New validator does not report error with duplicate contained resource Ids

[almostchristian]

The old validator reported this as an error. But since we migrated to the new validator, our testers were able to insert a payload with duplicate contained resource Ids. I tested in the Firely test server, it appears to report this as an error. If the test server uses the new validator, then it must be doing the check outside of the validator.

Minimal repro code:

References for new validator:
Firely.Fhir.Validation.R5@3.3.0
Hl7.Fhir.Specification.Data.R5@6.3.0

References for old validator:
Hl7.Fhir.Validation.Legacy.R5@5.11.0
Hl7.Fhir.Specification.Data.R5@5.13.4

var zipsource = ZipSource.CreateValidationSource();
var localTerminology = new LocalTerminologyService(zipsource);
Validator validator = new(zipsource, localTerminology);

var patientWithContained = new Hl7.Fhir.Model.Patient
{
    Id = "patient-with-contained",
    Contained = new List<Hl7.Fhir.Model.Resource>
    {
        new Hl7.Fhir.Model.Patient
        {
            Id = "other-patient",
            Gender = Hl7.Fhir.Model.AdministrativeGender.Male
        },
        new Hl7.Fhir.Model.Patient
        {
            Id = "other-patient",
            Gender = Hl7.Fhir.Model.AdministrativeGender.Female
        }
    },
    Link = new List<Hl7.Fhir.Model.Patient.LinkComponent>
    {
        new Hl7.Fhir.Model.Patient.LinkComponent
        {
            Other = new Hl7.Fhir.Model.ResourceReference("#other-patient"),
            Type = Hl7.Fhir.Model.Patient.LinkType.ReplacedBy,
        }
    }
};

var result = validator.Validate(patientWithContained);

Console.WriteLine(result.ToJson());

Result:

Old validator

{
  "resourceType": "OperationOutcome",
  "issue": [
    {
      "severity": "fatal",
      "code": "exception",
      "details": {
        "coding": [
          {
            "system": "http://hl7.org/fhir/dotnet-api-operation-outcome",
            "code": "5003"
          }
        ],
        "text": "Internal logic failure: An item with the same key has already been added. Key: #other-patient"
      },
      "location": [
        "Patient.link[0].other[0]"
      ],
      "expression": [
        "Patient.link[0].other[0]"
      ]
    }
  ]
}

New validator

{
  "resourceType": "OperationOutcome"
}

Zulip chat discussion: https://chat.fhir.org/#narrow/channel/179166-implementers/topic/uniqueness.20of.20contained.20resource.20id/

[ewoutkramer]

Until this is added as an invariant (see discussion on Zulip above), we'd need to add this as a manual validation step. The risk is that once it gets added, it will be reported twice.