Unable to open URI's (based on $ref) for remote locations in bundeled schemas

[A-Fromell-Private]

Ex.
root schema:
{
"$id": "https://github.com/ITxPT/schematest/raw/main/identifiers/test5",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"description": "Must be a non-negative integer",
"$comment": "A JSON Schema that uses multiple external references",
"$defs": {
"nonNegativeInteger": {
"allOf": [
{
"$ref": "/ITxPT/schematest/raw/main/identifiers/test5-1"
},
{
"$ref": "/ITxPT/schematest/raw/main/identifiers/test5-2"
}
]
}
},
"$ref": "#/$defs/nonNegativeInteger"
}

sub-schema-1:
{
"$id": "https://github.com/ITxPT/schematest/raw/main/identifiers/test5-1",
"$schema": "https://json-schema.org/draft/2020-12/schema#",
"description": "Must be an integer",
"type": "integer"
}

sub-schema-2:
{
"$id": "https://github.com/ITxPT/schematest/raw/main/identifiers/test5-2",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"description": "Not allowed to be negative",
"minimum": 0
}

Output:
{
"exception": "CatalogError",
"message": "A source is not available for "https://github.com/ITxPT/schematest/raw/main/identifiers/test5-1\""
}

The schemas originates from: https://apisyouwonthate.com/blog/json-schema-bundling-finally-formalised

and is modified for evaluating external/remote sub-schemas..

What am I missing??
Best regards, Anders

[marksparkza]

Hi,

Apologies for the slow response.

The jschon.dev website does not support remote schema references, for security reasons.

However, it's fairly straightforward to enable this in application code. Take a look at the jschon library documentation. The docs only provide a LocalSource example, just swap that out for RemoteSource. The following catalog setup should work for you:

from jschon import create_catalog, RemoteSource, URI

catalog = create_catalog('2020-12')

catalog.add_uri_source(
    URI("https://github.com/ITxPT/schematest/"),
    RemoteSource("https://github.com/ITxPT/schematest/", suffix=".json")
)

[A-Fromell-Private]

Hi Mark, Thans for your responce, and all the good work with jschon.dev ! For more complex schemas the usage of bundling schemas (linked sub-schemas) is crutial, and also recomended by json-schema.org as of version 2020-12. As I understand, the website the also don't support "LocalSource" since I can not see any way of upload related schemas. The impact is that it in fact not at all support the intended usage of $id and $ref ! Meaning, The implementation is "only" partial compliant towards version 2020-12 ! Is there any plans to add support for it? Best regards, Anders Fromell, CTO ITxPT.org

…

________________________________ From: Mark Jacobson ***@***.***> Sent: Tuesday, January 31, 2023 10:47 To: marksparkza/jschon.dev ***@***.***> Cc: Anders Fromell ***@***.***>; Author ***@***.***> Subject: Re: [marksparkza/jschon.dev] Unable to open URI's (based on $ref) for remote locations in bundeled schemas (Issue #1) Hi, Apologies for the slow response. The jschon.dev website does not support remote schema references, for security reasons. However, it's fairly straightforward to enable this in application code. Take a look at the jschon library documentation<https://jschon.readthedocs.io/en/stable/guide/catalog.html#reference-loading>. The docs only provide a LocalSource example, just swap that out for RemoteSource. The following catalog setup should work for you: from jschon import create_catalog, RemoteSource, URI catalog = create_catalog('2020-12') catalog.add_uri_source( URI("https://github.com/ITxPT/schematest/"), RemoteSource("https://github.com/ITxPT/schematest/", suffix=".json") ) — Reply to this email directly, view it on GitHub<#1 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AOIP5TOH5XKVW4EYPN7EXBTWVDNSZANCNFSM6AAAAAAT7BIV3Y>. You are receiving this because you authored the thread.Message ID: ***@***.***>

[handrews]

@A-Fromell-ITxPT I've contributed PR marksparkza/jschon#82 as a proposed solution to fully support referencing into bundles in jschon 0.10.0. You might want to follow that to see if it gets accepted - even if this proposal doesn't work out, I'm hoping to get it solved some way.

This is just for the library - I've never even looked at the jschon.dev site code (although I have to agree about the security concerns on remote references).

[handrews]

@A-Fromell-ITxPT See also marksparkza/jschon#85 for an approach to writing LocalSource/RemoteSource variations that can handle bundling, and marksparkza/jschon#83 for registering a source that handles all URIs (which might be necessary depending on how your bundles are set up, but usually isn't).