Validation of required read-only field fails when request body use allOf to compose schema

Schema using allOf composition with required readOnly properties are not validated properly.

PUT /test {“notReadOnly”: “abc”, “writeOnly”: “write“}

should be valid but triggers validation error complaining `readOnly` is missing in request payload.

Given then openAPI spec is:

openapi: 3.0.0
info:
  version: 1.0.0
  title: RequiredReadOnlyAllOf
servers:
  - url: /
paths:
  /test:
    put:
      summary: update an item
      requestBody:
        description: updated
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ComposedWithAllOf'
      responses:
        '201':
          description: Updated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ComposedWithAllOf'
components:
  schemas:
    ReadOnly:
      type: object
      properties:
        readOnly:
          type: string
          readOnly: true
          example: 'read'
        notReadOnly:
          type: string
          example: 'abc'
        writeOnly:
          type: string
          writeOnly: true
          example: 'write'
      required:
        - readOnly
        - notReadOnly
        - writeOnly
    ComposedWithAllOf:
      allOf:
        - type: object
          required:
            - id
          properties:
            id:
              type: string
        - $ref: '#/components/schemas/ReadOnly

207 & 240 already fixed related issue, but the same bug appear when required, readOnly & allOfare used together.

‌

Comments (5)