better type detection in serialized parameters

- OAI/OpenAPI-Specification#4743 recommends also
  looking inside "allOf"
- if a "$ref" was seen, adjacent keywords are no longer ignored

Author: karenetheridge

Changes

@@ -1,6 +1,8 @@
 Revision history for OpenAPI-Modern
 
 {{$NEXT}}
+          - better type inference for serialized parameters (also looks inside
+            the "allOf" keyword, and respects keywords adjacent to "$ref")
 
 0.087     2025-06-17 21:01:06Z
           - various fixes to instance and keyword locations in some errors

lib/OpenAPI/Modern.pm

@@ -720,8 +720,8 @@ sub _validate_path_parameter ($self, $state, $param_obj, $path_captures) {
   return E({ %$state, keyword => 'style' }, 'only style: simple is supported in path parameters')
     if ($param_obj->{style}//'simple') ne 'simple';
 
-  my $types = $self->_type_in_schema($param_obj->{schema}, { %$state, schema_path => $state->{schema_path}.'/schema' });
-  if (grep $_ eq 'array', @$types or grep $_ eq 'object', @$types) {
+  my @types = $self->_type_in_schema($param_obj->{schema}, { %$state, schema_path => $state->{schema_path}.'/schema' });
+  if (grep $_ eq 'array', @types or grep $_ eq 'object', @types) {
     return E($state, 'deserializing to non-primitive types is not yet supported in path parameters');
   }
 
@@ -761,8 +761,8 @@ sub _validate_query_parameter ($self, $state, $param_obj, $uri) {
   return E({ %$state, keyword => 'style' }, 'only style: form is supported in query parameters')
     if ($param_obj->{style}//'form') ne 'form';
 
-  my $types = $self->_type_in_schema($param_obj->{schema}, { %$state, schema_path => $state->{schema_path}.'/schema' });
-  if (grep $_ eq 'array', @$types or grep $_ eq 'object', @$types) {
+  my @types = $self->_type_in_schema($param_obj->{schema}, { %$state, schema_path => $state->{schema_path}.'/schema' });
+  if (grep $_ eq 'array', @types or grep $_ eq 'object', @types) {
     return E($state, 'deserializing to non-primitive types is not yet supported in query parameters');
   }
 
@@ -791,19 +791,19 @@ sub _validate_header_parameter ($self, $state, $header_name, $header_obj, $heade
   # line value from a field line."
   my @values = map s/^\s*//r =~ s/\s*$//r, map split(/,/, $_), $headers->every_header($header_name)->@*;
 
-  my $types = $self->_type_in_schema($header_obj->{schema}, { %$state, schema_path => $state->{schema_path}.'/schema' });
+  my @types = $self->_type_in_schema($header_obj->{schema}, { %$state, schema_path => $state->{schema_path}.'/schema' });
 
   # RFC9110 §5.3-1: "A recipient MAY combine multiple field lines within a field section that have
   # the same field name into one field line, without changing the semantics of the message, by
   # appending each subsequent field line value to the initial field line value in order, separated
   # by a comma (",") and optional whitespace (OWS, defined in Section 5.6.3). For consistency, use
   # comma SP."
   my $data;
-  if (grep $_ eq 'array', @$types) {
+  if (grep $_ eq 'array', @types) {
     # style=simple, explode=false or true: "blue,black,brown" -> ["blue","black","brown"]
     $data = \@values;
   }
-  elsif (grep $_ eq 'object', @$types) {
+  elsif (grep $_ eq 'object', @types) {
     if ($header_obj->{explode}//false) {
       # style=simple, explode=true: "R=100,G=200,B=150" -> { "R": 100, "G": 200, "B": 150 }
       $data = +{ map m/^([^=]*)=?(.*)$/g, @values };
@@ -949,17 +949,25 @@ sub _resolve_ref ($self, $entity_type, $ref, $state) {
   return $schema_info->{schema};
 }
 
-# determines the type(s) requested in a schema, and the new schema.
+# determines the type(s) expected in a schema
 sub _type_in_schema ($self, $schema, $state) {
   return [] if not is_plain_hashref($schema);
 
-  while (my $ref = $schema->{'$ref'}) {
+  my @types;
+
+  push @types, is_plain_arrayref($schema->{type}) ? ($schema->{types}->@*) : ($schema->{type})
+    if exists $schema->{type};
+
+  push @types, map $self->_type_in_schema($schema->{allOf}[$_],
+      { %$state, schema_path => $state->{schema_path}.'/allOf/'.$_ }), 0..$schema->{allOf}->$#*
+    if exists $schema->{allOf};
+
+  if (my $ref = $schema->{'$ref'}) {
     $schema = $self->_resolve_ref('schema', $ref, $state);
+    push @types, $self->_type_in_schema($schema, $state);
   }
-  my $types = is_plain_hashref($schema) ? $schema->{type}//[] : [];
-  $types = [ $types ] if not is_plain_arrayref($types);
 
-  return $types;
+  return @types;
 }
 
 # evaluates data against the subschema at the current state location

t/validate_request.t

@@ -2002,14 +2002,27 @@ paths:
         schema:
           $ref: '#/paths/~1foo/get/parameters/2/schema'
           not: true
-      - name: ArrayWithBrokenRef
-        in: header
-        schema:
-          $ref: '#/components/schemas/i_do_not_exist'
       - name: MultipleValuesAsRawString
         in: header
         schema:
           const: 'one , two  , three'
+      - name: ArrayWithLocalTypeAndRef
+        in: header
+        schema:
+          type: array   # if detected, this will be used first to determine the parsing
+          $ref: '#/paths/~1foo/get/parameters/3/schema' # this provides  type: object
+          not: true
+      - name: ArrayWithAllOfAndRef
+        in: header
+        schema:
+          allOf:
+            - $ref: '#/paths/~1foo/get/parameters/2/schema'
+            - not: true
+      # must be evaluated last, as broken $refs abort all validation
+      - name: ArrayWithBrokenRef
+        in: header
+        schema:
+          $ref: '#/components/schemas/i_do_not_exist'
 YAML
 
   my $request = request('GET', 'http://example.com/foo', [ SingleValue => '  mystring  ' ]);
@@ -2085,6 +2098,8 @@ YAML
   $request = request('GET', 'http://example.com/foo', [
       ArrayWithRef => 'one, one, three',
       ArrayWithRefAndOtherKeywords => 'one, one, three',
+      ArrayWithLocalTypeAndRef => 'one, two, two',
+      ArrayWithAllOfAndRef => 'one, three, three',
       ArrayWithBrokenRef => 'hi',
     ]);
   cmp_result(
@@ -2110,10 +2125,40 @@ YAML
           absoluteKeywordLocation => $doc_uri->clone->fragment(jsonp(qw(/paths /foo get parameters 6 schema not)))->to_string,
           error => 'subschema is true',
         },
+        {
+          instanceLocation => '/request/header/ArrayWithLocalTypeAndRef',
+          keywordLocation => jsonp(qw(/paths /foo get parameters 8 schema $ref type)),
+          absoluteKeywordLocation => $doc_uri->clone->fragment(jsonp(qw(/paths /foo get parameters 3 schema type)))->to_string,
+          error => 'got array, not object',
+        },
+        {
+          instanceLocation => '/request/header/ArrayWithLocalTypeAndRef',
+          keywordLocation => jsonp(qw(/paths /foo get parameters 8 schema not)),
+          absoluteKeywordLocation => $doc_uri->clone->fragment(jsonp(qw(/paths /foo get parameters 8 schema not)))->to_string,
+          error => 'subschema is true',
+        },
+        {
+          instanceLocation => '/request/header/ArrayWithAllOfAndRef',
+          keywordLocation => jsonp(qw(/paths /foo get parameters 9 schema allOf 0 $ref uniqueItems)),
+          absoluteKeywordLocation => $doc_uri->clone->fragment(jsonp(qw(/paths /foo get parameters 2 schema uniqueItems)))->to_string,
+          error => 'items at indices 1 and 2 are not unique',
+        },
+        {
+          instanceLocation => '/request/header/ArrayWithAllOfAndRef',
+          keywordLocation => jsonp(qw(/paths /foo get parameters 9 schema allOf 1 not)),
+          absoluteKeywordLocation => $doc_uri->clone->fragment(jsonp(qw(/paths /foo get parameters 9 schema allOf 1 not)))->to_string,
+          error => 'subschema is true',
+        },
+        {
+          instanceLocation => '/request/header/ArrayWithAllOfAndRef',
+          keywordLocation => jsonp(qw(/paths /foo get parameters 9 schema allOf)),
+          absoluteKeywordLocation => $doc_uri->clone->fragment(jsonp(qw(/paths /foo get parameters 9 schema allOf)))->to_string,
+          error => 'subschemas 0, 1 are not valid',
+        },
         {
           instanceLocation => '/request/header/ArrayWithBrokenRef',
-          keywordLocation => jsonp(qw(/paths /foo get parameters 7 schema $ref)),
-          absoluteKeywordLocation => $doc_uri->clone->fragment(jsonp(qw(/paths /foo get parameters 7 schema $ref)))->to_string,
+          keywordLocation => jsonp(qw(/paths /foo get parameters 10 schema $ref)),
+          absoluteKeywordLocation => $doc_uri->clone->fragment(jsonp(qw(/paths /foo get parameters 10 schema $ref)))->to_string,
           error => 'EXCEPTION: unable to find resource "'.$doc_uri.'#/components/schemas/i_do_not_exist"',
         },
       ],