spec spec = specWith(op);
+    Filter f = newFilter(spec);
+
+    HttpExchange ex = exchange("GET", "/x?n=abc", new byte[0]);
+    assertThatThrownBy(() -> f.doFilter(ex, Mockito.mock(Filter.Chain.class)))
+        .isInstanceOf(ValidationException.class)
+        .extracting(t -> ((ValidationException) t).error().keyword())
+        .isEqualTo("type");
+  }
+
+  @Test
+  void numberQueryParamIsCoercedFromStringBeforeValidation() throws Exception {
+    var numSchema = new NumberSchema(Set.of(TypeName.NUMBER), null, null, null, null, null, null);
+    var op =
+        new Operation(
+            "a",
+            HttpMethod.GET,
+            PathTemplate.compile("/x"),
+            Optional.empty(),
+            List.of(new Parameter("n", Parameter.Location.QUERY, true, numSchema)),
+            Map.of());
+    Spec spec = specWith(op);
+    Filter f = newFilter(spec);
+
+    HttpExchange ex = exchange("GET", "/x?n=1.5", new byte[0]);
+    f.doFilter(ex, Mockito.mock(Filter.Chain.class));
+  }
 }

src/test/java/com/retailsvc/http/validate/StringIntegerNumberTest.java

@@ -312,4 +312,21 @@ void numberFormatUnknownIsIgnored() {
             Set.of(TypeName.NUMBER), null, null, null, null, null, "definitely-not-a-format");
     assertThatCode(() -> v.validate(1.5, s, "/v")).doesNotThrowAnyException();
   }
+
+  @Test
+  void integerRejectsNumericLookingString() {
+    IntegerSchema s =
+        new IntegerSchema(Set.of(TypeName.INTEGER), null, null, null, null, null, null);
+    assertThatThrownBy(() -> v.validate("42", s, "/v"))
+        .extracting(t -> ((ValidationException) t).error().keyword())
+        .isEqualTo("type");
+  }
+
+  @Test
+  void numberRejectsNumericLookingString() {
+    NumberSchema s = new NumberSchema(Set.of(TypeName.NUMBER), null, null, null, null, null, null);
+    assertThatThrownBy(() -> v.validate("1234567890", s, "/v"))
+        .extracting(t -> ((ValidationException) t).error().keyword())
+        .isEqualTo("type");
+  }
 }