Query and path parameters the schema does not declare are accepted without a type error

openapi-react-query version

0.5.4

Description

useQuery, useSuspenseQuery, useInfiniteQuery and queryOptions accept query and path parameters the operation does not declare. No error is reported; the extra key is serialized into the request, and a server that rejects unknown query parameters answers 400. It slips through whenever the object also holds at least one declared parameter, which is the normal case.

Init is inferred from the init argument, so the parameter type is derived from the argument itself and no property can be excess; the declared shape only participates as the constraint Init extends MaybeOptionalInit<...>, which is ordinary assignability. When every key is undeclared, inference produces nothing assignable and the constraint applies, which is why the all-undeclared variant below does error.

Reproduction

Any schema with a declared query parameter. Using this package's own test fixture, where GET /query-params declares string, number, boolean, array and object:

import createFetchClient from "openapi-fetch";
import createClient from "openapi-react-query";
import type { paths } from "./test/fixtures/api.js";

const $api = createClient(createFetchClient<paths>({ baseUrl: "https://example.com" }));

$api.queryOptions("get", "/query-params", {
  params: { query: { string: "a", undeclared: 1 } },
  //                              ^^^^^^^^^^ not declared by this operation; no error
});

tsc --noEmit passes. undeclared is not a parameter of the operation, and the request is sent as ?string=a&undeclared=1.

Dropping the declared key makes the same call error, which is the tell that this is about inference rather than about the parameter itself:

$api.queryOptions("get", "/query-params", { params: { query: { undeclared: 1 } } });
// Object literal may only specify known properties, and 'undeclared' does not exist in type ...

Expected result

The undeclared parameter is rejected, the way a wrong method or a wrong path already is.

Extra

• I’m willing to open a PR (see CONTRIBUTING.md)