Skip to content

Global security parameter should be overriden by local security parameter #348

@nekitk

Description

@nekitk

I have schema with globally set security for all paths. But some of the paths override global security with empty value to disable security. When I generate http client for such schema all method calls have security: true, even the methods which overriden value.

Minimum reproduction schema:

openapi: 3.0.1

paths:
  #  Авторизация
  /auth/login:
    post:
      tags: [auth]
      security: []

  /token/revoke:
    post:
      tags: [ token ]

security:
  - bearerAuth: []

Expected result:
auth/login path should have secure: false (because it is overriden) and token/revoke should have secure: true (as in global parameter)

Actual result:
All methods have secure: true:

auth = {
  /**
   * No description
   *
   * @tags auth
   * @name LoginCreate
   * @request POST:/auth/login
   * @secure
   */
  loginCreate: (params: RequestParams = {}) =>
    this.http.request<any, any>({
      path: `/auth/login`,
      method: 'POST',
      secure: true,
      ...params,
    }),
}
token = {
  /**
   * No description
   *
   * @tags token
   * @name RevokeCreate
   * @request POST:/token/revoke
   * @secure
   */
  revokeCreate: (params: RequestParams = {}) =>
    this.http.request<any, any>({
      path: `/token/revoke`,
      method: 'POST',
      secure: true,
      ...params,
    }),
}

Possible solution

Seems like this condition need to be updated:
https://github.com/acacode/swagger-typescript-api/blob/master/src/routes.js#L562-L565

const hasSecurity = security
  ? !!security.length
  : !!(globalSecurity && globalSecurity.length)

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions