Add support for validating readonly properties in the request payload (#74)

* check for type of the payload and presence of the discriminator in the payload while validating the discriminator

* Add support for validating readOnly properties in the request payload

* address review feedback

* fixed lint issue.

lib/helpers.js

@@ -113,6 +113,7 @@ function createJSONValidator () {
   ZSchemaValidator.JsonValidators.type = customValidators.typeValidator;
   ZSchemaValidator.JsonValidators.required = customValidators.requiredPropertyValidator;
   ZSchemaValidator.JsonValidators.oneOf = customValidators.oneOf;
+  ZSchemaValidator.JsonValidators.readOnly = customValidators.readOnlyValidator;
 
   var validator = new ZSchema({
     breakOnFirstError: false,

lib/validation/custom-zschema-validators.js

@@ -126,22 +126,22 @@ function oneOf (report, schema, json) {
 function validateDiscriminator (report, schema, json) {
   var basePolymorphicSchema = schema.oneOf.find(
     s => s.__$refResolved && s.__$refResolved.discriminator !== undefined
-  )
+  );
 
   // if none of the oneOf subschemas has a discriminator, we are not in a polymorphic oneOf.
   if (!basePolymorphicSchema) {
-    return false
+    return false;
   }
-  var discriminatorPropertyName = basePolymorphicSchema.__$refResolved.discriminator
+  var discriminatorPropertyName = basePolymorphicSchema.__$refResolved.discriminator;
 
   // to conform to the Azure specs, we accept a lenient discriminator. if the type is missing in the
   // payload we use the base class. Also if the type doesn't match anything, we use the base class.
   var basePolymorphicSchemaDiscriminatorValue =
-    basePolymorphicSchema.__$refResolved.properties[discriminatorPropertyName].enum[0]
+    basePolymorphicSchema.__$refResolved.properties[discriminatorPropertyName].enum[0];
 
-  var jsonDiscriminatorValue =
+    var jsonDiscriminatorValue =
     json[discriminatorPropertyName] ||
-    basePolymorphicSchemaDiscriminatorValue
+    basePolymorphicSchemaDiscriminatorValue;
 
   var schemaToValidate =
     schema.oneOf.find(
@@ -149,14 +149,17 @@ function validateDiscriminator (report, schema, json) {
         s.__$refResolved &&
         s.__$refResolved.properties[discriminatorPropertyName].enum[0] ===
         jsonDiscriminatorValue
-    ) || basePolymorphicSchema
+    ) || basePolymorphicSchema;
+  
+  var isJsonObject = typeof json === 'object' && json !== null && !Array.isArray(json);
 
-  // if the schema to validate is the base schema, we dont need to validate the discriminator enum value.
-  if (schemaToValidate === basePolymorphicSchema) {
-    json[discriminatorPropertyName] = basePolymorphicSchemaDiscriminatorValue
+  // if the schema to validate is the base schema and the payload is of type object then,
+  // we do not need to validate the discriminator enum value.
+  if (schemaToValidate === basePolymorphicSchema && isJsonObject) {
+    json[discriminatorPropertyName] = basePolymorphicSchemaDiscriminatorValue;
   }
-  ZSchemaValidator.validate.call(this, report, schemaToValidate, json)
-  return true
+  ZSchemaValidator.validate.call(this, report, schemaToValidate, json);
+  return true;
 }
 
 function whatIs (what) {
@@ -190,11 +193,38 @@ function whatIs (what) {
 
 function shouldSkipValidate (options, errors) {
   return options &&
-      Array.isArray(options.includeErrors) &&
-      options.includeErrors.length > 0 &&
-      !errors.some(function (err) {
-        return options.includeErrors.includes(err);
-      });
+    Array.isArray(options.includeErrors) &&
+    options.includeErrors.length > 0 &&
+    !errors.some(function (err) {
+      return options.includeErrors.includes(err);
+    });
+}
+
+function readOnlyValidator (report, schema, json) {
+  // http://json-schema.org/latest/json-schema-validation.html#rfc.section.10.3
+  if (shouldSkipValidate(this.validateOptions, ['READONLY_PROPERTY_NOT_ALLOWED_IN_REQUEST'])) {
+    return;
+  }
+
+  var isResponse = this.validateOptions && this.validateOptions.isResponse;
+  
+  if (!isResponse && schema && schema.readOnly && json !== undefined) {
+    let errorMessage = 'ReadOnly property `"{0}": ';
+    
+    if (schema && schema.type === 'string' && typeof json === 'string') {
+      errorMessage += '"{1}"';
+    } else {
+      errorMessage += '{1}';
+    }
+    errorMessage += '`, cannot be sent in the request.';
+    report.addCustomError(
+      'READONLY_PROPERTY_NOT_ALLOWED_IN_REQUEST',
+      errorMessage,
+      [report.parentReport.path[0], json],
+      null,
+      schema
+    );
+  }
 }
 
 module.exports.shouldSkipValidate = shouldSkipValidate;
@@ -202,3 +232,4 @@ module.exports.enumValidator = enumValidator;
 module.exports.requiredPropertyValidator = requiredPropertyValidator;
 module.exports.typeValidator = typeValidator;
 module.exports.oneOf = oneOf;
+module.exports.readOnlyValidator = readOnlyValidator;

package.json

@@ -1,6 +1,6 @@
 {
   "name": "yasway",
-  "version": "1.7.2",
+  "version": "1.7.3",
   "description": "A library that simplifies Swagger integrations.",
   "main": "index.js",
   "types": "index.d.ts",
@@ -81,4 +81,4 @@
     "swagger-methods": "^1.0.8",
     "swagger-schema-official": "2.0.0-bab6bed"
   }
-}
+}