v0.10.0: Strict Mode

[daveshanley]

Strict mode is an optional validation feature that detects undeclared properties in API requests and responses, even when the OpenAPI schema would normally allow them via additionalProperties: true.

In standard JSON Schema validation, setting additionalProperties: true (or omitting it entirely) permits any extra properties beyond those explicitly defined.

Strict mode overrides this permissive behavior to enforce API governance, ensuring that clients only send properties explicitly documented in the OpenAPI specification.

It supports configurable ignore patterns (using glob syntax like $.body.metadata.*) to exclude specific paths, and has sensible defaults for common HTTP headers that are typically not documented in specs.

Strict mode respects readOnly and writeOnly semantics based on whether validation is for a request or response.

https://pb33f.io/libopenapi/validation/#strict-mode-validation

[codecov]

Codecov Report

❌ Patch coverage is 99.23136% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 97.55%. Comparing base (3512bfa) to head (d63c3bb).
⚠️ Report is 29 commits behind head on main.

Files with missing lines	Patch %	Lines
strict/polymorphic.go	97.65%	5 Missing ⚠️
strict/matcher.go	93.33%	3 Missing ⚠️
strict/property_collector.go	97.05%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #211      +/-   ##
==========================================
+ Coverage   97.10%   97.55%   +0.44%     
==========================================
  Files          45       56      +11     
  Lines        4048     5122    +1074     
==========================================
+ Hits         3931     4997    +1066     
- Misses        117      125       +8     

Flag	Coverage Δ
unittests	97.55% <99.23%> (+0.44%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR introduces "Strict Mode," an optional validation feature that detects undeclared properties in API requests and responses, even when additionalProperties: true would normally allow them. This enables stronger API governance by ensuring clients only send properties explicitly documented in the OpenAPI specification.

Key Changes:

• New strict package with comprehensive validation logic for bodies, headers, query parameters, and cookies
• Support for polymorphic schemas (oneOf/anyOf/allOf) with per-branch validation
• Configurable ignore patterns using glob syntax (e.g., $.body.metadata.*)
• Respects readOnly/writeOnly semantics based on request vs response direction

Reviewed changes

Copilot reviewed 44 out of 45 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
validator.go	Added deterministic error sorting, updated copyright header
validator_test.go	Added strict mode integration tests, updated copyright
validator_examples_test.go	Updated examples to reflect security validation changes
strict/validator.go	Core validation entry points for bodies, headers, query params, cookies
strict/validator_test.go	Comprehensive 6000+ line test suite covering all scenarios
strict/types.go	Type definitions, Direction enum, traversal context with cycle detection
strict/utils.go	Path building utilities and glob pattern compilation
strict/schema_walker.go	Schema traversal with additionalProperties handling
strict/property_collector.go	Property collection from schemas including dependent schemas
strict/polymorphic.go	Complex handling for allOf/oneOf/anyOf validation
strict/matcher.go	Schema matching for variant selection with caching
strict/headers.go	Header validation with default ignore lists
strict/array_validator.go	Array validation with prefixItems and unevaluatedItems
requests/validate_request.go	Integration of strict validation into request pipeline
responses/validate_response.go	Integration of strict validation into response pipeline
responses/validate_headers.go	Header validation integration with strict mode
responses/validate_body_test.go	Tests for strict mode in response validation
requests/validate_body_test.go	Tests for strict mode in request validation
paths/specificity.go	New path specificity scoring for better path matching
openapi_vocabulary/vocabulary.go	Added Version32 constant

The implementation is thorough, well-tested, and follows good software engineering practices with proper cycle detection, caching, and error handling. No critical issues identified.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.