{"record":{"id":"6489ff4e7a1e0ea2","repo":"alibaba/spring-ai-alibaba","slug":"type-token-is-not-allowed","errorCode":null,"errorMessage":"Type \"token\" is not allowed.","messagePattern":"Type \"token\" is not allowed\\.","errorType":"validation","errorClass":"YAMLException","httpStatus":null,"severity":"error","filePath":"spring-ai-alibaba-admin/spring-ai-alibaba-admin-server-core/src/main/java/com/alibaba/cloud/ai/studio/core/utils/api/OpenApiUtils.java","lineNumber":603,"sourceCode":"\t * @param schemaField Schema field name\n\t * @param schema Schema object\n\t * @param resultList List to store results\n\t * @param currentDepth Current recursion depth\n\t * @throws YAMLException If recursion depth limit is reached\n\t */\n\tprivate static void checkSchemaExtension(String schemaField, Schema<?> schema, List<ApiParameter> resultList,\n\t\t\tint currentDepth) throws YAMLException {\n\t\tif (currentDepth >= MAX_DEPTH) {\n\t\t\tthrow new YAMLException(String.format(\"Schema extensions recursion depth limit(%d) reached.\", MAX_DEPTH));\n\t\t}\n\n\t\tif (!CollectionUtils.isEmpty(schema.getExtensions())) {\n\t\t\tObject paramSource = schema.getExtensions().get(DEFINED_EXTENSION);\n\t\t\tif (paramSource instanceof String && String.valueOf(paramSource).equals(EXTENSION_USER_SOURCE)) {\n\t\t\t\tString type = schema.getType();\n\t\t\t\t// 防止用户使用 \"token\" 类型的参数\n\t\t\t\tif (StringUtils.isNotBlank(type) && TOKEN_TYPE.equals(type)) {\n\t\t\t\t\tthrow new YAMLException(\"Type \\\"token\\\" is not allowed.\");\n\t\t\t\t}\n\n\t\t\t\tApiParameter param = new ApiParameter();\n\t\t\t\tparam.setKey(schemaField);\n\t\t\t\tparam.setType(type);\n\t\t\t\tparam.setDescription(schema.getDescription());\n\t\t\t\tresultList.add(param);\n\t\t\t}\n\t\t}\n\n\t\tif (StringUtils.isNotBlank(schema.getType()) && \"object\".equals(schema.getType())\n\t\t\t\t&& !CollectionUtils.isEmpty(schema.getProperties())) {\n\t\t\tschema.getProperties()\n\t\t\t\t.forEach((propName, propSchema) -> checkSchemaExtension(propName, (Schema<?>) propSchema, resultList,\n\t\t\t\t\t\tcurrentDepth + 1));\n\t\t}\n\t}\n","sourceCodeStart":585,"sourceCodeEnd":621,"githubUrl":"https://github.com/alibaba/spring-ai-alibaba/blob/f82da0b50f35744c13968191be2b1cd2452ef550/spring-ai-alibaba-admin/spring-ai-alibaba-admin-server-core/src/main/java/com/alibaba/cloud/ai/studio/core/utils/api/OpenApiUtils.java#L585-L621","documentation":"OpenApiUtils.checkSchemaExtension rejects user-sourced OpenAPI schema parameters whose declared type is \"token\". The \"token\" type is reserved for the platform's authentication mechanism, so allowing it in a user-defined parameter would let callers shadow or intercept credential injection. A YAMLException is thrown during RESTful method parsing to fail fast on the invalid definition.","triggerScenarios":"Parsing an OpenAPI spec where a schema node carries the user-source extension (x- parameter source equal to EXTENSION_USER_SOURCE) and schema.getType() equals \"token\". Raised from checkSchemaExtension, which is invoked recursively by parseRestfulMethod and by itself for nested properties.","commonSituations":"Hand-writing an OpenAPI YAML for a custom plugin/API tool and declaring an auth header parameter as type token; exporting a spec from another tool that uses \"token\" as a schema type; copying examples where an Authorization parameter was typed as token instead of string.","solutions":["Change the schema type from \"token\" to \"string\" for the user-defined parameter","Remove the parameter entirely if it was intended to carry an auth token — the platform injects credentials itself","Remove the user-source extension if the parameter is not meant to be user-editable","Re-parse the spec after the fix; the error is thrown at import/parse time, not runtime"],"exampleFix":"// before (OpenAPI YAML)\nparameters:\n  - name: accessToken\n    in: header\n    schema:\n      type: token\n// after\nparameters:\n  - name: accessToken\n    in: header\n    schema:\n      type: string","handlingStrategy":"validation","validationCode":"boolean isUserTokenParam(Schema<?> schema) {\n    Object src = schema.getExtensions() == null ? null : schema.getExtensions().get(\"x-param-source\");\n    return EXTENSION_USER_SOURCE.equals(String.valueOf(src)) && \"token\".equals(schema.getType());\n}\n// reject before import: if (isUserTokenParam(schema)) throw ...","typeGuard":null,"tryCatchPattern":"try {\n    OpenApiUtils.parseRestfulMethod(...);\n} catch (YAMLException e) {\n    log.error(\"Invalid OpenAPI definition: {}\", e.getMessage());\n    // surface to user as spec import failure\n}","preventionTips":["Lint OpenAPI specs with a standard validator before import; \"token\" is not a valid OAS type","Always type auth-related user parameters as string","Rely on platform credential injection rather than declaring token parameters"],"tags":["openapi","schema-validation","yaml"],"backgroundTag":"schema-validation-failed","analyzedSha":"f82da0b50f35744c13968191be2b1cd2452ef550","analyzedAt":"2026-09-09T15:32:42.421Z","contentChangedAt":"2026-09-09T15:32:42.421Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}