OpenAPITools / OpenAPITools/openapi-generator

[BUG] [regression] Security scopes are not generated properly since generator 4.3.1

Open
#9,286 0 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Issue: Bug
Dominant language
Java
Stars
26.8k
Forks
7.7k
PR merge metrics
PR metrics pending

Description

Bug Report Checklist
  • [x ] Have you provided a full/minimal spec to reproduce the issue?
  • [ x] Have you validated the input using an OpenAPI validator?
  • [x ] Have you tested with the latest master to confirm the issue still exists?
  • [x ] Have you searched for related issues/PRs?
  • [ x] What's the actual output vs expected output?
Description

I believe this change from #392 by @wing328 breaks behaviour from OpenApi generator 4.3.1 where it is not required to list all scopes from operations into securitySchemes definition. This is time consuming and error prone since our spec can include tens of operations. I believe we should generate all scopes to operations including the ones not listed in securitySchemes OAS3 spec.

5.1.0 output is without 'admin' scope

    @GET
    @Path("/findByStatus")
    @Produces({ "application/xml", "application/json" })
    @ApiOperation(value = "Finds Pets by status", notes = "Multiple status values can be provided with comma separated strings", authorizations = {
        @Authorization(value = "petstore_auth", scopes = {
            @AuthorizationScope(scope = "read:pets", description = "read your pets") }),
        @Authorization(value = "petstore_auth", scopes = {
             })
         }, tags={ "pet" })
    @ApiResponses(value = { 
        @ApiResponse(code = 200, message = "successful operation", response = Pet.class, responseContainer = "List"),
        @ApiResponse(code = 400, message = "Invalid status value", response = Void.class, responseContainer = "List") })
    Response findPetsByStatus(@QueryParam("status") @NotNull   @ApiParam("Status values that need to be considered for filter")  List<String> status);

version 4.3.1 still has admin scope as defined in specification https://github.com/gpor0/petstore/blob/master/src/main/resources/petstore.yaml

    @GET
    @Path("/findByStatus")
    @Produces({ "application/xml", "application/json" })
    @ApiOperation(value = "Finds Pets by status", notes = "Multiple status values can be provided with comma separated strings", authorizations = {
        @Authorization(value = "petstore_auth", scopes = {
            @AuthorizationScope(scope = "read:pets", description = "read your pets"),
            @AuthorizationScope(scope = "admin", description = "")
        })
    }, tags={ "pet",  })
    @ApiResponses(value = { 
        @ApiResponse(code = 200, message = "successful operation", response = Pet.class, responseContainer = "List"),
        @ApiResponse(code = 400, message = "Invalid status value", response = Void.class, responseContainer = "List") })
    Response findPetsByStatus(@QueryParam("status") @NotNull   @ApiParam("Status values that need to be considered for filter")  List<String> status);

Expected behaviour should be the same as 4.3.1 having both operations:

@ApiOperation(value = "Finds Pets by status", notes = "Multiple status values can be provided with comma separated strings", authorizations = {
        @Authorization(value = "petstore_auth", scopes = {
            @AuthorizationScope(scope = "read:pets", description = "read your pets"),
                @AuthorizationScope(scope = "admin", description = "read your pets")})
         }, tags={ "pet" })
openapi-generator version

> 4.3.1

OpenAPI declaration file content or url

https://github.com/gpor0/petstore

Generation Details

mvn clean package

Steps to reproduce

see the description and linked repository to reproduce this issue. Change pom.xml
from

      <groupId>org.openapitools</groupId>
      <artifactId>openapi-generator-maven-plugin</artifactId>
      <version>5.1.0</version>

to

     <groupId>org.openapitools</groupId>
     <artifactId>openapi-generator-maven-plugin</artifactId>
     <version>5.1.0</version>
Suggest a fix

To fix the linked code to include all security scopes as stated in operations security definition.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the change linked in the issue and compare security-scope generation between versions 4.3.1 and 5.1.0. Reproduce with the linked petstore repository using Maven and inspect the generated Java @Authorization annotations for findPetsByStatus. Done means the generated output includes the operation's admin scope as it did in 4.3.1.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, openapi
Domain
api, security, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.