Fix validation $ref, jhthorsen/json-validator#25

Changes

@@ -2,6 +2,7 @@ Revision history for perl distribution Mojolicious-Plugin-OpenAPI
 
 0.09 Not Released
  - Add check for $ref in the right place in the input specification
+   Contributor: Lari Taskula
 
 0.08 2016-07-29T14:33:14+0200
  - Add check for unique operationId and route names

lib/Mojolicious/Plugin/OpenAPI.pm

@@ -114,15 +114,17 @@ sub _invalid_input {
 
 sub _load_spec {
   my ($self, $app, $config) = @_;
-  my $jv      = JSON::Validator->new;
   my $openapi = JSON::Validator->new->schema(JSON::Validator::OpenAPI::SPECIFICATION_URL());
   my ($api_spec, @errors);
 
   # first check if $ref is in the right place,
   # and then check if the spec is correct
-  for (sub { }, undef) {
-    $api_spec = $jv->tap(resolver => $_ || $openapi->resolver)->schema($config->{url})->schema;
-    @errors = $jv->schema($openapi->schema->data)->validate($api_spec->data);
+  for my $r (sub { }, undef) {
+    next if $r and $config->{allow_invalid_ref};
+    my $jv = JSON::Validator->new;
+    $jv->resolver($r) if $r;
+    $api_spec = $jv->schema($config->{url})->schema;
+    @errors   = $openapi->validate($api_spec->data);
     die join "\n", "[OpenAPI] Invalid spec:", @errors if @errors;
   }
 
@@ -324,6 +326,13 @@ C<%config> can have:
 
 =over 2
 
+=item * allow_invalid_ref
+
+The OpenAPI specification does not allow "$ref" at every level, but setting
+this flag to a true value will ignore the $ref check.
+
+Note that setting this attribute is discourage.
+
 =item * coerce
 
 See L<JSON::Validator/coerce> for possible values that C<coerce> can take.

t/validate.t

@@ -8,6 +8,9 @@ like $@, qr{Invalid spec.*Missing}si, 'missing spec elements';
 eval { plugin OpenAPI => {url => 'data://main/swagger2/issues/89.json'} };
 like $@, qr{Properties not allowed.*\$ref}si, 'ref in the wrong place';
 
+eval { plugin OpenAPI => {allow_invalid_ref => 1, url => 'data://main/swagger2/issues/89.json'} };
+ok !$@, 'allow_invalid_ref=1';
+
 done_testing;
 
 __DATA__