readonly param designed behaviour is broken with oneof, anyof

Use-case abstract

According to docs readonly parameter should give False on validation if field with that parameter is in dict.

Works as expected in general case:

import cerberus

schema_one = {
    'id': {'type': 'integer', 'readonly': True},
    'text': {'type': 'string', 'required': True}
}
schema_two = {
    'id': {'type': 'integer', 'readonly': True},
    'extra_text': {'type': 'string', 'required': True}
}

v = cerberus.Validator({'record': {'type': 'dict', 'schema': schema_one}})

test_data = {'record': {'id': 10, 'text': 'ooops'}}
v.validate(test_data)
# -> False
v.errors
# -> {'record': [{'id': ['field is read-only']}]}

---

Support request / Bug report

However using multiple schemas with oneof for field will produce unexpected True.

import cerberus

schema_one = {
    'id': {'type': 'integer', 'readonly': True},
    'text': {'type': 'string', 'required': True}
}
schema_two = {
    'id': {'type': 'integer', 'readonly': True},
    'extra_text': {'type': 'string', 'required': True}
}

v = cerberus.Validator({'record': {'type': 'dict', 'oneof_schema': [schema_one, schema_two]}})

test_data = {'record': {'id': 10, 'text': 'ooops'}}
v.validate(test_data)
# -> True
v.errors
# -> {}

anyof gives same result, not tested with noneof and allof. Bug exists in version 1.1, 1.0.x, in 9.x exception is raised when using readonly param.

[funkyfuture]

unless there are other proposals how to proceed with this issue, i’m going to remove the 1.3 milestone from this.

[dkellner]

Yes, it was in PR #282. The other (non-simple) fix we had for that is in #272, and I still have the branch here: https://github.com/dkellner/cerberus/tree/default-readonly .

IIRC and Cerberus still works the same internally, we’re doing two full traversals now: one for normalization, and one for validation (more details in e.g. https://github.com/pyeve/cerberus/issues/268#issuecomment-248239479). readonly is special in that: it’s a validation rule that needs to be performed before normalization because it should see the original document before any modifcation happened. Unfortunately you cannot easily traverse the document for just readonly (that is exactly why I’ve implemented the rule_filter in #272).

Unfortunately I cannot look deeper into this now as lunar new year is coming. Let me know if I can still be of help in about two weeks.