fix(normalizer): prevent nullable state leaking across shared schema refs (OpenAPITools#24356)

Author: KannaKim

modules/openapi-generator/src/main/java/org/openapitools/codegen/utils/ModelUtils.java

@@ -23,6 +23,7 @@
 import io.swagger.v3.oas.models.OpenAPI;
 import io.swagger.v3.oas.models.Operation;
 import io.swagger.v3.oas.models.PathItem;
+import io.swagger.v3.oas.models.SpecVersion;
 import io.swagger.v3.oas.models.callbacks.Callback;
 import io.swagger.v3.oas.models.headers.Header;
 import io.swagger.v3.oas.models.media.*;
@@ -2481,6 +2482,13 @@ public static boolean isParent(Schema schema) {
         return false;
     }
 
+    /**
+     * Creates a deep copy of a schema.
+     *
+     * @param schema    schema to clone
+     * @param openapi31 true when cloning an OpenAPI 3.1 schema
+     * @return a deep copy of the schema
+     */
     public static Schema cloneSchema(Schema schema, boolean openapi31) {
         if (openapi31) {
             return AnnotationsUtils.clone(schema, openapi31);
@@ -2513,6 +2521,12 @@ public static Schema simplifyOneOfAnyOfWithOnlyOneNonNullSubSchema(OpenAPI openA
         // if only one element left, simplify to just the element (schema)
         if (subSchemas.size() == 1) {
             Schema<?> subSchema = subSchemas.get(0);
+            // The parser may reuse a $ref schema instance in multiple locations. Clone the
+            // remaining $ref before applying parent metadata so those locations stay isolated.
+            if (subSchema.get$ref() != null) {
+                subSchema = cloneSchema(subSchema,
+                        openAPI != null && SpecVersion.V31.equals(openAPI.getSpecVersion()));
+            }
             // Preserve parent-level docs when nullable anyOf/oneOf collapses to a single child schema.
             if (subSchema.getDescription() == null && schema.getDescription() != null) {
                 subSchema.setDescription(schema.getDescription());

modules/openapi-generator/src/test/java/org/openapitools/codegen/typescript/axios/TypeScriptAxiosClientCodegenTest.java

@@ -179,6 +179,27 @@ public void testDeprecatedArrayAttribute() throws Exception {
         TestUtils.assertFileContains(file, "'nicknames'?: Array<string>");
     }
 
+    @Test(description = "Nullable oneOf references do not make other uses of the referenced schema nullable")
+    public void testNullableReferenceDoesNotLeakIntoModelProperty() throws Exception {
+        final File output = Files.createTempDirectory("typescript_axios_nullable_reference_").toFile();
+        output.deleteOnExit();
+
+        final CodegenConfigurator configurator = new CodegenConfigurator()
+                .setGeneratorName("typescript-axios")
+                .setInputSpec("src/test/resources/3_1/issue_23340.yaml")
+                .setOutputDir(output.getAbsolutePath().replace("\\", "/"));
+
+        final List<File> files = new DefaultGenerator().opts(configurator.toClientOptInput()).generate();
+        files.forEach(File::deleteOnExit);
+
+        Path api = Paths.get(output + "/api.ts");
+        TestUtils.assertFileContains(api,
+                "export interface TitleGroupHierarchyLite {",
+                "'content_type': ContentType;");
+        TestUtils.assertFileNotContains(api, "'content_type': ContentType | null;");
+        TestUtils.assertFileContains(api, "search: async (contentType?: ContentType | null");
+    }
+
     @Test(description = "Verify multipart file arrays use repeated form fields")
     public void testMultipartFileArrayUsesRepeatedFormFields() throws Exception {
         final File output = Files.createTempDirectory("typescript_axios_multipart_file_array_").toFile();

modules/openapi-generator/src/test/java/org/openapitools/codegen/utils/ModelUtilsTest.java

@@ -18,6 +18,7 @@
 package org.openapitools.codegen.utils;
 
 import io.swagger.v3.oas.models.OpenAPI;
+import io.swagger.v3.oas.models.SpecVersion;
 import io.swagger.v3.oas.models.media.*;
 import io.swagger.v3.oas.models.parameters.Parameter;
 import io.swagger.v3.oas.models.parameters.RequestBody;
@@ -555,6 +556,23 @@ public void simplifyOneOfWithOnlyOneNonNullSubSchemaKeepsReadOnlyWriteOnlyAttrib
         assertEquals(schema.get$ref(), "#/components/schemas/IntegerRef");
     }
 
+    @Test
+    public void simplifyOneOfWithOnlyOneNonNullSubSchemaDoesNotMutateSharedSchema() {
+        OpenAPI openAPI = new OpenAPI().specVersion(SpecVersion.V31);
+        Schema sharedRef = new Schema<>().$ref("#/components/schemas/ContentType");
+        Schema nullableParent = new ComposedSchema().oneOf(new ArrayList<>(Arrays.asList(
+                new Schema<>().type("null"),
+                sharedRef)));
+
+        Schema simplified = ModelUtils.simplifyOneOfAnyOfWithOnlyOneNonNullSubSchema(
+                openAPI, nullableParent, nullableParent.getOneOf());
+
+        assertNotSame(simplified, sharedRef);
+        assertEquals(simplified.get$ref(), sharedRef.get$ref());
+        assertTrue(simplified.getNullable());
+        assertNull(sharedRef.getNullable());
+    }
+
     @Test
     public void simplifyAnyOfWithOnlyOneNonNullSubSchemaKeepsReadOnlyWriteOnlyAttribute() {
         OpenAPI openAPI = TestUtils.parseSpec("src/test/resources/3_0/simplifyOneOfAnyOf_test.yaml");

modules/openapi-generator/src/test/resources/3_1/issue_23340.yaml

@@ -0,0 +1,64 @@
+{
+  "openapi": "3.1.0",
+  "info": { "title": "repro-23340", "version": "1.0.0" },
+  "paths": {
+    "/home": {
+      "get": {
+        "operationId": "getHome",
+        "responses": {
+          "200": {
+            "description": "ok",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": ["data"],
+                  "properties": { "data": { "$ref": "#/components/schemas/HomePage" } }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/search": {
+      "get": {
+        "operationId": "search",
+        "parameters": [
+          {
+            "name": "content_type",
+            "in": "query",
+            "required": false,
+            "schema": { "oneOf": [ { "type": "null" }, { "$ref": "#/components/schemas/ContentType" } ] }
+          }
+        ],
+        "responses": { "200": { "description": "ok" } }
+      }
+    }
+  },
+  "components": {
+    "schemas": {
+      "ContentType": { "type": "string", "enum": ["movie"] },
+      "TitleGroupLite": {
+        "type": "object",
+        "required": ["content_type"],
+        "properties": { "content_type": { "$ref": "#/components/schemas/ContentType" } }
+      },
+      "HomePage": {
+        "type": "object",
+        "required": ["latest_uploads"],
+        "properties": {
+          "latest_uploads": { "type": "array", "items": { "$ref": "#/components/schemas/TitleGroupLite" } }
+        }
+      },
+      "TitleGroupHierarchyLite": {
+        "type": "object",
+        "required": ["id", "content_type"],
+        "properties": {
+          "id": { "type": "integer", "format": "int32" },
+          "content_type": { "$ref": "#/components/schemas/ContentType" }
+        }
+      }
+    }
+  }
+}

samples/client/others/ruby-nextgen-qdrant/lib/qdrant/models/batch_payloads_inner.rb

@@ -11,7 +11,7 @@ module Models
     # anyOf wrapper. Returns the first candidate that validates.
     module BatchPayloadsInner
       CANDIDATES = [
-        'Hash',
+        'Hash<String, Object>',
       ].freeze
 
       def self.build(data)

samples/client/others/typescript-node/encode-decode/build/api/defaultApi.ts

@@ -517,7 +517,7 @@ export class DefaultApi {
     /**
      * 
      */
-    public async testDecodeMapOfObjectsGet (options: {headers: {[name: string]: string}} = {headers: {}}) : Promise<{ response: http.IncomingMessage; body: { [key: string]: ComplexObject | undefined | null; };  }> {
+    public async testDecodeMapOfObjectsGet (options: {headers: {[name: string]: string}} = {headers: {}}) : Promise<{ response: http.IncomingMessage; body: { [key: string]: ComplexObject | undefined; };  }> {
         const localVarPath = this.basePath + '/test/decode/map-of/objects';
         let localVarQueryParameters: any = {};
         let localVarHeaderParams: any = (<any>Object).assign({}, this._defaultHeaders);
@@ -559,13 +559,13 @@ export class DefaultApi {
                     localVarRequestOptions.form = localVarFormParams;
                 }
             }
-            return new Promise<{ response: http.IncomingMessage; body: { [key: string]: ComplexObject | undefined | null; };  }>((resolve, reject) => {
+            return new Promise<{ response: http.IncomingMessage; body: { [key: string]: ComplexObject | undefined; };  }>((resolve, reject) => {
                 localVarRequest(localVarRequestOptions, (error, response, body) => {
                     if (error) {
                         reject(error);
                     } else {
                         if (response.statusCode && response.statusCode >= 200 && response.statusCode <= 299) {
-                            body = ObjectSerializer.deserialize(body, "{ [key: string]: ComplexObject | undefined | null; }");
+                            body = ObjectSerializer.deserialize(body, "{ [key: string]: ComplexObject | undefined; }");
                             resolve({ response: response, body: body });
                         } else {
                             reject(new HttpError(response, body, response.statusCode));
@@ -1487,7 +1487,7 @@ export class DefaultApi {
      * 
      * @param requestBody 
      */
-    public async testEncodeMapOfObjectsPost (requestBody: { [key: string]: ComplexObject | undefined | null; }, options: {headers: {[name: string]: string}} = {headers: {}}) : Promise<{ response: http.IncomingMessage; body?: any;  }> {
+    public async testEncodeMapOfObjectsPost (requestBody: { [key: string]: ComplexObject | undefined; }, options: {headers: {[name: string]: string}} = {headers: {}}) : Promise<{ response: http.IncomingMessage; body?: any;  }> {
         const localVarPath = this.basePath + '/test/encode/map-of/objects';
         let localVarQueryParameters: any = {};
         let localVarHeaderParams: any = (<any>Object).assign({}, this._defaultHeaders);
@@ -1509,7 +1509,7 @@ export class DefaultApi {
             uri: localVarPath,
             useQuerystring: this._useQuerystring,
             json: true,
-            body: ObjectSerializer.serialize(requestBody, "{ [key: string]: ComplexObject | undefined | null; }")
+            body: ObjectSerializer.serialize(requestBody, "{ [key: string]: ComplexObject | undefined; }")
         };
 
         let authenticationPromise = Promise.resolve();