From e21adec2b29a7d9c7bda6e53c30183793e8d6574 Mon Sep 17 00:00:00 2001
From: aorzelskiGH <andreas@orzelski.de>
Date: Fri, 17 Apr 2026 16:58:47 +0200
Subject: [PATCH 1/2] fix(schema): use anyOf where BNF allows mixed inline and
 named groups

The BNF distinguishes concatenation (mix allowed) from alternation
(XOR) for the pairs inline-group / named-group. Three pairs in the
JSON schemas were marked oneOf (XOR) even though the grammar is CAT.

Grammar references (access-rules.bnf / grammar.bnf):

  <AttributeGroup> ::=
      ( <SingleAttribute> <ws> )*
      ( <UseAttributeGroup> <ws> )*     -- CAT

  <AccessPermissionRule> ::=
      "ACCESSRULE:" ...
      ( <ACL> | <UseACL> ) <ws>          -- XOR
      "OBJECTS:" <ws>
      ( <SingleObject> <ws> )*
      ( <UseObjectGroup> <ws> )*         -- CAT (inline, not <ObjectGroup>)
      ( "FORMULA:" ... | <UseFormula> )  -- XOR

Changes:

  - ACL.{ATTRIBUTES, USEATTRIBUTES}              oneOf -> anyOf
  - AccessPermissionRule.{OBJECTS, USEOBJECTS}   oneOf -> anyOf
  - DEFATTRIBUTES item.{attributes, USEATTRIBUTES} oneOf -> anyOf
    (only in aas-specs-security; API schema doesn't have USEATTRIBUTES
     at DEFATTRIBUTES level.)

Kept as oneOf (XOR):

  - AccessPermissionRule.{ACL, USEACL}
  - AccessPermissionRule.{FORMULA, USEFORMULA}
  - DEFOBJECTS item.{objects, USEOBJECTS}
  - SecurityQueryFilter.{CONDITION, USEFORMULA}

Refs: Review Finding T-13
Made-with: Cursor
---
 documentation/IDTA-01002-3/modules/ROOT/pages/schema.adoc     | 4 ++--
 .../IDTA-01002-3/modules/ROOT/partials/query-json-schema.json | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/documentation/IDTA-01002-3/modules/ROOT/pages/schema.adoc b/documentation/IDTA-01002-3/modules/ROOT/pages/schema.adoc
index 348064ec..f75b61e7 100644
--- a/documentation/IDTA-01002-3/modules/ROOT/pages/schema.adoc
+++ b/documentation/IDTA-01002-3/modules/ROOT/pages/schema.adoc
@@ -607,7 +607,7 @@
         "RIGHTS",
         "ACCESS"
       ],
-      "oneOf": [
+      "anyOf": [
         {
           "required": [
             "ATTRIBUTES"
@@ -671,7 +671,7 @@
           ]
         },
         {
-          "oneOf": [
+          "anyOf": [
             {
               "required": [
                 "OBJECTS"
diff --git a/documentation/IDTA-01002-3/modules/ROOT/partials/query-json-schema.json b/documentation/IDTA-01002-3/modules/ROOT/partials/query-json-schema.json
index a5f131d6..93e66007 100644
--- a/documentation/IDTA-01002-3/modules/ROOT/partials/query-json-schema.json
+++ b/documentation/IDTA-01002-3/modules/ROOT/partials/query-json-schema.json
@@ -591,7 +591,7 @@
         "RIGHTS",
         "ACCESS"
       ],
-      "oneOf": [
+      "anyOf": [
         {
           "required": [
             "ATTRIBUTES"
@@ -655,7 +655,7 @@
           ]
         },
         {
-          "oneOf": [
+          "anyOf": [
             {
               "required": [
                 "OBJECTS"

From 0c7205f89daccecee26627f1f7e6cffda4eea9f1 Mon Sep 17 00:00:00 2001
From: Sebastian Bader <s.bader@sap.com>
Date: Wed, 20 May 2026 14:50:43 +0200
Subject: [PATCH 2/2] docs: add changelog entry for anyOf schema alignment

---
 documentation/IDTA-01002-3/modules/ROOT/pages/changelog.adoc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/documentation/IDTA-01002-3/modules/ROOT/pages/changelog.adoc b/documentation/IDTA-01002-3/modules/ROOT/pages/changelog.adoc
index 05f7bfd0..d1a86628 100644
--- a/documentation/IDTA-01002-3/modules/ROOT/pages/changelog.adoc
+++ b/documentation/IDTA-01002-3/modules/ROOT/pages/changelog.adoc
@@ -53,6 +53,7 @@ Major Changes:
 
 Minor Changes:
 
+* fix: Changed JSON Schema validation from `oneOf` to `anyOf` where BNF grammar allows mixed inline and named groups in concatenation scenarios.
 * fix: Wrong ServiceSpecificationProfileEnum values for v3.0 profiles. (https://github.com/admin-shell-io/aas-specs-api/issues/526[#526])
 * removed: Remove TREE. (https://github.com/admin-shell-io/aas-specs-api/issues/537)
 * fix: fixed FILTER object in json schema & fixed inconsistencies in BNF (https://github.com/admin-shell-io/aas-specs-api/issues/547)