bug(symfony): #251's body-presence fix landed on the Laravel adapter only, so the same request passes on Laravel and fails on Symfony

[wadakatu]

Background

Found while auditing the adapters for v3 preconditions.

#251 (closed) fixed "a non-empty body with a non-JSON Content-Type is silently treated as absent". Both adapters carry docblocks citing #251, so both look fixed. Only one is.

Current behaviour

Laravel — src/Laravel/ValidatesOpenApiSchema.php:1481-1483 preserves the wire-presence bit:

if ($content !== '' || $request->request->all() !== [] || $request->files->all() !== []) {
    return DecodedBody::present(null);
}

return DecodedBody::absent();

Symfony — extractSymfonyRequestBody() (src/Symfony/OpenApiAssertions.php:457-474) handles form media types, then delegates everything else to extractSymfonyJsonBody(), which at :502-506 has no presence branch:

// Non-JSON Content-Type: leave the body undecoded and report it absent.
// ... (issue #251)
if ($contentType !== '' && !ContentTypeMatcher::isJsonContentType(
    ContentTypeMatcher::normalizeMediaType($contentType),
)) {
    return DecodedBody::absent();
}

src/Validation/Request/RequestBodyValidator.php branches on that bit in three places — :152, :270, :347 — all spelled if ($required && !$requestBody->present).

Problem

Same request, two verdicts:

	Content-Type: application/xml, non-empty body, requestBody.required: true
Laravel adapter	present(null) → $required && !present is false → passes
Symfony adapter	absent() → $required && !present is true → fails with "Request body is empty"

A contract-testing tool that returns a different verdict for the same request depending on which adapter the suite happens to use is reporting the framework, not the contract. There is no pin test on the Symfony side for this case.

What to do

Move the presence rule to one place and have both adapters use it. src/Symfony/HttpFoundationFormBody.php:25-29 is the existing precedent for an @internal helper shared by both HttpFoundation adapters, so it is the natural home.

Converge on the Laravel rule (presence preserved). That direction turns a current Symfony failure into a pass, which is safe for a minor; the reverse would break passing suites.

One constraint on the shared helper: the failure channel must be a thrown JsonException that each trait wraps, not a direct failOpenApi() call. The AssertionFailedError that failOpenApi() produces is caught by type in the baseline path from #402; a shared helper calling it directly would route Symfony failures into the Laravel-shaped handler.

Compatibility

Verdict change on the Symfony adapter, in the fail → pass direction. Ships as a v2 minor bug fix. Under ADR 0004 this must not be folded into a v3 reduction PR — it changes what Gesso decides about a request.

Acceptance criteria

• A failing test first: a Symfony Request with a non-empty, non-JSON, non-form body against an operation declaring requestBody.required: true currently fails and must pass
• The equivalent Laravel test asserts the same verdict, so the two adapters are pinned against each other rather than each against itself
• The presence rule lives in one @internal helper used by both HttpFoundation adapters
• The shared helper signals decode failure by throwing; each trait wraps it in its own failure channel, and the feat(adoption): violation baseline file — fail only on new contract violations #402 baseline path still catches AssertionFailedError from the Laravel side
• The str_contains(strtolower($contentType), 'json') / ContentTypeMatcher::isJsonContentType() split noted in tech-debt(adapters) — 非空・非JSON Content-Type のボディが silent に「ボディ無し」扱いされる #251 stays converged on ContentTypeMatcher
• composer ci passes

Related

• tech-debt(adapters) — 非空・非JSON Content-Type のボディが silent に「ボディ無し」扱いされる #251 (closed) — the original fix; this issue is its unlanded Symfony half
• tech-debt(validation) — decoded body の mixed を absent/present を表現する型に置き換える #248, tech-debt(adapters) — JSON body decoding to literal null / scalar is silently treated as "no body" #246 — the DecodedBody envelope this relies on
• feat(adoption): violation baseline file — fail only on new contract violations #402 — the baseline path that constrains the failure channel