openapi_parser 2.6.0 → 2.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 265685ba8a1e648f9b4611356022227b5d80917f46d2450dae55747ffec40a23
-  data.tar.gz: 9ba7d7d561d7ec84a5ce6a8c42cb13beffa09e1250699b206f6e4ec639350575
+  metadata.gz: 6332e2e24a629533ff6ae7159cff7b51db53a2e451bd527743610122ed3bb994
+  data.tar.gz: 88b477bdea9749ebe10b0bf7214529152cbed08e53290ea3657ca17e6d1970d6
 SHA512:
-  metadata.gz: 4168f6e1dcedcd2c8be552937692215f8214511df0979f7bcc3d4ec00181980e5d397bc5cb0288cf9fc498eafc3a1322f0f1579bad89fb4915221b6b62a4f667
-  data.tar.gz: 6fe2b4ae0877312fcdd0f6fc56643c7658e9e6325cffaa066caec1b263e6657c88db5a7233d6bd24ce7d8270ff8d5e1d7d8c7b38188e4ac237ca86cb5f374a4c
+  metadata.gz: 69fb1000151935a4636ba3bd98edf9f1e1e221ebea86e4a3cf23348b7452ecf49e2047e9be42322713f438ed56855a20cf52647f0cc08077efc95631839d8e49
+  data.tar.gz: 72287aa48edfe2dae9894006b2da9e90c14c5b552bb5cbc598bd166f931ab25e6283167c0b6afda3d7270761487edc83739f73686c3c9e739724049ac23f6d10

data/CHANGELOG.md

@@ -1,5 +1,12 @@
 ## Unreleased
 
+## 2.7.0 (2026-11-06)
+* match `additionalOperations` method names case-sensitively ([OpenAPI 3.2](https://spec.openapis.org/oas/v3.2.0.html#path-item-object), [RFC 9110 §9.1](https://www.rfc-editor.org/rfc/rfc9110.html#section-9.1)). Standard methods still match their fixed fields in any case
+* check the keywords next to `allOf`, `anyOf` and `oneOf` (OpenAPI 3.0 and 3.1), such as `{ allOf: [...], required: [a] }`, and all of these keywords when a schema has more than one. They were ignored before, so a value that passed may now fail. In particular, `additionalProperties: false` next to `allOf` now rejects the properties defined only in `allOf`, as in JSON Schema
+* return the coerced value from `allOf` and `oneOf` when `coerce_value` is on. They returned the original value before
+* support the `dependentRequired` keyword (OpenAPI 3.1): an object that has a property but not the properties it depends on now fails with `NotExistDependentRequiredKey`. It was ignored before, so a value that passed may now fail
+* add `SpecValidator` rule `DependentRequiredIn30`: detect `dependentRequired` in 3.0 documents (3.1 addition)
+
 ## 2.6.0 (2026-11-04)
 * support the `multipleOf` keyword (OpenAPI 3.0 and 3.1): a number that is not a multiple of it now fails with `NotMultipleOf`. Decimals are compared exactly, so `19.99` is a multiple of `0.01`. A `multipleOf` that is not a positive number is still ignored. It was ignored before, so a value that passed may now fail
 * support the `not` keyword (OpenAPI 3.0 and 3.1): a value that is valid against the `not` schema now fails with `NotSchemaMatched`. It was ignored before, so a value that passed may now fail

data/README.md

@@ -127,7 +127,7 @@ OpenAPIParser.parse(schema, strict_specification_version: :raise)
 
 Detected mismatches:
 
-- 3.1 additions in 3.0 documents: `const`, `prefixItems`, array-form `type`, `type: "null"`, `webhooks`, `jsonSchemaDialect`, `components.pathItems`, `$dynamicRef`, `$dynamicAnchor`, `contentEncoding`, `contentMediaType`, `contentSchema`, `$defs`, boolean schemas
+- 3.1 additions in 3.0 documents: `const`, `prefixItems`, array-form `type`, `type: "null"`, `webhooks`, `jsonSchemaDialect`, `components.pathItems`, `$dynamicRef`, `$dynamicAnchor`, `contentEncoding`, `contentMediaType`, `contentSchema`, `$defs`, `dependentRequired`, boolean schemas
 - the 3.0 Boolean vs 3.1 numeric forms of `exclusiveMinimum` / `exclusiveMaximum`
 - 3.2 additions in earlier documents: `$self`, the `query` operation, `additionalOperations`, `components.mediaTypes`, Tag `summary` / `parent` / `kind`, Server `name`, Example `dataValue` / `serializedValue`, XML `nodeType`, Security Scheme `deprecated` / `oauth2MetadataUrl` and the `deviceAuthorization` flow, Media Type and Encoding `itemSchema` / `itemEncoding` / `prefixEncoding`, Discriminator `defaultMapping`, Parameter `in: querystring` and `style: cookie`, Response `summary`
 - keywords removed or deprecated by the declared version: `nullable` and singular schema `example` in 3.1+, XML `attribute: true` / `wrapped: true` and Parameter `allowEmptyValue` in 3.2

data/lib/openapi_parser/errors.rb

@@ -56,6 +56,18 @@ module OpenAPIParser
     end
   end
 
+  class NotExistDependentRequiredKey < OpenAPIError
+    def initialize(property, keys, reference)
+      super(reference)
+      @property = property
+      @keys = keys
+    end
+
+    def message
+      "#{@reference} missing parameters required by #{@property}: #{@keys.join(", ")}"
+    end
+  end
+
   class NotExistPropertyDefinition < OpenAPIError
     def initialize(keys, reference)
       super(reference)

data/lib/openapi_parser/schema_validator/all_of_validator.rb

@@ -10,17 +10,24 @@ class OpenAPIParser::SchemaValidator
       end
 
       # if any schema return error, it's not a valid all_of
+      # Members with `type` go first, so that the other members see the coerced value.
+      steps = schema.all_of.partition(&:type).flatten.map do |s|
+        lambda do |input|
+          # We need to store the reference to all of, so we can perform strict check on allowed properties
+          validatable.validate_schema(
+            input,
+            s,
+            :parent_all_of => true,
+            parent_discriminator_schemas: keyword_args[:parent_discriminator_schemas] || []
+          )
+        end
+      end
+      coerced, err = validatable.validate_in_order(value, steps)
+      return [nil, err] if err
+
       remaining_keys               = value.kind_of?(Hash) ? value.keys : []
       nested_additional_properties = false
       schema.all_of.each do |s|
-        # We need to store the reference to all of, so we can perform strict check on allowed properties
-        _coerced, err = validatable.validate_schema(
-          value,
-          s,
-          :parent_all_of => true,
-          parent_discriminator_schemas: keyword_args[:parent_discriminator_schemas] || []
-        )
-
         if s.type == "object"
           remaining_keys               -= (s.properties || {}).keys
           nested_additional_properties = true if s.additional_properties
@@ -28,8 +35,6 @@ class OpenAPIParser::SchemaValidator
           # If this is not allOf having array of objects inside, but e.g. having another anyOf/oneOf nested
           remaining_keys.clear
         end
-
-        return [nil, err] if err
       end
 
       # If there are nested additionalProperties, we allow not defined extra properties and lean on the specific
@@ -38,7 +43,7 @@ class OpenAPIParser::SchemaValidator
         return [nil, OpenAPIParser::NotExistPropertyDefinition.new(remaining_keys, schema.object_reference)]
       end
 
-      [value, nil]
+      [coerced, nil]
     end
   end
 end

data/lib/openapi_parser/schema_validator/object_validator.rb

@@ -53,9 +53,30 @@ class OpenAPIParser::SchemaValidator
       end
       return [nil, OpenAPIParser::NotExistRequiredKey.new(required_set.to_a, schema.object_reference)] unless required_set.empty?
 
+      dependent_required_error = check_dependent_required(value, schema)
+      return [nil, dependent_required_error] if dependent_required_error
+
       value.merge!(coerced_values.to_h) if @coerce_value
 
       check_properties_number(value, schema)
     end
+
+    private
+
+    # @return [OpenAPIParser::NotExistDependentRequiredKey, nil]
+    def check_dependent_required(value, schema)
+      dependent_required = schema.dependent_required
+      return unless dependent_required.is_a?(Hash)
+
+      dependent_required.each do |property, keys|
+        next unless value.key?(property) && keys.is_a?(Array)
+
+        missing_keys = keys.reject { |key| value.key?(key) }
+        next if missing_keys.empty?
+
+        return OpenAPIParser::NotExistDependentRequiredKey.new(property, missing_keys, schema.object_reference)
+      end
+      nil
+    end
   end
 end

data/lib/openapi_parser/schema_validator/one_of_validator.rb

@@ -11,12 +11,9 @@ class OpenAPIParser::SchemaValidator
       end
 
       # if multiple schemas are satisfied, it's not valid
-      result = schema.one_of.one? do |s|
-        _coerced, err = validatable.validate_schema(value, s)
-        err.nil?
-      end
-      if result
-        [value, nil]
+      matched = schema.one_of.map { |s| validatable.validate_schema(value, s) }.select { |_coerced, err| err.nil? }
+      if matched.one?
+        [matched.first.first, nil]
       else
         [nil, OpenAPIParser::NotOneOf.new(value, schema.object_reference)]
       end

data/lib/openapi_parser/schema_validator.rb

@@ -40,6 +40,7 @@ class OpenAPIParser::SchemaValidator
 
   # Types to pick from for a schema without `type`. integer comes before
   # number so that an Integer is checked as an integer.
+  JSON_VALUE_CLASSES = [Hash, Array, String, Numeric, TrueClass, FalseClass, NilClass].freeze
   VALUE_TYPES = %w[object array string integer number boolean].freeze
 
   class << self
@@ -100,18 +101,9 @@ class OpenAPIParser::SchemaValidator
       return [nil, OpenAPIParser::NotSchemaMatched.new(value, schema.not.object_reference)] unless not_error
     end
 
-    return coerce_into_type_array(value, schema, **keyword_args) if coerce_into_type_array?(value, schema)
+    return validate_composition(value, schema, **keyword_args) if composition_validators(schema).any?
 
-    if (v = validator(value, schema))
-      if keyword_args.empty?
-        return v.coerce_and_validate(value, schema)
-      else
-        return v.coerce_and_validate(value, schema, **keyword_args)
-      end
-    end
-
-    # unknown return error
-    OpenAPIParser::ValidateError.build_error_result(value, schema)
+    validate_without_composition(value, schema, **keyword_args)
   end
 
   # validate integer value by schema
@@ -122,13 +114,71 @@ class OpenAPIParser::SchemaValidator
     integer_validator.coerce_and_validate(value, schema)
   end
 
+  # Run the steps in order, each with the value coerced by the steps before it.
+  # Keywords check JSON values. A coerced value of another class, like DateTime,
+  # is only the output form, so the later steps check the original value.
+  # @param [Object] value
+  # @param [Array<Proc>] steps each takes a value and returns coerced value and error
+  # @return [Array] coerced value and error
+  def validate_in_order(value, steps)
+    current = value
+    steps.each do |step|
+      returned, err = step.call(json_value?(current) ? current : value)
+      return [nil, err] if err
+
+      current = returned if json_value?(current)
+    end
+    [current, nil]
+  end
+
   private
 
+    def json_value?(value)
+      JSON_VALUE_CLASSES.any? { |klass| value.is_a?(klass) }
+    end
+
+    # @return [Array<OpenAPIParser::SchemaValidator::Base>]
+    def composition_validators(schema)
+      validators = []
+      validators << any_of_validator if schema.any_of
+      validators << all_of_validator if schema.all_of
+      validators << one_of_validator if schema.one_of
+      validators
+    end
+
+    # All the keywords in a schema apply to the value, so the composition
+    # keywords and the keywords next to them are all checked.
+    # `type` goes first, so that the other steps see the coerced value.
+    # @return [Array] coerced value and error
+    def validate_composition(value, schema, **keyword_args)
+      composition_steps = composition_validators(schema).map do |v|
+        ->(input) { v.coerce_and_validate(input, schema, **keyword_args) }
+      end
+      # the composition keyword already used discriminator
+      parents = (keyword_args[:parent_discriminator_schemas] || []) + [schema]
+      other_step = ->(input) { validate_without_composition(input, schema, **keyword_args, parent_discriminator_schemas: parents) }
+
+      validate_in_order(value, schema.type ? [other_step, *composition_steps] : [*composition_steps, other_step])
+    end
+
+    # @return [Array] coerced value and error
+    def validate_without_composition(value, schema, **keyword_args)
+      return coerce_into_type_array(value, schema, **keyword_args) if coerce_into_type_array?(value, schema)
+
+      if (v = validator(value, schema))
+        if keyword_args.empty?
+          return v.coerce_and_validate(value, schema)
+        else
+          return v.coerce_and_validate(value, schema, **keyword_args)
+        end
+      end
+
+      # unknown return error
+      OpenAPIParser::ValidateError.build_error_result(value, schema)
+    end
+
     # @return [OpenAPIParser::SchemaValidator::Base, nil]
     def validator(value, schema)
-      return any_of_validator if schema.any_of
-      return all_of_validator if schema.all_of
-      return one_of_validator if schema.one_of
       return nil_validator if value.nil?
 
       # 3.1: `format: binary` with `string` in an array-form `type` accepts a
@@ -197,7 +247,6 @@ class OpenAPIParser::SchemaValidator
     # @return [Boolean]
     def coerce_into_type_array?(value, schema)
       return false unless @coerce_value && !value.nil?
-      return false if schema.any_of || schema.all_of || schema.one_of
 
       schema.type.is_a?(Array) && pick_type(value, schema.type, schema).nil?
     end

data/lib/openapi_parser/schemas/path_item.rb

@@ -36,13 +36,10 @@ module OpenAPIParser::Schemas
 
     private
 
-      # additionalOperations keys are method names as sent on the wire
-      # (conventionally uppercase); prefer an exact match, else ignore case
+      # additionalOperations keys use the method's case as sent on the wire,
+      # and method names are case-sensitive (RFC 9110 §9.1)
       def additional_operation(name)
-        operations = additional_operations
-        return nil unless operations
-
-        operations.fetch(name) { operations.find { |key, _| key.casecmp?(name) }&.last }
+        additional_operations&.[](name)
       end
   end
 end

data/lib/openapi_parser/schemas/schema.rb

@@ -83,6 +83,10 @@ module OpenAPIParser::Schemas
     #   @return [Boolean, nil]
     openapi_attr_value :write_only, schema_key: :writeOnly
 
+    # @!attribute [r] dependent_required
+    #   @return [Hash{String => Array<String>}, nil]
+    openapi_attr_value :dependent_required, schema_key: :dependentRequired
+
     # @!attribute [r] all_of
     #   @return [Array<Schema, Reference>, nil]
     openapi_attr_list_object :all_of, Schema, reference: true, schema_key: :allOf

data/lib/openapi_parser/spec_validator/rules/dependent_required_in_30.rb

@@ -0,0 +1,25 @@
+module OpenAPIParser
+  class SpecValidator
+    module Rules
+      # `dependentRequired` is a JSON Schema 2020-12 keyword that 3.1 adopted.
+      # 3.0 Schema Objects do not define it. The validator checks it regardless
+      # of version; this rule reports the version mismatch.
+      class DependentRequiredIn30 < Rule
+        def check(root)
+          return [] unless version_before?('3.1')
+
+          violations = []
+          each_schema(root) do |schema|
+            next unless schema.raw_schema.is_a?(Hash) && schema.raw_schema.key?('dependentRequired')
+
+            violations << violation(
+              path: schema.object_reference,
+              message: '`dependentRequired` is a 3.1 addition (from JSON Schema 2020-12); 3.0 Schema Objects do not define it',
+            )
+          end
+          violations
+        end
+      end
+    end
+  end
+end

data/lib/openapi_parser/spec_validator.rb

@@ -18,6 +18,7 @@ require_relative 'spec_validator/rules/dynamic_ref_in_30'
 require_relative 'spec_validator/rules/dynamic_anchor_in_30'
 require_relative 'spec_validator/rules/content_schema_in_30'
 require_relative 'spec_validator/rules/defs_in_30'
+require_relative 'spec_validator/rules/dependent_required_in_30'
 require_relative 'spec_validator/rules/allow_empty_value_deprecation'
 require_relative 'spec_validator/rules/xml_node_type_before_32'
 require_relative 'spec_validator/rules/xml_attribute_deprecation'
@@ -100,6 +101,7 @@ module OpenAPIParser
           Rules::DynamicAnchorIn30,
           Rules::ContentSchemaIn30,
           Rules::DefsIn30,
+          Rules::DependentRequiredIn30,
           Rules::AllowEmptyValueDeprecation,
           Rules::XmlNodeTypeBefore32,
           Rules::XmlAttributeDeprecation,

data/lib/openapi_parser/version.rb

@@ -1,3 +1,3 @@
 module OpenAPIParser
-  VERSION = '2.6.0'.freeze
+  VERSION = '2.7.0'.freeze
 end

data/sig/openapi_parser/schema_validator.rbs

@@ -25,6 +25,7 @@ module OpenAPIParser
     def validate_data: -> Object
     def validate_schema: (Object value, OpenAPIParser::Schemas::Schema schema, **bot) -> [Object, OpenAPIParser::validate_error]
     def validate_integer: (Object value, OpenAPIParser::Schemas::Schema schema) -> [Object, OpenAPIParser::validate_error]
+    def validate_in_order: (Object value, Array[untyped] steps) -> [Object, OpenAPIParser::validate_error]
 
     private
     def validator: (Object value, OpenAPIParser::Schemas::Schema schema) -> [OpenAPIParser::SchemaValidator::Base, OpenAPIParser::validate_error]

data/sig/openapi_parser/spec_validator.rbs

@@ -114,6 +114,10 @@ module OpenAPIParser
         def check: (OpenAPIParser::Schemas::OpenAPI root) -> Array[SpecValidator::SpecViolation]
       end
 
+      class DependentRequiredIn30 < Rule
+        def check: (OpenAPIParser::Schemas::OpenAPI root) -> Array[SpecValidator::SpecViolation]
+      end
+
       class AllowEmptyValueDeprecation < Rule
         def check: (OpenAPIParser::Schemas::OpenAPI root) -> Array[SpecValidator::SpecViolation]
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: openapi_parser
 version: !ruby/object:Gem::Version
-  version: 2.6.0
+  version: 2.7.0
 platform: ruby
 authors:
 - ota42y
@@ -221,6 +221,7 @@ files:
 - lib/openapi_parser/spec_validator/rules/cookie_style_before_32.rb
 - lib/openapi_parser/spec_validator/rules/default_mapping_before_32.rb
 - lib/openapi_parser/spec_validator/rules/defs_in_30.rb
+- lib/openapi_parser/spec_validator/rules/dependent_required_in_30.rb
 - lib/openapi_parser/spec_validator/rules/dynamic_anchor_in_30.rb
 - lib/openapi_parser/spec_validator/rules/dynamic_ref_in_30.rb
 - lib/openapi_parser/spec_validator/rules/example_singular_deprecation.rb