Duplicated headers in request body in generated docs (POST, PATCH, etc.)

[boarush]

Description

When specifying custom headers in GET endpoints, the generated documentation is correctly built with the header field separate from the query params. In case of other HTTP Verbs (POST, PATCH, etc.), the documentation incorrectly includes the header in the request body instead of making a header field, though after specifying the inputSources in the config, request works in both cases, including the value in the request body and not in the headers OR including it in the headers and not in the request body.

Expected

Generated documentation should correctly specify the field as a header in case of POST and other HTTP Verbs.

Reproduction

Sample Repo: https://github.com/boarush/express-zod-api/tree/bug/missing-headers

Have forked this repo and modified the example GET, POST and PATCH endpoints for in the user section.

Context

• Node.js version: 20.12.2
• express-zod-api version: 19.1.0

Thank you for the wonderful work! Really simple working with the library!

[RobinTail]

I assume this commit is what illustrates the issue

https://github.com/RobinTail/express-zod-api/commit/ccc098e6621f2d09961900731d0e6ebcb2cef9db

[RobinTail]

@boarush , this line controls the appearance of the parameter in headers when you generate the documentation:

https://github.com/RobinTail/express-zod-api/blob/78ea9a8c8d4ecd299b5c90a18ecfcb55d5315f9f/src/documentation-helpers.ts#L705-L706

Which means, as described in README, you should:

1. Enable headers in inputSources;
2. The header name should starts with x-.

In your commit first step is missing and that's why it's treated differently. The step is missing, because you made changes to the example that is not configured to handle headers.

though after specifying the inputSources in the config, request works in both cases

So... What's the issue with setting inputSources? Headers in input is the opt-in feature that you can enable that way. Please clarify.

Thank you for the wonderful work! Really simple working with the library!

Thank you as well, appreciate it :)

[boarush]

In the screenshots, you can see that I have specified the x-request-id header as input for both the GET and POST endpoint, however, one shows up correctly as a header in the swagger doc and one only as the part of request body.

I have tried setting the inputSources to explicitly include the header field and also using just the defaults, both result in the same generated doc.

Does this example make the problem clear?

[RobinTail]

Ok. I need to make a test...

[RobinTail]

On your screenshots both actually appear wrong, @boarush . Even for GET request it says that the placement is query, but it should be header

And that's very confusing, because for that case I already have a test.

[boarush]

I think I mixed up the screenshots, those were for when I was not including the inputSources. Following are for when I am including the inputSources:

GET is absolutely correct, POST is showing double fields.

My bad, sorry for the confusion.

[RobinTail]

I see, it's duplicated, @boarush Present in both "parameters" and the "body"

[RobinTail]

Confirmed, @boarush

Thank you so much for informing me and for the detailed explanation.

[boarush]

I think that when getting the requestBody here, it needs to exclude the headers if they're enabled.

https://github.com/RobinTail/express-zod-api/blob/78ea9a8c8d4ecd299b5c90a18ecfcb55d5315f9f/src/documentation.ts#L222-L233

[RobinTail]

🚀 Should be fixed in v19.1.1, @boarush In case it's not, please open another issue. Thank you once again for your contribution!