express-openapi not coercing parameters that use a $ref in their schema

When I use a parameter like this:

parameters:
  - name: flag
    in: query
    schema:
      $ref: '#/components/schemas/SomeFlag'

where the component looks like this:

components:
  schemas:
    SomeFlag:
      type: boolean

The parameter that ends up in my controller action hasn’t been parsed as the appropriate type. If i inline the schema it works as expected.

Here’s a minimal reproduction of my issue: https://github.com/chadxz/param-ref-repro

When i was debugging the issue it looks like there’s no support for $ref in openapi-request-coercer, but I don’t know if the schema refs should have been resolved prior to getting to that library or not.

[jberger]

Parameter validations shouldn’t silently be ignored; it is important to avoid false negatives. In a worst-case scenario this could be a security issue (though it would likely be detected before then). If express-openapi cannot and will not handle these valid openapi documents it should at least throw an exception when it notices the case.

[chadxz]

As far as I know yes