Skip to content

Conversation

@sakurai-ryo
Copy link
Contributor

What/Why/How?

Fixed an issue where the no-invalid-media-type-examples rule incorrectly reported validation errors/warnings when example/examples properly omitted readOnly properties in request bodies or writeOnly properties in response bodies.

ajv does not support readOnly and writeOnly properties, and the request and response context is specific to OpenAPI.
So this must be handled in the lint rule rather than in ajv.
ajv-validator/ajv#2097

How

This PR introduces context-aware validation.
It modifies the object schema based on whether mediaType examples are request or response context.

Check the properties field of mediaType.schema and remove properties that should not be required in the request or response context from the properties field and the required field.

This PR skips validating cases where mediaType.schema contains complex elements like allOf.
If there are any utility functions that support this case, please let us know.

Reference

Fixes #1416

Testing

Added unit tests.

Screenshots (optional)

Check yourself

  • Code changed? - Tested with Redoc/Realm/Reunite (internal)
  • All new/updated code is covered by tests
  • New package installed? - Tested in different environments (browser/node)
  • Documentation update considered

Security

  • The security impact of the change has been considered
  • Code follows company security practices and guidelines

@sakurai-ryo sakurai-ryo requested review from a team as code owners November 7, 2025 09:47
@changeset-bot
Copy link

changeset-bot bot commented Nov 7, 2025

🦋 Changeset detected

Latest commit: f85ee35

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages
Name Type
@redocly/openapi-core Patch
@redocly/cli Patch
@redocly/respect-core Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

Copy link
Collaborator

@tatomyr tatomyr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for spending your time on this @sakurai-ryo! Left a couple of suggestion/concerns.
Also, I'm not sure how this solution will work with circular references and nested objects (for instance, objects in arrays). Could you check that?

Comment on lines +113 to +114
mediaTypeLocation.pointer.includes('/components/responses') ||
/paths\/[^/]+\/[^/]+\/responses/.test(mediaTypeLocation.pointer)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a bit fragile and hard to read. I suggest using Responses and RequestBody visitors to narrow down the context:

Responses: {
    MediaType: {
      leave(mediaType, ctx: UserContext) {
         // Filter out `writeOnly` props...

return;
}

const resolvedSchema = ensureSchemaIsResolved(mediaType.schema!, ctx);
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess it will still be easier to fix that on the AJV side. We use our own AJV fork, and we can try passing down a new parameter, something like ignoreWriteOnly. Let me think this through.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tatomyr you are absolutely right. In AJV it looks better. I try to create a quick fix directly in AJV and it works. I created draft PR: Redocly/ajv#35.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

validation of sample : readOnly / writeOnly and required statement interaction

3 participants