Skip to content

Conversation

@joakimnordling
Copy link
Contributor

@joakimnordling joakimnordling commented Sep 11, 2025

This PR adds support for optional stricter validation in the generated routes.

If the OpenAPI Spec (.json) files on the root level contain the key x-strict-validation and it's set to true the library will use a stricter mode of validation for the models generated from the file. If the key is not present or set to false, the library will default to old, laxer mode.

In short this stricter mode consists of:

  • Disallowing extra fields in the models
  • Using strict validation for str,bytes,int,float,bool
  • Strict validation of datetimes to follow RFC 3339 and dates to follow the 'full-date' format from RFC 3339

It's worth noting that the underlying datamodel-code-generator in version 0.33.0 reverted the behaviour of how datetimes are handled. Based on koxudaxi/datamodel-code-generator#2441 it seems like datamodel-code-generator versions 0.26.2 - 0.32.0 accidentally defaulted to using datetime for datetime fields, whereas versions before that and after that default to AwareDatetime. In essence this means that the versions 0.26.2 - 0.32.0 had a laxer validation of datetimes than versions up until 0.26.1 and again starting from 0.33.0. This means also openapi-to-fastapi has had this laxer validation in versions starting from 0.18.0 ->. This PR updates datamode-code-generator to latest 0.33.0 version, but contains such changes that by default the validation will be as lax as in the previous version by defaulting to using the datetime class for those fields. Thus by default the datetime validation will work the same way after this update to openapi-to-fastapi as before it despite datamodel-code-generator being updated to the latest version.

The strict mode provided by this PR however takes things one step further. The AwareDatetime is somewhat lax; it allows you to send dates in multiple formats that are valid ISO 8601 formats, but aren't following the strict set of RFC 3339, as well as unix timestamps (seconds since 1970). It thus defines it's own StrictAwareDatetime, which checks the type and format. In essence it will check the separator is a capital T and that there is either a capital Z or + or - with a HH:MM.

The strict mode also ensures that date fields can neither be unix timestamps, rather must be of the YYYY-MM-DD format.

@joakimnordling joakimnordling marked this pull request as ready for review September 11, 2025 13:25
Copy link
Contributor

@lietu lietu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added a few suggestions that might make code or messages clearer

Joakim Nordling and others added 3 commits September 12, 2025 12:07
@joakimnordling joakimnordling merged commit 817888d into main Sep 12, 2025
5 checks passed
@joakimnordling joakimnordling deleted the feature/strict-validation branch September 12, 2025 09:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants