additionalProperties doesn't work in exploded form query parameters

[aweller]

Description

I am trying to accept dynamic parameters, i.e. parameters that are defined by the user and not known to me in advance of the request.

I was following this Stackoverflow example: https://stackoverflow.com/questions/49582559/how-to-document-dynamic-query-parameter-names-in-openapi-swagger

and wrote my yaml as

openapi: 3.0.1

(...)

  /nodes:
    get:
      operationId: my_lib.get
      parameters:
      - in: query
        name: params
        schema:
          type: object
          additionalProperties:
            type: string
          additionalProperties: true
        style: form
        explode: true

Expected behaviour

A GET to /nodes?foo=bar should return 200 and pass {'foo':'bar'} to my function.

Actual behaviour

A GET to /nodes?foo=bar returns

{
    "detail": "Extra query parameter(s) foo not in spec",
    "status": 400,
    "title": null,
    "type": "about:blank"
}

Steps to reproduce

Additional info:

Output of the commands:

• python --version: Python 3.7.0
• pip show connexion | grep "^Version\:" Version: 2.0.2

[dtkav]

hey @aweller , thanks for making this issue.
#789 added support for additionalProperties in the requestBody. If you want to take a crack at a PR, that would be a great place to start.
#781 is the related ticket for requestBody.

[aweller]

Thanks @dtkav, I will give it a try!

[dtkav]

I looked at that stackoverflow post in detail, and this looks like a bit of a nightmare to implement in connexion.

Right now we loop through the list of query parameters, and for each one we look for a schema and try to cast it to the right type based on the matching schema.

The main thing I can't figure out with this feature is that it's possible to have multiple parameter schemas that accept free-from keys, and they aren't namespaced!
Consider the following case:

in: query
name: free_form1
schema:
  type: object
  additionalProperties:
    type: integer
in: query
name: free_form2
schema:
  type: object
  additionalProperties:
    type: integer

and the query:

curl http://localhost:8000/?lucky=7

How are we supposed to pass this into the handler function? should it be:

def f(lucky):
    return lucky == 7

or

def f(free_form1):
    free_form1['lucky'] == 7

or

def f(free_form2):
    free_form2['lucky'] == 7

I'll see if I can find out more info on the openapi github.
It looks like we need to discuss/decide how to handle this before it makes sense to go implementing it.

[RobbeSneyders]

The issue is only for exploded form query parameters. If you change the style to deepObject, it works.

As @dtkav mentioned, there is no way to know how to validate additionalProperties in exploded form query parameters.

As long as you don't enable strict_validation, these extra parameters are passed to the view function though, just not as part of the params parameter, but as separate top level parameters.