[BUG] [Java] Object with non-null object field can be constructed with it unset

Bug Report Checklist

• Have you provided a full/minimal spec to reproduce the issue?
• Have you validated the input using an OpenAPI validator?
• Have you tested with the latest master to confirm the issue still exists?
• Have you searched for related issues/PRs?
• What's the actual output vs expected output?
• [Optional] Sponsorship to speed up the bug fix or feature request (example)

Description

If there is a schema A with a required field b of type B which is also an object and has no default value, the generated class for A will mark b as non-null, but the A() constructor is still provided which does not set b. This will be caught by spotbugs as NP_NONNULL_FIELD_NOT_INITIALIZED_IN_CONSTRUCTOR.

openapi-generator version

Using the latest version.

OpenAPI declaration file content or url

openapi: 3.0.1
info:
  title: Example
  version: 1.0.0
paths:
  /example:
    post:
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/A"
      responses:
        '201':
          description: success
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
components:
  schemas:
    A:
      type: object
      properties:
        b:
          $ref: "#/components/schemas/B"
      required: [b]
    B:
      type: object
      properties:
        c:
          type: string

Generation Details

The generated class A.java will contain:

public class A {
  public static final String SERIALIZED_NAME_B = "b";
  @SerializedName(SERIALIZED_NAME_B)
  @javax.annotation.Nonnull
  private B b;

  public A() {
  }

  public A b(@javax.annotation.Nonnull B b) {
    this.b = b;
    return this;
  }

  /**
   * Get b
   * @return b
   */
  @javax.annotation.Nonnull
  public B getB() {
    return b;
  }

  public void setB(@javax.annotation.Nonnull B b) {
    this.b = b;
  }

The A() constructor breaks the guarantees of @javax.annotation.Nonnull, so we either need to emit A(B b) such that it is always set (if there is no default value), or emit a Builder class which has no such guarantees during building but validates non-null inside build().

Steps to reproduce

Using the above YAML in openapi.yaml, against the latest version:

docker run --rm -v .:/local openapitools/openapi-generator-cli:latest generate -i local/openapi.yaml -g java -o /local/out/java
docker run --rm -v .:/local -w /local/out/java gradle:latest gradle build

Suggest a fix

We should not emit the constructor A(), instead we should emit A(B b). Alternatively we could emit a Builder class which has only nullable fields but which validates that the required fields have been set when calling build().

Start with the provided openapi.yaml and inspect the generated A.java, especially its no-argument constructor and required B field. Run the Docker generation and Gradle build commands from the report to reproduce the SpotBugs warning. Done means required non-null fields cannot be left unset by the generated construction path and the generated project builds cleanly.