Fix validation for readOnly $ref properties

Yosi-Hezi commented 12 months ago

The "readOnly" keyword of $ref properties is ignored by oav validation process.

Full context: My team and I are developing a new RP via RPaaS and we have RPaaS validation enabled. We expect read-only properties that are sent as part of the request to be discarded. Instead, if they are defined with the $ref keyword (see example below), they go through and override the existing values of these properties in RPaaS database. I might be wrong, but I heard that RPaaS are using oav tools to perform their validation task (including the removal of read-only fields from the request body). Is this true? If it is, can this be fixed? Thanks in advance.

Example of a property defined with the $ref keyword:

"systemData": {
          "$ref": "../../../../../common-types/resource-management/v3/types.json#/definitions/systemData",
          "description": "Azure Resource Manager metadata containing createdBy and modifiedBy information",
          "readOnly": true // This is ignored by oav
        }

mikeharder commented 3 months ago

Root cause might be a dependency on a tool that ignores siblings of $ref. More info: https://github.com/Azure/azure-openapi-validator/discussions/706

mikeharder commented 3 months ago

Possible dup of #848

Azure / oav

Fix validation for readOnly $ref properties #999