ktor-shared/ktor-openapi-schema/ktor-openapi-schema-reflect/jvm/src/io/ktor/openapi/reflect/JsonSchemaInference.jvm.kt (1)

242-250: ⚠️ Potential issue | 🔴 Critical

resolvedPropertyType is computed but never used for the actual schema — defeats the generic substitution.

buildSchemaOrRef(prop.returnType, …) is still passing the unresolved prop.returnType. For a property like Response<T>.data whose returnType.classifier is a KTypeParameter, buildSchemaInternal falls through the classifier as? KClass<*> cast and returns a bare JsonSchema(type = JsonType.OBJECT) — so the expected nested structure in Response.yaml (data → items/total → Country) won't be produced through the reflection path. The isNullable fix alone isn't enough.

🐛 Proposed fix

             val propertyName = adapter.getName(prop)
             val resolvedPropertyType = swapTypeArgs(prop.returnType, type)
             val propertyIsNullable = adapter.isNullable(resolvedPropertyType)

-            properties[propertyName] = buildSchemaOrRef(prop.returnType, visiting, prop.annotations)
+            properties[propertyName] = buildSchemaOrRef(resolvedPropertyType, visiting, prop.annotations)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@ktor-shared/ktor-openapi-schema/ktor-openapi-schema-reflect/jvm/src/io/ktor/openapi/reflect/JsonSchemaInference.jvm.kt`
around lines 242 - 250, The code calculates resolvedPropertyType via
swapTypeArgs but still calls buildSchemaOrRef(prop.returnType…), so generic type
substitutions are ignored; change the call to use the substituted type
(resolvedPropertyType) and use that same resolved type when checking nullability
and when passing annotations/context into buildSchemaInternal (i.e., replace
occurrences of prop.returnType with resolvedPropertyType for schema creation),
ensuring functions like buildSchemaOrRef, buildSchemaInternal, swapTypeArgs, and
adapter.isNullable operate on the resolvedPropertyType so Reflection produces
the correct nested schema for generic properties (e.g., Response<T>.data).

ktor-shared/ktor-openapi-schema/common/src/io/ktor/openapi/JsonSchemaInference.kt (1)

77-103: ⚠️ Potential issue | 🟡 Minor

Update ABI signatures after verifying Default getter behavior is intentional.

The implementation creates a fresh KotlinxSerializerJsonSchemaInference instance on every access to Default (line 77-78), which differs from a cached singleton. Since each instance has its own kTypeLookup, there is no cross-call leakage—each top-level buildSchema call works against an independent cache. However, this means:

1. KotlinxJsonSchemaInference (line 42) and SerialDescriptor.buildJsonSchema(...) (line 349) produce ephemeral instances whose kTypeLookup stays empty, making isParameterized() effectively a no-op in those paths. If this is intentional, add a brief comment clarifying the scope; if not, consider storing the instance or passing kTypeLookup as state.

2. The key strategy type.toString().substringBefore('<') (line 94) is fragile—KType.toString() is not a contractually stable identity. While the current code is self-correcting (line 103 only triggers on entries with non-empty arguments), document the invariant for clarity. Alternatively, use (type.classifier as? KClass<*>)?.qualifiedName where available and fall back to toString() only for web/JS.

Run ./gradlew :ktor-openapi-schema:updateLegacyAbi and checkLegacyAbi to update the /api/ signatures—this is a new public property (getter) and requires ABI tracking.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@ktor-shared/ktor-openapi-schema/common/src/io/ktor/openapi/JsonSchemaInference.kt`
around lines 77 - 103, The Default getter currently returns a new
KotlinxSerializerJsonSchemaInference each call which yields ephemeral
kTypeLookup caches (affecting buildSchema, KotlinxJsonSchemaInference and
SerialDescriptor.buildJsonSchema paths) — either make Default return a cached
singleton instance of KotlinxSerializerJsonSchemaInference (so kTypeLookup is
shared) or explicitly document the intended per-call scope with a comment; while
here, harden includeKType’s key strategy by using (type.classifier as?
KClass<*>)?.qualifiedName ?: type.toString().substringBefore('<') in
includeKType and ensure isParameterized reads from the intended shared
kTypeLookup; after choosing the approach, run ./gradlew
:ktor-openapi-schema:updateLegacyAbi and checkLegacyAbi to update ABI signatures
for the new public getter behavior.

ktor-shared/ktor-openapi-schema/common/src/io/ktor/openapi/JsonSchemaInference.kt (1)

80-100: ⚠️ Potential issue | 🟠 Major

Shared Default instance: kTypeLookup is unsynchronized, unbounded, and drops sibling type args.

KotlinxSerializerJsonSchemaInference.Default (Lines 77-78) is a process-wide singleton, and kTypeLookup is a plain mutableMapOf that is written from buildSchema/includeKType without synchronization and never cleared. Three concrete concerns:

1. Thread-safety: concurrent buildSchema(...) calls on Default (the normal case when used via KotlinxJsonSchemaInference) race on the same map and can raise ConcurrentModificationException or produce corrupt reads.
2. Unbounded growth: every distinct type ever inferred stays resident for the lifetime of the process — effectively a leak for long-running servers.
3. Sibling-argument collision: keying on type.toString().substringBefore('<') and early-returning at Line 95 means that for e.g. Pair<List<Int>, List<String>>, the first List<…> caches "kotlin.collections.List" and the recursion into the second List<String> is skipped entirely — so String's KType is never registered. This directly undermines the PR's stated goal of "populating a lookup of KTypes so nested generic information is available for schema inference" as soon as the same generic container appears twice with different arguments (and the JVM-side swapTypeArgs consults this information).

Within this file isParameterized() only reads arguments.isNotEmpty(), so the local title-suppression still works; the failure mode is for any consumer (including the JVM inference added in this PR) that looks up a specific argument type.

💡 Suggested direction

• Scope the lookup to a single buildSchema call (e.g., pass it alongside visiting) so it is inherently per-invocation and thread-local; or
• If a shared cache really is desired, use ConcurrentHashMap/a synchronized wrapper and key by the full KType (or type.toString()) so distinct parameterizations don't collide, and recurse unconditionally into each typeArg.type regardless of whether the parent name was seen before.

-    private val kTypeLookup = mutableMapOf<String, KType>()
-
-    override fun buildSchema(type: KType): JsonSchema {
-        includeKType(type)
-        return buildSchemaFromDescriptor(
-            module.serializer(type).descriptor,
-            // parameterized types cannot be referenced from their serial name
-            includeTitle = type.arguments.isEmpty(),
-            visiting = mutableSetOf()
-        )
-    }
-
-    private fun includeKType(type: KType) {
-        // use toString() because qualifiedName is unavailable in web
-        val qualifiedName = type.toString().substringBefore('<')
-        if (qualifiedName in kTypeLookup) return
-        kTypeLookup[qualifiedName] = type
-        for (typeArg in type.arguments) {
-            typeArg.type?.let(::includeKType)
-        }
-    }
+    override fun buildSchema(type: KType): JsonSchema {
+        val kTypeLookup = mutableMapOf<String, KType>()
+        includeKType(type, kTypeLookup)
+        return buildSchemaFromDescriptor(
+            module.serializer(type).descriptor,
+            // parameterized types cannot be referenced from their serial name
+            includeTitle = type.arguments.isEmpty(),
+            visiting = mutableSetOf(),
+            kTypeLookup = kTypeLookup,
+        )
+    }
+
+    private fun includeKType(type: KType, lookup: MutableMap<String, KType>) {
+        // use toString() because qualifiedName is unavailable in web
+        val key = type.toString()
+        if (lookup.put(key, type) != null) return
+        for (typeArg in type.arguments) {
+            typeArg.type?.let { includeKType(it, lookup) }
+        }
+    }

This also requires threading kTypeLookup through buildSchemaFromDescriptor / isParameterized() rather than reading a field.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In
`@ktor-shared/ktor-openapi-schema/common/src/io/ktor/openapi/JsonSchemaInference.kt`
around lines 80 - 100, The shared mutable kTypeLookup causes races, leaks, and
generic-argument collisions; make the lookup be per-invocation (thread-local) by
creating a new map inside buildSchema and passing it through to includeKType and
buildSchemaFromDescriptor/ isParameterized (i.e., thread-scope the map alongside
visiting) so each buildSchema call uses its own lookup and is cleared when done;
ensure includeKType keys by the full type string (type.toString()) and do not
early-return skipping recursion into other type arguments — always recurse into
each typeArg.type to register distinct parameterizations.