mdms-v2: data _create throws ClassCastException when a schema's empty x-ref-schema is stored as {} (unguarded cast in validateReference)

[ChakshuGautam]

Summary

POST /mdms-v2/v2/_create/{schemaCode} throws an unhandled ClassCastException — class org.json.JSONObject cannot be cast to class org.json.JSONArray — for every data create against a schema whose stored x-ref-schema is a JSON object ({}) instead of an array ([]).

Where (confirmed unchanged on master, HEAD cfcfe600)

core-services/mdms-v2/.../service/validator/MdmsDataValidator.java, validateReference(...):

if (schemaObject.has(X_REFERENCE_SCHEMA_KEY)) {
    org.json.JSONArray referenceSchema = (org.json.JSONArray) schemaObject.get(X_REFERENCE_SCHEMA_KEY); // unguarded cast
    ...
}

The cast is gated only by .has(...), so any non-array value (e.g. an empty {}) triggers the ClassCastException.

How the object gets there (reproduced on egovio/mdms-v2:maven-jdk21-9f83afb)

Create a schema via POST /mdms-v2/schema/v1/_create whose definition contains an empty "x-ref-schema": []. When read back (eg_mdms_schema_definition.definition), it is stored as "x-ref-schema": {} — an empty object, not an empty array. A schema cloned from another tenant (SQL/dump copy) keeps [] and works; only API-created schemas exhibit {}.

SchemaDefinitionEnricher only enriches id/auditDetails and does not touch the definition, so the []→{} conversion appears to happen in a serialization/persist layer — we couldn't pin the exact step.

Once stored as {}, every data create against that schema fails with the cast above.

Repro

1. POST /mdms-v2/schema/v1/_create with a definition containing "x-ref-schema": [].
2. Verify: SELECT definition->'x-ref-schema' FROM eg_mdms_schema_definition WHERE code = '<code>'; → {}.
3. POST /mdms-v2/v2/_create/<code> with any valid row → HTTP 400 ClassCastException: JSONObject cannot be cast to JSONArray.

Impact

Any schema created through the schema API with an empty x-ref-schema becomes a landmine — all its data creates fail with an opaque server error. It's masked when schemas are seeded via SQL/dump/clone (which preserve []), so it surfaces on fresh, API-seeded installs.

Suggested fix

• Guard the cast in validateReference — skip the block when the value isn't a non-empty JSONArray (an empty object/array both mean "no references"), and/or
• Fix the schema-create/persist path so an empty x-ref-schema: [] is stored as [], not {}.

Version

• Runtime: egovio/mdms-v2:maven-jdk21-9f83afb
• Validator code confirmed unchanged on egovernments/Digit-Core@master (cfcfe600)