openapi-core的validate_response方法未校验响应属性问题

一、API Schema定义 #

main.yaml #

openapi: 3.0.1
info:
  title: blabla
  description: description

  termsOfService: 'TBD'
  contact:
    email: asd@email
  version: 1.1.9999
externalDocs:
  description: Find out more about Swagger
  url: 'http://swagger.io'
servers:
  - url: https://dummy_server.com/

tags:
  - name: login
    description: login


components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer

paths:
  /local/sub/{user}/duration:
    $ref: './methods/local/sub-user-duration.yaml'

./methods/local/sub-user-duration.yaml #

get:
  security:
    - bearerAuth: []
  tags:
    - duration
  summary: summ
  description: desc
  operationId: getDurationLimit
  parameters:
    - name: user
      in: path
      description: user
      required: true
      schema:
        type: integer
        format: int64
  responses:
    '400':
      description: Bad Request
      content:
        'application/json':
          schema:
            type: object
            properties:
              timestamp:
                type: string
              status:
                type: integer
              error:
                type: string
              path:
                type: string

二、Python校验代码 #

API调用代码 #

import requests

response = requests.post(url=url, params=query_params, headers=headers)

self.validate_request_swagger(response.request)
self.validate_response_swagger(response)

openapi-core校验逻辑 #

from openapi_core import Spec
from openapi_core import validate_request
from openapi_core import validate_response
from openapi_core.contrib.requests import RequestsOpenAPIRequest
from openapi_core.contrib.requests import RequestsOpenAPIResponse

def get_partner_spec(self):
    spec_ = Spec.from_file_path(str(self.get_project_root()) + "/docs/main.yaml")
    return spec_

def validate_request_swagger(self, request):
    request = RequestsOpenAPIRequest(request)
    validate_request(request=request, spec=self.get_partner_spec())

def validate_response_swagger(self, response):
    request = RequestsOpenAPIRequest(response.request)
    response = RequestsOpenAPIResponse(response)
    validate_response(response=response, spec=self.get_partner_spec(), request=request)

（注：原代码中from openapi_core.contrib语句不完整，已补全RequestsOpenAPIResponse的导入）

三、实际API响应内容 #

{
   "timestamp":"2023-03-03T11:26:26.293+00:00",
   "status":400,
   "error":"Bad Request",
   "path":"/local/sub/1647222638/duration"
}

四、问题现象 #

请求校验功能正常，但validate_response仅校验响应状态码：即使修改Schema中400响应的属性类型（比如把path设为integer），或者移除所有属性定义，校验仍然能通过，不会检测到响应内容不符合Schema的问题。

内容的提问来源于stack exchange，提问作者MG9901