guardrail-dev / guardrail-dev/guardrail
Server readOnly properties are applied to responses instead of requests
- Dominant language
- Scala
- Stars
- 541
- Forks
- 138
- PR merge metrics
- No merged PRs in 30d
Description
Hi,
See example below with the readonly property TestObject.bar:
```
---
swagger: "2.0"
schemes:
- http
consumes:
- application/json
produces:
- application/json
paths:
/test:
get:
operationId: testGet
responses:
200:
schema:
$ref: "#/definitions/TestObject"
post:
operationId: testSet
parameters:
- name: body
in: body
schema:
$ref: "#/definitions/TestObject"
responses:
200:
description: OK
definitions:
TestObject:
type: object
properties:
foo:
type: string
bar:
type: string
readOnly: true
```
The server code generated from this removes the readOnly properties from responses when encoding as JSON (in definitions/TestObject.scala), and does not perform any validation on incoming request objects. Is this the wrong way round? As I understand it, readOnly properties are allowed on response objects and forbidden on request objects (https://github.com/swagger-api/swagger-spec/blob/master/versions/2.0.md#schemaReadOnly).
I guess it's straightforward to remove the code that removes readOnly properties from encoded responses, but I'm not sure how to add validation and error reporting if a request contains one of the properties.
Any advice much appreciated, thanks!
Contributor guide
Assessment
This issue has not been assessed yet.