readOnly is not respected on $ref

[callebjorkell]

$ref objects that are marked as readOnly, and are not relevant for requests, still show up in the documentation and cause confusion.

Current Behavior

For any property marked as readOnly, that also uses a $ref, the read-only marking is not reflected in the documentation. The readOnly is ignored, and the element shows up in requestBody elements, as well as in examples. In the schema section, the element is rendered without a "read-only" label.

Expected Behavior

The property set to readOnly should be omitted from request bodies, examples and be marked in the schema as "read-only"

Steps to Reproduce

Given the following spec:

openapi: 3.1.0
paths:
  /outcomes:
    patch:
      description: "Quick patch example"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Outcome"
info:
  title: "Test"
  version: "1.0"

components:
  schemas:
    Video:
      properties:
        url:
          readOnly: true
          type: string
    Outcome:
      properties:
        title:
          type: string
        createdAt:
          type: string
          readOnly: true
        subtitle:
          type: object
          readOnly: true
          properties:
            url:
              type: string
              format: uri
        video:
          $ref: "#/components/schemas/Video"
          readOnly: true

The patch endpoint gets rendered with an empty video element:

... and looking at the schemas section for the Outcome, the read-only label is also missing from the video element:

Note that the inlined subtitle object works as expected.

Environment

• Version used: 9.0.0 (can be reproduced at https://elements-demo.stoplight.io)
• Environment name and version (e.g. Chrome 39, node.js 5.4): Firefox 134.0.1
• Operating System and version (desktop or mobile): Linux
• Link to your environment/workspace/project: N/A

[callebjorkell]

I did find issue https://github.com/stoplightio/elements/issues/2194 that is very similar, and where this functionality seems to have worked, so maybe it's a regression?