Conversation
tsand
force-pushed
the
fix/openapi-spec-defects
branch
from
July 28, 2026 13:51
7de116d to
473cec4
Compare
tsand
force-pushed
the
fix/openapi-spec-defects
branch
from
August 14, 2026 13:50
b7305b6 to
0a6361c
Compare
tsand
force-pushed
the
fix/openapi-spec-defects
branch
from
September 22, 2026 19:50
0a6361c to
4164e9e
Compare
The oneOf arms are inline schemas, so `propertyName: type` has no schema name to resolve to and the discriminator never applied. Generators fail with "discriminator: not all schemas were mapped". Each arm keeps its `type` enum, so clients can still branch on create vs request.
IdentitySchema.id serializes models.Identity.ProviderID, the subject issued by the external provider, not a UUID. Only the email and phone providers use the user's ID there. Strict UUID parsing in generated clients fails to deserialize identities from other providers.
UserUpdateParams accepts it, and the handler requires it when Security.UpdatePasswordRequireCurrentPassword is enabled.
The endpoint is routed to adminUserCreate and documented in the README, but was missing from the spec. AdminCreateUserSchema mirrors AdminUserParams: UserSchema describes a response and cannot express password, password_hash, email_confirm, phone_confirm or ban_duration, so a client generated against it could not exercise the endpoint.
tsand
force-pushed
the
fix/openapi-spec-defects
branch
from
September 22, 2026 20:25
4164e9e to
76bd590
Compare
tsand
changed the title
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What kind of change does this PR introduce?
Bug fix. Spec-only, no code changes.
What is the current behavior?
idis typedformat: uuid, but it holds the provider's subject. Generated clients fail to decode identities for every provider exceptemailandphone.discriminatortargets inlineoneOfarms, so it can never resolve.current_passwordonPUT /userandPOST /admin/usersare undocumented.What is the new behavior?
idis a plain string.typeenum, so clients can still branch on create vs request.current_passwordis documented: required whenGOTRUE_SECURITY_UPDATE_PASSWORD_REQUIRE_CURRENT_PASSWORDis on and the user has a password, except during recovery.POST /admin/usersis documented, including 422 for an already registered email or phone.Additional context
Warning
Identity
idbecomes a string, soidentity.Id.String()breaks the next timeclient/adminis regenerated. The UUID is still onidentity_id.client/adminis not regenerated here. Verified the admin client generates with the pinned oapi-codegen v2.8.0. No tests added.https://claude.ai/code/session_01Evn2jxb2PeQQLzAUpN5pAN