Deep-dup SCALAR_SCHEMAS entries so exported schemas never share state

[VSN2015]

The bug

scalar_schema and array_schema (lib/permittable/json_schema.rb) only shallow-.duped a SCALAR_SCHEMAS entry before mutating it into a per-field exported schema. SCALAR_SCHEMAS is .freezed, but .freeze is shallow — it freezes the top-level Hash, not the values nested inside it. :decimal's entry is { "type" => %w[string number], "format" => "decimal" }, and that "type" Array stayed live and unfrozen.

.dup on a Hash only copies its top-level key/value pairs; the nested Array object itself is not copied, so every :decimal field's exported schema ended up holding a reference to the very SAME Array as SCALAR_SCHEMAS[:decimal]["type"] — and as every other :decimal field's schema, process-wide.

nullify! mutates schema["type"] in place for nullable: true fields:

type_arr = schema_for_a_decimal_field["type"]
type_arr.equal?(Permittable::JsonSchema::SCALAR_SCHEMAS[:decimal]["type"]) # => true, should be false
type_arr << "null"

That single nullable: true :decimal field permanently mutates the shared constant to ["string", "number", "null"]. Every :decimal field exported afterward in that process — nullable or not — is then misdocumented as accepting null, with no error raised. array_schema's of: path had the identical bug for a scalar array element type.

The fix

Use .deep_dup (ActiveSupport, already a runtime dependency and already used elsewhere in the gem, e.g. for default:/example: values) instead of .dup in both scalar_schema and array_schema, so each exported schema owns independent copies of any nested Array/Hash from its SCALAR_SCHEMAS entry rather than sharing them with the frozen constant or with each other.

Verification

• New tests written first (spec/json_schema_spec.rb, one for scalar_schema and one for array_schema's of:), confirmed to fail before the fix (object identity between the exported "type" array and the frozen constant's) and pass after
• bundle exec rspec — 853 examples, 0 failures
• bundle exec rubocop lib/permittable/json_schema.rb spec/json_schema_spec.rb — no offenses

🤖 Generated with Claude Code