Guard array fields against required: + default:

[VSN2015]

The bug

array fields had no guard against declaring both required: true and default: — the two are semantically contradictory, since a default only ever applies when a field is absent, and a required field can never be absent by definition without erroring first. validate_scalar_opts! and validate_json_opts! already raise on this combination at class load, but array had no equivalent check, so this loaded silently:

permit_params(:create) do
  array :tags, of: :string, required: true, default: ["x"]  # no error at class load
end

At request time, permittable_check_hash checks field.key?(:default) before field[:required], so an absent tags is quietly treated as optional-with-default — required: true becomes a no-op. Worse, lib/permittable/json_schema.rb builds the exported "required" array purely from field[:required], with no awareness of default:, so the published JSON Schema says tags is required while the real contract happily accepts a request that omits it — a genuine behavior/schema divergence, not just cosmetic.

Nested required(:name) { ... } fields were never affected: NESTED_OPTS doesn't even list :default as an allowed option, so assert_opts! already rejects default: there at class load via a different mechanism. This bug — and this fix — is scoped to array fields only.

The fix

Add the same required+default guard validate_scalar_opts!/validate_json_opts! already carry, to array:

field = { name: name, kind: :array, required: required, **opts }
if field[:required] && field.key?(:default)
  raise ArgumentError, "#{LABEL}: field :#{name} is required and cannot have a :default (default implies optional)"
end

Now the same declaration fails loudly at class load, the same way the scalar and JSON cases already do:

ArgumentError: Permittable: field :tags is required and cannot have a :default (default implies optional)

Verification

• bundle exec rspec — 849 examples, 0 failures
• bundle exec rubocop lib/permittable.rb spec/permittable_spec.rb — no offenses
• New test written first (spec/permittable_spec.rb), confirmed to fail before the implementation change and pass after

🤖 Generated with Claude Code