openapi-generators / openapi-generators/openapi-python-client

Security key doesn't respect endpoint explicitly setting anonymous access (via `{}`)

Open
#1,372 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
2k
Forks
293
Avg merge
34m
Merged PRs (30d)
1

Description

Thanks for this wonderful library! It's been SO helpful :)

Describe the bug
The client args in generated methods (Client vs AuthenticatedClient) don't match those described by security in the spec, when explicitly anonymous access is permitted in an endpoint's security list, as allowed in spec:

An empty Security Requirement Object ({}) indicates anonymous access is supported. [ref, with examples]

Example:

  /auth-optional-explicit:
    get:
      summary: Requires auth but has empty object
      security:   # <--- client: AuthenticatedClient (EXPECTED: Client | AuthenticatedClient)
        - {}
        - ApiKeyAuth: []
      responses:
        '200':
          description: OK

This is due to this line

https://github.com/openapi-generators/openapi-python-client/blob/49fa8fc076a5733e68029ba36f4672759c4ac52b/openapi_python_client/parser/openapi.py#L423

>>> bool([])
False
>>> bool([{"ApiKeyAuth": []}])
True
>>> bool([{"ApiKeyAuth": []}, {}])
True
>>> bool([{}])
True

We would want the last two to return False. We should check if {} is anywhere in a list (when it's a list).

This would do the trick:

requires_security_check = lambda sec: bool(sec or []) and {} not in (sec or [])

OpenAPI Spec File

openapi: 3.1.0
info:
  title: Security Test API
  version: 1.0.0
servers:
  - url: https://example.com
paths:
  /no-auth-specified:
    get:
      summary: Truly anonymous
      security: []   # client: Client | AuthenticatedClient (EXPECTED: same)
      responses:
        '200':
          description: OK
  /explicit-anon:
    get:
      summary: Requires auth but has empty object
      security:   # <--- client: AuthenticatedClient (EXPECTED: not sure, but def not this)
        - {}
      responses:
        '200':
          description: OK
  /auth-optional-explicit:
    get:
      summary: Requires auth but has empty object
      security:   # <--- client: AuthenticatedClient (EXPECTED: Client | AuthenticatedClient)
        - {}
        - ApiKeyAuth: []
      responses:
        '200':
          description: OK
  /auth-required:
    get:
      summary: Requires API key
      security:   # <--- client: AuthenticatedClient
        - ApiKeyAuth: []
      responses:
        '200':
          description: OK
components:
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-API-Key

Desktop (please complete the following information):

  • OS: [e.g. macOS 10.15.1]
  • Python Version: [e.g. 3.8.0]
  • openapi-python-client version [e.g. 0.1.0]

Additional context
...

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in parser/openapi.py at the referenced line around 423, where the endpoint security value is converted into the requires-security-check result. Compare the four security configurations in the issue, especially lists containing {}. Done means generated client argument expectations distinguish truly anonymous, explicitly anonymous, optional-authentication, and required-authentication endpoints correctly; no test file is named in the issue.

Written by the indexing model from the issue text.

Assessment

Tech stack
openapi, python
Domain
api, security, tooling
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.