additionalProperties scope into $dynamicRefs

[dustinwilson]

$schema = <<<'JSON'
{
    "$schema": "https://json-schema.org/draft/2020-12/schema",
    "additionalProperties": false,
    "type": "object",
    "properties": {
        "foo": {
            "$ref": "#/$defs/nested"
        },
        "version": {
            "type": "integer"
        }
    },
    "$defs": {
        "nested": {
            "$dynamicAnchor": "nested",
            "type": "object",
            "properties": {
                "+bar": { "type": "string" }
            },
            "patternProperties": {
                "^[a-zA-Z_][a-zA-Z0-9_]*$": {
                    "$dynamicRef": "#nested"
                }
            }
        }
    }
}
JSON;

$data = (object)[
    'version' => 1,
    'foo' => (object)[
        'ook' => (object)[
            '+bar' => 'eek'
        ]
    ]
];

$validator = new Validator();
$result = $validator->validate($data, $schema);
$errors = [];
if (!$result->isValid()) {
    $formatter = new ErrorFormatter();
    foreach ($formatter->format($result->error(), true) as $path => $messages) {
        $m = json_encode($messages);
        echo "$path: $m\n";
    }
}

Output:

/foo/ook: ["Additional object properties are not allowed: +bar"]

According to the JSON Schema 2020-12 specification (section 10.3.2.3), additionalProperties behavior depends on the annotation results of properties and patternProperties within the same schema object.

That means in this example above when additionalProperties is set in the root, it shouldn't apply to the def, but in this library it does. The same schema passes in tools like JSON Schema Validator.

It seems from a passing glance at the code in SchemaParser.php, it's only checking for $anchors and not $dynamicAnchors. I'm sure there's more to it than that.

[downsider]

I've looked into this a bit, as I hit a similar issue. It seems $dynamicRef/$dynamicAnchor aren't fully implemented.

Tracing through the code, it looks like there was an assumption that $dynamicRef would work similarly to how $recursiveRef worked in previous drafts, but while it can replace $recursiveRef, it's also meant to extend functionality significantly.

The assumption presumes that $dynamicAnchor will only ever be set at the root of a schema and that's the only place it looks for it. The reason you are getting additionalProperties errors is because the scope of the schema is changed to the root (where the anchor is expected to be) and the constraints found there are applied to the current data, incorrectly.

I can't say what the solution should be as I don't know the ins-and-outs of JSON schema well enough to say what all the edge cases are, but it would seem like either pre-parsing the schema to collect $dynamicAnchors, or traversing the schema from the current scope to find them would be the place to start