Can't validate array of items with anyOf

[ovidals]

I have an object with two properties, one of them is type array and can contain multiple definitions inside, my schema definition is this:

{ "id": "public/doc/json_schema", "type": "object", "required": [ "code", "data" ], "additionalProperties": false, "properties": { "code": { "type": "number", "example": 200 }, "data": { "type": "object", "required": [ "message", "feed" ], "additionalProperties": false, "properties": { "message": { "type": "string", "example": "User feed information" }, "feed": { "type": "array", "items": { "anyOf": [ { "$ref": "./event/event_sport_activity_rewarded.json" }, { "$ref": "./event/event_voucher_acquired.json" }, { "$ref": "./event/event_challenge_accepted.json" }, { "$ref": "./event/event_challenge_completed.json" }, { "$ref": "./event/event_challenge_abandoned.json" }, { "$ref": "./event/event_challenge_expired.json" } ] } } } } } }

All the schemas inside anyOf starts like this:

{ "type": "object",

Am I missing something? when I try to validate an array with some events that match any of theses, random errors are fired indicating that some field is missing (a field from another schema).

[erayd]

Could you post a minimal example to reproduce this please.

[ovidals]

What information do you need @erayd ?

[erayd]

The smallest possible schema and example data needed to replicate the problem, and ideally a PHP code snippet that shows how you're using the library.

[balazswmann]

It seems I run into the same weird issue. Here is an example API specification to reproduce the bug:

openapi: 3.0.0
info:
  title: Import API
  version: 1.0.0
paths:
  /import/v1/{name}:
    post:
      tags:
        - Import
      description: 'Import operation'
      operationId: import
      parameters:
        - in: path
          name: name
          description: 'The name of data to be imported'
          required: true
          schema:
            type: string
            format: identifier
      requestBody:
        description: 'The data to be imported'
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties:
                type: string
      responses:
        200:
          description: 'Response about the data import'
        500:
          description: 'Internal server error'
      security:
        - oauth: []
components:
  securitySchemes:
    oauth:
      type: oauth2
      flows:
        clientCredentials:
          tokenUrl: https://{reporting-hostname}/oauth/{company}/token
          scopes: {}
security:
  - oauth: []

This specification is valid according to both Swagger Editor and Swagger/Open API online validator but I get the following errors when I try to validate it with the official Open API v3.0 schema:

• [components.securitySchemes.oauth.openIdConnectUrl] The property openIdConnectUrl is required
• [components.securitySchemes.oauth.type] Does not have a value in the enumeration ["openIdConnect"]
• [components.securitySchemes.oauth] The property flows is not defined and the definition does not allow additional properties
• [components.securitySchemes.oauth.name] The property name is required
• [components.securitySchemes.oauth.in] The property in is required
• [components.securitySchemes.oauth.type] Does not have a value in the enumeration ["apiKey"]
• [components.securitySchemes.oauth.scheme] The property scheme is required
• [components.securitySchemes.oauth] Failed to match exactly one schema
• [components.securitySchemes.oauth.type] Does not have a value in the enumeration ["http"]
• [components.securitySchemes.oauth.flows.clientCredentials.tokenUrl] Invalid URL format
• [components.securitySchemes.oauth.$ref] The property $ref is required

This is how I run the validation:

$validator->validate($content, (object) [
  '$ref' => 'file://' . $this->schemaPath(),
]);

I use the latest v5.2.10 release.

[erayd]

@balazswmann As per my comments earlier in this thread, could you please post a minimal example to reproduce the issue.

[balazswmann]

@erayd Here it is, I cannot simplify it more. Same errors with this one as well:

openapi: 3.0.0
info:
  title: Example API
  version: 1.0.0
paths: {}
components:
  securitySchemes:
    oauth:
      type: oauth2
      flows:
        clientCredentials:
          tokenUrl: https://{reporting-hostname}/oauth/{company}/token
          scopes: {}

[erayd]

@balazswmann Please post a minimal schema, and minimal JSON data to reproduce the issue. Not YAML data and the entirety of the OpenAPI schema, as you've done here.

Much as I'd love to, I unfortunately don't have the free time to do that kind of reduction work for you; I'm already barely scratching the sides of what this project needs.

[guilliamxavier]

@balazswmann: All your other errors are because of this one:

• [components.securitySchemes.oauth.flows.clientCredentials.tokenUrl] Invalid URL format

Indeed https://{reporting-hostname}/oauth/{company}/token is not a valid URL (more precisely, {reporting-hostname} is not a valid hostname, because of braces); because of that, it tries other security schemes (APIKey, HTTP, OpenIdConnect).
After I fix the URL, the other errors go away too.

@ovidals: Maybe the same thing? I cannot reproduce otherwise

[guilliamxavier]

But I agree that the errors are confusing. "Failed to match exactly one schema" should be first (or last, but not mixed in the middle of others). I'll see if I can find the time to improve that...

[erayd]

@guilliamxavier For what it's worth, the current ordering is the result of optimising the order in which constraints are checked in order to get an overall result as quickly as possible. If you are going to be reordering them, please take this into account, as it's common to include this library as part of an API hot path - so it should be as performant as possible without having to resort to schema compilation.

[guilliamxavier]

See #663: I eventually thought that changing the current ordering of errors for oneOf/anyOf/allOf (and maybe also schema) to move the "Failed to match ..." (or "Schema is not valid") one before the nested ones would be too disruptive (both in code changes and potential user breaks), so I just fixed oneOf so that it is after, like anyOf/allOf (and like it actually was originally)

[DannyvdSluijs]

@ovidals in an attempt to cleanup this repo we are trying to filter the issues and see which ones might be closed. Is it safe to assume this is a rather old issue, which sadly was left unanswered, and can be closed? Feel free to close it yourself with some comments if helpful.