Incorrect zod generation for schemas with `"additionalProperties": true`

[ntjess]

Description

Make an openapi spec for a schema with arbitrary keys (`"additionalProperties": true) and generate types + zod models for it using hey-api.

The type will be correct:

export type MyModel = {
  id: string;
  [key: string]: unknown | string; // Hooray, it worked!
};

But the zod schema won't look for these extra properties and will instead strip them during parse:

export const zMyModel = z.object({
  id: z.string()
}); // no .catchall(...) :(

Reproducible example or configuration

(Seems like a bunch of work to mangle stackblitz into a MWE -- hopefully the bug report contains sufficient info)

OpenAPI specification (optional)

No response

System information (optional)

No response

[kentkwee]

The issue with additional properties is also evident in the test suite.

Problem: The test expectation appears to be incorrect:

openapi-ts/packages/openapi-ts-tests/zod/v4/__snapshots__/3.1.x/v4/default/zod.gen.ts

Lines 1008 to 1014 in 83cfd40

	export const zAdditionalPropertiesUnknownIssue = z.object({});
	export const zAdditionalPropertiesUnknownIssue2 = z.object({});
	export const zAdditionalPropertiesUnknownIssue3 = z.intersection(z.string(), z.object({
	entries: z.object({})
	}));

Reference: The corresponding OpenAPI specification can be found here:

openapi-ts/packages/openapi-ts-tests/specs/3.1.x/full.yaml

Lines 2570 to 2594 in 83cfd40

	AdditionalPropertiesUnknownIssue:
	type: object
	properties: {}
	additionalProperties:
	anyOf:
	- type: string
	- type: number
	AdditionalPropertiesUnknownIssue2:
	type: object
	additionalProperties:
	anyOf:
	- type: string
	- type: number
	AdditionalPropertiesUnknownIssue3:
	type: object
	allOf:
	- type: string
	- type: object
	required:
	- entries
	properties:
	entries:
	type: object
	additionalProperties:
	$ref: '#/components/schemas/AdditionalPropertiesUnknownIssue'

[mrlubos]

@kentkwee that appears to be true. Do you want to open a pull request?

[kentkwee]

I'll need to dive into the code generation logic to identify the issue. If you have any insights or suggestions on where to start looking, that would help accelerate the investigation.

[mrlubos]

@kentkwee you should only need to touch the actual Zod plugin(s), specifically object handlers. Here's the code for Zod 4, it's very similar for other versions https://github.com/hey-api/openapi-ts/blob/main/packages/openapi-ts/src/plugins/zod/v4/plugin.ts#L353-L473

My guess is we'll need to modify the conditional for additional properties and handle boolean true

[mrlubos]

I think is partially addressed by #2287

[kentkwee]

Great. Thank you for the hint. I'll wait and see if the issues are fixed with the pull request.

[mrlubos]

@kentkwee it doesn't add the .catchall() API but I see it modifies the snapshots you pointed out. I'll release it today, looking forward to your feedback!

[kentkwee]

My issues were unrelated to catchAll. The type issues appear to be resolved now for my use case. Thank you for the new release!

[mrlubos]

Great, thanks for confirming! I'll be closing this issue, please comment or open a new issue if you find any more problems

[ntjess]

@mrlubos are you sure this issue is resolved ("additionalProperties": true)? I ran pnpm i -D git+https://github.com/hey-api/openapi-ts.git and generated bindings again, but the zod type still doesn't allow extra keys

[mrlubos]

@ntjess can you share a reproducible example?

[ntjess]

Does this link work for you?

https://stackblitz.com/edit/hey-api-client-fetch-example-u5xtopuk?file=src%2Fclient%2Fzod.gen.ts,openapi.yml

It should show that an openapi schema with additionalProperties: true generates the following files:

/// This file is auto-generated by @hey-api/openapi-ts

export type Character = {
  [key: string]: unknown;
};

export type ClientOptions = {
  baseUrl: `${string}://${string}` | (string & {});
};

// This file is auto-generated by @hey-api/openapi-ts

import { z } from "zod";

export const zCharacter = z.object({});

Note that using zCharacter.safeParse({myKey: 1}) will silently strip the extra keys.