Fields marked required that nothing enforces
Found while generating demo data for every schema (ADR-111). These properties carry required: true on the property, which is the OpenAPI 2.0 idiom. JSON Schema — and OpenRegister — take required as an array on the parent object.
ValidateObject reads $schemaObject->required as that array and never collects per-property flags, so a field marked this way is optional at save time, whatever its author intended.
Why this is a small finding and not a large one
Most uses of the idiom here are harmless: the property carries the flag and is named in its parent's required array, so the flag is redundant and the field really is required. Measured across softwarecatalog: 38 of 42 are mirrored that way.
These are the ones that are not:
| schema |
property |
gebruik |
status |
koppeling |
gegevensuitwisselingRichting |
Both in lib/Settings/softwarecatalogus_register.json.
The fix is a product decision, which is why this is an issue and not a PR
Adding these to the parent's required array makes them required — which changes what saves, and may reject objects that exist today. Removing the required: true flag makes the schema honest about current behaviour. Both are defensible; which is right depends on whether the field was meant to be mandatory.
What should not persist is the third state: a declaration that reads as a constraint and enforces nothing.
Note on a related retraction
An earlier report of mine claimed 55 schemas across this app and one other "are not valid JSON Schema". That was wrong — it was my validator not knowing OpenRegister's dialect (required: true, oneOf: [] placeholders, and type: "file", which PropertyValidatorHandler accepts as a first-class type). Corrected in ConductionNL/hydra#626. This issue is the small, real remainder.
Fields marked required that nothing enforces
Found while generating demo data for every schema (ADR-111). These properties carry
required: trueon the property, which is the OpenAPI 2.0 idiom. JSON Schema — and OpenRegister — takerequiredas an array on the parent object.ValidateObjectreads$schemaObject->requiredas that array and never collects per-property flags, so a field marked this way is optional at save time, whatever its author intended.Why this is a small finding and not a large one
Most uses of the idiom here are harmless: the property carries the flag and is named in its parent's
requiredarray, so the flag is redundant and the field really is required. Measured across softwarecatalog: 38 of 42 are mirrored that way.These are the ones that are not:
gebruikstatuskoppelinggegevensuitwisselingRichtingBoth in
lib/Settings/softwarecatalogus_register.json.The fix is a product decision, which is why this is an issue and not a PR
Adding these to the parent's
requiredarray makes them required — which changes what saves, and may reject objects that exist today. Removing therequired: trueflag makes the schema honest about current behaviour. Both are defensible; which is right depends on whether the field was meant to be mandatory.What should not persist is the third state: a declaration that reads as a constraint and enforces nothing.
Note on a related retraction
An earlier report of mine claimed 55 schemas across this app and one other "are not valid JSON Schema". That was wrong — it was my validator not knowing OpenRegister's dialect (
required: true,oneOf: []placeholders, andtype: "file", whichPropertyValidatorHandleraccepts as a first-class type). Corrected in ConductionNL/hydra#626. This issue is the small, real remainder.