Swagger-editor: readOnly not effective

[atomobianco]

Marking a property in a model schema as readOnly: true does not produce any effects in the swagger-editor
PS: swagger-editor commit 973048c37358804bdfc9482e573c6b1b90106385

[mohsen1]

What a read-only model should do?

[webron]

@mohsen1 - readOnly sets a model property as only applicable when being sent from the server, but not to the server, so it shouldn't appear in a model form for operation parameters. For reference - https://github.com/swagger-api/swagger-spec/blob/master/versions/2.0.md#schemaReadOnly.

[atomobianco]

An example is the "createdAt" or "updatedAt" fields in a resource. You want them to be returned by the server, but no client should be able to change those values.

[mohsen1]

Just to make it clear for myself, here I created a simple Swagger spec that has a model with one read-only property. The form generated for POST operation marks the createdAt property as read-only and user is not able change that field:

---
swagger: '2.0'
info:
  version: 0.0.0
  title: Simple API
paths:
  /:
    get:
      responses:
        200:
          description: OK
          schema:
            $ref: '#/definitions/User'
    post:
      parameters:
        - name: body
          in: body
          description: description
          schema:
            $ref: '#/definitions/User'
      responses:
        200:
          description: OK

definitions:
  User:
    properties:
      name: 
        type: string
      createdAt:
        type: string
        readOnly: true

So what is the bug?

[webron]

LGTM

[atomobianco]

You are right! My fault. Actually I was expecting to see the effects somehow – maybe the field totally absent or with gray color font – already in the schema, as is the case for required parameters, in which a star is added.

swagger: '2.0'
info:
  version: 0.0.0
  title: Simple API
paths:
  /:
    get:
      responses:
        200:
          description: OK
          schema:
            $ref: '#/definitions/User'
    post:
      parameters:
        - name: body
          in: body
          description: description
          schema:
            $ref: '#/definitions/User'
      responses:
        200:
          description: OK

definitions:
  User:
    required:
    - name
    properties:
      name: 
        type: string
      createdAt:
        type: string
        readOnly: true

[mohsen1]

No worries. :+1:

[atomobianco]

Sorry to return on a closed subject, but I still have some worries.
I am augmenting the code @mohsen1 presented, but with internal documents.
Comments are created by a User and rendered as an array when a User is returned, but you cannot create a User resource that already contains Comments, that is, the property comments should be readOnly. Yet, the form still gives me the possibility to add Comments, and empty fields are sent in the POST request. I would expect the entire coments field not sent at all.

swagger: '2.0'
info:
  version: 0.0.0
  title: Simple API
paths:
  /:
    get:
      responses:
        200:
          description: OK
          schema:
            $ref: '#/definitions/User'
    post:
      parameters:
        - name: body
          in: body
          description: description
          schema:
            $ref: '#/definitions/User'
      responses:
        200:
          description: OK

definitions:
  Comment:
    properties:
      name: 
        type: string

  User:
    properties:
      name: 
        type: string
      createdAt:
        type: string
        readOnly: true
      comments:
        readOnly: true
        type: array
        items:
          readOnly: true
          $ref: '#/definitions/Comment'

[mohsen1]

It's a dependency bug and I've reported it here
https://github.com/jdorn/json-editor/issues/455

[davisford]

Just a note, this issue also seems to affect embedded $ref objects, for example:

definitions:
   Customer:
     type: object 
     properties:
       id: 
         type: number 
         format: int 
       name:
         type: string 
         required: true 
  ThingThatHasCustomer:
    type: object 
    properties:
      customer:
        readOnly: true 
        $ref: '#/definitions/Customer'
      customerId:
        type: number 
        format: int 
        required: true 

In this instance, I don't want to POST ThingThatHasCustomer with the embedded customer object. There is a separate route to update customers, and I don't want to send it back on every update. But you can send back the customerId. Unfortunately marking it readOnly does not appear to work. In the "try this operation", it lists customer and since customer itself has required fields, they are required on any method that embeds it also.

[mohsen1]

You can't do this:

      customer:
        readOnly: true 
        $ref: '#/definitions/Customer'

$ref resolver will replace everything in the object with it's referencer result. So your readOnly property here will be overriden after resolution

[davisford]

Oh, that explains that, I guess. Can you somehow pull it in under the property name, like:

   properties:
      customer:
         readOnly: true 
         allOf:
           - $ref: '#/definitions/Customer'

[Project0]

I have the same problem with an readonly propertie of type object, the editor always send an empty object "{}" with this attribute

[Pyrolistical]

still an issue. cannot allOf readOnly + $ref, also readOnly never works with type object

[webron]

Closing as an old issue. Please file a new one if still relevant.

[florianajir]

It's not an old issue, it's still relevant !
Why can we set readonly on array of objects or primitives but not on object property ?