Validation for form schemas in call processes broken?

[btylerburton]

We tried turning on SPIFFWORKFLOW_BACKEND_VALIDATE_USER_TASK_DATA_AGAINST_SCHEMA but because it references a call process the validation threw an error:

[1] text: '{"type": "about:blank", "title": "internal_server_error", "detail": "ProcessModelFileNotFoundError: No file found with name jinja-form-schema.json in BLM CE - Moab", "status": 500, "error_code": "internal_server_error", "message": "ProcessModelFileNotFoundError: No file found with name jinja-form-schema.json in BLM CE - Moab"}' [1] }

We had a conversation with the robot and it dug a bit deeper and we think this is a bug:

The Bug
SPIFFWORKFLOW_BACKEND_VALIDATE_USER_TASK_DATA_AGAINST_SCHEMA enables server-side JSON schema validation when a user submits a form task. When true, the backend loads the task's formJsonSchemaFilename and validates the submitted data against it using jsonschema.validate().

The problem is in the file lookup. In process_instance_service.py:745, the validation code resolves the schema file using the top-level process instance's process model:

So when general-form-2 is a called activity from "BLM CE - Moab", it looks for jinja-form-schema.json in the parent model's directory ("BLM CE - Moab") instead of in the called activity's directory (general-form-2) where the file actually lives.

This is a known inconsistency — the task display endpoint correctly resolves the called activity's process model using TaskService.bpmn_process_for_called_activity_or_top_level_process(), but the validation code path doesn't.

Your Options
Disable it — set SPIFFWORKFLOW_BACKEND_VALIDATE_USER_TASK_DATA_AGAINST_SCHEMA: "false" in docker-compose.yml (quick fix, loses server-side validation)
Fix it upstream in spiff-arena — the validation logic in process_instance_service.py needs to resolve the process model the same way task_show does, using the called activity's bpmn_process to find the correct model directory