AnyOf implicitly allows additional properties on given models

[DKorosec]

Hello 👋

I've stumbled upon a problem where if I have a list of possible models (stored on a parent's model property), they implicitly allow additional properties. And only way to prevent it is to use @AdditionalProperties(false) on all of the data model classes in the list.

Here is the example class

class ModelA {
  @Required()
  a: string;
}

class ModelB {
  @Required()
  b: string;
}

class ExampleModel {
  @Required()
  id: string;

  @Required()
  @AnyOf(ModelA, ModelB)
  modelList: Array<ModelA | ModelB>;
}

@Controller("/example")
export class ExampleController {
  @Post("/")
  post(@BodyParams(ExampleModel) model: ExampleModel): ExampleModel {
    console.log(model);
    return model;
  }
}

where payload:

{
  "id": "string",
  "additionalProperty": "this gets removed",
  "modelList": [
    {
      "a": "string",
      "additionalProperty": "this doesn't get removed"
    },
    {
      "b": "string"
    }
  ]
}

produces:

{
  "id": "string",
  "modelList": [
    {
      "a": "string",
      "additionalProperty": "this doesn't get removed"
    },
    {
      "b": "string"
    }
  ]
}

Is this expected? And my question would be, is there a way to annotate ExampleModel's modelList so it doesn't allow additional properties implicitly (the same way they get removed in the parent model)?

[DKorosec]

I see this is closely related to https://github.com/orgs/tsedio/discussions/2781 and none of the proposed solutions (OneOf | Any | AnyOf) do work. But my question remains the same: is there a way to achieve this implicit additional properties removal instead of annotating classes with AdditionalProperties(false) ?

[Romakita]

Hi @DKorosec

Sorry for the late answer. This option should resolve your problem:
https://beta.tsed.dev/docs/json-mapper.html#jsonmapper-additionalproperties

[Romakita]

But jsonMapper.additionaProperties is disabled by default.

[Romakita]

I'll check your issue ASAP