From 6db701ce3783dd34f46fedaf29e80d194ed73a46 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Enrique=20Garc=C3=ADa=20Cota?= <kikito@gmail.com>
Date: Fri, 21 Sep 2018 13:17:01 +0200
Subject: [PATCH] test(schemas) fix plugins after moving schemas to the new dao

---
 kong/plugins/basic-auth/access.lua            |  10 +-
 kong/plugins/hmac-auth/access.lua             |   9 +-
 kong/plugins/jwt/handler.lua                  |   8 +-
 kong/plugins/key-auth/handler.lua             |   7 +-
 kong/plugins/ldap-auth/access.lua             |   9 +-
 kong/plugins/oauth2/access.lua                |   8 +-
 kong/plugins/rate-limiting/policies/init.lua  |   9 +-
 .../response-ratelimiting/policies/init.lua   |   9 +-
 .../03-dao/04-constraints_spec.lua            |   2 -
 .../03-plugins/06-statsd/02-schema_spec.lua   | 114 ------------------
 .../03-plugins/10-key-auth/01-api_spec.lua    |   5 +-
 .../03-plugins/14-cors/02-schema_spec.lua     |  35 ------
 .../15-request-transformer/01-schema_spec.lua |  16 ---
 .../20-hmac-auth/01-schema_spec.lua           |  26 ----
 .../23-aws-lambda/02-schema_spec.lua          |  46 -------
 .../24-rate-limiting/01-schema_spec.lua       |  40 ------
 .../01-schema_spec.lua                        |  51 --------
 .../25-response-rate-limiting/03-api_spec.lua |   2 +-
 .../03-plugins/26-oauth2/01-schema_spec.lua   |  69 -----------
 .../27-request-termination/01-schema_spec.lua |  57 ---------
 .../000-new-dao/01-schema/06-plugins_spec.lua |   2 +-
 .../000-new-dao/03-plugins_spec.lua           |   2 -
 .../03-dao/04-constraints_spec.lua            |   2 -
 spec/03-plugins/08-datadog/02-schema_spec.lua |  61 +++++-----
 spec/03-plugins/10-key-auth/01-api_spec.lua   |   7 +-
 .../11-basic-auth/04-invalidations_spec.lua   |   2 +-
 spec/03-plugins/14-cors/02-schema_spec.lua    |  30 ++---
 .../15-request-transformer/01-schema_spec.lua |  19 ++-
 .../04-filter_spec.lua                        |   2 +-
 spec/03-plugins/17-jwt/06-schema_spec.lua     |  42 +++----
 .../18-ip-restriction/01-schema_spec.lua      |  69 ++++++-----
 .../20-hmac-auth/01-schema_spec.lua           |  27 ++---
 .../23-aws-lambda/02-schema_spec.lua          |  62 +++++-----
 .../24-rate-limiting/01-schema_spec.lua       |  40 +++---
 .../24-rate-limiting/04-access_spec.lua       |  16 +--
 .../01-schema_spec.lua                        |  52 ++++----
 .../25-response-rate-limiting/03-api_spec.lua |   4 +-
 .../04-access_spec.lua                        |  16 +--
 spec/03-plugins/26-oauth2/01-schema_spec.lua  |  84 ++++++-------
 .../27-request-termination/01-schema_spec.lua |  60 +++++----
 .../kong/plugins/dummy/schema.lua             |  14 ++-
 .../kong/plugins/rewriter/schema.lua          |  14 ++-
 spec/helpers.lua                              |  35 ++++++
 43 files changed, 401 insertions(+), 793 deletions(-)
 delete mode 100644 spec-old-api/03-plugins/06-statsd/02-schema_spec.lua
 delete mode 100644 spec-old-api/03-plugins/14-cors/02-schema_spec.lua
 delete mode 100644 spec-old-api/03-plugins/15-request-transformer/01-schema_spec.lua
 delete mode 100644 spec-old-api/03-plugins/20-hmac-auth/01-schema_spec.lua
 delete mode 100644 spec-old-api/03-plugins/23-aws-lambda/02-schema_spec.lua
 delete mode 100644 spec-old-api/03-plugins/24-rate-limiting/01-schema_spec.lua
 delete mode 100644 spec-old-api/03-plugins/25-response-rate-limiting/01-schema_spec.lua
 delete mode 100644 spec-old-api/03-plugins/26-oauth2/01-schema_spec.lua
 delete mode 100644 spec-old-api/03-plugins/27-request-termination/01-schema_spec.lua

diff --git a/kong/plugins/basic-auth/access.lua b/kong/plugins/basic-auth/access.lua
index 7398733dd300..fe7cc1a65634 100644
--- a/kong/plugins/basic-auth/access.lua
+++ b/kong/plugins/basic-auth/access.lua
@@ -10,6 +10,12 @@ local realm = 'Basic realm="' .. _KONG._NAME .. '"'
 
 local _M = {}
 
+
+local function is_present(str)
+  return str and str ~= "" and str ~= ngx.null
+end
+
+
 -- Fast lookup for credential retrieval depending on the type of the authentication
 --
 -- All methods must respect:
@@ -165,7 +171,7 @@ end
 
 function _M.execute(conf)
 
-  if ngx.ctx.authenticated_credential and conf.anonymous ~= "" then
+  if ngx.ctx.authenticated_credential and is_present(conf.anonymous) then
     -- we're already authenticated, and we're configured for using anonymous,
     -- hence we're in a logical OR between auth methods and we're already done.
     return
@@ -173,7 +179,7 @@ function _M.execute(conf)
 
   local ok, err = do_authentication(conf)
   if not ok then
-    if conf.anonymous ~= "" then
+    if is_present(conf.anonymous) then
       -- get anonymous user
       local consumer_cache_key = kong.db.consumers:cache_key(conf.anonymous)
       local consumer, err      = kong.cache:get(consumer_cache_key, nil,
diff --git a/kong/plugins/hmac-auth/access.lua b/kong/plugins/hmac-auth/access.lua
index 2ddfcee15bb0..ff3bd288cf38 100644
--- a/kong/plugins/hmac-auth/access.lua
+++ b/kong/plugins/hmac-auth/access.lua
@@ -37,6 +37,7 @@ do
   end
 end
 
+
 local _M = {}
 
 local hmac = {
@@ -63,6 +64,10 @@ local function list_as_set(list)
   return set
 end
 
+local function is_present(str)
+  return str and str ~= "" and str ~= ngx.null
+end
+
 local function validate_params(params, conf)
   -- check username and signature are present
   if not params.username and params.signature then
@@ -315,7 +320,7 @@ end
 
 function _M.execute(conf)
 
-  if ngx.ctx.authenticated_credential and conf.anonymous ~= "" then
+  if ngx.ctx.authenticated_credential and is_present(conf.anonymous) then
     -- we're already authenticated, and we're configured for using anonymous,
     -- hence we're in a logical OR between auth methods and we're already done.
     return
@@ -323,7 +328,7 @@ function _M.execute(conf)
 
   local ok, err = do_authentication(conf)
   if not ok then
-    if conf.anonymous ~= "" then
+    if is_present(conf.anonymous) then
       -- get anonymous user
       local consumer_cache_key = kong.db.consumers:cache_key(conf.anonymous)
       local consumer, err      = kong.cache:get(consumer_cache_key, nil,
diff --git a/kong/plugins/jwt/handler.lua b/kong/plugins/jwt/handler.lua
index 3bcf5307069c..ba3d6a897e6a 100644
--- a/kong/plugins/jwt/handler.lua
+++ b/kong/plugins/jwt/handler.lua
@@ -14,6 +14,10 @@ local JwtHandler = BasePlugin:extend()
 JwtHandler.PRIORITY = 1005
 JwtHandler.VERSION = "0.1.0"
 
+local function is_present(str)
+  return str and str ~= "" and str ~= ngx.null
+end
+
 --- Retrieve a JWT in a request.
 -- Checks for the JWT in URI parameters, then in cookies, and finally
 -- in the `Authorization` header.
@@ -201,7 +205,7 @@ function JwtHandler:access(conf)
     return
   end
 
-  if ngx.ctx.authenticated_credential and conf.anonymous ~= "" then
+  if ngx.ctx.authenticated_credential and is_present(conf.anonymous) then
     -- we're already authenticated, and we're configured for using anonymous,
     -- hence we're in a logical OR between auth methods and we're already done.
     return
@@ -209,7 +213,7 @@ function JwtHandler:access(conf)
 
   local ok, err = do_authentication(conf)
   if not ok then
-    if conf.anonymous ~= "" then
+    if is_present(conf.anonymous) then
       -- get anonymous user
       local consumer_cache_key = kong.db.consumers:cache_key(conf.anonymous)
       local consumer, err      = kong.cache:get(consumer_cache_key, nil,
diff --git a/kong/plugins/key-auth/handler.lua b/kong/plugins/key-auth/handler.lua
index 5cbb786b4381..221f6ecbcae1 100644
--- a/kong/plugins/key-auth/handler.lua
+++ b/kong/plugins/key-auth/handler.lua
@@ -10,6 +10,9 @@ local KeyAuthHandler = BasePlugin:extend()
 KeyAuthHandler.PRIORITY = 1003
 KeyAuthHandler.VERSION = "0.2.0"
 
+local function is_present(str)
+  return str and str ~= "" and str ~= ngx.null
+end
 
 function KeyAuthHandler:new()
   KeyAuthHandler.super.new(self, "key-auth")
@@ -176,7 +179,7 @@ function KeyAuthHandler:access(conf)
   -- checking both old and new ctx for backward and forward compatibility
   local authenticated_credential = kong.ctx.shared.authenticated_credential
                                    or ngx.ctx.authenticated_credential
-  if authenticated_credential and conf.anonymous ~= "" then
+  if authenticated_credential and is_present(conf.anonymous) then
     -- we're already authenticated, and we're configured for using anonymous,
     -- hence we're in a logical OR between auth methods and we're already done.
     return
@@ -184,7 +187,7 @@ function KeyAuthHandler:access(conf)
 
   local ok, err = do_authentication(conf)
   if not ok then
-    if conf.anonymous ~= "" then
+    if is_present(conf.anonymous) then
       -- get anonymous user
       local consumer_cache_key = kong.db.consumers:cache_key(conf.anonymous)
       local consumer, err = kong.cache:get(consumer_cache_key, nil,
diff --git a/kong/plugins/ldap-auth/access.lua b/kong/plugins/ldap-auth/access.lua
index 64bbb5825886..c415304b725c 100644
--- a/kong/plugins/ldap-auth/access.lua
+++ b/kong/plugins/ldap-auth/access.lua
@@ -25,6 +25,11 @@ local PROXY_AUTHORIZATION = "proxy-authorization"
 local ldap_config_cache = setmetatable({}, { __mode = "k" })
 
 
+local function is_present(str)
+  return str and str ~= "" and str ~= ngx.null
+end
+
+
 local _M = {}
 
 local function retrieve_credentials(authorization_header_value, conf)
@@ -203,7 +208,7 @@ end
 
 function _M.execute(conf)
 
-  if ngx.ctx.authenticated_credential and conf.anonymous ~= "" then
+  if ngx.ctx.authenticated_credential and is_present(conf.anonymous) then
     -- we're already authenticated, and we're configured for using anonymous,
     -- hence we're in a logical OR between auth methods and we're already done.
     return
@@ -211,7 +216,7 @@ function _M.execute(conf)
 
   local ok, err = do_authentication(conf)
   if not ok then
-    if conf.anonymous ~= "" then
+    if is_present(conf.anonymous) then
       -- get anonymous user
       local consumer_cache_key = singletons.db.consumers:cache_key(conf.anonymous)
       local consumer, err      = singletons.cache:get(consumer_cache_key, nil,
diff --git a/kong/plugins/oauth2/access.lua b/kong/plugins/oauth2/access.lua
index 468621836f93..0326d5e66cdb 100644
--- a/kong/plugins/oauth2/access.lua
+++ b/kong/plugins/oauth2/access.lua
@@ -35,6 +35,10 @@ local GRANT_PASSWORD = "password"
 local ERROR = "error"
 local AUTHENTICATED_USERID = "authenticated_userid"
 
+local function is_present(str)
+  return str and str ~= "" and str ~= ngx.null
+end
+
 local function generate_token(conf, service, api, credential, authenticated_userid, scope, state, expiration, disable_refresh)
   local token_expiration = expiration or conf.token_expiration
 
@@ -604,7 +608,7 @@ end
 function _M.execute(conf)
 
 
-  if ngx.ctx.authenticated_credential and conf.anonymous ~= "" then
+  if ngx.ctx.authenticated_credential and is_present(conf.anonymous) then
     -- we're already authenticated, and we're configured for using anonymous,
     -- hence we're in a logical OR between auth methods and we're already done.
     return
@@ -626,7 +630,7 @@ function _M.execute(conf)
 
   local ok, err = do_authentication(conf)
   if not ok then
-    if conf.anonymous ~= "" then
+    if is_present(conf.anonymous) then
       -- get anonymous user
       local consumer_cache_key = kong.db.consumers:cache_key(conf.anonymous)
       local consumer, err      = kong.cache:get(consumer_cache_key, nil,
diff --git a/kong/plugins/rate-limiting/policies/init.lua b/kong/plugins/rate-limiting/policies/init.lua
index 61ec471684a8..c1815d506eff 100644
--- a/kong/plugins/rate-limiting/policies/init.lua
+++ b/kong/plugins/rate-limiting/policies/init.lua
@@ -14,6 +14,11 @@ local fmt = string.format
 local NULL_UUID = "00000000-0000-0000-0000-000000000000"
 
 
+local function is_present(str)
+  return str and str ~= "" and str ~= ngx.null
+end
+
+
 local function get_ids(conf)
   conf = conf or {}
 
@@ -148,7 +153,7 @@ return {
         return nil, err
       end
 
-      if times == 0 and conf.redis_password and conf.redis_password ~= "" then
+      if times == 0 and is_present(conf.redis_password) then
         local ok, err = red:auth(conf.redis_password)
         if not ok then
           ngx_log(ngx.ERR, "failed to auth Redis: ", err)
@@ -229,7 +234,7 @@ return {
         return nil, err
       end
 
-      if times == 0 and conf.redis_password and conf.redis_password ~= "" then
+      if times == 0 and is_present(conf.redis_password) then
         local ok, err = red:auth(conf.redis_password)
         if not ok then
           ngx_log(ngx.ERR, "failed to connect to Redis: ", err)
diff --git a/kong/plugins/response-ratelimiting/policies/init.lua b/kong/plugins/response-ratelimiting/policies/init.lua
index 28253fc24bee..e30b98db9030 100644
--- a/kong/plugins/response-ratelimiting/policies/init.lua
+++ b/kong/plugins/response-ratelimiting/policies/init.lua
@@ -14,6 +14,11 @@ local fmt = string.format
 local NULL_UUID = "00000000-0000-0000-0000-000000000000"
 
 
+local function is_present(str)
+  return str and str ~= "" and str ~= ngx.null
+end
+
+
 local function get_ids(conf)
   conf = conf or {}
 
@@ -149,7 +154,7 @@ return {
         return nil, err
       end
 
-      if times == 0 and conf.redis_password and conf.redis_password ~= "" then
+      if times == 0 and is_present(conf.redis_password) then
         local ok, err = red:auth(conf.redis_password)
         if not ok then
           ngx_log(ngx.ERR, "failed to auth Redis: ", err)
@@ -228,7 +233,7 @@ return {
         return nil, err
       end
 
-      if times == 0 and conf.redis_password and conf.redis_password ~= "" then
+      if times == 0 and is_present(conf.redis_password) then
         local ok, err = red:auth(conf.redis_password)
         if not ok then
           ngx_log(ngx.ERR, "failed to auth Redis: ", err)
diff --git a/spec-old-api/02-integration/03-dao/04-constraints_spec.lua b/spec-old-api/02-integration/03-dao/04-constraints_spec.lua
index 7e4c96e14ca5..1a1076b6bafb 100644
--- a/spec-old-api/02-integration/03-dao/04-constraints_spec.lua
+++ b/spec-old-api/02-integration/03-dao/04-constraints_spec.lua
@@ -48,7 +48,6 @@ for _, strategy in helpers.each_strategy() do
             run_on_preflight = true,
             hide_credentials = false,
             key_names = {"apikey"},
-            anonymous = "",
             key_in_body = false,
           }, plugin.config)
       end)
@@ -64,7 +63,6 @@ for _, strategy in helpers.each_strategy() do
             run_on_preflight = true,
             hide_credentials = false,
             key_names = {"api-key"},
-            anonymous = "",
             key_in_body = false,
           }, plugin.config)
       end)
diff --git a/spec-old-api/03-plugins/06-statsd/02-schema_spec.lua b/spec-old-api/03-plugins/06-statsd/02-schema_spec.lua
deleted file mode 100644
index a18c6981b60b..000000000000
--- a/spec-old-api/03-plugins/06-statsd/02-schema_spec.lua
+++ /dev/null
@@ -1,114 +0,0 @@
-local schemas = require "kong.dao.schemas_validation"
-local statsd_schema = require "kong.plugins.statsd.schema"
-local validate_entity = schemas.validate_entity
-
-describe("Plugin: statsd (schema)", function()
-  it("accepts empty config", function()
-    local ok, err = validate_entity({}, statsd_schema)
-    assert.is_nil(err)
-    assert.is_true(ok)
-  end)
-  it("accepts empty metrics", function()
-    local metrics_input = {}
-    local ok, err = validate_entity({ metrics = metrics_input}, statsd_schema)
-    assert.is_nil(err)
-    assert.is_true(ok)
-  end)
-  it("accepts just one metrics", function()
-    local metrics_input = {
-      {
-        name = "request_count",
-        stat_type = "counter",
-        sample_rate = 1
-      }
-    }
-    local ok, err = validate_entity({ metrics = metrics_input}, statsd_schema)
-    assert.is_nil(err)
-    assert.is_true(ok)
-  end)
-  it("rejects if name or stat not defined", function()
-    local metrics_input = {
-      {
-        name = "request_count",
-        sample_rate = 1
-      }
-    }
-    local _, err = validate_entity({ metrics = metrics_input}, statsd_schema)
-    assert.not_nil(err)
-    assert.equal("name and stat_type must be defined for all stats", err.metrics)
-    local metrics_input = {
-      {
-        stat_type = "counter",
-        sample_rate = 1
-      }
-    }
-    _, err = validate_entity({ metrics = metrics_input}, statsd_schema)
-    assert.not_nil(err)
-    assert.equal("name and stat_type must be defined for all stats", err.metrics)
-  end)
-  it("rejects counters without sample rate", function()
-    local metrics_input = {
-      {
-        name = "request_count",
-        stat_type = "counter",
-      }
-    }
-    local _, err = validate_entity({ metrics = metrics_input}, statsd_schema)
-    assert.not_nil(err)
-  end)
-  it("rejects invalid metrics name", function()
-    local metrics_input = {
-      {
-        name = "invalid_name",
-        stat_type = "counter",
-      }
-    }
-    local _, err = validate_entity({ metrics = metrics_input}, statsd_schema)
-    assert.not_nil(err)
-    assert.equal("unrecognized metric name: invalid_name", err.metrics)
-  end)
-  it("rejects invalid stat type", function()
-    local metrics_input = {
-      {
-        name = "request_count",
-        stat_type = "invalid_stat",
-      }
-    }
-    local _, err = validate_entity({ metrics = metrics_input}, statsd_schema)
-    assert.not_nil(err)
-    assert.equal("unrecognized stat_type: invalid_stat", err.metrics)
-  end)
-  it("rejects if customer identifier missing", function()
-    local metrics_input = {
-      {
-        name = "status_count_per_user",
-        stat_type = "counter",
-        sample_rate = 1
-      }
-    }
-    local _, err = validate_entity({ metrics = metrics_input}, statsd_schema)
-    assert.not_nil(err)
-    assert.equal("consumer_identifier must be defined for metric status_count_per_user", err.metrics)
-  end)
-  it("rejects if metric has wrong stat type", function()
-    local metrics_input = {
-      {
-        name = "unique_users",
-        stat_type = "counter"
-      }
-    }
-    local _, err = validate_entity({ metrics = metrics_input}, statsd_schema)
-    assert.not_nil(err)
-    assert.equal("unique_users metric only works with stat_type 'set'", err.metrics)
-    metrics_input = {
-      {
-        name = "status_count",
-        stat_type = "set",
-        sample_rate = 1
-      }
-    }
-    _, err = validate_entity({ metrics = metrics_input}, statsd_schema)
-    assert.not_nil(err)
-    assert.equal("status_count metric only works with stat_type 'counter'", err.metrics)
-  end)
-end)
diff --git a/spec-old-api/03-plugins/10-key-auth/01-api_spec.lua b/spec-old-api/03-plugins/10-key-auth/01-api_spec.lua
index ef4a5bd70510..759bac92fa84 100644
--- a/spec-old-api/03-plugins/10-key-auth/01-api_spec.lua
+++ b/spec-old-api/03-plugins/10-key-auth/01-api_spec.lua
@@ -293,9 +293,8 @@ describe("Plugin: key-auth (API)", function()
       })
       assert.response(res).has.status(400)
       local body = assert.response(res).has.jsonbody()
-      assert.equal("'hello\\world' is illegal: bad header name " ..
-                   "'hello\\world', allowed characters are A-Z, a-z, 0-9," ..
-                   " '_', and '-'", body.fields.config.key_names)
+        assert.equal("bad header name 'hello\\world', allowed characters are A-Z, a-z, 0-9, '_', and '-'",
+                     body.fields.config.key_names)
     end)
     it("succeeds with valid key_names", function()
       local key_name = "hello-world"
diff --git a/spec-old-api/03-plugins/14-cors/02-schema_spec.lua b/spec-old-api/03-plugins/14-cors/02-schema_spec.lua
deleted file mode 100644
index 35ec685236ae..000000000000
--- a/spec-old-api/03-plugins/14-cors/02-schema_spec.lua
+++ /dev/null
@@ -1,35 +0,0 @@
-local validate_entity = require("kong.dao.schemas_validation").validate_entity
-local cors_schema = require "kong.plugins.cors.schema"
-
-describe("cors schema", function()
-  it("validates '*'", function()
-    local ok, err = validate_entity({ origins = { "*" } }, cors_schema)
-
-    assert.True(ok)
-    assert.is_nil(err)
-  end)
-
-  it("validates what looks like a domain", function()
-    local ok, err = validate_entity({ origins = { "example.com" } }, cors_schema)
-
-    assert.True(ok)
-    assert.is_nil(err)
-  end)
-
-  it("validates what looks like a regex", function()
-    local ok, err = validate_entity({ origins = { [[.*\.example(?:-foo)?\.com]] } }, cors_schema)
-
-    assert.True(ok)
-    assert.is_nil(err)
-  end)
-
-  describe("errors", function()
-    it("with invalid regex in origins", function()
-      local mock_origins = { [[.*.example.com]], [[invalid_**regex]] }
-      local ok, err = validate_entity({ origins = mock_origins }, cors_schema)
-
-      assert.False(ok)
-      assert.equals("origin '" .. mock_origins[2] .. "' is not a valid regex", err.origins)
-    end)
-  end)
-end)
diff --git a/spec-old-api/03-plugins/15-request-transformer/01-schema_spec.lua b/spec-old-api/03-plugins/15-request-transformer/01-schema_spec.lua
deleted file mode 100644
index dcb3d6ae0718..000000000000
--- a/spec-old-api/03-plugins/15-request-transformer/01-schema_spec.lua
+++ /dev/null
@@ -1,16 +0,0 @@
-local schemas = require "kong.dao.schemas_validation"
-local request_transformer_schema = require "kong.plugins.request-transformer.schema"
-local validate_entity = schemas.validate_entity
-
-describe("Plugin: request-transformer (schema)", function()
-  it("validates http_method", function()
-    local ok, err = validate_entity({http_method = "GET"}, request_transformer_schema)
-    assert.is_nil(err)
-    assert.True(ok)
-  end)
-  it("errors invalid http_method", function()
-    local ok, err = validate_entity({http_method = "HELLO"}, request_transformer_schema)
-    assert.equal("HELLO is not supported", err.http_method)
-    assert.False(ok)
-  end)
-end)
diff --git a/spec-old-api/03-plugins/20-hmac-auth/01-schema_spec.lua b/spec-old-api/03-plugins/20-hmac-auth/01-schema_spec.lua
deleted file mode 100644
index 4dd0af558a56..000000000000
--- a/spec-old-api/03-plugins/20-hmac-auth/01-schema_spec.lua
+++ /dev/null
@@ -1,26 +0,0 @@
-local schemas = require "kong.dao.schemas_validation"
-local hmac_auth_schema = require "kong.plugins.hmac-auth.schema"
-local validate_entity = schemas.validate_entity
-
-describe("Plugin: hmac-auth (schema)", function()
-  it("accepts empty config", function()
-    local ok, err = validate_entity({}, hmac_auth_schema)
-    assert.is_nil(err)
-    assert.is_true(ok)
-  end)
-  it("accepts correct clock skew", function()
-    local ok, err = validate_entity({clock_skew = 10}, hmac_auth_schema)
-    assert.is_nil(err)
-    assert.is_true(ok)
-  end)
-  it("errors with negative clock skew", function()
-    local ok, err = validate_entity({clock_skew = -10}, hmac_auth_schema)
-    assert.equal("Clock Skew should be positive", err.clock_skew)
-    assert.is_false(ok)
-  end)
-  it("errors with wrong algorithm", function()
-    local ok, err = validate_entity({algorithms = {"sha1024"}}, hmac_auth_schema)
-    assert.equal('"sha1024" is not allowed. Allowed values are: "hmac-sha1", "hmac-sha256", "hmac-sha384", "hmac-sha512"', err.algorithms)
-    assert.is_false(ok)
-  end)
-end)
diff --git a/spec-old-api/03-plugins/23-aws-lambda/02-schema_spec.lua b/spec-old-api/03-plugins/23-aws-lambda/02-schema_spec.lua
deleted file mode 100644
index 363e8c49dc73..000000000000
--- a/spec-old-api/03-plugins/23-aws-lambda/02-schema_spec.lua
+++ /dev/null
@@ -1,46 +0,0 @@
-local aws_lambda_schema = require "kong.plugins.aws-lambda.schema"
-local schemas = require "kong.dao.schemas_validation"
-local utils = require "kong.tools.utils"
-local validate_entity = schemas.validate_entity
-
-describe("Plugin: AWS Lambda (schema)", function()
-  local DEFAULTS = {
-    timeout = 60000,
-    keepalive = 60000,
-    aws_key = "my-key",
-    aws_secret = "my-secret",
-    aws_region = "us-east-1",
-    function_name = "my-function",
-    invocation_type  = "RequestResponse",
-    log_type = "Tail",
-    port  = 443,
-  }
-
-  it("accepts nil Unhandled Response Status Code", function()
-    local entity = utils.table_merge(DEFAULTS, { unhandled_status = nil })
-    local ok, err = validate_entity(entity, aws_lambda_schema)
-    assert.is_nil(err)
-    assert.True(ok)
-  end)
-
-  it("accepts correct Unhandled Response Status Code", function()
-    local entity = utils.table_merge(DEFAULTS, { unhandled_status = 412 })
-    local ok, err = validate_entity(entity, aws_lambda_schema)
-    assert.is_nil(err)
-    assert.True(ok)
-  end)
-
-  it("errors with Unhandled Response Status Code less than 100", function()
-    local entity = utils.table_merge(DEFAULTS, { unhandled_status = 99 })
-    local ok, err = validate_entity(entity, aws_lambda_schema)
-    assert.equal("unhandled_status must be within 100 - 999.", err.unhandled_status)
-    assert.False(ok)
-  end)
-
-  it("errors with Unhandled Response Status Code greater than 999", function()
-    local entity = utils.table_merge(DEFAULTS, { unhandled_status = 1000 })
-    local ok, err = validate_entity(entity, aws_lambda_schema)
-    assert.equal("unhandled_status must be within 100 - 999.", err.unhandled_status)
-    assert.False(ok)
-  end)
-end)
diff --git a/spec-old-api/03-plugins/24-rate-limiting/01-schema_spec.lua b/spec-old-api/03-plugins/24-rate-limiting/01-schema_spec.lua
deleted file mode 100644
index 96e781bc4080..000000000000
--- a/spec-old-api/03-plugins/24-rate-limiting/01-schema_spec.lua
+++ /dev/null
@@ -1,40 +0,0 @@
-local schemas = require "kong.dao.schemas_validation"
-local plugin_schema = require "kong.plugins.rate-limiting.schema"
-local validate_entity = schemas.validate_entity
-
-describe("Plugin: rate-limiting (schema)", function()
-  it("proper config validates", function()
-    local config = {second = 10}
-    local ok, _, err = validate_entity(config, plugin_schema)
-    assert.True(ok)
-    assert.is_nil(err)
-  end)
-  it("proper config validates (bis)", function()
-    local config = {second = 10, minute = 20, hour = 30, day = 40, month = 50, year = 60}
-    local ok, _, err = validate_entity(config, plugin_schema)
-    assert.True(ok)
-    assert.is_nil(err)
-  end)
-
-  describe("errors", function()
-    it("limits: smaller unit is less than bigger unit", function()
-      local config = {second = 20, hour = 10}
-      local ok, _, err = validate_entity(config, plugin_schema)
-      assert.False(ok)
-      assert.equal("The limit for hour cannot be lower than the limit for second", err.message)
-    end)
-    it("limits: smaller unit is less than bigger unit (bis)", function()
-      local config = {second = 10, minute = 20, hour = 30, day = 40, month = 60, year = 50}
-      local ok, _, err = validate_entity(config, plugin_schema)
-      assert.False(ok)
-      assert.equal("The limit for year cannot be lower than the limit for month", err.message)
-    end)
-
-    it("invalid limit", function()
-      local config = {}
-      local ok, _, err = validate_entity(config, plugin_schema)
-      assert.False(ok)
-      assert.equal("You need to set at least one limit: second, minute, hour, day, month, year", err.message)
-    end)
-  end)
-end)
diff --git a/spec-old-api/03-plugins/25-response-rate-limiting/01-schema_spec.lua b/spec-old-api/03-plugins/25-response-rate-limiting/01-schema_spec.lua
deleted file mode 100644
index a0352e6bc2d6..000000000000
--- a/spec-old-api/03-plugins/25-response-rate-limiting/01-schema_spec.lua
+++ /dev/null
@@ -1,51 +0,0 @@
-local schemas = require "kong.dao.schemas_validation"
-local plugin_schema = require "kong.plugins.response-ratelimiting.schema"
-local validate_entity = schemas.validate_entity
-
-describe("Plugin: response-rate-limiting (schema)", function()
-  it("proper config validates", function()
-    local config = {limits = {video = {second = 1}}}
-    local ok, err = validate_entity(config, plugin_schema)
-    assert.True(ok)
-    assert.is_nil(err)
-  end)
-  it("proper config validates (bis)", function()
-    local config = {limits = {video = {second = 1, minute = 2, hour = 3, day = 4, month = 5, year = 6}}}
-    local ok, err = validate_entity(config, plugin_schema)
-    assert.True(ok)
-    assert.is_nil(err)
-  end)
-
-  describe("errors", function()
-    it("empty config", function()
-      local config = {}
-      local ok, _, err = validate_entity(config, plugin_schema)
-      assert.False(ok)
-      assert.equal("You need to set at least one limit name", err.message)
-    end)
-    it("invalid limit", function()
-      local config = {limits = {video = {seco = 1}}}
-      local ok, err = validate_entity(config, plugin_schema)
-      assert.False(ok)
-      assert.equal("seco is an unknown field", err["limits.video.seco"])
-    end)
-    it("limits: smaller unit is less than bigger unit", function()
-      local config = {limits = {video = {second = 2, minute = 1}}}
-      local ok, _, self_check_err = validate_entity(config, plugin_schema)
-      assert.False(ok)
-      assert.equal("The limit for minute cannot be lower than the limit for second", self_check_err.message)
-    end)
-    it("limits: smaller unit is less than bigger unit (bis)", function()
-      local config = {limits = {video = {second = 1, minute = 2, hour = 3, day = 4, month = 6, year = 5}}}
-      local ok, _, self_check_err = validate_entity(config, plugin_schema)
-      assert.False(ok)
-      assert.equal("The limit for year cannot be lower than the limit for month", self_check_err.message)
-    end)
-    it("invaldid unit type", function()
-      local config = {limits = {second = 10}}
-      local ok, err = validate_entity(config, plugin_schema)
-      assert.False(ok)
-      assert.equal("second is not a table", err["limits.second"])
-    end)
-  end)
-end)
diff --git a/spec-old-api/03-plugins/25-response-rate-limiting/03-api_spec.lua b/spec-old-api/03-plugins/25-response-rate-limiting/03-api_spec.lua
index 99bada30b70c..300b699aba09 100644
--- a/spec-old-api/03-plugins/25-response-rate-limiting/03-api_spec.lua
+++ b/spec-old-api/03-plugins/25-response-rate-limiting/03-api_spec.lua
@@ -40,7 +40,7 @@ describe("Plugin: response-rate-limiting (API)", function()
       })
       local body = assert.res_status(400, res)
       local json = cjson.decode(body)
-      assert.same("length must be at least 1", json.fields.config.limits)
+      assert.same("required field missing", json.fields.config.limits)
     end)
     it("accepts proper config", function()
       local res = assert(admin_client:send {
diff --git a/spec-old-api/03-plugins/26-oauth2/01-schema_spec.lua b/spec-old-api/03-plugins/26-oauth2/01-schema_spec.lua
deleted file mode 100644
index 9ee294be5036..000000000000
--- a/spec-old-api/03-plugins/26-oauth2/01-schema_spec.lua
+++ /dev/null
@@ -1,69 +0,0 @@
-local validate_entity = require("kong.dao.schemas_validation").validate_entity
-local oauth2_schema = require "kong.plugins.oauth2.schema"
-
-describe("Plugin: oauth2 (schema)", function()
-  it("does not require `scopes` when `mandatory_scope` is false", function()
-    local ok, errors = validate_entity({enable_authorization_code = true, mandatory_scope = false}, oauth2_schema)
-    assert.True(ok)
-    assert.is_nil(errors)
-  end)
-  it("valid when both `scopes` when `mandatory_scope` are given", function()
-    local ok, errors = validate_entity({enable_authorization_code = true, mandatory_scope = true, scopes = {"email", "info"}}, oauth2_schema)
-    assert.True(ok)
-    assert.is_nil(errors)
-  end)
-  it("autogenerates `provision_key` when not given", function()
-    local t = {enable_authorization_code = true, mandatory_scope = true, scopes = {"email", "info"}}
-    local ok, errors = validate_entity(t, oauth2_schema)
-    assert.True(ok)
-    assert.is_nil(errors)
-    assert.truthy(t.provision_key)
-    assert.equal(32, t.provision_key:len())
-  end)
-  it("does not autogenerate `provision_key` when it is given", function()
-    local t = {enable_authorization_code = true, mandatory_scope = true, scopes = {"email", "info"}, provision_key = "hello"}
-    local ok, errors = validate_entity(t, oauth2_schema)
-    assert.True(ok)
-    assert.is_nil(errors)
-    assert.truthy(t.provision_key)
-    assert.equal("hello", t.provision_key)
-  end)
-  it("sets default `auth_header_name` when not given", function()
-    local t = {enable_authorization_code = true, mandatory_scope = true, scopes = {"email", "info"}}
-    local ok, errors = validate_entity(t, oauth2_schema)
-    assert.True(ok)
-    assert.is_nil(errors)
-    assert.truthy(t.provision_key)
-    assert.equal(32, t.provision_key:len())
-    assert.equal("authorization", t.auth_header_name)
-  end)
-  it("does not set default value for `auth_header_name` when it is given", function()
-    local t = {enable_authorization_code = true, mandatory_scope = true, scopes = {"email", "info"}, provision_key = "hello",
-    auth_header_name="custom_header_name"}
-    local ok, errors = validate_entity(t, oauth2_schema)
-    assert.True(ok)
-    assert.is_nil(errors)
-    assert.truthy(t.provision_key)
-    assert.equal("hello", t.provision_key)
-    assert.equal("custom_header_name", t.auth_header_name)
-  end)
-  it("sets refresh_token_ttl to default value if not set", function()
-    local t = {enable_authorization_code = true, mandatory_scope = false}
-    local ok, errors = validate_entity(t, oauth2_schema)
-    assert.True(ok)
-    assert.is_nil(errors)
-    assert.equal(1209600, t.refresh_token_ttl)
-  end)
-  describe("errors", function()
-    it("requires at least one flow", function()
-      local ok, _, err = validate_entity({}, oauth2_schema)
-      assert.False(ok)
-      assert.equal("You need to enable at least one OAuth flow", tostring(err))
-    end)
-    it("requires `scopes` when `mandatory_scope` is true", function()
-      local ok, errors = validate_entity({enable_authorization_code = true, mandatory_scope = true}, oauth2_schema)
-      assert.False(ok)
-      assert.equal("To set a mandatory scope you also need to create available scopes", errors.mandatory_scope)
-    end)
-  end)
-end)
diff --git a/spec-old-api/03-plugins/27-request-termination/01-schema_spec.lua b/spec-old-api/03-plugins/27-request-termination/01-schema_spec.lua
deleted file mode 100644
index d039c76a66fc..000000000000
--- a/spec-old-api/03-plugins/27-request-termination/01-schema_spec.lua
+++ /dev/null
@@ -1,57 +0,0 @@
-local schemas_validation = require "kong.dao.schemas_validation"
-local schema = require "kong.plugins.request-termination.schema"
-
-local v = schemas_validation.validate_entity
-
-describe("Plugin: request-termination (schema)", function()
-  it("should accept a valid status_code", function()
-    assert(v({status_code = 404}, schema))
-  end)
-  it("should accept a valid message", function()
-    assert(v({message = "Not found"}, schema))
-  end)
-  it("should accept a valid content_type", function()
-    assert(v({content_type = "text/html",body = "<body><h1>Not found</h1>"}, schema))
-  end)
-  it("should accept a valid body", function()
-    assert(v({body = "<body><h1>Not found</h1>"}, schema))
-  end)
-
-  describe("errors", function()
-    it("status_code should only accept numbers", function()
-      local ok, err = v({status_code = "abcd"}, schema)
-      assert.same({status_code = "status_code is not a number"}, err)
-      assert.False(ok)
-    end)
-    it("status_code < 100", function()
-      local ok, _, err = v({status_code = "99"}, schema)
-      assert.False(ok)
-      assert.same("status_code must be between 100 .. 599", err.message)
-    end)
-    it("status_code > 599", function()
-      local ok, _, err = v({status_code = "600"}, schema)
-      assert.False(ok)
-      assert.same("status_code must be between 100 .. 599", err.message)
-    end)
-    it("message with body", function()
-      local ok, _, err = v({message = "error", body = "test"}, schema)
-      assert.False(ok)
-      assert.same("message cannot be used with content_type or body", err.message)
-    end)
-    it("message with body and content_type", function()
-      local ok, _, err = v({message = "error", content_type="text/html", body = "test"}, schema)
-      assert.False(ok)
-      assert.same("message cannot be used with content_type or body", err.message)
-    end)
-    it("message with content_type", function()
-      local ok, _, err = v({message = "error", content_type="text/html"}, schema)
-      assert.False(ok)
-      assert.same("message cannot be used with content_type or body", err.message)
-    end)
-    it("content_type without body", function()
-      local ok, _, err = v({content_type="text/html"}, schema)
-      assert.False(ok)
-      assert.same("content_type requires a body", err.message)
-    end)
-  end)
-end)
diff --git a/spec/01-unit/000-new-dao/01-schema/06-plugins_spec.lua b/spec/01-unit/000-new-dao/01-schema/06-plugins_spec.lua
index 05ace3bdfc76..df96f689ca7b 100644
--- a/spec/01-unit/000-new-dao/01-schema/06-plugins_spec.lua
+++ b/spec/01-unit/000-new-dao/01-schema/06-plugins_spec.lua
@@ -118,7 +118,7 @@ describe("plugins", function()
     assert.same({
       key_names = { "apikey" },
       hide_credentials = false,
-      anonymous = "",
+      anonymous = ngx.null,
       key_in_body = false,
       run_on_preflight = true,
     }, plugin.config)
diff --git a/spec/02-integration/000-new-dao/03-plugins_spec.lua b/spec/02-integration/000-new-dao/03-plugins_spec.lua
index da8d07c39cfa..e45faeb11785 100644
--- a/spec/02-integration/000-new-dao/03-plugins_spec.lua
+++ b/spec/02-integration/000-new-dao/03-plugins_spec.lua
@@ -31,7 +31,6 @@ for _, strategy in helpers.each_strategy() do
 
           assert.same({
             config = {
-              anonymous = "",
               hide_credentials = false,
               run_on_preflight = true,
               key_in_body = false,
@@ -76,7 +75,6 @@ for _, strategy in helpers.each_strategy() do
 
           assert.same({
             config = {
-              anonymous = "",
               hide_credentials = false,
               run_on_preflight = true,
               key_in_body = false,
diff --git a/spec/02-integration/03-dao/04-constraints_spec.lua b/spec/02-integration/03-dao/04-constraints_spec.lua
index a7625c4da297..380e3dbdcbfc 100644
--- a/spec/02-integration/03-dao/04-constraints_spec.lua
+++ b/spec/02-integration/03-dao/04-constraints_spec.lua
@@ -43,7 +43,6 @@ for _, strategy in helpers.each_strategy() do
           run_on_preflight = true,
           hide_credentials = false,
           key_names        = {"apikey"},
-          anonymous        = "",
           key_in_body      = false,
         }, plugin.config)
       end)
@@ -58,7 +57,6 @@ for _, strategy in helpers.each_strategy() do
           run_on_preflight = true,
           hide_credentials = false,
           key_names        = {"api-key"},
-          anonymous        = "",
           key_in_body      = false,
         }, plugin.config)
       end)
diff --git a/spec/03-plugins/08-datadog/02-schema_spec.lua b/spec/03-plugins/08-datadog/02-schema_spec.lua
index 98bce6c5f793..fd8d5ef574cb 100644
--- a/spec/03-plugins/08-datadog/02-schema_spec.lua
+++ b/spec/03-plugins/08-datadog/02-schema_spec.lua
@@ -1,18 +1,18 @@
-local schemas = require "kong.dao.schemas_validation"
-local datadog_schema = require "kong.plugins.datadog.schema"
-local validate_entity = schemas.validate_entity
+local schema_def = require "kong.plugins.datadog.schema"
+local v = require("spec.helpers").validate_plugin_config_schema
+
 
 describe("Plugin: datadog (schema)", function()
   it("accepts empty config #o", function()
-    local ok, err = validate_entity({}, datadog_schema)
+    local ok, err = v({}, schema_def)
     assert.is_nil(err)
-    assert.is_true(ok)
+    assert.is_truthy(ok)
   end)
   it("accepts empty metrics", function()
     local metrics_input = {}
-    local ok, err = validate_entity({ metrics = metrics_input}, datadog_schema)
+    local ok, err = v({ metrics = metrics_input }, schema_def)
     assert.is_nil(err)
-    assert.is_true(ok)
+    assert.is_truthy(ok)
   end)
   it("accepts just one metrics", function()
     local metrics_input = {
@@ -23,9 +23,9 @@ describe("Plugin: datadog (schema)", function()
         tags = {"K1:V1"}
       }
     }
-    local ok, err = validate_entity({ metrics = metrics_input}, datadog_schema)
+    local ok, err = v({ metrics = metrics_input }, schema_def)
     assert.is_nil(err)
-    assert.is_true(ok)
+    assert.is_truthy(ok)
   end)
   it("rejects if name or stat not defined", function()
     local metrics_input = {
@@ -34,18 +34,16 @@ describe("Plugin: datadog (schema)", function()
         sample_rate = 1
       }
     }
-    local _, err = validate_entity({ metrics = metrics_input}, datadog_schema)
-    assert.not_nil(err)
-    assert.equal("name and stat_type must be defined for all stats", err.metrics)
+    local _, err = v({ metrics = metrics_input }, schema_def)
+    assert.same({ stat_type = "required field missing" }, err.config.metrics)
     local metrics_input = {
       {
         stat_type = "counter",
         sample_rate = 1
       }
     }
-    _, err = validate_entity({ metrics = metrics_input}, datadog_schema)
-    assert.not_nil(err)
-    assert.equal("name and stat_type must be defined for all stats", err.metrics)
+    _, err = v({ metrics = metrics_input }, schema_def)
+    assert.same("required field missing", err.config.metrics.name)
   end)
   it("rejects counters without sample rate", function()
     local metrics_input = {
@@ -54,7 +52,7 @@ describe("Plugin: datadog (schema)", function()
         stat_type = "counter",
       }
     }
-    local _, err = validate_entity({ metrics = metrics_input}, datadog_schema)
+    local _, err = v({ metrics = metrics_input }, schema_def)
     assert.not_nil(err)
   end)
   it("rejects invalid metrics name", function()
@@ -64,9 +62,9 @@ describe("Plugin: datadog (schema)", function()
         stat_type = "counter",
       }
     }
-    local _, err = validate_entity({ metrics = metrics_input}, datadog_schema)
-    assert.not_nil(err)
-    assert.equal("unrecognized metric name: invalid_name", err.metrics)
+    local _, err = v({ metrics = metrics_input }, schema_def)
+    assert.match("expected one of: kong_latency", err.config.metrics.name)
+    assert.equal("required field missing", err.config.metrics.sample_rate)
   end)
   it("rejects invalid stat type", function()
     local metrics_input = {
@@ -75,9 +73,8 @@ describe("Plugin: datadog (schema)", function()
         stat_type = "invalid_stat",
       }
     }
-    local _, err = validate_entity({ metrics = metrics_input}, datadog_schema)
-    assert.not_nil(err)
-    assert.equal("unrecognized stat_type: invalid_stat", err.metrics)
+    local _, err = v({ metrics = metrics_input }, schema_def)
+    assert.match("expected one of: counter", err.config.metrics.stat_type)
   end)
   it("rejects if customer identifier missing", function()
     local metrics_input = {
@@ -87,9 +84,8 @@ describe("Plugin: datadog (schema)", function()
         sample_rate = 1
       }
     }
-    local _, err = validate_entity({ metrics = metrics_input}, datadog_schema)
-    assert.not_nil(err)
-    assert.equal("consumer_identifier must be defined for metric status_count_per_user", err.metrics)
+    local _, err = v({ metrics = metrics_input }, schema_def)
+    assert.equals("required field missing", err.config.metrics.consumer_identifier)
   end)
   it("rejects if metric has wrong stat type", function()
     local metrics_input = {
@@ -98,9 +94,9 @@ describe("Plugin: datadog (schema)", function()
         stat_type = "counter"
       }
     }
-    local _, err = validate_entity({ metrics = metrics_input}, datadog_schema)
+    local _, err = v({ metrics = metrics_input }, schema_def)
     assert.not_nil(err)
-    assert.equal("unique_users metric only works with stat_type 'set'", err.metrics)
+    assert.equal("value must be counter", err.config.metrics.stat_type)
     metrics_input = {
       {
         name = "status_count",
@@ -108,9 +104,9 @@ describe("Plugin: datadog (schema)", function()
         sample_rate = 1
       }
     }
-    _, err = validate_entity({ metrics = metrics_input}, datadog_schema)
+    _, err = v({ metrics = metrics_input }, schema_def)
     assert.not_nil(err)
-    assert.equal("status_count metric only works with stat_type 'counter'", err.metrics)
+    assert.equal("value must be set", err.config.metrics.stat_type)
   end)
   it("rejects if tags malformed", function()
     local metrics_input = {
@@ -121,9 +117,8 @@ describe("Plugin: datadog (schema)", function()
         tags = {"T1:"}
       }
     }
-    local _, err = validate_entity({ metrics = metrics_input}, datadog_schema)
-    assert.not_nil(err)
-    assert.equal("malformed tags: key 'T1:' has no value. Tags must be list of key[:value]", err.metrics)
+    local _, err = v({ metrics = metrics_input }, schema_def)
+    assert.same({ tags = "invalid value: T1:" }, err.config.metrics)
   end)
   it("accept if tags is aempty list", function()
     local metrics_input = {
@@ -134,7 +129,7 @@ describe("Plugin: datadog (schema)", function()
         tags = {}
       }
     }
-    local _, err = validate_entity({ metrics = metrics_input}, datadog_schema)
+    local _, err = v({ metrics = metrics_input }, schema_def)
     assert.is_nil(err)
   end)
 end)
diff --git a/spec/03-plugins/10-key-auth/01-api_spec.lua b/spec/03-plugins/10-key-auth/01-api_spec.lua
index 496d9942e1db..9f714eecc044 100644
--- a/spec/03-plugins/10-key-auth/01-api_spec.lua
+++ b/spec/03-plugins/10-key-auth/01-api_spec.lua
@@ -4,7 +4,7 @@ local utils = require "kong.tools.utils"
 
 
 for _, strategy in helpers.each_strategy() do
-  describe("Plugin: key-auth (API) [" .. strategy .. "]", function()
+  describe("Plugin: key-auth (API) [#" .. strategy .. "]", function()
     local consumer
     local admin_client
     local bp
@@ -290,9 +290,8 @@ for _, strategy in helpers.each_strategy() do
         })
         assert.response(res).has.status(400)
         local body = assert.response(res).has.jsonbody()
-        assert.equal("'hello\\world' is illegal: bad header name " ..
-                     "'hello\\world', allowed characters are A-Z, a-z, 0-9," ..
-                     " '_', and '-'", body.fields.config.key_names)
+        assert.equal("bad header name 'hello\\world', allowed characters are A-Z, a-z, 0-9, '_', and '-'",
+                     body.fields.config.key_names)
       end)
       it("succeeds with valid key_names", function()
         local key_name = "hello-world"
diff --git a/spec/03-plugins/11-basic-auth/04-invalidations_spec.lua b/spec/03-plugins/11-basic-auth/04-invalidations_spec.lua
index 121dd70bf3d2..5c7d862a9c2d 100644
--- a/spec/03-plugins/11-basic-auth/04-invalidations_spec.lua
+++ b/spec/03-plugins/11-basic-auth/04-invalidations_spec.lua
@@ -17,7 +17,7 @@ for _, strategy in helpers.each_strategy() do
       assert(db:truncate("services"))
       assert(db:truncate("consumers"))
       assert(db:truncate("plugins"))
-      assert(db:truncate("hmacauth_credentials"))
+      assert(db:truncate("basicauth_credentials"))
 
       local route = bp.routes:insert {
         hosts = { "basic-auth.com" },
diff --git a/spec/03-plugins/14-cors/02-schema_spec.lua b/spec/03-plugins/14-cors/02-schema_spec.lua
index c9dfb893ed1e..f71acf629a1f 100644
--- a/spec/03-plugins/14-cors/02-schema_spec.lua
+++ b/spec/03-plugins/14-cors/02-schema_spec.lua
@@ -1,36 +1,36 @@
-local validate_entity = require("kong.dao.schemas_validation").validate_entity
-local cors_schema     = require "kong.plugins.cors.schema"
-
+local schema_def = require "kong.plugins.cors.schema"
+local v = require("spec.helpers").validate_plugin_config_schema
 
 describe("cors schema", function()
   it("validates '*'", function()
-    local ok, err = validate_entity({ origins = { "*" } }, cors_schema)
+    local ok, err = v({ origins = { "*" } }, schema_def)
 
-    assert.True(ok)
-    assert.is_nil(err)
+    assert.truthy(ok)
+    assert.falsy(err)
   end)
 
   it("validates what looks like a domain", function()
-    local ok, err = validate_entity({ origins = { "example.com" } }, cors_schema)
+    local ok, err = v({ origins = { "example.com" } }, schema_def)
 
-    assert.True(ok)
-    assert.is_nil(err)
+    assert.truthy(ok)
+    assert.falsy(err)
   end)
 
   it("validates what looks like a regex", function()
-    local ok, err = validate_entity({ origins = { [[.*\.example(?:-foo)?\.com]] } }, cors_schema)
+    local ok, err = v({ origins = { [[.*\.example(?:-foo)?\.com]] } }, schema_def)
 
-    assert.True(ok)
-    assert.is_nil(err)
+    assert.truthy(ok)
+    assert.falsy(err)
   end)
 
   describe("errors", function()
     it("with invalid regex in origins", function()
       local mock_origins = { [[.*.example.com]], [[invalid_**regex]] }
-      local ok, err = validate_entity({ origins = mock_origins }, cors_schema)
+      local ok, err = v({ origins = mock_origins }, schema_def)
 
-      assert.False(ok)
-      assert.equals("origin '" .. mock_origins[2] .. "' is not a valid regex", err.origins)
+      assert.falsy(ok)
+      assert.equals("'invalid_**regex' is not a valid regex",
+                    err.config.origins)
     end)
   end)
 end)
diff --git a/spec/03-plugins/15-request-transformer/01-schema_spec.lua b/spec/03-plugins/15-request-transformer/01-schema_spec.lua
index 47ba18ae9386..ecf1338a89bf 100644
--- a/spec/03-plugins/15-request-transformer/01-schema_spec.lua
+++ b/spec/03-plugins/15-request-transformer/01-schema_spec.lua
@@ -1,19 +1,16 @@
-local schemas                    = require "kong.dao.schemas_validation"
-local request_transformer_schema = require "kong.plugins.request-transformer.schema"
-
-
-local validate_entity            = schemas.validate_entity
+local schema_def = require "kong.plugins.request-transformer.schema"
+local v = require("spec.helpers").validate_plugin_config_schema
 
 
 describe("Plugin: request-transformer (schema)", function()
   it("validates http_method", function()
-    local ok, err = validate_entity({http_method = "GET"}, request_transformer_schema)
-    assert.is_nil(err)
-    assert.True(ok)
+    local ok, err = v({ http_method = "GET" }, schema_def)
+    assert.truthy(ok)
+    assert.falsy(err)
   end)
   it("errors invalid http_method", function()
-    local ok, err = validate_entity({http_method = "HELLO"}, request_transformer_schema)
-    assert.equal("HELLO is not supported", err.http_method)
-    assert.False(ok)
+    local ok, err = v({ http_method = "HELLO!" }, schema_def)
+    assert.falsy(ok)
+    assert.equal("invalid value: HELLO!", err.config.http_method)
   end)
 end)
diff --git a/spec/03-plugins/16-response-transformer/04-filter_spec.lua b/spec/03-plugins/16-response-transformer/04-filter_spec.lua
index 67db9371fe58..75fc9e988cfc 100644
--- a/spec/03-plugins/16-response-transformer/04-filter_spec.lua
+++ b/spec/03-plugins/16-response-transformer/04-filter_spec.lua
@@ -2,7 +2,7 @@ local helpers = require "spec.helpers"
 
 
 for _, strategy in helpers.each_strategy() do
-  describe("Plugin: response-transformer (filter)", function()
+  describe("Plugin: response-transformer (filter) [#" .. strategy .. "]", function()
     local proxy_client
 
     setup(function()
diff --git a/spec/03-plugins/17-jwt/06-schema_spec.lua b/spec/03-plugins/17-jwt/06-schema_spec.lua
index 9dbe040b8720..f63c3e939ed3 100644
--- a/spec/03-plugins/17-jwt/06-schema_spec.lua
+++ b/spec/03-plugins/17-jwt/06-schema_spec.lua
@@ -1,53 +1,49 @@
-local validate_entity = require("kong.dao.schemas_validation").validate_entity
-local jwt_schema = require "kong.plugins.jwt.schema"
+local schema_def = require "kong.plugins.jwt.schema"
+local v = require("spec.helpers").validate_plugin_config_schema
 
 
 describe("Plugin: jwt (schema)", function()
   it("validates 'maximum_expiration'", function()
-    local ok, err = validate_entity({
+    local ok, err = v({
       maximum_expiration = 60,
       claims_to_verify = { "exp", "nbf" },
-    }, jwt_schema)
+    }, schema_def)
 
     assert.is_nil(err)
-    assert.is_true(ok)
+    assert.is_truthy(ok)
   end)
 
   describe("errors", function()
     it("when 'maximum_expiration' is negative", function()
-      local ok, err = validate_entity({
+      local ok, err = v({
         maximum_expiration = -1,
         claims_to_verify = { "exp", "nbf" },
-      }, jwt_schema)
+      }, schema_def)
 
-      assert.is_false(ok)
+      assert.is_falsy(ok)
       assert.same({
-        maximum_expiration = "should be 0 or greater"
-      }, err)
+        maximum_expiration = "value should be between 0 and 31536000"
+      }, err.config)
 
-      local ok, err = validate_entity({
+      local ok, err = v({
         maximum_expiration = -1,
         claims_to_verify = { "nbf" },
-      }, jwt_schema)
+      }, schema_def)
 
-      assert.is_false(ok)
+      assert.is_falsy(ok)
       assert.same({
-        maximum_expiration = "should be 0 or greater"
-      }, err)
+        maximum_expiration = "value should be between 0 and 31536000"
+      }, err.config)
     end)
 
     it("when 'maximum_expiration' is specified without 'exp' in 'claims_to_verify'", function()
-      local ok, err, self_err = validate_entity({
+      local ok, err = v({
         maximum_expiration = 60,
         claims_to_verify = { "nbf" },
-      }, jwt_schema)
+      }, schema_def)
 
-      assert.is_false(ok)
-      assert.is_nil(err)
-      assert.same({
-        message = "claims_to_verify must contain 'exp' when specifying maximum_expiration",
-        schema = true,
-      }, self_err)
+      assert.is_falsy(ok)
+      assert.equals("expected to contain: exp", err.config.claims_to_verify)
     end)
   end)
 end)
diff --git a/spec/03-plugins/18-ip-restriction/01-schema_spec.lua b/spec/03-plugins/18-ip-restriction/01-schema_spec.lua
index 31bb641f0375..3bd8c2c0c206 100644
--- a/spec/03-plugins/18-ip-restriction/01-schema_spec.lua
+++ b/spec/03-plugins/18-ip-restriction/01-schema_spec.lua
@@ -1,60 +1,59 @@
-local schemas_validation = require "kong.dao.schemas_validation"
-local schema             = require "kong.plugins.ip-restriction.schema"
-
-
-local v = schemas_validation.validate_entity
+local schema_def = require "kong.plugins.ip-restriction.schema"
+local v = require("spec.helpers").validate_plugin_config_schema
 
 
 describe("Plugin: ip-restriction (schema)", function()
   it("should accept a valid whitelist", function()
-    assert(v({whitelist = {"127.0.0.1", "127.0.0.2"}}, schema))
+    assert(v({ whitelist = { "127.0.0.1", "127.0.0.2" } }, schema_def))
   end)
   it("should accept a valid blacklist", function()
-    assert(v({blacklist = {"127.0.0.1", "127.0.0.2"}}, schema))
+    assert(v({ blacklist = { "127.0.0.1", "127.0.0.2" } }, schema_def))
   end)
 
   describe("errors", function()
     it("whitelist should not accept invalid types", function()
-      local ok, err = v({whitelist = 12}, schema)
-      assert.False(ok)
-      assert.same({whitelist = "whitelist is not an array"}, err)
+      local ok, err = v({ whitelist = 12 }, schema_def)
+      assert.falsy(ok)
+      assert.same({ whitelist = "expected an array" }, err.config)
     end)
     it("whitelist should not accept invalid IPs", function()
-      local ok, err = v({whitelist = "hello"}, schema)
-      assert.False(ok)
-      assert.same({whitelist = "cannot parse 'hello': Invalid IP"}, err)
+      local ok, err = v({ whitelist = { "hello" } }, schema_def)
+      assert.falsy(ok)
+      assert.same({ whitelist = "cannot parse 'hello': Invalid IP" }, err.config)
 
-      ok, err = v({whitelist = {"127.0.0.1", "127.0.0.2", "hello"}}, schema)
-      assert.False(ok)
-      assert.same({whitelist = "cannot parse 'hello': Invalid IP"}, err)
+      ok, err = v({ whitelist = { "127.0.0.1", "127.0.0.2", "hello" } }, schema_def)
+      assert.falsy(ok)
+      assert.same({ whitelist = "cannot parse 'hello': Invalid IP" }, err.config)
     end)
     it("blacklist should not accept invalid types", function()
-      local ok, err = v({blacklist = 12}, schema)
-      assert.False(ok)
-      assert.same({blacklist = "blacklist is not an array"}, err)
+      local ok, err = v({ blacklist = 12 }, schema_def)
+      assert.falsy(ok)
+      assert.same({ blacklist = "expected an array" }, err.config)
     end)
     it("blacklist should not accept invalid IPs", function()
-      local ok, err = v({blacklist = "hello"}, schema)
-      assert.False(ok)
-      assert.same({blacklist = "cannot parse 'hello': Invalid IP"}, err)
+      local ok, err = v({ blacklist = { "hello" } }, schema_def)
+      assert.falsy(ok)
+      assert.same({ blacklist = "cannot parse 'hello': Invalid IP" }, err.config)
 
-      ok, err = v({blacklist = {"127.0.0.1", "127.0.0.2", "hello"}}, schema)
-      assert.False(ok)
-      assert.same({blacklist = "cannot parse 'hello': Invalid IP"}, err)
+      ok, err = v({ blacklist = { "127.0.0.1", "127.0.0.2", "hello" } }, schema_def)
+      assert.falsy(ok)
+      assert.same({ blacklist = "cannot parse 'hello': Invalid IP" }, err.config)
     end)
     it("should not accept both a whitelist and a blacklist", function()
-      local t = {blacklist = {"127.0.0.1"}, whitelist = {"127.0.0.2"}}
-      local ok, err, self_err = v(t, schema)
-      assert.False(ok)
-      assert.is_nil(err)
-      assert.equal("you cannot set both a whitelist and a blacklist", self_err.message)
+      local t = { blacklist = { "127.0.0.1" }, whitelist = { "127.0.0.2" } }
+      local ok, err = v(t, schema_def)
+      assert.falsy(ok)
+      assert.same({ "only one of these fields must be non-empty: 'config.whitelist', 'config.blacklist'" }, err["@entity"])
     end)
     it("should not accept both empty whitelist and blacklist", function()
-      local t = {blacklist = {}, whitelist = {}}
-      local ok, err, self_err = v(t, schema)
-      assert.False(ok)
-      assert.is_nil(err)
-      assert.equal("you must set at least a whitelist or blacklist", self_err.message)
+      local t = { blacklist = {}, whitelist = {} }
+      local ok, err = v(t, schema_def)
+      assert.falsy(ok)
+      local expected = {
+        "only one of these fields must be non-empty: 'config.whitelist', 'config.blacklist'",
+        "at least one of these fields must be non-empty: 'config.whitelist', 'config.blacklist'",
+      }
+      assert.same(expected, err["@entity"])
     end)
   end)
 end)
diff --git a/spec/03-plugins/20-hmac-auth/01-schema_spec.lua b/spec/03-plugins/20-hmac-auth/01-schema_spec.lua
index 8e36ab49c00a..87f6f22ac51a 100644
--- a/spec/03-plugins/20-hmac-auth/01-schema_spec.lua
+++ b/spec/03-plugins/20-hmac-auth/01-schema_spec.lua
@@ -1,27 +1,26 @@
-local schemas          = require "kong.dao.schemas_validation"
-local hmac_auth_schema = require "kong.plugins.hmac-auth.schema"
-local validate_entity  = schemas.validate_entity
-
+local schema_def = require "kong.plugins.hmac-auth.schema"
+local v = require("spec.helpers").validate_plugin_config_schema
 
 describe("Plugin: hmac-auth (schema)", function()
   it("accepts empty config", function()
-    local ok, err = validate_entity({}, hmac_auth_schema)
+    local ok, err = v({}, schema_def)
+    assert.is_truthy(ok)
     assert.is_nil(err)
-    assert.is_true(ok)
   end)
   it("accepts correct clock skew", function()
-    local ok, err = validate_entity({clock_skew = 10}, hmac_auth_schema)
+    local ok, err = v({ clock_skew = 10 }, schema_def)
+    assert.is_truthy(ok)
     assert.is_nil(err)
-    assert.is_true(ok)
   end)
   it("errors with negative clock skew", function()
-    local ok, err = validate_entity({clock_skew = -10}, hmac_auth_schema)
-    assert.equal("Clock Skew should be positive", err.clock_skew)
-    assert.is_false(ok)
+    local ok, err = v({ clock_skew = -10 }, schema_def)
+    assert.is_falsy(ok)
+    assert.equal("value must be greater than 0", err.config.clock_skew)
   end)
   it("errors with wrong algorithm", function()
-    local ok, err = validate_entity({algorithms = {"sha1024"}}, hmac_auth_schema)
-    assert.equal('"sha1024" is not allowed. Allowed values are: "hmac-sha1", "hmac-sha256", "hmac-sha384", "hmac-sha512"', err.algorithms)
-    assert.is_false(ok)
+    local ok, err = v({ algorithms = { "sha1024" } }, schema_def)
+    assert.is_falsy(ok)
+    assert.equal("expected one of: hmac-sha1, hmac-sha256, hmac-sha384, hmac-sha512",
+                 err.config.algorithms)
   end)
 end)
diff --git a/spec/03-plugins/23-aws-lambda/02-schema_spec.lua b/spec/03-plugins/23-aws-lambda/02-schema_spec.lua
index bf1962e98182..be70505dfc3f 100644
--- a/spec/03-plugins/23-aws-lambda/02-schema_spec.lua
+++ b/spec/03-plugins/23-aws-lambda/02-schema_spec.lua
@@ -1,49 +1,51 @@
-local aws_lambda_schema = require "kong.plugins.aws-lambda.schema"
-local schemas           = require "kong.dao.schemas_validation"
-local utils             = require "kong.tools.utils"
+local schema_def = require "kong.plugins.aws-lambda.schema"
+local utils = require "kong.tools.utils"
+local validate_plugin_config_schema = require("spec.helpers").validate_plugin_config_schema
 
 
-local validate_entity   = schemas.validate_entity
+local DEFAULTS = {
+  timeout          = 60000,
+  keepalive        = 60000,
+  aws_key          = "my-key",
+  aws_secret       = "my-secret",
+  aws_region       = "us-east-1",
+  function_name    = "my-function",
+  invocation_type  = "RequestResponse",
+  log_type         = "Tail",
+  port             = 443,
+}
 
 
-describe("Plugin: AWS Lambda (schema)", function()
-  local DEFAULTS = {
-    timeout          = 60000,
-    keepalive        = 60000,
-    aws_key          = "my-key",
-    aws_secret       = "my-secret",
-    aws_region       = "us-east-1",
-    function_name    = "my-function",
-    invocation_type  = "RequestResponse",
-    log_type         = "Tail",
-    port             = 443,
-  }
+local function v(config)
+  return validate_plugin_config_schema(
+    utils.table_merge(DEFAULTS, config),
+    schema_def
+  )
+end
+
 
+describe("Plugin: AWS Lambda (schema)", function()
   it("accepts nil Unhandled Response Status Code", function()
-    local entity = utils.table_merge(DEFAULTS, { unhandled_status = nil })
-    local ok, err = validate_entity(entity, aws_lambda_schema)
+    local ok, err = v({ unhandled_status = nil })
+    assert.truthy(ok)
     assert.is_nil(err)
-    assert.True(ok)
   end)
 
   it("accepts correct Unhandled Response Status Code", function()
-    local entity = utils.table_merge(DEFAULTS, { unhandled_status = 412 })
-    local ok, err = validate_entity(entity, aws_lambda_schema)
+    local ok, err = v({ unhandled_status = 412 })
+    assert.truthy(ok)
     assert.is_nil(err)
-    assert.True(ok)
   end)
 
   it("errors with Unhandled Response Status Code less than 100", function()
-    local entity = utils.table_merge(DEFAULTS, { unhandled_status = 99 })
-    local ok, err = validate_entity(entity, aws_lambda_schema)
-    assert.equal("unhandled_status must be within 100 - 999.", err.unhandled_status)
-    assert.False(ok)
+    local ok, err = v({ unhandled_status = 99 })
+    assert.falsy(ok)
+    assert.equal("value should be between 100 and 999", err.config.unhandled_status)
   end)
 
   it("errors with Unhandled Response Status Code greater than 999", function()
-    local entity = utils.table_merge(DEFAULTS, { unhandled_status = 1000 })
-    local ok, err = validate_entity(entity, aws_lambda_schema)
-    assert.equal("unhandled_status must be within 100 - 999.", err.unhandled_status)
-    assert.False(ok)
+    local ok, err = v({ unhandled_status = 1000 })
+    assert.falsy(ok)
+    assert.equal("value should be between 100 and 999", err.config.unhandled_status)
   end)
 end)
diff --git a/spec/03-plugins/24-rate-limiting/01-schema_spec.lua b/spec/03-plugins/24-rate-limiting/01-schema_spec.lua
index d9a0e7af29bb..a2ae564dd980 100644
--- a/spec/03-plugins/24-rate-limiting/01-schema_spec.lua
+++ b/spec/03-plugins/24-rate-limiting/01-schema_spec.lua
@@ -1,41 +1,41 @@
-local schemas         = require "kong.dao.schemas_validation"
-local plugin_schema   = require "kong.plugins.rate-limiting.schema"
-local validate_entity = schemas.validate_entity
+local schema_def = require "kong.plugins.rate-limiting.schema"
+local v = require("spec.helpers").validate_plugin_config_schema
 
 
 describe("Plugin: rate-limiting (schema)", function()
   it("proper config validates", function()
-    local config = {second = 10}
-    local ok, _, err = validate_entity(config, plugin_schema)
-    assert.True(ok)
+    local config = { second = 10 }
+    local ok, _, err = v(config, schema_def)
+    assert.truthy(ok)
     assert.is_nil(err)
   end)
   it("proper config validates (bis)", function()
-    local config = {second = 10, minute = 20, hour = 30, day = 40, month = 50, year = 60}
-    local ok, _, err = validate_entity(config, plugin_schema)
-    assert.True(ok)
+    local config = { second = 10, minute = 20, hour = 30, day = 40, month = 50, year = 60 }
+    local ok, _, err = v(config, schema_def)
+    assert.truthy(ok)
     assert.is_nil(err)
   end)
 
   describe("errors", function()
     it("limits: smaller unit is less than bigger unit", function()
-      local config = {second = 20, hour = 10}
-      local ok, _, err = validate_entity(config, plugin_schema)
-      assert.False(ok)
-      assert.equal("The limit for hour cannot be lower than the limit for second", err.message)
+      local config = { second = 20, hour = 10 }
+      local ok, err = v(config, schema_def)
+      assert.falsy(ok)
+      assert.equal("The limit for hour(10.0) cannot be lower than the limit for second(20.0)", err.config)
     end)
     it("limits: smaller unit is less than bigger unit (bis)", function()
-      local config = {second = 10, minute = 20, hour = 30, day = 40, month = 60, year = 50}
-      local ok, _, err = validate_entity(config, plugin_schema)
-      assert.False(ok)
-      assert.equal("The limit for year cannot be lower than the limit for month", err.message)
+      local config = { second = 10, minute = 20, hour = 30, day = 40, month = 60, year = 50 }
+      local ok, err = v(config, schema_def)
+      assert.falsy(ok)
+      assert.equal("The limit for year(50.0) cannot be lower than the limit for month(60.0)", err.config)
     end)
 
     it("invalid limit", function()
       local config = {}
-      local ok, _, err = validate_entity(config, plugin_schema)
-      assert.False(ok)
-      assert.equal("You need to set at least one limit: second, minute, hour, day, month, year", err.message)
+      local ok, err = v(config, schema_def)
+      assert.falsy(ok)
+      assert.same({"at least one of these fields must be non-empty: 'config.second', 'config.minute', 'config.hour', 'config.day', 'config.month', 'config.year'" },
+                  err["@entity"])
     end)
   end)
 end)
diff --git a/spec/03-plugins/24-rate-limiting/04-access_spec.lua b/spec/03-plugins/24-rate-limiting/04-access_spec.lua
index 2de1903c95e6..61d458b111bc 100644
--- a/spec/03-plugins/24-rate-limiting/04-access_spec.lua
+++ b/spec/03-plugins/24-rate-limiting/04-access_spec.lua
@@ -76,8 +76,8 @@ for _, strategy in helpers.each_strategy() do
         }
 
         bp.keyauth_credentials:insert {
-          key         = "apikey122",
-          consumer_id = consumer1.id,
+          key      = "apikey122",
+          consumer = { id = consumer1.id },
         }
 
         local consumer2 = bp.consumers:insert {
@@ -85,13 +85,13 @@ for _, strategy in helpers.each_strategy() do
         }
 
         bp.keyauth_credentials:insert {
-          key         = "apikey123",
-          consumer_id = consumer2.id,
+          key      = "apikey123",
+          consumer = { id = consumer2.id },
         }
 
         bp.keyauth_credentials:insert {
-          key         = "apikey333",
-          consumer_id = consumer2.id,
+          key      = "apikey333",
+          consumer = { id = consumer2.id },
         }
 
         local route1 = bp.routes:insert {
@@ -636,8 +636,8 @@ for _, strategy in helpers.each_strategy() do
         bp.key_auth_plugins:insert()
 
         bp.keyauth_credentials:insert {
-          key         = "apikey125",
-          consumer_id = consumer.id,
+          key      = "apikey125",
+          consumer = { id = consumer.id },
         }
 
         -- just consumer, no no route or service
diff --git a/spec/03-plugins/25-response-rate-limiting/01-schema_spec.lua b/spec/03-plugins/25-response-rate-limiting/01-schema_spec.lua
index ed1d42ac838f..9b07aa41bd41 100644
--- a/spec/03-plugins/25-response-rate-limiting/01-schema_spec.lua
+++ b/spec/03-plugins/25-response-rate-limiting/01-schema_spec.lua
@@ -1,54 +1,56 @@
-local schemas         = require "kong.dao.schemas_validation"
-local plugin_schema   = require "kong.plugins.response-ratelimiting.schema"
-
-
-local validate_entity = schemas.validate_entity
+local schema_def = require "kong.plugins.response-ratelimiting.schema"
+local v = require("spec.helpers").validate_plugin_config_schema
 
 
 describe("Plugin: response-rate-limiting (schema)", function()
   it("proper config validates", function()
     local config = {limits = {video = {second = 1}}}
-    local ok, err = validate_entity(config, plugin_schema)
-    assert.True(ok)
+    local ok, err = v(config, schema_def)
+    assert.truthy(ok)
     assert.is_nil(err)
   end)
   it("proper config validates (bis)", function()
     local config = {limits = {video = {second = 1, minute = 2, hour = 3, day = 4, month = 5, year = 6}}}
-    local ok, err = validate_entity(config, plugin_schema)
-    assert.True(ok)
+    local ok, err = v(config, schema_def)
+    assert.truthy(ok)
     assert.is_nil(err)
   end)
 
   describe("errors", function()
     it("empty config", function()
-      local config = {}
-      local ok, _, err = validate_entity(config, plugin_schema)
-      assert.False(ok)
-      assert.equal("You need to set at least one limit name", err.message)
+      local ok, err = v({}, schema_def)
+      assert.falsy(ok)
+      assert.equal("required field missing", err.config.limits)
+
+      local ok, err = v({ limits = {} }, schema_def)
+      assert.falsy(ok)
+      assert.equal("length must be at least 1", err.config.limits)
     end)
     it("invalid limit", function()
       local config = {limits = {video = {seco = 1}}}
-      local ok, err = validate_entity(config, plugin_schema)
-      assert.False(ok)
-      assert.equal("seco is an unknown field", err["limits.video.seco"])
+      local ok, err = v(config, schema_def)
+      assert.falsy(ok)
+      assert.equal("unknown field", err.config.limits.seco)
     end)
     it("limits: smaller unit is less than bigger unit", function()
       local config = {limits = {video = {second = 2, minute = 1}}}
-      local ok, _, self_check_err = validate_entity(config, plugin_schema)
-      assert.False(ok)
-      assert.equal("The limit for minute cannot be lower than the limit for second", self_check_err.message)
+      local ok, err = v(config, schema_def)
+      assert.falsy(ok)
+      assert.equal("the limit for minute(1.0) cannot be lower than the limit for second(2.0)",
+                   err.config.limits)
     end)
     it("limits: smaller unit is less than bigger unit (bis)", function()
       local config = {limits = {video = {second = 1, minute = 2, hour = 3, day = 4, month = 6, year = 5}}}
-      local ok, _, self_check_err = validate_entity(config, plugin_schema)
-      assert.False(ok)
-      assert.equal("The limit for year cannot be lower than the limit for month", self_check_err.message)
+      local ok, err = v(config, schema_def)
+      assert.falsy(ok)
+      assert.equal("the limit for year(5.0) cannot be lower than the limit for month(6.0)",
+                   err.config.limits)
     end)
     it("invaldid unit type", function()
       local config = {limits = {second = 10}}
-      local ok, err = validate_entity(config, plugin_schema)
-      assert.False(ok)
-      assert.equal("second is not a table", err["limits.second"])
+      local ok, err = v(config, schema_def)
+      assert.falsy(ok)
+      assert.equal("expected a record", err.config.limits)
     end)
   end)
 end)
diff --git a/spec/03-plugins/25-response-rate-limiting/03-api_spec.lua b/spec/03-plugins/25-response-rate-limiting/03-api_spec.lua
index a4da730d1136..5ccfe2d42490 100644
--- a/spec/03-plugins/25-response-rate-limiting/03-api_spec.lua
+++ b/spec/03-plugins/25-response-rate-limiting/03-api_spec.lua
@@ -59,10 +59,10 @@ for _, strategy in helpers.each_strategy() do
           name = "schema violation",
           fields = {
             config = {
-              limits = "length must be at least 1",
+              limits = "required field missing",
             }
           },
-          message = "schema violation (config.limits: length must be at least 1)",
+          message = "schema violation (config.limits: required field missing)",
         }, json)
       end)
       it("accepts proper config", function()
diff --git a/spec/03-plugins/25-response-rate-limiting/04-access_spec.lua b/spec/03-plugins/25-response-rate-limiting/04-access_spec.lua
index 97f05b9aaacd..190761e049d7 100644
--- a/spec/03-plugins/25-response-rate-limiting/04-access_spec.lua
+++ b/spec/03-plugins/25-response-rate-limiting/04-access_spec.lua
@@ -75,20 +75,20 @@ for _, strategy in helpers.each_strategy() do
 
         local consumer1 = bp.consumers:insert {custom_id = "provider_123"}
         bp.keyauth_credentials:insert {
-          key         = "apikey123",
-          consumer_id = consumer1.id
+          key      = "apikey123",
+          consumer = { id = consumer1.id },
         }
 
         local consumer2 = bp.consumers:insert {custom_id = "provider_124"}
         bp.keyauth_credentials:insert {
-          key         = "apikey124",
-          consumer_id = consumer2.id
+          key      = "apikey124",
+          consumer = { id = consumer2.id },
         }
 
         local consumer3 = bp.consumers:insert {custom_id = "provider_125"}
         bp.keyauth_credentials:insert {
-          key         = "apikey125",
-          consumer_id = consumer3.id
+          key      = "apikey125",
+          consumer = { id = consumer3.id },
         }
 
         local service1 = bp.services:insert()
@@ -772,8 +772,8 @@ for _, strategy in helpers.each_strategy() do
         bp.key_auth_plugins:insert()
 
         bp.keyauth_credentials:insert {
-          key         = "apikey125",
-          consumer_id = consumer.id,
+          key      = "apikey125",
+          consumer = { id = consumer.id },
         }
 
         -- just consumer, no no route or service
diff --git a/spec/03-plugins/26-oauth2/01-schema_spec.lua b/spec/03-plugins/26-oauth2/01-schema_spec.lua
index f02e72aaea59..d090a81240ef 100644
--- a/spec/03-plugins/26-oauth2/01-schema_spec.lua
+++ b/spec/03-plugins/26-oauth2/01-schema_spec.lua
@@ -1,8 +1,8 @@
 local helpers         = require "spec.helpers"
-local validate_entity = require("kong.dao.schemas_validation").validate_entity
 local utils           = require "kong.tools.utils"
+local schema_def = require "kong.plugins.oauth2.schema"
+local v = require("spec.helpers").validate_plugin_config_schema
 
-local oauth2_schema   = require "kong.plugins.oauth2.schema"
 local fmt = string.format
 
 for _, strategy in helpers.each_strategy() do
@@ -14,68 +14,70 @@ for _, strategy in helpers.each_strategy() do
     local oauth2_tokens_schema = db.oauth2_tokens.schema
 
     it("does not require `scopes` when `mandatory_scope` is false", function()
-      local ok, errors = validate_entity({enable_authorization_code = true, mandatory_scope = false}, oauth2_schema)
-      assert.True(ok)
-      assert.is_nil(errors)
+      local ok, errors = v({enable_authorization_code = true, mandatory_scope = false}, schema_def)
+      assert.is_truthy(ok)
+      assert.is_falsy(errors)
     end)
     it("valid when both `scopes` when `mandatory_scope` are given", function()
-      local ok, errors = validate_entity({enable_authorization_code = true, mandatory_scope = true, scopes = {"email", "info"}}, oauth2_schema)
-      assert.True(ok)
-      assert.is_nil(errors)
+      local ok, errors = v({enable_authorization_code = true, mandatory_scope = true, scopes = {"email", "info"}}, schema_def)
+      assert.truthy(ok)
+      assert.is_falsy(errors)
     end)
     it("autogenerates `provision_key` when not given", function()
       local t = {enable_authorization_code = true, mandatory_scope = true, scopes = {"email", "info"}}
-      local ok, errors = validate_entity(t, oauth2_schema)
-      assert.True(ok)
-      assert.is_nil(errors)
-      assert.truthy(t.provision_key)
-      assert.equal(32, t.provision_key:len())
+      local t2, errors = v(t, schema_def)
+      assert.is_falsy(errors)
+      assert.truthy(t2.config.provision_key)
+      assert.equal(32, t2.config.provision_key:len())
     end)
     it("does not autogenerate `provision_key` when it is given", function()
       local t = {enable_authorization_code = true, mandatory_scope = true, scopes = {"email", "info"}, provision_key = "hello"}
-      local ok, errors = validate_entity(t, oauth2_schema)
-      assert.True(ok)
-      assert.is_nil(errors)
+      local ok, errors = v(t, schema_def)
+      assert.truthy(ok)
+      assert.is_falsy(errors)
       assert.truthy(t.provision_key)
       assert.equal("hello", t.provision_key)
     end)
     it("sets default `auth_header_name` when not given", function()
       local t = {enable_authorization_code = true, mandatory_scope = true, scopes = {"email", "info"}}
-      local ok, errors = validate_entity(t, oauth2_schema)
-      assert.True(ok)
-      assert.is_nil(errors)
-      assert.truthy(t.provision_key)
-      assert.equal(32, t.provision_key:len())
-      assert.equal("authorization", t.auth_header_name)
+      local t2, errors = v(t, schema_def)
+      assert.truthy(t2)
+      assert.is_falsy(errors)
+      assert.truthy(t2.config.provision_key)
+      assert.equal(32, t2.config.provision_key:len())
+      assert.equal("authorization", t2.config.auth_header_name)
     end)
     it("does not set default value for `auth_header_name` when it is given", function()
       local t = {enable_authorization_code = true, mandatory_scope = true, scopes = {"email", "info"}, provision_key = "hello",
       auth_header_name="custom_header_name"}
-      local ok, errors = validate_entity(t, oauth2_schema)
-      assert.True(ok)
-      assert.is_nil(errors)
-      assert.truthy(t.provision_key)
-      assert.equal("hello", t.provision_key)
-      assert.equal("custom_header_name", t.auth_header_name)
+      local t2, errors = v(t, schema_def)
+      assert.truthy(t2)
+      assert.is_falsy(errors)
+      assert.truthy(t2.config.provision_key)
+      assert.equal("hello", t2.config.provision_key)
+      assert.equal("custom_header_name", t2.config.auth_header_name)
     end)
     it("sets refresh_token_ttl to default value if not set", function()
       local t = {enable_authorization_code = true, mandatory_scope = false}
-      local ok, errors = validate_entity(t, oauth2_schema)
-      assert.True(ok)
-      assert.is_nil(errors)
-      assert.equal(1209600, t.refresh_token_ttl)
+      local t2, errors = v(t, schema_def)
+      assert.truthy(t2)
+      assert.is_falsy(errors)
+      assert.equal(1209600, t2.config.refresh_token_ttl)
     end)
 
     describe("errors", function()
       it("requires at least one flow", function()
-        local ok, _, err = validate_entity({}, oauth2_schema)
-        assert.False(ok)
-        assert.equal("You need to enable at least one OAuth flow", tostring(err))
+        local ok, err = v({}, schema_def)
+        assert.is_falsy(ok)
+
+        assert.same("at least one of these fields must be true: enable_authorization_code, enable_implicit_grant, enable_client_credentials, enable_password_grant",
+                     err.config)
       end)
       it("requires `scopes` when `mandatory_scope` is true", function()
-        local ok, errors = validate_entity({enable_authorization_code = true, mandatory_scope = true}, oauth2_schema)
-        assert.False(ok)
-        assert.equal("To set a mandatory scope you also need to create available scopes", errors.mandatory_scope)
+        local ok, err = v({enable_authorization_code = true, mandatory_scope = true}, schema_def)
+        assert.is_falsy(ok)
+        assert.equal("required field missing",
+                     err.config.scopes)
       end)
       it("errors when given an invalid service_id on oauth tokens", function()
         local ok, err_t = oauth2_tokens_schema:validate_insert({
@@ -113,7 +115,7 @@ for _, strategy in helpers.each_strategy() do
         assert.is_nil(err_t)
       end)
 
-      it("#errors when given an invalid service_id on oauth authorization codes", function()
+      it("errors when given an invalid service_id on oauth authorization codes", function()
         local ok, err_t = oauth2_authorization_codes_schema:validate_insert({
           credential = { id = "foo" },
           service = { id = "bar" },
@@ -173,8 +175,8 @@ for _, strategy in helpers.each_strategy() do
 
         ok, err, err_t = db.services:delete({ id = service.id })
         assert.truthy(ok)
-        assert.is_nil(err_t)
-        assert.is_nil(err)
+        assert.is_falsy(err_t)
+        assert.is_falsy(err)
 
         -- no more service
         service, err = db.services:select({ id = service.id })
diff --git a/spec/03-plugins/27-request-termination/01-schema_spec.lua b/spec/03-plugins/27-request-termination/01-schema_spec.lua
index facd891785b9..fa048ef018a9 100644
--- a/spec/03-plugins/27-request-termination/01-schema_spec.lua
+++ b/spec/03-plugins/27-request-termination/01-schema_spec.lua
@@ -1,59 +1,55 @@
-local schemas_validation = require "kong.dao.schemas_validation"
-local schema             = require "kong.plugins.request-termination.schema"
-
-
-local v = schemas_validation.validate_entity
-
+local schema_def = require "kong.plugins.request-termination.schema"
+local v = require("spec.helpers").validate_plugin_config_schema
 
 describe("Plugin: request-termination (schema)", function()
   it("should accept a valid status_code", function()
-    assert(v({status_code = 404}, schema))
+    assert(v({status_code = 404}, schema_def))
   end)
   it("should accept a valid message", function()
-    assert(v({message = "Not found"}, schema))
+    assert(v({message = "Not found"}, schema_def))
   end)
   it("should accept a valid content_type", function()
-    assert(v({content_type = "text/html",body = "<body><h1>Not found</h1>"}, schema))
+    assert(v({content_type = "text/html",body = "<body><h1>Not found</h1>"}, schema_def))
   end)
   it("should accept a valid body", function()
-    assert(v({body = "<body><h1>Not found</h1>"}, schema))
+    assert(v({body = "<body><h1>Not found</h1>"}, schema_def))
   end)
 
   describe("errors", function()
     it("status_code should only accept numbers", function()
-      local ok, err = v({status_code = "abcd"}, schema)
-      assert.same({status_code = "status_code is not a number"}, err)
-      assert.False(ok)
+      local ok, err = v({status_code = "abcd"}, schema_def)
+      assert.falsy(ok)
+      assert.same("expected an integer", err.config.status_code)
     end)
     it("status_code < 100", function()
-      local ok, _, err = v({status_code = "99"}, schema)
-      assert.False(ok)
-      assert.same("status_code must be between 100 .. 599", err.message)
+      local ok, err = v({status_code = 99}, schema_def)
+      assert.falsy(ok)
+      assert.same("value should be between 100 and 599", err.config.status_code)
     end)
     it("status_code > 599", function()
-      local ok, _, err = v({status_code = "600"}, schema)
-      assert.False(ok)
-      assert.same("status_code must be between 100 .. 599", err.message)
+      local ok,err = v({status_code = 600}, schema_def)
+      assert.falsy(ok)
+      assert.same("value should be between 100 and 599", err.config.status_code)
     end)
-    it("message with body", function()
-      local ok, _, err = v({message = "error", body = "test"}, schema)
-      assert.False(ok)
-      assert.same("message cannot be used with content_type or body", err.message)
+    it("#message with body", function()
+      local ok, err = v({message = "error", body = "test"}, schema_def)
+      assert.falsy(ok)
+      assert.same("message cannot be used with content_type or body", err.config)
     end)
     it("message with body and content_type", function()
-      local ok, _, err = v({message = "error", content_type="text/html", body = "test"}, schema)
-      assert.False(ok)
-      assert.same("message cannot be used with content_type or body", err.message)
+      local ok, err = v({message = "error", content_type="text/html", body = "test"}, schema_def)
+      assert.falsy(ok)
+      assert.same("message cannot be used with content_type or body", err.config)
     end)
     it("message with content_type", function()
-      local ok, _, err = v({message = "error", content_type="text/html"}, schema)
-      assert.False(ok)
-      assert.same("message cannot be used with content_type or body", err.message)
+      local ok, err = v({message = "error", content_type="text/html"}, schema_def)
+      assert.falsy(ok)
+      assert.same("message cannot be used with content_type or body", err.config)
     end)
     it("content_type without body", function()
-      local ok, _, err = v({content_type="text/html"}, schema)
-      assert.False(ok)
-      assert.same("content_type requires a body", err.message)
+      local ok, err = v({content_type="text/html"}, schema_def)
+      assert.falsy(ok)
+      assert.same("content_type requires a body", err.config)
     end)
   end)
 end)
diff --git a/spec/fixtures/custom_plugins/kong/plugins/dummy/schema.lua b/spec/fixtures/custom_plugins/kong/plugins/dummy/schema.lua
index 4985df3482fe..56d7013b667c 100644
--- a/spec/fixtures/custom_plugins/kong/plugins/dummy/schema.lua
+++ b/spec/fixtures/custom_plugins/kong/plugins/dummy/schema.lua
@@ -1,7 +1,13 @@
 return {
+  name = "dummy",
   fields = {
-    resp_header_value = { type = "string", default = "1" },
-    append_body = { type = "string" },
-    resp_code = { type = "number" },
-  }
+    { config = {
+        type = "record",
+        nullable = false,
+        fields = {
+          { resp_header_value = { type = "string", default = "1" }, },
+          { append_body = { type = "string" }, },
+          { resp_code = { type = "number" }, },
+    }, }, },
+  },
 }
diff --git a/spec/fixtures/custom_plugins/kong/plugins/rewriter/schema.lua b/spec/fixtures/custom_plugins/kong/plugins/rewriter/schema.lua
index 7060f58f9d27..2be297f3867b 100644
--- a/spec/fixtures/custom_plugins/kong/plugins/rewriter/schema.lua
+++ b/spec/fixtures/custom_plugins/kong/plugins/rewriter/schema.lua
@@ -1,9 +1,13 @@
 return {
+  name = "rewriter",
   fields = {
-    value = { type = "string" },
-    extra = {
-      type    = "string",
-      default = "extra",
-    }
+    { config = {
+        type = "record",
+        nullable = false,
+        fields = {
+          { value = { type = "string" }, },
+          { extra = { type = "string", default = "extra" }, },
+        },
+    }, },
   }
 }
diff --git a/spec/helpers.lua b/spec/helpers.lua
index 944742ef1e4d..0079dfb7a93d 100644
--- a/spec/helpers.lua
+++ b/spec/helpers.lua
@@ -15,6 +15,11 @@ local MOCK_UPSTREAM_HOSTNAME = "localhost"
 local MOCK_UPSTREAM_PORT = 15555
 local MOCK_UPSTREAM_SSL_PORT = 15556
 
+local consumers_schema_def = require "kong.db.schema.entities.consumers"
+local services_schema_def = require "kong.db.schema.entities.services"
+local plugins_schema_def = require "kong.db.schema.entities.plugins"
+local routes_schema_def = require "kong.db.schema.entities.routes"
+local apis_schema_def = require "kong.db.schema.entities.apis"
 local conf_loader = require "kong.conf_loader"
 local DAOFactory = require "kong.dao.factory"
 local Blueprints = require "spec.fixtures.blueprints"
@@ -24,6 +29,7 @@ local pl_path = require "pl.path"
 local pl_file = require "pl.file"
 local pl_dir = require "pl.dir"
 local pl_Set = require "pl.Set"
+local Schema = require "kong.db.schema"
 local cjson = require "cjson.safe"
 local utils = require "kong.tools.utils"
 local http = require "resty.http"
@@ -1157,6 +1163,34 @@ local function get_running_conf(prefix)
   return conf_loader(default_conf.kong_env)
 end
 
+
+-- Prepopulate Schema's cache
+Schema.new(consumers_schema_def)
+Schema.new(services_schema_def)
+Schema.new(routes_schema_def)
+Schema.new(apis_schema_def)
+
+local plugins_schema = assert(Schema.new(plugins_schema_def))
+
+local function validate_plugin_config_schema(config, schema_def)
+  assert(plugins_schema:new_subschema(schema_def.name, schema_def))
+  local entity = {
+    id = utils.uuid(),
+    name = schema_def.name,
+    config = config
+  }
+  local entity_to_insert, err = plugins_schema:process_auto_fields(entity, "insert")
+  if err then
+    return nil, err
+  end
+  local _, err = plugins_schema:validate_insert(entity_to_insert)
+  if err then return
+    nil, err
+  end
+  return entity_to_insert
+end
+
+
 ----------
 -- Exposed
 ----------
@@ -1209,6 +1243,7 @@ return {
   clean_prefix = clean_prefix,
   wait_for_invalidation = wait_for_invalidation,
   each_strategy = each_strategy,
+  validate_plugin_config_schema = validate_plugin_config_schema,
 
   -- miscellaneous
   intercept = intercept,