moonming commented on issue #3296:
URL: 
https://github.com/apache/apisix-dashboard/issues/3296#issuecomment-4932692467

   Confirmed on current `master` (`9979b31`) — with one important nuance: the 
logic is indeed inverted, **but `zOneOf` is currently dead code**.
   
   The inversion is exactly as described: `src/utils/zod.ts` does
   
   ```ts
   if (xor(arg[key1] as boolean, arg[key2] as boolean)) {
     ctx.addIssue({ ... });  // errors when EXACTLY ONE is set — the valid case
     return false;
   }
   return true;              // passes when both or neither are set — the 
invalid cases
   ```
   
   rambdax's `xor(a, b)` is `true` when exactly one operand is truthy, so the 
helper rejects the valid state and accepts both invalid ones — backwards on all 
four quadrants.
   
   However, `grep -rn zOneOf src/` shows the definition is the **only** 
occurrence — no call site imports it, so there is no user-facing impact on 
master today. It's a loaded trap for the next feature that reaches for it (and 
the existing e2e spec `validation.zOneOf-single-field.spec.ts` only tests the 
one-alternative-accepted case, which an inverted implementation also passes — 
so the suite can't catch this).
   
   I'll send a PR that fixes the predicate (error on both/neither, pass on 
exactly-one, with proper "filled" detection for empty strings) and adds unit 
tests covering all four quadrants.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to