Deep-copy ERROR_SCHEMA/PROBLEM_SCHEMA before handing them out

[VSN2015]

The bug

Permittable::OpenAPI::ERROR_SCHEMA and PROBLEM_SCHEMA are .freezed, but Ruby's .freeze is shallow — it only freezes the top-level Hash, not the Hashes nested inside it. .components (and, through it, .document) handed these constants out by direct reference:

def error_schema
  problem_format? ? PROBLEM_SCHEMA : ERROR_SCHEMA
end

So a caller mutating a nested level of ITS OWN generated document — an easy mistake, since everything else about the returned document is caller-owned data — silently succeeded with no FrozenError, and permanently corrupted the shared constant for every document generated for the rest of the process:

doc = Permittable::OpenAPI.document(...)
doc["components"]["schemas"]["PermittableInvalidParameters"]["properties"]["error"]["properties"]["message"]["description"] = "MUTATED"
# no error raised, and now:
Permittable::OpenAPI::ERROR_SCHEMA["properties"]["error"]["properties"]["message"]["description"] # => "MUTATED", forever

In a long-lived process — a Rails console, or an admin endpoint that regenerates the OpenAPI doc on demand — one caller's mutation leaks into every other caller's document from then on.

The fix

error_schema now returns .deep_dup of the constant instead of the constant itself:

def error_schema
  (problem_format? ? PROBLEM_SCHEMA : ERROR_SCHEMA).deep_dup
end

deep_dup is ActiveSupport's existing recursive-copy helper — already required by lib/permittable.rb and already the pattern this gem uses to copy authored default:/example: values before freezing them (see lib/permittable.rb), so this reuses rather than duplicates that mechanism. VIOLATION_SCHEMA, nested inside both ERROR_SCHEMA and PROBLEM_SCHEMA, is copied along with them since deep_dup recurses through nested Hashes/Arrays. lib/permittable/json_schema.rb doesn't need an equivalent change here — it builds its schema Hashes fresh on every call rather than freezing and sharing a constant — so this fix is scoped to open_api.rb only.

Verification

• New test written first (spec/open_api_spec.rb), confirmed to fail before the fix (mutating a returned document's nested schema silently succeeded and leaked into a freshly generated document) and pass after
• bundle exec rspec — 852 examples, 0 failures
• bundle exec rubocop lib/permittable/open_api.rb spec/open_api_spec.rb — no offenses

🤖 Generated with Claude Code