openapi-generators / openapi-generators/openapi-python-client
Security key doesn't respect endpoint explicitly setting anonymous access (via `{}`)
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 2k
- Forks
- 293
- Avg merge
- 34m
- Merged PRs (30d)
- 1
Description
Thanks for this wonderful library! It's been SO helpful :)
Describe the bug
The client args in generated methods (Client vs AuthenticatedClient) don't match those described by security in the spec, when explicitly anonymous access is permitted in an endpoint's security list, as allowed in spec:
An empty Security Requirement Object ({}) indicates anonymous access is supported. [ref, with examples]
Example:
/auth-optional-explicit:
get:
summary: Requires auth but has empty object
security: # <--- client: AuthenticatedClient (EXPECTED: Client | AuthenticatedClient)
- {}
- ApiKeyAuth: []
responses:
'200':
description: OK
This is due to this line
>>> bool([])
False
>>> bool([{"ApiKeyAuth": []}])
True
>>> bool([{"ApiKeyAuth": []}, {}])
True
>>> bool([{}])
True
We would want the last two to return False. We should check if {} is anywhere in a list (when it's a list).
This would do the trick:
requires_security_check = lambda sec: bool(sec or []) and {} not in (sec or [])
OpenAPI Spec File
openapi: 3.1.0
info:
title: Security Test API
version: 1.0.0
servers:
- url: https://example.com
paths:
/no-auth-specified:
get:
summary: Truly anonymous
security: [] # client: Client | AuthenticatedClient (EXPECTED: same)
responses:
'200':
description: OK
/explicit-anon:
get:
summary: Requires auth but has empty object
security: # <--- client: AuthenticatedClient (EXPECTED: not sure, but def not this)
- {}
responses:
'200':
description: OK
/auth-optional-explicit:
get:
summary: Requires auth but has empty object
security: # <--- client: AuthenticatedClient (EXPECTED: Client | AuthenticatedClient)
- {}
- ApiKeyAuth: []
responses:
'200':
description: OK
/auth-required:
get:
summary: Requires API key
security: # <--- client: AuthenticatedClient
- ApiKeyAuth: []
responses:
'200':
description: OK
components:
securitySchemes:
ApiKeyAuth:
type: apiKey
in: header
name: X-API-Key
Desktop (please complete the following information):
- OS: [e.g. macOS 10.15.1]
- Python Version: [e.g. 3.8.0]
- openapi-python-client version [e.g. 0.1.0]
Additional context
...
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in parser/openapi.py at the referenced line around 423, where the endpoint security value is converted into the requires-security-check result. Compare the four security configurations in the issue, especially lists containing {}. Done means generated client argument expectations distinguish truly anonymous, explicitly anonymous, optional-authentication, and required-authentication endpoints correctly; no test file is named in the issue.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- openapi, python
- Domain
- api, security, tooling
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 55/100