OAS 3.0: readOnly properties are included in request body examples

[hkosova]

Version: ft/oas3 branch, commit a1ce0e7

In 3.0 specs, request body examples generated from the schema include read-only properties -- but they should not be included in requests. The issue does not exist in 2.0 specs.

Spec:

openapi: 3.0.0
info:
  version: 0.0.0
  title: test

paths:
  /users:
    post:
      summary: Create a user
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/User'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/User'

components:
  schemas:
    User:
      type: object
      properties:
        id:
          type: integer
          example: 5
          readOnly: true
        name:
          type: string
          example: Bob

Expected result: Request body example is:

{
  "name": "Bob"
}

Actual result: Request body example includes the read-only property id:

{
  "id": 5,
  "name": "Bob"
}

[owenconti]

@hkosova Running the latest master locally, this is what I am seeing with your example spec:

I don't see the id property in any of the example objects, however I do see it in the Model tab of the request body field.

[hkosova]

@owenconti, yes, this seems to be fixed already. 🎉
Closing.

[amochohan]

It looks like this is still an issue for readOnly attributes which refer to objects. If I expand on the original example:

paths:
  /users:
    post:
      summary: Create a user
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/User'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/User'

components:
  schemas:
    User:
      type: object
      properties:
        id:
          type: integer
          example: 5
          readOnly: true
        name:
          type: string
          example: Bob
        example_attribute:
            type: object
            $ref: '#/components/schemas/AnotherModel'
            readOnly: true

The example_attribute will still be displayed in the requestBody example.

[hkosova]

@amochohan, $ref works by overwriting all of its sibling attributes, so readOnly does not actually have effect in your example. You'll need to use something like:

        example_attribute:
          readOnly: true
          allOf:
            - $ref: '#/components/schemas/AnotherModel'

Here's a related discussion about combining $ref with other attributes: #3325 (comment).

[amochohan]

Thanks @hkosova, apologies if this wasn't the correct medium through which to have raised this.

[Adeynack]

EDIT: Nevermind this.

Just realised it is an issue with the SwaggerDoc, not OpenAPI. The online editor display examples properly. The version we have offline does not. My apologies

Original post

I still have the same problem, observed in SwaggerDoc.
I changed some properties to readOnly: true. They disappeared from the POST example, but they still show up in the PATCH one. Since PATCH is a write verb, I expect them not to show up in the example.

Should I post this here, since it is a closed issue (to be reopened) or should I create a new one?