Required value for openapi or swagger is not checked for existence or value

[jamescooke]

Context

In version 3 of OpenAPI, the field openapi is required in the root object as per the spec: https://github.com/OAI/OpenAPI-Specification/blob/master/versions/3.0.2.md#fixed-fields

In version 2, the field swagger is required as per the spec: https://swagger.io/specification/v2/#fixed-fields

However, the validator does not check that these fields are provided, nor does it check their values.

The examples below are running v0.17.0 inside a Node 13.7 docker container.

When not provided

Current behaviour

Given the following specification, which contains neither swagger nor openapi:

info:
  description: Test
  version: "1"
  title: Test
paths:
  '/things':
    post:
      summary: Create things
      operationId: create_things
      produces:
        - application/json

Validator falls back to assuming that this is v2 (which is why produces is required to avoid generating a warning) - and the output is:

openapi.yaml passed the validator

Expected behaviour

Validator should fail because neither swagger nor openapi fields are specified in the root object. It would probably be simplest if validation just stopped at this point, rather than making any assumptions about the version that was desired.

When a bad value is provided

Current behaviour

The value provided for swagger and openapi are not checked. This means that strange configurations pass validation. The following pass with no warnings or errors:

Providing both values:

swagger: 4
openapi: 5
info:
  description: Test
  version: "1"
  title: Test
paths:
  '/things':
    post:
      summary: Create things
      operationId: create_things

Providing objects:

swagger:
  is_good: true
openapi:
  is_better: Maybe
info:
  description: Test
  version: "1"
  title: Test
paths:
  '/things':
    post:
      summary: Create things
      operationId: create_things
      produces:
        - things

Expected behaviour

My understanding of the specs is that the openapi.yaml file's root object must contain one of:

• swagger: 2.0 (because spec says: """The value MUST be "2.0".""") or
• openapi: 3.0.0 or
• openapi: 3.0.1 or
• openapi: 3.0.2

Any other variation should raise an error and halt validation.

This might be a little strict in terms of the possible values for openapi, but it certainly should not allow anything that does not look like a semver string since the spec says "An OpenAPI document compatible with OAS 3.. contains a required openapi field which designates the semantic version of the OAS that it uses."

[dpopp07]

This is certainly very clear in the spec so I think these would be reasonable changes to make! Thanks for the issue