Preserve explicitly located nested parameters on write methods

[numbata]

Problem

A parameter's location (path/query/body/header) is resolved per-parameter, but RequestParams#extract_non_body_params only flattened bracket-notation nested params (e.g. filter[kind]) into non-body parameters when the HTTP method was GET/HEAD/DELETE. On POST/PUT/PATCH, a nested Hash explicitly documented as query, header, or path silently vanished from the generated spec entirely — it was rejected by the method-gated flattening branch, and its Hash-typed root was separately dropped by an unconditional Hash-type skip in the same method. Closes #147.

Fix

The HTTP-method gate turns out to be redundant on the read side: the flattening branch already resolves the root's own location, and GET/HEAD/DELETE default unlocated params to "query" — so the gate never changed the outcome there. Replacing it with a direct check against the root's resolved location (skip only when it resolves to "body") makes every HTTP method behave the same way, and as a side effect also fixes two adjacent gaps that predate this PR and reproduced on read methods too: an explicit in: "header" override on a nested root, and a childless Hash parameter (no nested children of its own) marked non-body.

Also removes ParamLocationResolver#explicit_non_body_param? and its one caller — a guard in NestedParamsBuilder#build that can never fire, since nested_body_params only ever selects roots that already resolved to "body"; a root explicitly marked query/header/path is filtered out one step earlier and never reaches that guard.

Example

class API < Grape::API
  format :json
  params do
    optional :filter, type: Hash, documentation: { in: "query" } do
      optional :kind, type: String
    end
  end
  post("items") { {} }
end

Schema before / after

# Before — filter and filter[kind] vanish entirely; no parameters, no requestBody
paths:
  /items:
    post: {}

# After
paths:
  /items:
    post:
      parameters:
        - name: filter[kind]
          in: query
          required: false
          schema:
            type: string

OAS 2.0 emits the equivalent in: query parameter; OAS 3.1 emits the same parameter shape through its JSON Schema-compatible exporter. No requestBody/body parameter is introduced in any version, since filter never resolves to "body".

Backward compatibility

• Public API surface: unchanged.
• Emitted OAS shape for inputs that don't exercise this fix: unchanged — GET/HEAD/DELETE nested-param flattening is provably a no-op change (the removed method gate was already implied by the root-location check for those methods). POST/PUT/PATCH routes with unlocated nested Hash params are unaffected; they still resolve to the body by default.
• New runtime/dev dependencies: none.

[github-actions]

Memory Profile Report

Summary

Metric	Value
Iterations	5
API Endpoints	18
Avg Allocated	1.79 MB
Avg Retained	888.00 B
Retained Trend	0.0%
Memory Stable	Yes
Potential Leak	No

Iteration Details

#	Allocated	Retained	Objects
1	1.79 MB	888.00 B	25033
2	1.79 MB	888.00 B	25033
3	1.79 MB	888.00 B	25033
4	1.79 MB	888.00 B	25033
5	1.79 MB	888.00 B	25033

Top Memory Allocations (by location)

#	Avg Memory	Location
1	208.63 KB	lib/grape_oas/doc_key_normalizer.rb:11
2	121.21 KB	lib/grape_oas/api_model_builders/concerns/oas_utilities.rb:18
3	89.69 KB	lib/grape_oas/type_resolvers/primitive_resolver.rb:44
4	82.03 KB	lib/grape_oas/api_model/schema.rb:26
5	82.03 KB	lib/grape_oas/api_model/schema.rb:32
6	62.03 KB	lib/grape_oas/schema_constraints.rb:10
7	59.53 KB	lib/grape_oas/exporter/concerns/schema_indexer.rb:63
8	51.80 KB	lib/grape_oas/api_model/schema.rb:43
9	48.91 KB	vendor/bundle/ruby/4.0.0/gems/securerandom-0.4.1/lib/securerandom.rb:71

---

_{Generated by Memory Profile workflow • Commit: a742313}

[github-actions]

Danger Report

No issues found.

View run