[BUG] PHP Client - ObjectSerializer::buildQuery flattens array params resulting invalid URL params (param=a&param=b vs param[]=a&param[]=b) #19233

[serbanghita]

Fix for #19233

[serbanghita]

Looks like I need to run bin/generate-samples.sh locally and commit again

[serbanghita]

pushed the template fix 59a8412

[serbanghita]

@wing328 can you please restart https://github.com/OpenAPITools/openapi-generator/actions/runs/10145363184 - I pushed the fix

[serbanghita]

ping @wing328

[wing328]

according to https://swagger.io/docs/specification/serialization/, the behavior for an array with deepObject style and explode set to true should be undefined.

if you want to send an array in query parameter, should the style be something else instead of deepObject?

(i'm not against this change as it allows users to send array with index but just want to confirm that's what the server intends to receive from the PHP client)

[serbanghita]

@wing328 I presume you are referring to the paragraph:

deepObject – simple non-nested objects are serialized as paramName[prop1]=value1&paramName[prop2]=value2&.... The behavior for nested objects and arrays is undefined.

I believe the reson for "The behavior for nested objects and arrays is undefined." is explained in this comment:

According to OAI/OpenAPI-Specification#1006 (comment):

Tooling will have to deal with it, and I'd suggest just clobbering values. It's really up to the user to define things that make sense, within the defined behavior.
Authoring tools might be able to provide warnings to users in such a case.

My justification for this BEHAVING like that is #19233 (comment).

if you want to send an array in query parameter, should the style be something else instead of deepObject?

My justification for this BEING in deepObject is that my problem was in the query params as opposed to body of a form payload.
Because of the PHP behaviour of $_GET and $_POST I believe both form + deepObject with explode: true should serialize with brakets []

(i'm not against this change as it allows users to send array with index but just want to confirm that's what the server intends to receive from the PHP client)

If you code in PHP, the expectations are exactly like in my POC

PS: The way we mitigated this is by migrating the OpenAPI schema from get: to

post:
  requestBody:
  ...
   color:
      type: array
      items:
          type: string

[wing328]

thanks for the explanation.

let's give it a try