No validation error is raised on PATCH with unknown attribute

[leplatrem]

With PUT, Cornice is in charge of validating against view schema. Works fine:

echo '{"title": "change"}' | http PUT "http://0.0.0.0:8888/v1/buckets/default/collections/articles/records/ff7db2ad-cc85-4715-b563-1579d4c27c3b" --auth=user:pass
HTTP/1.1 400 Bad Request
Access-Control-Expose-Headers: Backoff, Retry-After, Alert
Content-Length: 231
Content-Type: application/json; charset=UTF-8
Date: Fri, 10 Jul 2015 10:45:42 GMT
Server: waitress

{
    "code": 400, 
    "details": [
        {
            "description": "data is missing", 
            "location": "body", 
            "name": "data"
        }, 
        {
            "description": "title is not allowed", 
            "location": "body", 
            "name": "title"
        }
    ], 
    "errno": 107, 
    "error": "Invalid parameters", 
    "message": "data is missing"
}

With PATCH, it does not raise:

echo '{"title": "change"}' | http PATCH "http://0.0.0.0:8888/v1/buckets/default/collections/articles/records/ff7db2ad-cc85-4715-b563-1579d4c27c3b" --auth=user:pass
HTTP/1.1 200 OK
Access-Control-Expose-Headers: Backoff, Retry-After, Alert
Content-Length: 202
Content-Type: application/json; charset=UTF-8
Date: Fri, 10 Jul 2015 10:47:45 GMT
Etag: "1436525081662"
Last-Modified: Fri, 10 Jul 2015 10:44:41 GMT
Server: waitress

{
    "data": {
        "id": "ff7db2ad-cc85-4715-b563-1579d4c27c3b", 
        "last_modified": 1436525081662, 
        "title": "toto"
    }, 
    "permissions": {
        "write": [
            "basicauth:631c2d625ee5726172cf67c6750de10a3e1a04bcd603bc9ad6d6b196fa8257a6"
        ]
    }
}

Explanation:

Since the PATCH request payload does not always match schema, Cliquet does define any schema for the PATCH endpoint.
Instead, it validates the result of merge (old record + changes) against the resource mapping (which BTW duplicates some Cornice code to add colander errors to the response).

But the resource mapping is not the same as the schema that was used by the ViewSet. This should be fixed.