OAS3.1 validation not triggering for `exclusiveMinimum`? #810

miketheman · 2024-03-14T19:09:32Z

miketheman
Mar 14, 2024

Hello!

I've been looking at updating pyramid_openapi3 to support OAS3.1, since openapi-core supports it, woohoo!

I wasn't sure if this is a bug in openapi-core/one of the underlying libraries yet, so I thought it'd be best to ask here.

Here's a sample.yaml file I'm using:

openapi: "3.1.0"
info:
  version: "1.0.0"
  title: Hello API
paths:
  /hello:
    get:
      parameters:
        - name: name
          in: query
          required: true
          schema:
            type: string
            exclusiveMinimum: 3
      responses:
        200:
          description: Say hello
        400:
          description: Bad Request

Note the exclusiveMinimum: 3 value. In OAS3.0, this would have been a pair of minimum: 3 and exclusiveMinimum: true, but in OAS3.1 I should be able to express it only with one key.

Here's a repro that should error, but doesn't:

import requests
from openapi_core import OpenAPI
from openapi_core.contrib.requests import RequestsOpenAPIRequest

openapi = OpenAPI.from_file_path('sample.yaml')

request = requests.Request('GET', 'https://foo.local/hello?name=yo')
openapi_request = RequestsOpenAPIRequest(request)

# Should raise a validation error for the parameter being too short, doesn't
validated = openapi.unmarshal_request(openapi_request)

# Some debug handling
assert not validated.errors
print(validated.parameters.query["name"]) #=> yo
print(len(validated.parameters.query["name"])) #=> 2

Some versions:

Python 3.12.2
openapi-core 0.19.0

Full version tree, in case that's interesting:

$ poetry show -t openapi-core
openapi-core 0.19.0 client-side and server-side support for the OpenAPI Specification v3
├── isodate *
│   └── six *
├── jsonschema >=4.18.0,<5.0.0
│   ├── attrs >=22.2.0
│   ├── jsonschema-specifications >=2023.03.6
│   │   └── referencing >=0.31.0
│   │       ├── attrs >=22.2.0 (circular dependency aborted here)
│   │       └── rpds-py >=0.7.0
│   ├── referencing >=0.28.4 (circular dependency aborted here)
│   └── rpds-py >=0.7.1 (circular dependency aborted here)
├── jsonschema-path >=0.3.1,<0.4.0
│   ├── pathable >=0.4.1,<0.5.0
│   ├── pyyaml >=5.1
│   ├── referencing >=0.28.0,<0.32.0
│   │   ├── attrs >=22.2.0
│   │   └── rpds-py >=0.7.0
│   └── requests >=2.31.0,<3.0.0
│       ├── certifi >=2017.4.17
│       ├── charset-normalizer >=2,<4
│       ├── idna >=2.5,<4
│       └── urllib3 >=1.21.1,<3
├── more-itertools *
├── openapi-schema-validator >=0.6.0,<0.7.0
│   ├── jsonschema >=4.19.1,<5.0.0
│   │   ├── attrs >=22.2.0
│   │   ├── jsonschema-specifications >=2023.03.6
│   │   │   └── referencing >=0.31.0
│   │   │       ├── attrs >=22.2.0 (circular dependency aborted here)
│   │   │       └── rpds-py >=0.7.0
│   │   ├── referencing >=0.28.4 (circular dependency aborted here)
│   │   └── rpds-py >=0.7.1 (circular dependency aborted here)
│   ├── jsonschema-specifications >=2023.5.2,<2024.0.0 (circular dependency aborted here)
│   └── rfc3339-validator *
│       └── six *
├── openapi-spec-validator >=0.7.1,<0.8.0
│   ├── jsonschema >=4.18.0,<5.0.0
│   │   ├── attrs >=22.2.0
│   │   ├── jsonschema-specifications >=2023.03.6
│   │   │   └── referencing >=0.31.0
│   │   │       ├── attrs >=22.2.0 (circular dependency aborted here)
│   │   │       └── rpds-py >=0.7.0
│   │   ├── referencing >=0.28.4 (circular dependency aborted here)
│   │   └── rpds-py >=0.7.1 (circular dependency aborted here)
│   ├── jsonschema-path >=0.3.1,<0.4.0
│   │   ├── pathable >=0.4.1,<0.5.0
│   │   ├── pyyaml >=5.1
│   │   ├── referencing >=0.28.0,<0.32.0 (circular dependency aborted here)
│   │   └── requests >=2.31.0,<3.0.0
│   │       ├── certifi >=2017.4.17
│   │       ├── charset-normalizer >=2,<4
│   │       ├── idna >=2.5,<4
│   │       └── urllib3 >=1.21.1,<3
│   ├── lazy-object-proxy >=1.7.1,<2.0.0
│   └── openapi-schema-validator >=0.6.0,<0.7.0
│       ├── jsonschema >=4.19.1,<5.0.0 (circular dependency aborted here)
│       ├── jsonschema-specifications >=2023.5.2,<2024.0.0 (circular dependency aborted here)
│       └── rfc3339-validator *
│           └── six *
├── parse *
└── werkzeug *
    └── markupsafe >=2.1.1