[BUG] Validator Doesn't Check Whether Every Item in `required` is in the `properties` of a Schema Object

Update:

I found this in the JSONSchema validation doc:

An object instance is valid against this keyword if every item in the array is the name of a property in the instance.

But apparently the validator doesn't check it and allow validation of the following spec to be passed.

Original issue:

Go: UNKNOWN_BASE_TYPE Type Generated in Request Body when Both allOf and type are defined

Description

Not sure if it's the spec's issue or generator issue (because it's not common to use partial object with allOf), the Go generated code contains UNKNOWN_BASE_TYPE

type NetworkingAPIService service

type ApiCreateFirewallDeviceRequest struct {
	ctx context.Context
	ApiService *NetworkingAPIService
	firewallId int32
	uNKNOWNBASETYPE *UNKNOWN_BASE_TYPE
}

func (r ApiCreateFirewallDeviceRequest) UNKNOWNBASETYPE(uNKNOWNBASETYPE UNKNOWN_BASE_TYPE) ApiCreateFirewallDeviceRequest {
	r.uNKNOWNBASETYPE = &uNKNOWNBASETYPE
	return r
}

func (r ApiCreateFirewallDeviceRequest) Execute() (*FirewallDevices, *http.Response, error) {
	return r.ApiService.CreateFirewallDeviceExecute(r)
}

Although it's not commonly seen, I couldn't find any text in the spec against this pattern, and it passed the openapi-generator's validation. May I get some suggestions?

openapi-generator version

7.5.0

OpenAPI declaration file content or url

requestBody:
  content:
    application/json:
      schema:
        type: object
        required:
          - id
          - type
        allOf:
          - $ref: '#/components/schemas/FirewallDevices/properties/entity'

Or full minimal yaml:

openapi: 3.0.1
info: 
  title: Linode API
  description: >
    The Linode API provides the ability to programmatically manage the full range of Linode products and services.
  version: 4.175.0
  contact:
    name: Linode
    url: https://www.linode.com

servers:
- url: https://api.linode.com/v4
- url: https://api.linode.com/v4beta
paths:
  /networking/firewalls/{firewallId}/devices:
    parameters:
      - name: firewallId
        in: path
        description: >
          ID of the Firewall to access.
        required: true
        schema:
          type: integer
    post:
      servers:
      - url: https://api.linode.com/v4
      tags:
      - Networking
      summary: Firewall Device Create
      description: |
        some description here
      operationId: createFirewallDevice
      security:
      - personalAccessToken: []
      - oauth:
        - firewall:read_write
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required:
                - id
                - type
              allOf:
                - $ref: '#/components/schemas/FirewallDevices/properties/entity'
      responses:
        '200':
          description: Returns information about the created Firewall Device.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/FirewallDevices'
        default:
          $ref: '#/components/responses/ErrorResponse'

components:
  schemas:
    FirewallDevices:
      type: object
      description: >
        some description here
      properties:
        id:
          type: integer
          description: >
            The Device's unique ID
          example: 123
        created:
          type: string
          format: date-time
          readOnly: true
          description: >
            some description here
        updated:
          type: string
          format: date-time
          readOnly: true
          description: >
            some description here
        entity:
          type: object
          readOnly: true
          description: >
            some description here
          properties:
            id:
              description: The entity's ID
              type: integer
              example: 123
            type:
              description: The entity's type.
              type: string
              enum:
              - linode
              - nodebalancer
              example: linode
            label:
              description: some description here
              type: string
              readOnly: true
              example: my-linode
            url:
              description: >
                some description here
              type: string
              format: url
              readOnly: true
              example: /v4/linode/instances/123

Generation Details

Start with the OpenAPI declaration in the issue and reproduce validation and Go generation for the request body using both required and allOf. Inspect the validator and the generated ApiCreateFirewallDeviceRequest; done means invalid required properties are rejected or the generated request no longer contains UNKNOWN_BASE_TYPE, with the behavior covered by a regression test.