[Bug]: when `"request-body-strict": false` OpenAPI returns "Entity_NoAutoPK" & "Entity_NoPK"

[JerryNixon]

What?

When DAB is not strict it no longer requires NoAutoPk or NoPk types in OpenAPI.

• This is misleading to tooling that doesn't realize these useless types are not required.
• This also multiplies the size of the OpenAPI document, 2x for every entity.

Configuration

{
  "$schema": "https://github.com/Azure/data-api-builder/releases/download/vmajor.minor.patch/dab.draft.schema.json",
  "data-source": {
    "database-type": "mssql",
    "connection-string": "@env('MSSQL_CONNECTION_STRING')",
    "options": {
      "set-session-context": false
    }
  },
  "runtime": {
    "telemetry": {
      "log-level": {
        "Default": "information"
      }
    },
    "rest": {
      "enabled": true,
      "path": "/api",
      "request-body-strict": false // set to false
    },
    "graphql": {
      "enabled": true,
      "path": "/graphql",
      "allow-introspection": true
    },
    "mcp": {
      "enabled": true,
      "path": "/mcp"
    },
    "host": {
      "cors": {
        "origins": [],
        "allow-credentials": false
      },
      "authentication": {
        "provider": "Unauthenticated"
      },
      "mode": "development"
    }
  },
  "autoentities": {
    "default": {
      "patterns": {
        "include": [
          "%.%%"
        ]
      },
      "permissions": [
        {
          "role": "anonymous",
          "actions": [
            {
              "action": "*"
            }
          ]
        }
      ]
    }
  },
  "entities": {}
}

OpenAPI

{
  "openapi": "3.0.1",
  "info": {
    "title": "Data API builder - REST Endpoint - anonymous",
    "version": "2.0.0"
  },

[snip]

  "components": {
    "schemas": {
      "Todo": {
        "type": "object",
        "properties": {
          "id": {
            "type": "number",
            "format": ""
          },
          "title": {
            "type": "string",
            "format": ""
          },
          "completed": {
            "type": "boolean",
            "format": ""
          }
        }
      },
      "Todo_NoAutoPK": { // should not exist
        "type": "object",
        "properties": {
          "title": {
            "type": "string",
            "format": ""
          },
          "completed": {
            "type": "boolean",
            "format": ""
          }
        }
      },
      "Todo_NoPK": { // should not exist
        "type": "object",
        "properties": {
          "title": {
            "type": "string",
            "format": ""
          },
          "completed": {
            "type": "boolean",
            "format": ""
          }
        }
      }
    }
  },
  "tags": [
    {
      "name": "Todo"
    }
  ]
}

[Aniruddh25]

It seems that PR ##2998 should have fixed this. Is that true? @aaronburtle, please investigate.

[aaronburtle]

It seems that PR ##2998 should have fixed this. Is that true? @aaronburtle, please investigate.

This added the toggle but never added logic to omit the redundant schemas entirely when strict mode is off. See the RCA below:

RCA

In the CreateComponentSchemas method of the OpenApiDocumentor class (around line 1340), the _NoAutoPK and _NoPK schemas are always generated whenever mutation operations (POST, PUT, PATCH) are available, regardless of the request-body-strict setting. The isRequestBodyStrict parameter is passed through and only affects whether AdditionalPropertiesAllowed is set on those schemas, but it does not control whether the schemas are created at all.

Version

The _NoAutoPK and _NoPK schemas have been part of the OpenAPI generation since the feature was originally built. The request-body-strict awareness was added in PR #2998 ("Filter OpenAPI REST methods and fields based on role permissions") in v2.0.0-rc, but that PR only added the AdditionalPropertiesAllowed toggle and did not consider omitting the redundant schemas entirely when strict mode is off.