OAS3.1 validation not triggering for `exclusiveMinimum`? #810

miketheman · 2024-03-14T19:09:32Z

miketheman
Mar 14, 2024

Hello!

I've been looking at updating pyramid_openapi3 to support OAS3.1, since openapi-core supports it, woohoo!

I wasn't sure if this is a bug in openapi-core/one of the underlying libraries yet, so I thought it'd be best to ask here.

Here's a sample.yaml file I'm using:

openapi: "3.1.0"info:
version: "1.0.0"title: Hello APIpaths:
/hello:
get:
parameters:
- name: namein: queryrequired: trueschema:
type: stringexclusiveMinimum: 3responses:
200:
description: Say hello400:
description: Bad Request

Note the exclusiveMinimum: 3 value. In OAS3.0, this would have been a pair of minimum: 3 and exclusiveMinimum: true, but in OAS3.1 I should be able to express it only with one key.

Here's a repro that should error, but doesn't:

importrequestsfromopenapi_coreimportOpenAPIfromopenapi_core.contrib.requestsimportRequestsOpenAPIRequestopenapi=OpenAPI.from_file_path('sample.yaml')
request=requests.Request('GET', 'https://foo.local/hello?name=yo')
openapi_request=RequestsOpenAPIRequest(request)
# Should raise a validation error for the parameter being too short, doesn'tvalidated=openapi.unmarshal_request(openapi_request)
# Some debug handlingassertnotvalidated.errorsprint(validated.parameters.query["name"]) #=> yoprint(len(validated.parameters.query["name"])) #=> 2

Some versions:

Python 3.12.2
openapi-core 0.19.0

Full version tree, in case that's interesting:

Details

$ poetry show -t openapi-coreopenapi-core 0.19.0 client-side and server-side support for the OpenAPI Specification v3├── isodate *│ └── six *├── jsonschema >=4.18.0,<5.0.0│ ├── attrs >=22.2.0│ ├── jsonschema-specifications >=2023.03.6│ │ └── referencing >=0.31.0│ │ ├── attrs >=22.2.0 (circular dependency aborted here)│ │ └── rpds-py >=0.7.0│ ├── referencing >=0.28.4 (circular dependency aborted here)│ └── rpds-py >=0.7.1 (circular dependency aborted here)├── jsonschema-path >=0.3.1,<0.4.0│ ├── pathable >=0.4.1,<0.5.0│ ├── pyyaml >=5.1│ ├── referencing >=0.28.0,<0.32.0│ │ ├── attrs >=22.2.0│ │ └── rpds-py >=0.7.0│ └── requests >=2.31.0,<3.0.0│ ├── certifi >=2017.4.17│ ├── charset-normalizer >=2,<4│ ├── idna >=2.5,<4│ └── urllib3 >=1.21.1,<3├── more-itertools *├── openapi-schema-validator >=0.6.0,<0.7.0│ ├── jsonschema >=4.19.1,<5.0.0│ │ ├── attrs >=22.2.0│ │ ├── jsonschema-specifications >=2023.03.6│ │ │ └── referencing >=0.31.0│ │ │ ├── attrs >=22.2.0 (circular dependency aborted here)│ │ │ └── rpds-py >=0.7.0│ │ ├── referencing >=0.28.4 (circular dependency aborted here)│ │ └── rpds-py >=0.7.1 (circular dependency aborted here)│ ├── jsonschema-specifications >=2023.5.2,<2024.0.0 (circular dependency aborted here)│ └── rfc3339-validator *│ └── six *├── openapi-spec-validator >=0.7.1,<0.8.0│ ├── jsonschema >=4.18.0,<5.0.0│ │ ├── attrs >=22.2.0│ │ ├── jsonschema-specifications >=2023.03.6│ │ │ └── referencing >=0.31.0│ │ │ ├── attrs >=22.2.0 (circular dependency aborted here)│ │ │ └── rpds-py >=0.7.0│ │ ├── referencing >=0.28.4 (circular dependency aborted here)│ │ └── rpds-py >=0.7.1 (circular dependency aborted here)│ ├── jsonschema-path >=0.3.1,<0.4.0│ │ ├── pathable >=0.4.1,<0.5.0│ │ ├── pyyaml >=5.1│ │ ├── referencing >=0.28.0,<0.32.0 (circular dependency aborted here)│ │ └── requests >=2.31.0,<3.0.0│ │ ├── certifi >=2017.4.17│ │ ├── charset-normalizer >=2,<4│ │ ├── idna >=2.5,<4│ │ └── urllib3 >=1.21.1,<3│ ├── lazy-object-proxy >=1.7.1,<2.0.0│ └── openapi-schema-validator >=0.6.0,<0.7.0│ ├── jsonschema >=4.19.1,<5.0.0 (circular dependency aborted here)│ ├── jsonschema-specifications >=2023.5.2,<2024.0.0 (circular dependency aborted here)│ └── rfc3339-validator *│ └── six *├── parse *└── werkzeug * └── markupsafe >=2.1.1