Support for polymorphic validation

[daveismith]

I've been trying to use swagger-tools to validate requests to my controllers. It seems that when I perform a request with the body parameter specified as a base class, validation happens only against the specification of the base class model, but not against the model for the extended class identified by the discriminator.

[whitlockjc]

Can you give a code snippet and some example? I ask because we have heavily tested validation so I'm not sure how to reproduce.

[daveismith]

Below a simplified version of my schema.

{
  "swagger": "2.0",
  "info": {
    "title": "My Cloud API",
    "version": "1.0"
  },
  "consumes": ["application/json"],
  "produces": ["application/json"],
  "host": "localhost:3000",
  "basePath": "/api",
  "paths": {
    "/commands": {
      "post": {
        "description": "Issues a command",
        "operationId": "executeCommand",
        "parameters": [
          {
            "name": "body",
            "in": "body",
            "description": "Command to execute",
            "required": true,
            "schema": {
              "$ref": "#/definitions/Command"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful request.",
            "schema": {
              "$ref": "#/definitions/CommandResult"
            }
          },
          "default": {
            "description": "Invalid request.",
            "schema": {
              "$ref": "#/definitions/Error"
            }
          }
        }
      }
    }
  },
  "definitions": {
    "Error": {
      "properties": {
        "message": {
          "type": "string"
        }
      },
      "required": ["message"]
    },
    "CommandResult": {
      "properties": {
        "message": {
          "type": "string"
        }
      },
      "required": ["message"]
    },
    "Command": {
      "discriminator": "type",
      "properties": {
        "type": {
          "type": "string"
        },
        "propBase": {
          "type": "string"
        }
      },
      "required": ["type", "propBase"]
    },
    "Command1": {
      "description": "Command 1",
      "allOf": [
        {
          "$ref": "#/definitions/Command"
        },
        {
          "properties": {
            "prop1": {
              "type": "string"
            }
          },
          "required": ["prop1"]
        }
      ]
    }
  }
}

The issue is that commands that are sent to /api/commands are only validated against Command, regardless of the discriminator value. If I send the following it will still pass validation and call my controller function even though it's missing the required property "prop1" for the type "Command1".

{
  "type": "Command1",
  "propBase": "blah"
}

[whitlockjc]

I cannot reproduce this. Whenever I throw your definitions into my API and have my request/response use them, if I post only what you do, I get a request validation error (Parameter (command) failed schema validation]):

{
  [Error: Parameter (pet) failed schema validation]
  code: 'SCHEMA_VALIDATION_FAILED',
  failedValidation: true,
  results: {
    errors: [
      {
        "code": "OBJECT_MISSING_REQUIRED_PROPERTY",
        "message": "Missing required property: prop1",
        "path": []
      }
    ],
    warnings: []
  },
  path: [ 'paths', '/pets', 'post', 'parameters', '0' ],
  paramName: 'pet'
}

And when I post a full example, with the prop1 provided, the request is successful. Which version of swagger-tools are you using?

[daveismith]

My package.json has "swagger-tools": "^0.8.7". I am using it with MEAN.js, and have the following in my express.js configuration file. I'm using the express router vs the swagger-tools one, but it since that middleware comes after the validator, and it's validating some requests I'm hope I've got it correctly configured.

    var swaggerDoc = require('../app/api/swagger.json');

    swaggerTools.initializeMiddleware(swaggerDoc, function (middleware) {
        // Interpret Swagger resources and attach metadata to request - must be first in swagger-tools middleware chain
        app.use(middleware.swaggerMetadata());

        // Validate Swagger requests
        app.use(middleware.swaggerValidator());

        // Route validated requests to appropriate controller
        //app.use(middleware.swaggerRouter(options));

        // Serve the Swagger documents and Swagger UI
        app.use(middleware.swaggerUi());
    });

[whitlockjc]

Can you run with DEBUG=swagger-tools* and paste the output of the failed request? swagger-validator should be working right based on my tests.

[daveismith]

When I submit

{
  "type": "Command1",
  "propBase": "string"
}

the output of the request to the log is

NODE_ENV is not defined! Using default development environment
  swagger-tools:middleware Initializing middleware +0ms
  swagger-tools:middleware   Identified Swagger version: 2.0 +2ms
  swagger-tools:middleware   Validation: succeeded +26ms
  swagger-tools:middleware:metadata Initializing swagger-metadata middleware +162ms
  swagger-tools:middleware:metadata   Identified Swagger version: 2.0 +1ms
  swagger-tools:middleware:metadata   Found Path: /commands +1ms
  swagger-tools:middleware:validator Initializing swagger-validator middleware +1ms
  swagger-tools:middleware:validator   Response validation: disabled +0ms
  swagger-tools:middleware:ui Initializing swagger-ui middleware +35ms
  swagger-tools:middleware:ui   Using swagger-ui from: internal +1ms
  swagger-tools:middleware:ui   API Docs path: /api-docs +0ms
  swagger-tools:middleware:ui   swagger-ui path: /docs +0ms
MEAN.JS application started on port 3000
  swagger-tools:middleware:metadata POST /api/commands +2m
  swagger-tools:middleware:metadata   Is a Swagger path: true +1ms
  swagger-tools:middleware:metadata   Is a Swagger operation: true +0ms
  swagger-tools:middleware:metadata   Processing Parameters +0ms
  swagger-tools:middleware:metadata     body +1ms
  swagger-tools:middleware:metadata       Type: object +1ms
  swagger-tools:middleware:metadata       Value provided: true +0ms
  swagger-tools:middleware:metadata       Value: [object Object] +0ms
  swagger-tools:middleware:validator POST /api/commands +0ms
  swagger-tools:middleware:validator   Will process: yes +0ms
  swagger-tools:middleware:ui POST /api/commands +5ms
  swagger-tools:middleware:ui   Will process: no +0ms
POST /api/commands 200 159.372 ms - 4

[whitlockjc]

Can you show me the rest of your server file, replacing sensitive data with reasonable mocks so as not to change the structure of the file?

[whitlockjc]

I hate to keep bugging you but I cannot reproduce it. If you'd rather not give me your server file, could you give me a recipe via a patch/PR that will showcase this issue in test/2.0/test-middleware-swagger-validator.js. Without a way to reproduce this, I cannot fix it.

[whitlockjc]

I was able to reproduce it. It required me to get outside of the test suite. Let me take a look.

[daveismith]

Awesome. I was just about to start putting together a skeleton app for you. Sorry for the delay. I was out grabbing some lunch. Let me know if you need the skeleton app anymore.

[whitlockjc]

I've figured it out, swagger-tools is working right which is why my test worked but the server didn't. Your parameter references #/definitions/Command but you want it to be #/definitions/Command1. If I change the reference, it works as expected.

[daveismith]

Right, but the goal in reality is that I want to have Command1, Command2, Command3, etc. Is that not possible?

[whitlockjc]

Let me get @webron involved as I don't understand the discriminator field honestly, I thought it was only useful for swagger-codegen. I would expect that allowing a parameter, or a response, to be N different types would violate Swagger's design goals but let's see what Ron has to say.

[daveismith]

Cool. I'm pretty new to swagger, so I may be understanding it incorrectly. I'll wait to hear what the verdict is. Thanks for being so responsive.

[webron]

I'm guessing TL;DR won't work here? 😊

Let me have a look.