Response validation does not work at all about oas3-tools HOT 2 OPEN

Hi,

I experienced the same issue and I investigated it a bit further.

Short answer:

Use res.send() or res.json() methods to respond with data and response validation will work as expected.

Long answer:

Response validation is hooked on res.json() method in express-openapi-validator:
https://github.com/cdimascio/express-openapi-validator/blob/3e803b586170e4fc079faedc2eb219276429826e/src/framework/modded.express.mung.ts#L59

Current implementation of the Pet example is using utils.writeJson(res, response):

Also Express suggest to use res.json() or res.send() instead of res.end() when returning data.
https://expressjs.com/en/api.html#res.end

Keep in mind, that validation will work only with JSON response.

I also tested, that it is possible to enable response validation which will remove all fields not mentioned in openAPI schema:

validateResponses: {
  removeAdditional: 'all',
}

from oas3-tools.

to my previous answer:

I also tested, that it is possible to enable response validation which will remove all fields not mentioned in openAPI schema:

validateResponses: {
  removeAdditional: 'all',
}

There is a problem with response validation when removeAdditional: 'all' option is used in this case:

1. OAS contains oneOf statement without discriminator
2. express-openapi-validator and ajv used in oas3-tools do not understand discriminator
   oas3-tools v2.2.3 depends on express-openapi-validator ^4.4.3 (v4.13.5) which depends on ajv ^6.12.6 (6.12.6)

removeAdditional option is propagated to ajv which describes the problem here:
https://ajv.js.org/guide/modifying-data.html#removing-additional-properties
https://ajv.js.org/json-schema.html#discriminator

Solution could be to use express-openapi-validator version which supports discriminator:
Discriminator support in ajv was added in v8. Ajv v8 is used in express-openapi-validator v4.13.8 https://github.com/cdimascio/express-openapi-validator/commits/v4.13.8
I did not test express-openapi-validator v4.13.8 though.

from oas3-tools.