Write operations return HTTP 500 when no config schema provider is registered (empty anyOf)

[eluhr]

Summary

Every POST/PUT/PATCH on the ApiConfiguration resource returns HTTP 500 when no configJson schema provider is registered, instead of a graceful validation error. This makes the write endpoints unusable on a fresh install until at least one Dmstr\OpenApiJsonSchema\Interface\SchemaProviderInterface is wired up.

• dmstr/api-configuration-bundle: 0.2.0
• dmstr/openapi-json-schema-bundle: 0.3.0
• Symfony 7.4, API Platform 4.x, opis/json-schema 2.x, PHP 8.4

Root cause

SchemaRegistry::getUnifiedSchema() (openapi-json-schema-bundle) returns an empty anyOf when no providers are registered:

// SchemaRegistry::generateUnifiedSchema()
if (empty($this->providers)) {
    return [
        '$schema' => 'https://json-schema.org/draft-07/schema#',
        'description' => 'No schemas available',
        'anyOf' => []            // <-- invalid per JSON Schema
    ];
}

ApiConfigurationValidator::validate() then hands that schema to opis:

// Dmstr\ApiConfiguration\Validator\ApiConfigurationValidator
$validator = new Validator();
$result = $validator->validate($data, $schema);   // throws while *parsing* the schema

anyOf: [] is illegal (JSON Schema requires a non-empty array), so opis throws anyOf must have at least one element during schema parsing. The exception is uncaught in the constraint validator, so API Platform renders it as HTTP 500.

Trimmed stack trace

"anyOf must have at least one element"
  vendor/opis/json-schema/src/Parsers/Keywords/AnyOfKeywordParser.php:53
  vendor/opis/json-schema/src/Validator.php:73  (dataValidation)
  vendor/dmstr/api-configuration-bundle/src/Validator/ApiConfigurationValidator.php:58  (validate)
  vendor/symfony/validator/.../RecursiveContextualValidator.php  (validate)
  vendor/api-platform/core/src/Symfony/Validator/State/ValidateProvider.php:42
  ...
  → HTTP 500

Steps to reproduce

1. Install the bundle in a Symfony + API Platform app.
2. Register no SchemaProviderInterface.
3. POST /api/.../api_configurations with any body, e.g. {"name":"x","configJson":{"type":"t","endpoint_type":"rest"}}.
4. → 500 anyOf must have at least one element.

Expected

With no schemas registered, writes should fail gracefully (a clear 422 validation error, or a descriptive configuration error) — never a 500. Ideally the docs would also show a meaningful request body rather than an empty schema.

Suggested fix

Either (or both):

• openapi-json-schema-bundle — when $this->providers is empty, generateUnifiedSchema() should emit a schema that validates deterministically instead of an illegal anyOf: []. Options: ['not' => new \stdClass()] (matches nothing, so any config is a clean validation failure), or false (JSON Schema "reject everything").
• api-configuration-bundle — guard in ApiConfigurationValidator: if the unified schema has an empty anyOf, add a violation ("no configuration schema is registered") instead of invoking opis with an invalid schema.

Workaround

Register at least one SchemaProviderInterface (even a permissive generic one), which makes anyOf non-empty. That also fixes the empty OpenAPI request body for the write operations.

[eluhr]

Companion issue for the root cause in the schema bundle: dmstr/openapi-json-schema-bundle#3 (SchemaRegistry::getUnifiedSchema() emitting an invalid empty anyOf). Fixing it there resolves this 500 at the source; a defensive guard in ApiConfigurationValidator here would still be nice belt-and-suspenders.