HeaderParameter and validation not coherent

[Grummfy]

API Platform version(s) affected: 3.4 -> 4.1.x
tested with my project (3.4) and validated that it still exist with master of api-platform/api-platform so I assume 4.x

Description
HeaderParameter constraint seems not coherent. Here, I tested the validation of an header parameter for the api. It seems to be inconsistent.

• checking that it's required : worked great
• checking that my value is less or equals than X : work great on the openapi front part, not on back part (no validation)
• checking that my value is an integer : work great on the openapi front part, not on back part
• checking that my value is greater or equals than X : failed

How to reproduce

I took the demo project, and on the greeting entity I have make this change

#[ApiResource(mercure: true)]
to
#[ApiResource(mercure: true, parameters: ['Foo' => new HeaderParameter(schema: ['type' => 'integer', 'example' => 3, 'minimum' => 1, 'maximum' => 5], required: true)])]

to check each test, maximum need to be removed to test the other constraint

Possible Solution
validation on the value of the array ?

Additional Context
Perhaps I missuses the HeaderParameter ? But the output in openApi format seems coherent

The constraint is applied on an array (don't know why an array instead of the value), so perhaps it's the reason of the behaviour?

thanks

[soyuka]

To clarify, the schema defines the JSON Schema definition of your Parameter, and this is used by OpenAPI (as its JSON-Schema compliant).

Based on these, in this part of the code, we're adding some automatic constraints:

core/src/Validator/Metadata/Resource/Factory/ParameterValidationResourceMetadataCollectionFactory.php

Lines 92 to 173 in 04d5cff

	private function addSchemaValidation(Parameter $parameter, ?array $schema = null, ?bool $required = null, ?OpenApiParameter $openApi = null): Parameter
	{
	if (null !== $parameter->getConstraints()) {
	return $parameter;
	}
	$schema ??= $parameter->getSchema();
	$required ??= $parameter->getRequired() ?? false;
	$openApi ??= $parameter->getOpenApi();
	// When it's an array of openapi parameters take the first one as it's probably just a variant of the query parameter,
	// only getAllowEmptyValue is used here anyways
	if (\is_array($openApi)) {
	$openApi = $openApi[0];
	} elseif (false === $openApi) {
	$openApi = null;
	}
	$assertions = [];
	if ($required && false !== ($allowEmptyValue = $openApi?->getAllowEmptyValue())) {
	$assertions[] = new NotNull(message: \sprintf('The parameter "%s" is required.', $parameter->getKey()));
	}
	if (false === ($allowEmptyValue ?? $openApi?->getAllowEmptyValue())) {
	$assertions[] = new NotBlank(allowNull: !$required);
	}
	if (isset($schema['exclusiveMinimum'])) {
	$assertions[] = new GreaterThan(value: $schema['exclusiveMinimum']);
	}
	if (isset($schema['exclusiveMaximum'])) {
	$assertions[] = new LessThan(value: $schema['exclusiveMaximum']);
	}
	if (isset($schema['minimum'])) {
	$assertions[] = new GreaterThanOrEqual(value: $schema['minimum']);
	}
	if (isset($schema['maximum'])) {
	$assertions[] = new LessThanOrEqual(value: $schema['maximum']);
	}
	if (isset($schema['pattern'])) {
	$assertions[] = new Regex('#'.$schema['pattern'].'#');
	}
	if (isset($schema['maxLength']) || isset($schema['minLength'])) {
	$assertions[] = new Length(min: $schema['minLength'] ?? null, max: $schema['maxLength'] ?? null);
	}
	if (isset($schema['minItems']) || isset($schema['maxItems'])) {
	$assertions[] = new Count(min: $schema['minItems'] ?? null, max: $schema['maxItems'] ?? null);
	}
	if (isset($schema['multipleOf'])) {
	$assertions[] = new DivisibleBy(value: $schema['multipleOf']);
	}
	if ($schema['uniqueItems'] ?? false) {
	$assertions[] = new Unique();
	}
	if (isset($schema['enum'])) {
	$assertions[] = new Choice(choices: $schema['enum']);
	}
	if (isset($schema['type']) && 'array' === $schema['type']) {
	$assertions[] = new Type(type: 'array');
	}
	if (!$assertions) {
	return $parameter;
	}
	if (1 === \count($assertions)) {
	return $parameter->withConstraints($assertions[0]);
	}
	return $parameter->withConstraints($assertions);
	}

But we definitely do not cover the whole JSON Schema specification. The safest way to ensure that is to add your own constraint to the parameter. Feel free to contribute any new validation if you think it can be automatic!

[Grummfy]

Thanks for the response. For me the problem is that it's incoherent and inconsistent.

So, the result is that I can't declare a proper schema because of this.