API Platform version(s) affected

4.4.4

Description

The JSON:API resource document schemas, such as Book.jsonapi and the input schemas like Order.OrderInput.jsonapi, have only a properties key at the top level. They have no type: object.

A schema without type also accepts a string, number, array or null, because properties applies only to objects. Validators and fuzzers that generate requests from the spec (for example Schemathesis) then send bodies like "foo" or 42, which the API never accepts. The nested data objects already declare "type": "object". Only the top level is missing it.

How to reproduce

Any resource with the jsonapi format shows it, for example the Book resource from #8699. Generated schema:

"Book.jsonapi": {
  "properties": {
    "data": { "type": "object", "properties": { "...": "..." } }
  }
}

In a minimal app with the resources from #8698 and #8699, these four schemas have no type: Book.jsonapi, Order.jsonapi, Order.OrderInput.jsonapi, OrderLine.jsonapi.

Expected: every *.jsonapi document schema declares "type": "object".

Possible Solution

In JsonApi\JsonSchema\SchemaFactory::buildSchema(), set $definitions[$definitionName]['type'] = 'object' next to the properties assignment for item schemas.

Additional Context

Checked on api-platform/core v4.4.4, Symfony 7.4, PHP 8.5, in an empty Symfony app. The code of JsonApi\JsonSchema\SchemaFactory on main is the same as in v4.4.4.

The app has only FrameworkBundle, TwigBundle and ApiPlatformBundle, with this config:

$c->extension('api_platform', [
    'mapping' => ['paths' => ['%kernel.project_dir%/src/ApiResource']],
    'formats' => ['jsonapi' => ['application/vnd.api+json']],
    'docs_formats' => ['jsonopenapi' => ['application/vnd.openapi+json']],
    'doctrine' => ['enabled' => false],
]);

The spec comes from bin/console api:openapi:export.