Skip to content

Validate required fields based on readOnly & writeOnly #1943

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
whoseoyster wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Validate required fields based on readOnly & writeOnly #1943

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9dd7c21
Validate required fields based on readOnly & writeOnly
whoseoyster Jun 26, 2024
f567775
Fix failing tests and linting issues
whoseoyster Oct 6, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 26 additions & 0 deletions connexion/json_schema.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,6 +128,29 @@ def nullable_validation_fn(validator, to_validate, instance, schema):
return nullable_validation_fn


def validate_required(validator, required, instance, schema):
if not validator.is_type(instance, "object"):
return

for prop in required:
if prop not in instance:
properties = schema.get('properties')
Copy link
Copy Markdown
Contributor

@chrisinmtown chrisinmtown Sep 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the prevailing style in this code is to use double quotes (not single quotes) around strings, please consider matching that.

if properties is not None:
subschema = properties.get(prop)
if subschema is not None:
if 'readOnly' in validator.VALIDATORS and subschema.get('readOnly'):
continue
if 'writeOnly' in validator.VALIDATORS and subschema.get('writeOnly'):
continue
if 'x-writeOnly' in validator.VALIDATORS and subschema.get('x-writeOnly') is True:
continue
yield ValidationError("%r is a required property" % prop)


def validate_readOnly(validator, wo, instance, schema):
yield ValidationError("Property is read-only")
Copy link
Copy Markdown
Contributor

@chrisinmtown chrisinmtown Sep 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@sampoh0523 has convinced me that there is no need for this function, the argument is that Connexion should tolerate a readOnly field in requests without complaint.

Copy link
Copy Markdown

@sampoh0523 sampoh0523 Sep 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The current implementation of validate_required checks that some kind of function is specified for validating readOnly fields, since that is used to determine whether such fields can be skipped from the required validation. Deleting the function would therefore require some additional changes.

Copy link
Copy Markdown
Contributor

@chrisinmtown chrisinmtown Sep 16, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh good point. Why is it important for the validate_required function to check for presence of a validate_readOnly function? Asked differently, why is just checking for the readOnly subschema property not sufficient?

Copy link
Copy Markdown

@sampoh0523 sampoh0523 Sep 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is because the same validate_required is used for both requests and responses, and it recognizes which is which by checking the validators used (if there is a readOnly validator, it is a request; if there is a writeOnly validator, it is a response).

Copy link
Copy Markdown
Contributor

@chrisinmtown chrisinmtown Sep 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please let me amend my first comment here. @sampoh0523 has convinced me that this function should be a no-op. It has to exist and be registered, so the validation function can detect it is validating a request, but this function should never reject an instance.



def validate_writeOnly(validator, wo, instance, schema):
yield ValidationError("Property is write-only")
Copy link
Copy Markdown
Contributor

@chrisinmtown chrisinmtown Sep 21, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Extending the scope here slightly, for writeOnly the OpenAPI spec section https://spec.openapis.org/oas/v3.0.3.html#fixed-fields-19 says "MAY be sent as part of a request but SHOULD NOT be sent as part of the response." Well, this test case checks that Connexion rejects/fails a response that contains a writeOnly field. I don't much like it, but to conform to the spec, apparently Connexion should allow a response with such a field. The V2 and V3 branches agree on this point, for whatever that is worth. @sampoh0523 would you please comment?

Copy link
Copy Markdown

@sampoh0523 sampoh0523 Oct 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, I did not see this before.

I do not have strong opinions about writeOnly, because the code using Connexion has control over its responses, unlike with readOnly where it has no control over the requests it receives.


Expand All @@ -140,6 +163,8 @@ def validate_writeOnly(validator, wo, instance, schema):
{
"type": NullableTypeValidator,
"enum": NullableEnumValidator,
"readOnly": validate_readOnly,
"required": validate_required,
},
)

Expand All @@ -150,5 +175,6 @@ def validate_writeOnly(validator, wo, instance, schema):
"enum": NullableEnumValidator,
"writeOnly": validate_writeOnly,
"x-writeOnly": validate_writeOnly,
"required": validate_required,
},
)