Should an implementation know all schemas with their canonical URIs before evaluation?

[flaksp]

Hello.

I'd like to clarify my understanding on how $id and $ref work. When I was looking for some references and examples, found following test case in the official repository:

{
  "description": "refs with relative uris and defs",
  "schema": {
    "$schema": "https://json-schema.org/draft/2020-12/schema",
    "$id": "http://example.com/schema-relative-uri-defs1.json",
    "properties": {
      "foo": {
        "$id": "schema-relative-uri-defs2.json",
        "$defs": {
          "inner": {
            "properties": {
              "bar": {
                "type": "string"
              }
            }
          }
        },
        "$ref": "#/$defs/inner"
      }
    },
    "$ref": "schema-relative-uri-defs2.json"
  },
  "tests": [
    {
      "description": "invalid on inner field",
      "data": {
        "foo": {
          "bar": 1
        },
        "bar": "a"
      },
      "valid": false
    },
    {
      "description": "invalid on outer field",
      "data": {
        "foo": {
          "bar": "a"
        },
        "bar": 1
      },
      "valid": false
    },
    {
      "description": "valid on both fields",
      "data": {
        "foo": {
          "bar": "a"
        },
        "bar": "a"
      },
      "valid": true
    }
  ]
}

How I understand evaluation process:

1. Implementation starts processing the root schema. At this moment it does not know any schemas and their canonical URIs because implementation hadn't met them yet. When implementation evaluates $id keyword at the root schema, it stores somewhere in the memory an association between canonical URI http://example.com/schema-relative-uri-defs1.json and this schema, so when some other schema will refer to it, implementation will pick the schema from this association map.
2. Then, implementation may evaluate the next keyword which may be $ref from the example. This $ref refers to schema-relative-uri-defs2.json, which expands to http://example.com/schema-relative-uri-defs2.json, but implementation hadn't met schema with such canonical URI yet! Because schema with canonical URI http://example.com/schema-relative-uri-defs2.json defined somewhere within the schema it is processing right now.

Should implementation process the document twice: first time for collecting all schemas and their canonical URIs and the second time for actual processing the schema (like validation or code generation)?

[gregsdennis]

Most implementations do have this two-stage processing where the first stage is scanning for internally-defined schemas, and the second is processing.

A bit more expansively, implementations are recommended against downloading content, so preloading them is the preferred approach. Mine has a registry that allows users to load any references schemas ahead of validation. For convenience, I also have a fetch function that is disabled by default. My docs also warn about potential security risks when downloading content.