fix: enforce required=true for path parameters per OpenAPI spec#1011
fix: enforce required=true for path parameters per OpenAPI spec#1011Yanhu007 wants to merge 1 commit intodanielgtaylor:mainfrom
Conversation
Since v2.37.0, the 'required' struct tag override (line 245-246) can set Required=false for path parameters, which violates the OpenAPI 3.x specification: 'If the parameter location is "path", this property is REQUIRED and its value MUST be true.' The initial Required=true set at line 149 for path params was being overridden by the generic tag processing. Add a post-override enforcement that always sets Required=true for path params. Fixes danielgtaylor#1009
There was a problem hiding this comment.
Pull request overview
This PR fixes an OpenAPI spec regression where path parameters tagged required:"false" could omit the required field from generated OpenAPI output, despite the OpenAPI 3.x requirement that all path parameters must be required.
Changes:
- Enforce
Required = truefor allpathparameters after genericrequiredtag processing. - Add inline comments explaining the OpenAPI 3.x requirement and why the override is necessary.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| // Per OpenAPI 3.x spec, path parameters MUST always be required. | ||
| // Override any user-set `required:"false"` tag for path params. | ||
| if pfi.Loc == "path" { | ||
| pfi.Required = true | ||
| } |
There was a problem hiding this comment.
There’s no regression test covering the scenario described in #1009 (a path parameter tagged required:"false" should still emit required: true in the OpenAPI output). Adding a test (e.g., in huma_test.go alongside other OpenAPI/parameter assertions) that registers an operation with a path field tagged required:"false" and then asserts the generated parameter object has Required == true (and marshals to JSON with "required": true) would help prevent this from regressing again.
| // While discouraged, make it possible to make query/header params required. | ||
| if _, ok = f.Tag.Lookup("required"); ok { | ||
| pfi.Required = boolTag(f, "required", false) | ||
| } |
There was a problem hiding this comment.
The comment says this required tag override is for “query/header params”, but the code applies to any parameter location returned by parseParamLocation (including form, cookie, and now path prior to the enforced override). Consider updating the comment to accurately describe the behavior (and note that path is always forced to required).
Fixes #1009
Problem
Since v2.37.0, path parameters with
required:"false"struct tag omit the"required"field from the generated OpenAPI spec. Per the OpenAPI 3.x specification:The initial
Required = trueset for path params (line 149) was being overridden by the genericrequiredtag processing (lines 245-246).Fix
Add post-override enforcement that always sets
Required = truefor path parameters, regardless of the struct tag value. This restores the pre-v2.37.0 behavior whererequired:"false"on path parameters was silently ignored.