Query params that should be required in OpenAPI spec are not

image_list_v1 is wrong

image_list_v1 requires a project selector in the query string, which means you need at least a project identifier, but if you use a project ID (as opposed to a name), you don't need the org identifier. So the org is optional but the project is required.

https://github.com/oxidecomputer/omicron/blob/4e98516befcec14b669840c4f5bb6674e76cabc6/nexus/src/external_api/http_entrypoints.rs#L4968-L4973

And the struct reflects that: project has type NameOrId, but the org selector is optional.

https://github.com/oxidecomputer/omicron/blob/4e98516befcec14b669840c4f5bb6674e76cabc6/nexus/types/src/external_api/params.rs#L165-L170

But in the OpenAPI spec, the project selector does not get required: true like you would expect.

https://github.com/oxidecomputer/omicron/blob/4e98516befcec14b669840c4f5bb6674e76cabc6/openapi/nexus.json#L8310-L8316

But image_create_v1 is fine

image_create_v1, by contrast, does get the expected params: project is required and org is optional. This endpoint uses the much simpler Query<params::ProjectSelector> so it seems the problem is introduced by having multiple layers of wrappers with #[serde(flatten)] to hide them.

https://github.com/oxidecomputer/omicron/blob/4e98516befcec14b669840c4f5bb6674e76cabc6/nexus/src/external_api/http_entrypoints.rs#L5054-L5056

https://github.com/oxidecomputer/omicron/blob/4e98516befcec14b669840c4f5bb6674e76cabc6/openapi/nexus.json#L8353-L8367

Start in nexus/src/external_api/http_entrypoints.rs and nexus/types/src/external_api/params.rs, then compare image_list_v1 with the working image_create_v1 definition. Inspect the generated entry in openapi/nexus.json and the serde(flatten) wrappers; done means the image_list_v1 project query parameter is required while org remains optional.