Repository navigation
Support discriminator for oneOf in OpenApiValidationPlugin - #2042
Open
waldekmastykarz wants to merge 13 commits into
Open
waldekmastykarz wants to merge 13 commits into
waldekmastykarz wants to merge 13 commits into
Conversation
…nAPI specs Adds a reporting plugin that validates intercepted requests and responses against local OpenAPI specs (specFiles and/or specsFolder) and reports undocumented paths/methods/status codes/content types, parameter issues and request/response body schema violations. Closes dotnet#779 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
- Report schemas nested deeper than the supported maximum instead of treating them as valid - Search all specs and matching paths for the requested method before reporting it as undocumented - Recognize required deepObject query parameters - Match operations against their effective (document-, path- or operation-level) servers - Match server base paths and request paths case-sensitively and strictly on trailing slashes - Decode array parameters according to their style and explode settings - Reject non-finite numbers when coercing parameter values Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Memoize composed (allOf/anyOf/oneOf) subschema results per schema and value, dedupe repeated allOf errors, and cap total evaluations as a backstop so repeated references can't cause exponential validation work. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
- Use unambiguous property paths so memoized results don't collide - Recognize exploded form-object query parameters - Exempt bracketed query keys only for deepObject parameters - Report malformed JSON even when the media type has no schema - Match server URLs with explicit default ports - Coerce parameter values using types declared via composition Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Type inference, item lookup and property discovery now traverse allOf/anyOf/oneOf with a visited set, so repeated references and cycles can't cause exponential work. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
- When an allOf subschema with additionalProperties: false rejects a property declared in a sibling subschema, explain why in the message - Skip validating JSON bodies larger than 5 MB to avoid stalling the proxy, and log that validation was skipped Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
- Dedupe allOf errors with a hash set instead of a linear scan - Include depth in the composed-schema memo key so depth-limited results aren't reused at shallower depths - Accept parameter values that are valid as strings when the coerced value isn't, e.g. for schemas allowing both integers and strings Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Unresolved schema-validation and path-matching defects can reject valid requests or responses, accept enum-disallowed nulls, and treat undocumented methods as documented operations.
5 open issues
What changed in this PR
Adds discriminator-based oneOf selection to OpenApiValidationPlugin, building on the traffic-validation functionality included from #2037.
Changes:
- Selects branches using explicit mappings, implicit schema names, or OAS 3.2
defaultMapping. - Reports selected-branch errors and invalid discriminator values while preserving strict
oneOfvalidation without a discriminator. - Includes plugin configuration, reporting, and integration tests for traffic validation and discriminator behavior.
| File | Description |
|---|---|
| schemas/v4.1.0/openapivalidationplugin.schema.json | Defines spec sources and unmatched-request reporting options. |
| DevProxy.Plugins/Utils/OpenApiSchemaValidator.cs | Implements schema validation and discriminator-based branch selection. |
| DevProxy.Plugins/Reporting/OpenApiValidationPluginReport.cs | Formats validation results as Markdown and plain text. |
| DevProxy.Plugins/Reporting/OpenApiValidationPlugin.cs | Loads specs, validates traffic, and records reports. |
| DevProxy.Integration.Tests/OpenApiValidationPluginTests.cs | Covers traffic validation, discriminator selection, errors, and fallback behavior. |
Review effort: Balanced
- Most specific matching path takes precedence; a missing method is reported as undocumented - OpenAPI 3.1+ specs require null to be listed in enums - Honor readOnly/writeOnly declared in allOf subschemas and references Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Closes dotnet#2040 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
waldekmastykarz
force-pushed
the
oneof-discriminator
branch
from
October 31, 2026 16:09
432a6b4 to
c8ca15e
Compare
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #2040
Depends on #2037. This PR is based on #2037's branch, so its diff includes #2037's commits until #2037 merges.
Changes
When a schema with
oneOfdefines adiscriminatorand the value is an object,OpenApiValidationPluginnow selects theoneOfbranch from the discriminator property's value and validates only that branch, instead of requiring that the value match exactly one branch.mappingentry first, then the implicit component schema name (for exampleCatfor#/components/schemas/Cat).defaultMapping(OAS 3.2), the plugin uses it when the discriminator property is missing or its value is unknown.oneOfwithout a discriminator is still validated strictly.