fix: ensure correct parent reference ordering in allOf for default resolution

Author: Picazsoo

modules/openapi-generator/src/main/java/org/openapitools/codegen/OpenAPINormalizer.java

@@ -1757,8 +1757,14 @@ protected void ensureInheritanceForDiscriminatorMapping(Schema parent, Schema ch
                 // already done, so no need to add
                 return;
             }
+            // Prepend at position 0 so the parent ref is the FIRST item in the child's allOf.
+            // resolveDefault() uses last-writer-wins semantics, so anything the child already
+            // expressed in its allOf (including its own defaults) must come after the base in
+            // order to win. Appending at the end would make the parent the last — and therefore
+            // the winning — default, which is wrong: the normalizer is injecting structural
+            // inheritance here, not overriding child-specified defaults.
             Schema refToParent = new Schema<>().$ref(reference);
-            allOf.add(refToParent);
+            allOf.add(0, refToParent);
         } else {
             allOf = new ArrayList<>();
             child.setAllOf(allOf);

modules/openapi-generator/src/main/java/org/openapitools/codegen/utils/ModelUtils.java

@@ -1053,6 +1053,10 @@ public static ResolvedMinBound resolveMinimumBound(OpenAPI openAPI, Schema<?> sc
      * @param openAPI the OpenAPI document used to resolve {@code $ref}s
      * @param schema  the schema to inspect
      * @return the effective default value, or {@code null} if none is defined
+     * @implNote The result depends on the {@code allOf} array ordering <em>as it exists when
+     *     this method is called</em> — i.e., after the OpenAPI normalizer has run.
+     *     Normalizer mutations (e.g. {@code ensureInheritanceForDiscriminatorMapping} prepending
+     *     a parent {@code $ref}) are therefore visible here and are accounted for by design.
      */
     public static Object resolveDefault(OpenAPI openAPI, Schema<?> schema) {
         schema = getReferencedSchema(openAPI, schema);

modules/openapi-generator/src/test/java/org/openapitools/codegen/OpenAPINormalizerTest.java

@@ -1544,4 +1544,62 @@ public void oneOf_issue_23276() {
         assertNotNull(payload.getOneOf());
     }
 
+    @Test
+    public void ensureInheritanceForDiscriminatorMapping_prependsParentRef_childDefaultWins() {
+        // When a child already has allOf items (e.g. a base schema carrying "base_default"),
+        // the normalizer must INSERT the parent $ref at position 0 — not append at the end.
+        // With last-writer-wins semantics in resolveDefault(), appending at the end would make
+        // the parent's default the winner, incorrectly overriding the child's own default.
+        OpenAPI openAPI = TestUtils.createOpenAPI();
+
+        Schema<?> parent = new StringSchema();
+        parent.setDefault("parent_default");
+
+        Schema<?> base = new StringSchema();
+        base.setDefault("base_default");
+        openAPI.getComponents().addSchemas("Base", base);
+
+        // Child: allOf → [Base]; no Parent ref yet — use mutable list (parser always produces ArrayList)
+        Schema<?> child = new Schema<>().allOf(new ArrayList<>(List.of(new Schema<>().$ref("#/components/schemas/Base"))));
+        openAPI.getComponents().addSchemas("Child", child);
+        openAPI.getComponents().addSchemas("Parent", parent);
+
+        OpenAPINormalizer normalizer = new OpenAPINormalizer(openAPI, Map.of());
+        normalizer.ensureInheritanceForDiscriminatorMapping(parent, child, "Parent", new HashSet<>());
+
+        // Parent ref must be prepended at index 0; Base ref stays at index 1
+        assertEquals(((Schema<?>) child.getAllOf().get(0)).get$ref(), "#/components/schemas/Parent");
+        assertEquals(((Schema<?>) child.getAllOf().get(1)).get$ref(), "#/components/schemas/Base");
+
+        // resolveDefault walks top-to-bottom, last non-null wins → "base_default"
+        assertEquals(ModelUtils.resolveDefault(openAPI, child), "base_default");
+    }
+
+    @Test
+    public void ensureInheritanceForDiscriminatorMapping_noExistingAllOf_noProperties_directDefaultPreserved() {
+        // When a child has no allOf and no properties but does have a direct default,
+        // the normalizer creates allOf with just the parent $ref. The child's direct default
+        // must NOT be cleared — resolveDefault() short-circuits on it before inspecting allOf.
+        OpenAPI openAPI = TestUtils.createOpenAPI();
+
+        Schema<?> parent = new StringSchema();
+        parent.setDefault("parent_default");
+        openAPI.getComponents().addSchemas("Parent", parent);
+
+        // Child: direct default only, no allOf, no properties
+        Schema<?> child = new StringSchema();
+        child.setDefault("child_direct_default");
+        openAPI.getComponents().addSchemas("Child", child);
+
+        OpenAPINormalizer normalizer = new OpenAPINormalizer(openAPI, Map.of());
+        normalizer.ensureInheritanceForDiscriminatorMapping(parent, child, "Parent", new HashSet<>());
+
+        // Child now has allOf (parent ref only), and still holds its direct default
+        assertNotNull(child.getAllOf());
+        assertEquals(child.getDefault(), "child_direct_default");
+
+        // resolveDefault short-circuits on the direct default — child wins
+        assertEquals(ModelUtils.resolveDefault(openAPI, child), "child_direct_default");
+    }
+
 }