openapi-spec-validator icon indicating copy to clipboard operation
openapi-spec-validator copied to clipboard

Validation of required fields inconsistent

Open Archelyst opened this issue 1 year ago • 0 comments

The validation of the required keyword does not make sense as it is implemented right now, IMHO.

  1. It really does not make any sense to list properties in required that do not exist.
  2. If you want to use it with allOf and therefore have properties in required that do not exist, there are already precautions (#154).
  3. Currently, there is no validation error in the standard case but as soon as I have allOf in my schema, there is a validation error. That is inconsistent. The PR that breaks it: #312
  4. In $referenced schemas, the validation does not take effect either.

One of the main reasons why this should urgently be validated (as was in version 0.7.0) is that validators (that use the specification to validate requests/responses) will fail if there is e.g. a typo in one of the entries in required. And now there is no way to detect that.

In general, the OpenAPI/JsonSchema specification is quite relaxed. If only the bare minimum should be validated, this is probably not the only validation that can basically be removed completely.

My take on this:

  1. Best case: Throw validation errors for things that are obvious errors (like specifying a field as required that does not even exist).
  2. Second best option: make it configurable ("strict mode") or filterable (error IDs to exclude, filter levels, ...).
  3. Absolutely necessary minium: make it consistent.

I'd be willing to provide a PR. But since this has been going back and forth I'd like a decision first, where this is going.

Archelyst avatar Aug 09 '24 11:08 Archelyst