Request with $ref parameter can't be validated against schema without setting allow_invalid_ref to true

[elcamlost]

I have a schema with a path object like this

  /hit:
    post:
      operationId: v1_hit
      x-mojo-to: rest_api-v1#hit
      summary: register new hit
      produces:
      - application/json
      parameters:
      - $ref: "#/parameters/apiKey"
      - name: body
        in: body
        required: true
        schema:
          $ref: "#/definitions/hit"
      responses:
        '202':
          description: ''
          examples:
            application/json:
              status: ok
        '500':
          description: "Internal server error"
        '401':
          description: "Authorization failed"
        '400':
          description: "Bad Request"

Unless i set allow_invalid_ref to true while initializing Mojolicious::Plugin, I get error Unsupported $in: . Please report at https://github.com/jhthorsen/json-validator at /home/irassadin/Relap/script/../local/lib/perl5/JSON/Validator/OpenAPI.pm line 296.

So, as far as i can see it's a bug. First of all, using reference inside parameters is valid (see https://github.com/OAI/OpenAPI-Specification/blob/master/versions/2.0.md#path-item-object). And second, I have no error about invalid schema, but get a validation error for request.

[elcamlost]

It seems, that starting from JSON::Validator 1.05 all refs doesn't expand at all. Al least, before 1.05 we can get response schema for current route like this

my $spec = $c->openapi->spec;
my $schema = $spec->{responses}{$code}{schema}; 

Since 1.05 $schema is

{
     '$ref' => '#/definitions/Item'
};

[jhthorsen]

Not sure when I find time to fix this, but hopefully someone else can step in.

The quick fix for now is to initialise M::P::OPenAPI with {allow_invalid_ref => 1}, since it forces the spec to be resolved.

[jhthorsen]

Could you see if this is fixed now?

cpanm https://github.com/jhthorsen/json-validator/archive/master.tar.gz
cpanm https://github.com/jhthorsen/mojolicious-plugin-openapi/archive/master.tar.gz

These versions should also be available on CPAN soon.

[elcamlost]

As far as I can see, everything works great. My opinion is based on my own (far from full coverage) tests for my app. New version is not in production yet, so later I will be able to tell "everything works great" with greater confidence.

[jhthorsen]

Thanks for testing 👍

Please comment on https://github.com/jhthorsen/mojolicious-plugin-openapi/issues/50 if the issue is not fixed. I think it's the same issue.