Conflicting Routes cause 405 Error

[mathiasmah]

Describe the bug I ran into an issue, that the Validator returned a 405 Error for an existing Route. The Problem is that there is a conflict between two routes, where one is an explicit path and the other looks the same but contains a path parameter.

Here are the routes that cause the issue:

[POST | DELETE] /v1/products/{id}/{flagName}

[GET] [/v1/products/{idordivanr}/list

The Validator matches for calls that should go to the second route, also the first one, and then gives the error since GET is not a valid method. In express, I can work around this issue by the order the routes are registered, but for the validator the order does not matter, it always searches the route alphabetically.

I think I found the relevant lines in the source code: https://github.com/cdimascio/express-openapi-validator/blob/5928ac5a959ff3b532c05c63cd464229eedc0e9e/src/middlewares/openapi.metadata.ts#L70

We finally managed to work around this, by changing the parameter of the second route, so that it alphabetically appears before the first route. (idordivanr -> divanrorid)

So I'm not sure if this is even a bug, or by design. I just wanted to let you know that I ran in to this issue, and I am curious what the reasons are for this. What does the Open API Specification say about this? I didn't really find anything. Maybe this is ready just bad design by my side? Because nobody else seems to be having this issue.