From 150e0562c795978c5eefc8a5268ed366c54b56d0 Mon Sep 17 00:00:00 2001
From: aorzelskiGH <andreas@orzelski.de>
Date: Fri, 17 Apr 2026 16:58:47 +0200
Subject: [PATCH] fix(schema): use anyOf where BNF allows mixed inline and
 named groups

The BNF distinguishes concatenation (mix allowed) from alternation
(XOR) for the pairs inline-group / named-group. Three pairs in the
JSON schemas were marked oneOf (XOR) even though the grammar is CAT.

Grammar references (access-rules.bnf / grammar.bnf):

  <AttributeGroup> ::=
      ( <SingleAttribute> <ws> )*
      ( <UseAttributeGroup> <ws> )*     -- CAT

  <AccessPermissionRule> ::=
      "ACCESSRULE:" ...
      ( <ACL> | <UseACL> ) <ws>          -- XOR
      "OBJECTS:" <ws>
      ( <SingleObject> <ws> )*
      ( <UseObjectGroup> <ws> )*         -- CAT (inline, not <ObjectGroup>)
      ( "FORMULA:" ... | <UseFormula> )  -- XOR

Changes:

  - ACL.{ATTRIBUTES, USEATTRIBUTES}              oneOf -> anyOf
  - AccessPermissionRule.{OBJECTS, USEOBJECTS}   oneOf -> anyOf
  - DEFATTRIBUTES item.{attributes, USEATTRIBUTES} oneOf -> anyOf
    (only in aas-specs-security; API schema doesn't have USEATTRIBUTES
     at DEFATTRIBUTES level.)

Kept as oneOf (XOR):

  - AccessPermissionRule.{ACL, USEACL}
  - AccessPermissionRule.{FORMULA, USEFORMULA}
  - DEFOBJECTS item.{objects, USEOBJECTS}
  - SecurityQueryFilter.{CONDITION, USEFORMULA}

Refs: Review Finding T-13
Made-with: Cursor
---
 documentation/IDTA-01002-3/modules/ROOT/pages/schema.adoc     | 4 ++--
 .../IDTA-01002-3/modules/ROOT/partials/query-json-schema.json | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/documentation/IDTA-01002-3/modules/ROOT/pages/schema.adoc b/documentation/IDTA-01002-3/modules/ROOT/pages/schema.adoc
index 8ea759ce..47e0c402 100644
--- a/documentation/IDTA-01002-3/modules/ROOT/pages/schema.adoc
+++ b/documentation/IDTA-01002-3/modules/ROOT/pages/schema.adoc
@@ -607,7 +607,7 @@
         "RIGHTS",
         "ACCESS"
       ],
-      "oneOf": [
+      "anyOf": [
         {
           "required": [
             "ATTRIBUTES"
@@ -671,7 +671,7 @@
           ]
         },
         {
-          "oneOf": [
+          "anyOf": [
             {
               "required": [
                 "OBJECTS"
diff --git a/documentation/IDTA-01002-3/modules/ROOT/partials/query-json-schema.json b/documentation/IDTA-01002-3/modules/ROOT/partials/query-json-schema.json
index a5f131d6..93e66007 100644
--- a/documentation/IDTA-01002-3/modules/ROOT/partials/query-json-schema.json
+++ b/documentation/IDTA-01002-3/modules/ROOT/partials/query-json-schema.json
@@ -591,7 +591,7 @@
         "RIGHTS",
         "ACCESS"
       ],
-      "oneOf": [
+      "anyOf": [
         {
           "required": [
             "ATTRIBUTES"
@@ -655,7 +655,7 @@
           ]
         },
         {
-          "oneOf": [
+          "anyOf": [
             {
               "required": [
                 "OBJECTS"