[OpenAPI] Property schema has been overwritten due to suspicious type check

[c1tru55]

API Platform version(s) affected: 4.0.12

Description

in custom custom decorated api_platform.metadata.property.metadata_factory I return following property schema (schema_type = input):

  'exclusiveMinimum' => 0,
  'type' =>  [
    'integer',
    'null',
  ],

in a result on this line https://github.com/api-platform/core/blob/4.1/src/JsonSchema/SchemaFactory.php#L189 I have following variable values:

$isUnknown = false;
$propertySchema = [
  'exclusiveMinimum' => 0,
  'type' =>  [
    'integer',
    'null',
  ],
];
$propertySchemaType = [
  'integer',
  'null',
];

but since this condition is not passed:

        if (
            !$isUnknown && (
                [] === $types
                || ($propertySchema['$ref'] ?? $propertySchema['anyOf'] ?? $propertySchema['allOf'] ?? $propertySchema['oneOf'] ?? false)
                || (\is_array($propertySchemaType) ? \array_key_exists('string', $propertySchemaType) : 'string' !== $propertySchemaType)
                || ($propertySchema['format'] ?? $propertySchema['enum'] ?? false)
            )
        ) {
            $schema->getDefinitions()[$definitionName]['properties'][$normalizedPropertyName] = new \ArrayObject($propertySchema);

            return;
        }

my schema is changed to:

$propertySchema = [
  'exclusiveMinimum' => 0,
  'anyOf' => 
  [
    [
      '$ref' => '#/components/schemas/Entity.jsonld-Input',
    ],
    [
      'type' => 'null',
    ],
  ],
];

which is not I want.

How to reproduce

Possible Solution

not sure about this condition, why generated schema is changed at all: https://github.com/api-platform/core/blob/4.1/src/JsonSchema/SchemaFactory.php#L189
but this check looks suspicious:

\is_array($propertySchemaType) ? \array_key_exists('string', $propertySchemaType) : 'string' !== $propertySchemaType

especially when type in openapi schema should be string or plain array of strings.
https://datatracker.ietf.org/doc/html/draft-bhutton-json-schema-validation-00#section-6.1.1

Additional Context

[soyuka]

I think that we're not detecting properly that you set the type yourself, can you try adding this flag to your ApiProperty to hit this breakpoint:

core/src/JsonSchema/SchemaFactory.php

Line 167 in 9389b4f

if (true === ($extraProperties[SchemaPropertyMetadataFactory::JSON_SCHEMA_USER_DEFINED] ?? false)) {

[c1tru55]

I think that we're not detecting properly that you set the type yourself, can you try adding this flag to your ApiProperty to hit this breakpoint:

core/src/JsonSchema/SchemaFactory.php

Line 167 in 9389b4f

if (true === ($extraProperties[SchemaPropertyMetadataFactory::JSON_SCHEMA_USER_DEFINED] ?? false)) {

yeah, came to same solution temporary.

#[AsDecorator(decorates: 'api_platform.metadata.property.metadata_factory')]
readonly class FooPropertyMetadataFactory implements PropertyMetadataFactoryInterface
{
    public function create(string $resourceClass, string $property, array $options = []): ApiProperty
    {
        $propertyMetadata = $this->decorated->create($resourceClass, $property, $options);
        
        if (
            null !== ($builtinType = $propertyMetadata->getBuiltinTypes()[0] ?? null)
            && !$builtinType->isCollection()
            && null !== ($className = $builtinType->getClassName())
            && is_a($className, FooInterface::class, true)
        ) {
            return $propertyMetadata
                ->withSchema(/* new schema */)
                ->withExtraProperties(array_merge($propertyMetadata->getExtraProperties(), [
                    SchemaPropertyMetadataFactory::JSON_SCHEMA_USER_DEFINED => true, <---
                ]))
            ;

but this check anyway looks suspicious:

\array_key_exists('string', $propertySchemaType)

when type in openapi schema should be string or plain array of strings.

[soyuka]

Agreed although you'd have the same issue no? To know why the check is there we probably need to comment + run the tests.

When metadata is read from attributes (

core/src/JsonSchema/Metadata/Property/Factory/SchemaPropertyMetadataFactory.php

Line 58 in a8d0c84

if (true === ($extraProperties[self::JSON_SCHEMA_USER_DEFINED] ?? false)) {

) we set this flag when the user defined the type, or else we compute it. As you're using metadata factories this check isn't added.